Daniel Lundin
c59ea29957
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
We want verity protected partitions as well as encrypted state/data along with verified boot. This PR integrates Peter Marshall's awesome little Nixlet project as a starting point, especially the nice testing scaffolding will be super helpful! ✨ https://github.com/petm5/nixlet/
37 lines
981 B
Nix
37 lines
981 B
Nix
{ pkgs, self }:
|
|
let
|
|
lib = pkgs.lib;
|
|
test-common = import ./common.nix { inherit self lib pkgs; };
|
|
sshKeys = import (pkgs.path + "/nixos/tests/ssh-keys.nix") pkgs;
|
|
|
|
image = test-common.makeImage {
|
|
system.image.sshKeys.keys = [ sshKeys.snakeOilPublicKey ];
|
|
system.extraDependencies = [ sshKeys.snakeOilPrivateKey ];
|
|
};
|
|
|
|
in
|
|
test-common.makeImageTest {
|
|
name = "ssh-preseed";
|
|
inherit image;
|
|
script = ''
|
|
start_tpm()
|
|
machine.start()
|
|
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
machine.succeed("[ -e /efi/default-ssh-authorized-keys.txt ]")
|
|
machine.succeed("[ -e /home/admin/.ssh/authorized_keys ]")
|
|
|
|
machine.wait_for_open_port(22)
|
|
|
|
machine.succeed(
|
|
"cat ${sshKeys.snakeOilPrivateKey} > privkey.snakeoil"
|
|
)
|
|
machine.succeed("chmod 600 privkey.snakeoil")
|
|
|
|
machine.succeed(
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil admin@127.0.0.1 true",
|
|
timeout=30
|
|
)
|
|
'';
|
|
}
|