Re: [cip-dev] [isar-cip-core][PATCH 02/14] ci: Prepare for running non-bookworm secure boot tests

[Florian Bezdeka <florian.bezdeka@siemens.com>]

On Tue Dec 2, 2025 at 10:21 AM CET, Jan Kiszka via lists.cip-project.org wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
>
> Do no hard-code the release which provides alternative keys for the
> mismatch test. This allows for testing trixie as well.
>
> While at it, consolidate over OVMF_CODE_4M.secboot.fd which is actually
> identical to OVMF_CODE_4M.snakeoil.fd and is used elsewhere already.
> Will allow to deploy less with the lava-worker container.
>
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  scripts/submit_lava.sh | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/submit_lava.sh b/scripts/submit_lava.sh
> index ea733748..f7da99c3 100755
> --- a/scripts/submit_lava.sh
> +++ b/scripts/submit_lava.sh
> @@ -178,8 +178,13 @@ create_job_qemu () {
>  	sed -i -e "s@#architecture#@${2}@g" -e "s@#imageargs#@${image_args[$2]}@g" "${job_dir}"/*.yml
>  
>  	if [ "$1" = "secure-boot-mismatch-keys" ]; then
> -		sed -i "s@/usr/share/OVMF/OVMF_CODE_4M.secboot.fd@/root/keys/trixie-ovmf/OVMF_CODE_4M.snakeoil.fd@g" "${job_dir}/${1}_mismatch_keys_${2}.yml"
> -		sed -i "s@/usr/share/OVMF/OVMF_VARS_4M.snakeoil.fd@/root/keys/trixie-ovmf/OVMF_VARS_4M.snakeoil.fd@g" "${job_dir}/${1}_mismatch_keys_${2}.yml"
> +		if [ "${RELEASE}" = "trixie" ]; then
> +			KEYS_DISTRO=bookworm
> +		else
> +			KEYS_DISTRO=trixie
> +		fi

Really? That looks flipped, no?

> +		sed -i "s@/usr/share/OVMF/OVMF_CODE_4M.secboot.fd@/root/keys/${KEYS_DISTRO}-ovmf/OVMF_CODE_4M.secboot.fd@g" "${job_dir}/${1}_mismatch_keys_${2}.yml"
> +		sed -i "s@/usr/share/OVMF/OVMF_VARS_4M.snakeoil.fd@/root/keys/${KEYS_DISTRO}-ovmf/OVMF_VARS_4M.snakeoil.fd@g" "${job_dir}/${1}_mismatch_keys_${2}.yml"
>  	fi
>  
>  	# Target is recieved from gitlab job in form of qemu-"architecture"