[PATCH v2 3/3] test: binman: Add test for pkcs11 signed capsule

[Simon Glass]

Hi Wojciech,

On Tue, 6 Jan 2026 at 04:11, Wojciech Dubowik <Wojciech.Dubowik at mt.com> wrote:
>
> Test pkcs11 URI support for UEFI capsule generation. For
> simplicity only private key is defined in binman section
> as softhsm tool doesn't support certificate import (yet).
>
> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik at mt.com>
> ---
>  tools/binman/ftest.py                         | 46 +++++++++++++++++++
>  .../binman/test/351_capsule_signed_pkcs11.dts | 20 ++++++++
>  2 files changed, 66 insertions(+)
>  create mode 100644 tools/binman/test/351_capsule_signed_pkcs11.dts
>

Reviewed-by: Simon Glass <simon.glass at canonical.com>

nits below

> diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py
> index 21ec48d86fd1..cb5d69982772 100644
> --- a/tools/binman/ftest.py
> +++ b/tools/binman/ftest.py
> @@ -7532,6 +7532,52 @@ fdt         fdtmap                Extract the devicetree blob from the fdtmap
>
>          self._CheckCapsule(data, signed_capsule=True)
>
> +    def testPkcs11SignedCapsuleGen(self):
> +        """Test generation of EFI capsule (with PKCS11)"""
> +        data = tools.read_file(self.TestFile("key.key"))
> +        private_key = self._MakeInputFile("key.key", data)
> +        data = tools.read_file(self.TestFile("key.pem"))
> +        self._MakeInputFile("key.crt", data)
> +
> +        softhsm2_util = bintool.Bintool.create('softhsm2_util')
> +        self._CheckBintool(softhsm2_util)
> +
> +        prefix = "testPkcs11SignedCapsuleGen."
> +        # Configure SoftHSMv2
> +        data = tools.read_file(self.TestFile('340_softhsm2.conf'))
> +        softhsm2_conf = self._MakeInputFile(f'{prefix}softhsm2.conf', data)
> +        softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens')
> +
> +        softhsm_paths="/usr/local/lib/softhsm/libsofthsm2.so \
> +                /usr/lib/softhsm/libsofthsm2.so \
> +                /usr/lib64/pkcs11/libsofthsm2.so \
> +                /usr/lib/i386-linux-gnu/softhsm/libsofthsm2.so \
> +                /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so"
> +
> +        for softhsm2_lib_loc in softhsm_paths.split():
> +                if os.path.exists(softhsm2_lib_loc):
> +                        softhsm2_lib = softhsm2_lib_loc
> +
> +        with open(softhsm2_conf, 'a') as f:
> +            f.write(f'directories.tokendir = {softhsm2_tokens_dir}\n')

This 'open' should specify an encoding, but normally we use
tools.write_file() to write simple files.

> +
> +        with unittest.mock.patch.dict('os.environ',
> +                                      {'SOFTHSM2_CONF': softhsm2_conf}):

It's fine to mock this if you like, but in general we just set the
variable, e.g. os.environ['SOFTHSM2_CONF'] = softhsm2_conf

> +            tools.run('softhsm2-util', '--init-token', '--free', '--label',
> +                      'U-Boot token', '--pin', '1111', '--so-pin',
> +                      '222222')
> +            tools.run('softhsm2-util', '--import', private_key, '--token',
> +                      'U-Boot token', '--label', 'test_key', '--id', '999999',
> +                      '--pin', '1111')
> +
> +        with unittest.mock.patch.dict('os.environ',
> +                                      {'PKCS11_MODULE_PATH': softhsm2_lib,
> +                                       'SOFTHSM2_CONF': softhsm2_conf}):
> +                data = self._DoReadFile('351_capsule_signed_pkcs11.dts')
> +

should have a single blank line

> +
> +        self._CheckCapsule(data, signed_capsule=True)
> +
>      def testCapsuleGenVersionSupport(self):
>          """Test generation of EFI capsule with version support"""
>          data = self._DoReadFile('313_capsule_version.dts')
> diff --git a/tools/binman/test/351_capsule_signed_pkcs11.dts b/tools/binman/test/351_capsule_signed_pkcs11.dts
> new file mode 100644
> index 000000000000..c8c06805daf9
> --- /dev/null
> +++ b/tools/binman/test/351_capsule_signed_pkcs11.dts
> @@ -0,0 +1,20 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +
> +/dts-v1/;
> +
> +/ {
> +       binman {
> +               efi-capsule {
> +                       image-index = <0x1>;
> +                       /* Image GUID for testing capsule update */
> +                       image-guid = "binman-test";
> +                       hardware-instance = <0x0>;
> +                       private-key = "pkcs11:token=U-Boot%20token;object=test_key;type=private;pin-value=1111";
> +                       public-key-cert = "key.crt";
> +
> +                       blob {
> +                               filename = "capsule_input.bin";
> +                       };
> +               };
> +       };
> +};
> --
> 2.47.3
>

Regards,
Simon