CTS to ensure images in VM's boot path use sha256
Android already has CTS to ensure this. Verified boot path in VM also
should use an algorithm at least as strong as sha256 & this should be
tested.
This patch covers this test. For this, we run avbtool info_image on the
images from virt apex & check the output. We do this again after
resigning the image. This ensures the CI covers the test for apex signed
using sign_virt_apex as well as by build infrastructure.
Bug: 263490360
Test: atest MicrodroidHostTests#testAllVbmetaUseSHA256
Change-Id: I92783d45f7841725ce20aa54f62767d2bbf6dd1d
diff --git a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
index 4186ebb..18347ad 100644
--- a/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
+++ b/tests/hostside/java/com/android/microdroid/test/MicrodroidHostTests.java
@@ -839,6 +839,64 @@
assertThat(ret).contains("Payload binary name must not specify a path");
}
+ @Test
+ @CddTest(requirements = {"9.17/C-2-2", "9.17/C-2-6"})
+ public void testAllVbmetaUseSHA256() throws Exception {
+ File virtApexDir = FileUtil.createTempDir("virt_apex");
+ // Pull the virt apex's etc/ directory (which contains images)
+ File virtApexEtcDir = new File(virtApexDir, "etc");
+ // We need only etc/ directory for images
+ assertWithMessage("Failed to mkdir " + virtApexEtcDir)
+ .that(virtApexEtcDir.mkdirs())
+ .isTrue();
+ assertWithMessage("Failed to pull " + VIRT_APEX + "etc")
+ .that(getDevice().pullDir(VIRT_APEX + "etc", virtApexEtcDir))
+ .isTrue();
+
+ checkHashAlgorithm(virtApexEtcDir);
+ }
+
+ private String avbInfo(String image_path) throws Exception {
+ File avbtool = findTestFile("avbtool");
+ List<String> command =
+ Arrays.asList(avbtool.getAbsolutePath(), "info_image", "--image", image_path);
+ CommandResult result =
+ new RunUtil().runTimedCmd(5000, "/bin/bash", "-c", String.join(" ", command));
+ String out = result.getStdout();
+ String err = result.getStderr();
+ assertWithMessage(
+ "Command "
+ + command
+ + " failed."
+ + ":\n\tout: "
+ + out
+ + "\n\terr: "
+ + err
+ + "\n")
+ .about(command_results())
+ .that(result)
+ .isSuccess();
+ return out;
+ }
+
+ private void checkHashAlgorithm(File virtApexEtcDir) throws Exception {
+ List<String> images =
+ Arrays.asList(
+ // kernel image (contains descriptors from initrd(s) as well)
+ "/fs/microdroid_kernel",
+ // vbmeta partition (contains descriptors from vendor/system images)
+ "/fs/microdroid_vbmeta.img");
+
+ for (String path : images) {
+ String info = avbInfo(virtApexEtcDir + path);
+ Pattern pattern = Pattern.compile("Hash Algorithm:[ ]*(sha1|sha256)");
+ Matcher m = pattern.matcher(info);
+ while (m.find()) {
+ assertThat(m.group(1)).isEqualTo("sha256");
+ }
+ }
+ }
+
@Before
public void setUp() throws Exception {
testIfDeviceIsCapable(getDevice());