packit-ci.fmf

/e2e:

  summary: run keylime e2e tests

  environment:
    TPM_BINARY_MEASUREMENTS: /var/tmp/binary_bios_measurements
    RUST_IMA_EMULATOR: 1
    KEYLIME_RUST_CODE_COVERAGE: 1

  context:
    swtpm: yes
    agent: rust
    faked_measured_boot_log: yes

  prepare:
   - how: shell
     script:
      - ln -s $(pwd) /var/tmp/rust-keylime_sources
      - dnf makecache
      - systemctl disable --now dnf-makecache.service || true
      - systemctl disable --now dnf-makecache.timer || true

  discover:
    how: fmf
    url: https://github.com/RedHat-SP-Security/keylime-tests
    ref: main
    test:
       - /setup/apply_workarounds
       - /setup/configure_tpm_emulator
       - /setup/install_upstream_keylime
       - /setup/install_upstream_rust_keylime
       # change IMA policy to simple and run one attestation scenario
       # this is to utilize also a different parser
       - /setup/configure_kernel_ima_module/ima_policy_simple
       - /functional/basic-attestation-on-localhost
       # now change IMA policy to signing and run all tests
       - /setup/configure_kernel_ima_module/ima_policy_signing
       - /compatibility/basic-attestation-on-localhost-api-version-bump
       - /compatibility/basic-attestation-on-localhost-with-allowlist-excludelist
       - /functional/agent_UUID_assignment_options
       - /functional/basic-attestation-on-localhost
       - /functional/basic-attestation-with-custom-certificates
       - /functional/basic-attestation-with-concatenated-certificates 
       - /functional/basic-attestation-with-ima-signatures
       - /functional/basic-attestation-without-mtls
       - /functional/basic-attestation-with-unpriviledged-agent
       - /functional/db-postgresql-sanity-on-localhost
       - /functional/db-mariadb-sanity-on-localhost
       - /functional/db-mysql-sanity-on-localhost
       - /functional/durable-attestion-sanity-on-localhost
       - /functional/ek-cert-use-ek_check_script
       - /functional/ek-cert-use-ek_handle-custom-ca_certs
       - /functional/iak-idevid-persisted-and-protected
       - /functional/iak-idevid-register-with-certificates
       - /functional/install-rpm-with-ima-signature
       - /functional/keylime-non-default-ports
       - /functional/keylime_create_policy-static-data
       - /functional/keylime_policy-commands
       - /functional/keylime_tenant-commands-on-localhost
       - /functional/keylime_tenant-ima-signature-sanity
       - /functional/measured-boot-swtpm-sanity
       - /functional/service-logfiles-logging
       - /functional/tenant-runtime-policy-sanity
       - /functional/tpm-issuer-cert-using-ecc
       - /functional/tpm_policy-sanity-on-localhost
       - /functional/use-multiple-ima-sign-verification-keys
       - /functional/webhook-certificate-on-localhost
       - /regression/cve-2023-38200
       - /regression/cve-2023-38201
       - /regression/CVE-2023-3674
       - /regression/issue-1380-agent-removed-and-re-added
       - /regression/keylime-agent-option-override-through-envvar
       - /sanity/keylime-secure_mount
       - /upstream/run_rust_keylime_tests
       - /setup/generate_upstream_rust_keylime_code_coverage

  adjust:
   # prepare step adjustments
   - when: distro == centos-stream-9
     prepare+:
      - how: shell
        script:
         - yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
     # disable code coverage measurement everywhere except F39 and CS9
   - when: distro != fedora-39
     environment+:
        KEYLIME_RUST_CODE_COVERAGE: 0
     discover+:
        test-:
         - /setup/generate_upstream_rust_keylime_code_coverage

  execute:
    how: tmt