ci: fix fsim ov verification and resale tests

Author: mcattamoredhat

test/ci/test-onboarding-config.sh

@@ -70,7 +70,15 @@ run_go_fdo_server() {
   shift 3
   mkdir -p "$(dirname "${log}")"
   mkdir -p "$(dirname "${pid_file}")"
-  nohup "${bin_dir}/go-fdo-server" "${role}" "${@}" &>"${log}" &
+  # On RHEL 10.2 the binary is installed by RPM into /usr/bin; for all other
+  # distros it is built locally and placed in ${bin_dir}.
+  local server_bin
+  if [[ -x "${bin_dir}/go-fdo-server" ]]; then
+    server_bin="${bin_dir}/go-fdo-server"
+  else
+    server_bin="$(command -v go-fdo-server)"
+  fi
+  nohup "${server_bin}" "${role}" "${@}" &>"${log}" &
   echo -n $! >"${pid_file}"
 }
 

test/ci/test-resale.sh

@@ -33,15 +33,51 @@ new_owner_https_subj="/C=US/O=FDO/CN=new_owner"
 new_owner_https_key="${certs_dir}/new_owner-http.key"
 new_owner_https_crt="${certs_dir}/new_owner-http.crt"
 
-start_service_new_owner() {
-  local extra_opts=()
+new_owner_config_file="${base_dir}/new_owner.yaml"
+
+generate_new_owner_config() {
+  cat >"${new_owner_config_file}" <<EOF
+log:
+  level: "debug"
+db:
+  type: "sqlite"
+  dsn: "file:${base_dir}/new_owner.db"
+http:
+  ip: "${new_owner_dns}"
+  port: "${new_owner_port}"
+device_ca:
+  cert: "${device_ca_crt}"
+owner:
+  key: "${new_owner_key}"
+  to0_insecure_tls: true
+EOF
   if [ "${new_owner_protocol}" = "https" ]; then
-    extra_opts+=(--http-cert "${new_owner_https_crt}" --http-key "${new_owner_https_key}" --to0-insecure-tls)
+    # Append TLS cert/key under the http: section requires a fresh write;
+    # rewrite the whole file so the indentation is correct.
+    cat >"${new_owner_config_file}" <<EOF
+log:
+  level: "debug"
+db:
+  type: "sqlite"
+  dsn: "file:${base_dir}/new_owner.db"
+http:
+  ip: "${new_owner_dns}"
+  port: "${new_owner_port}"
+  cert: "${new_owner_https_crt}"
+  key: "${new_owner_https_key}"
+device_ca:
+  cert: "${device_ca_crt}"
+owner:
+  key: "${new_owner_key}"
+  to0_insecure_tls: true
+EOF
   fi
+}
+
+start_service_new_owner() {
+  generate_new_owner_config
   run_go_fdo_server owner ${new_owner_service} new_owner ${new_owner_pid_file} ${new_owner_log} \
-    --owner-key="${new_owner_key}" \
-    --device-ca-cert="${device_ca_crt}"
-  "${extra_opts[@]}"
+    --config="${new_owner_config_file}"
 }
 
 run_test() {

test/ci/utils.sh

@@ -319,7 +319,15 @@ run_go_fdo_server() {
   shift 5
   mkdir -p "$(dirname "${log}")"
   mkdir -p "$(dirname "${pid_file}")"
-  nohup "${bin_dir}/go-fdo-server" "${role}" "${address_port}" --db-type sqlite --db-dsn "file:${base_dir}/${name}.db" --log-level=debug "${@}" &>"${log}" &
+  # On RHEL 10.2 the binary is installed by RPM into /usr/bin; for all other
+  # distros it is built locally and placed in ${bin_dir}.
+  local server_bin
+  if [[ -x "${bin_dir}/go-fdo-server" ]]; then
+    server_bin="${bin_dir}/go-fdo-server"
+  else
+    server_bin="$(command -v go-fdo-server)"
+  fi
+  nohup "${server_bin}" "${role}" "${address_port}" --db-type sqlite --db-dsn "file:${base_dir}/${name}.db" --log-level=debug "${@}" &>"${log}" &
   echo -n $! >"${pid_file}"
 }
 

test/rpm/test-resale.sh

@@ -5,6 +5,78 @@ set -euo pipefail
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/../ci/test-resale.sh"
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/utils.sh"
 
+# Override run_test to inject configure_services before start_services.
+# test/ci/test-resale.sh's run_test calls start_services directly (which works
+# in the CI context where services are started as plain processes with all
+# config passed as CLI flags). In the RPM context, manufacturer/rendezvous/owner
+# are systemd services that read config files written by configure_service_*,
+# so configure_services must be called first.
+# new_owner is still started as a plain nohup process (no RPM systemd unit),
+# so it works without configure_service_new_owner.
+run_test() {
+  # Add the new owner service defined above
+  services+=("${new_owner_service_name}")
+
+  log_info "Setting the error trap handler"
+  trap on_failure ERR
+
+  log_info "Environment variables"
+  show_env
+
+  log_info "Creating directories"
+  create_directories
+
+  log_info "Generating service certificates"
+  generate_service_certs
+
+  log_info "Build and install the 'go-fdo-client' binary"
+  install_client
+
+  log_info "Build and install 'go-fdo-server' binary"
+  install_server
+
+  log_info "Configuring services"
+  configure_services
+
+  log_info "Configure DNS and start services"
+  start_services
+
+  log_info "Wait for the services to be ready:"
+  wait_for_services_ready
+
+  log_info "Setting or updating Rendezvous Info (RendezvousInfo)"
+  set_or_update_rendezvous_info "${manufacturer_url}" "${rv_info}"
+
+  log_info "Adding Device CA certificate to rendezvous"
+  add_device_ca_cert "${rendezvous_url}" "${device_ca_crt}" | jq -r -M .
+
+  log_info "Run Device Initialization"
+  guid=$(run_device_initialization)
+  log_info "Device initialized with GUID: ${guid}"
+
+  log_info "Sending Ownership Voucher to the Owner"
+  send_manufacturer_ov_to_owner "${manufacturer_url}" "${guid}" "${owner_url}"
+
+  log_info "Extracting the public key from the New Owner cert"
+  extract_pubkey_from_cert ${new_owner_crt} ${new_owner_pub}
+
+  log_info "Trigger the Resell protocol on the current owner"
+  resell "${owner_url}" "${guid}" "${new_owner_pub}" "${new_owner_ov}"
+
+  log_info "Setting or updating the New Owner Redirect Info (RVTO2Addr)"
+  set_or_update_owner_redirect_info "${new_owner_url}" "${new_owner_service_name}" "${new_owner_dns}" "${new_owner_port}" "${new_owner_protocol}"
+
+  log_info "Sending the Ownership Voucher to the New Owner"
+  send_ov_to_owner "${new_owner_url}" "${new_owner_ov}"
+
+  log_info "Running FIDO Device Onboard"
+  run_fido_device_onboard "${guid}" --debug
+
+  log_info "Unsetting the error trap handler"
+  trap - ERR
+  test_pass
+}
+
 # Allow running directly
 [[ "${BASH_SOURCE[0]}" != "$0" ]] || {
   run_test