Merge staging-next into staging

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -1,75 +1,109 @@
-import ./make-test-python.nix ({ lib, pkgs, ... }: let
-  passphrase = "secret";
-in {
-  name = "systemd-initrd-luks-unl0kr";
-  meta = {
-    maintainers = [];
-  };
+import ./make-test-python.nix (
+  { lib, pkgs, ... }:
+  let
+    passphrase = "secret";
 
-  enableOCR = true;
+    debugPackages = with pkgs; [
+      coreutils-prefixed
+      toybox
 
-  nodes.machine = { pkgs, ... }: {
-    virtualisation = {
-      emptyDiskImages = [ 512 512 ];
-      useBootLoader = true;
-      mountHostNixStore = true;
-      useEFIBoot = true;
-      qemu.options = [
-        "-vga virtio"
-      ];
-    };
-    boot.loader.systemd-boot.enable = true;
-
-    boot.initrd.availableKernelModules = [
-      "evdev" # for entering pw
-      "bochs"
+      micro
+      nano
     ];
-
-    environment.systemPackages = with pkgs; [ cryptsetup ];
-    boot.initrd = {
-      systemd = {
-        enable = true;
-        emergencyAccess = true;
-      };
-      unl0kr.enable = true;
+  in
+  {
+    name = "systemd-initrd-luks-unl0kr";
+    meta = {
+      maintainers = [ ];
     };
 
-    specialisation.boot-luks.configuration = {
-      boot.initrd.luks.devices = lib.mkVMOverride {
-        # We have two disks and only type one password - key reuse is in place
-        cryptroot.device = "/dev/vdb";
-        cryptroot2.device = "/dev/vdc";
+    # TODO: Fix OCR: #302965
+    # enableOCR = true;
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        virtualisation = {
+          emptyDiskImages = [
+            512
+            512
+          ];
+          useBootLoader = true;
+          mountHostNixStore = true;
+          useEFIBoot = true;
+          qemu.options = [
+            "-vga virtio"
+          ];
+        };
+        boot.loader.systemd-boot.enable = true;
+
+        boot.kernelParams = [
+          "rd.systemd.debug_shell"
+        ];
+
+        environment.systemPackages =
+          with pkgs;
+          [
+            cryptsetup
+          ]
+          ++ debugPackages;
+        boot.initrd = {
+          systemd = {
+            enable = true;
+            emergencyAccess = true;
+
+            storePaths = debugPackages;
+          };
+          unl0kr = {
+            enable = true;
+
+            settings = {
+              general.backend = "drm";
+              # TODO: Fix OCR. See above.
+              # theme.default = "adwaita-dark"; # Improves contrast quite a bit, helpful for OCR.
+            };
+          };
+        };
+
+        specialisation.boot-luks.configuration = {
+          testing.initrdBackdoor = true;
+          boot.initrd.luks.devices = lib.mkVMOverride {
+            # We have two disks and only type one password - key reuse is in place
+            cryptroot.device = "/dev/vdb";
+            cryptroot2.device = "/dev/vdc";
+          };
+          virtualisation.rootDevice = "/dev/mapper/cryptroot";
+          virtualisation.fileSystems."/".autoFormat = true;
+          # test mounting device unlocked in initrd after switching root
+          virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
+        };
       };
-      virtualisation.rootDevice = "/dev/mapper/cryptroot";
-      virtualisation.fileSystems."/".autoFormat = true;
-      # test mounting device unlocked in initrd after switching root
-      virtualisation.fileSystems."/cryptroot2".device = "/dev/mapper/cryptroot2";
-    };
-  };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+    testScript = ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_text("Password required for booting")
-    machine.screenshot("prompt")
-    machine.send_chars("${passphrase}")
-    machine.screenshot("pw")
-    machine.send_chars("\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk. This part of the test is SLOW.
+      machine.start()
+      machine.wait_for_unit("unl0kr-agent.service")
+      machine.screenshot("prompt")
+      machine.send_chars("${passphrase}")
+      machine.screenshot("pw")
+      machine.send_chars("\n")
+      machine.switch_root()
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-  '';
-})
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+    '';
+  }
+)