test(fsim-upload): validate onboarding process with FSIM upload enabled

Owner is started with --upload-directory and --command-upload.
Fdo device onboard is tarted with upload flag that points to the dir.
Matches source and destination file checksum.

Signed-off-by: Sayan Paul <paul.sayan@gmail.com>

Author: say-paul

.github/workflows/ci.yml

@@ -152,3 +152,33 @@ jobs:
 
       - name: Fail if the source code has changes after build
         uses: NathanielHill/fail-if-changes@master
+
+  test-fsim-upload:
+    name: test fsim upload
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install golang
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Test FSIM upload
+        run: |
+          source test/test-fsim-upload.sh
+          test_fsim-upload
+      
+      - name: Get Manufacturer, Rendezvous and Owner server logs after a failed onboarding
+        if: failure() && steps.setup_env.outcome == 'success'
+        run: |
+          source test/test-makefile.sh
+          get_server_logs
+
+      - name: Cleanup the environment
+        if: always()
+        run: |
+          source test/test-makefile.sh
+          cleanup
+          

test/test-fsim-upload.sh

@@ -0,0 +1,109 @@
+#! /bin/bash
+
+set -xeuo pipefail
+
+source "$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )/test-makefile.sh"
+
+BASE_DIR=/tmp/go-fdo
+UPLOADS_DIR=${BASE_DIR}/uploads
+CREDS_DIR=${BASE_DIR}/device-credentials
+ONBOARD_LOG=${BASE_DIR}/onboarding-owner.log
+
+trap 'fsim_teardown' EXIT
+
+fsim_teardown() {
+  echo "======================== Cleaning up FSIM upload environment =========================="
+  # Delegate to standard cleanup from test-makefile.sh
+  cleanup
+}
+
+setup_dirs() {
+  echo "======================== Setting up directories =========================="
+  mkdir -p "${UPLOADS_DIR}" "${CREDS_DIR}" "${BASE_DIR}/tmp"
+  chmod -R 777 "${BASE_DIR}" 2>/dev/null || true
+}
+
+# Start services with owner configured for upload FSIM
+run_services_upload() {
+  run_service manufacturing ${manufacturer_service} manufacturer ${manufacturer_log} \
+    --manufacturing-key="${manufacturer_key}" \
+    --owner-cert="${owner_crt}" \
+    --device-ca-cert="${device_ca_crt}" \
+    --device-ca-key="${device_ca_key}"
+  run_service rendezvous ${rendezvous_service} rendezvous ${rendezvous_log}
+  run_service owner ${owner_service} owner ${owner_log} \
+    --owner-key="${owner_key}" \
+    --device-ca-cert="${device_ca_crt}" \
+    --upload-directory="${UPLOADS_DIR}" \
+    --command-upload uploaded.bin
+}
+
+start_services() {
+  echo "======================== Starting services (local binaries) =========================="
+  generate_certs
+  install_client
+  install_server
+  setup_hostnames
+  run_services_upload
+  wait_for_service "${manufacturer_service}"
+  wait_for_service "${rendezvous_service}"
+  wait_for_service "${owner_service}"
+  set_rendezvous_info ${manufacturer_service} ${rendezvous_dns} ${rendezvous_ip} ${rendezvous_port} || \
+    update_rendezvous_info ${manufacturer_service} ${rendezvous_dns} ${rendezvous_ip} ${rendezvous_port}
+}
+
+prepare_upload_payload() {
+  echo "======================== Creating binary upload payload in creds dir =========================="
+  mkdir -p "${CREDS_DIR}"
+  dd if=/dev/urandom of="${CREDS_DIR}/uploaded.bin" bs=1M count=2 2>/dev/null
+  echo "Created test file: ${CREDS_DIR}/uploaded.bin ($(stat -c%s "${CREDS_DIR}/uploaded.bin") bytes)"
+}
+
+run_upload_flow() {
+  echo "======================== Running FDO onboarding with FSIM upload =========================="
+  # Perform full onboarding steps and pass upload dir to client
+  update_ips
+  update_rendezvous_info ${manufacturer_service} ${rendezvous_dns} ${rendezvous_ip} ${rendezvous_port}
+  run_device_initialization
+  guid=$(get_device_guid ${device_credentials})
+  get_ov_from_manufacturer ${manufacturer_service} "${guid}" ${owner_ov}
+  set_owner_redirect_info ${owner_service} ${owner_ip} ${owner_port}
+  send_ov_to_owner ${owner_service} ${owner_ov}
+  run_to0 ${owner_service} "${guid}"
+  run_fido_device_onboard ${owner_onboard_log} --upload '/'
+}
+
+verify_upload() {
+  echo "======================== Verifying FSIM upload (checksum only) =========================="
+  local src_file="${CREDS_DIR}/uploaded.bin"
+  local dst_file="${UPLOADS_DIR}/uploaded.bin"
+
+  [ -f "${dst_file}" ] || { echo "✗ FSIM upload file not found: ${dst_file}"; return 1; }
+
+  local src_sha dst_sha
+  src_sha=$(sha256sum "${src_file}" | awk '{print $1}')
+  dst_sha=$(sha256sum "${dst_file}" | awk '{print $1}')
+  if [ "${src_sha}" != "${dst_sha}" ]; then
+    echo "✗ Checksum mismatch: src=${src_sha} dst=${dst_sha}"
+    return 1
+  fi
+
+  echo "✓ FSIM upload verified at ${dst_file} (sha256=${dst_sha})"
+}
+
+# Public entrypoint used by CI
+test_fsim_upload() {
+  echo "=============== Running FDO FSIM Upload Tests ====================="
+  trap fsim_teardown EXIT
+  setup_dirs
+  start_services
+  prepare_upload_payload
+  run_upload_flow
+  verify_upload
+  echo "======================== SUCCESS: FSIM upload test passed! =========================="
+}
+
+# Allow running directly
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  test_fsim_upload
+fi 

test/test-makefile.sh

@@ -137,8 +137,9 @@ get_device_guid () {
 
 run_fido_device_onboard () {
   local log=$1
+  local extra_args=("${@:2}")
   cd ${creds_dir}
-  go-fdo-client --blob "${device_credentials}" --debug onboard --key ec256 --kex ECDH256 | tee "${log}"
+  go-fdo-client --blob "${device_credentials}" --debug onboard --key ec256 --kex ECDH256 "${extra_args[@]}" | tee "${log}"
   cd -
   grep 'FIDO Device Onboard Complete' "${log}"
 }