xapi-project / xen-api / 24662365561
80%
master: 79%

LAST BUILD BRANCH: private/mingl/CP-312088
DEFAULT BRANCH: master
Ran
Jobs 1
Files 34
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 80.459%. Remained the same
24662365561

push

github

web-flow 
Feature UEFI expiry: Implement VM.secureboot_certificates_state tracking (#7015)

## Background

Microsoft Secure Boot certificates from 2011 are reaching end-of-life,
and legacy VMs may still contain only the old certificate set. This PR
implements the xapi side of the out-of-band mechanism to track and
update per-VM UEFI Secure Boot variables safely, as described in the
[design doc](https://github.com/xapi-project/xen-api/pull/7006).

## Changes

Sorry for the large PR, but the changes form a single feature.
The two main commits are:

### 1. CP-311907: Add `VM.secureboot_certificates_state` field

Add a new `DynamicRO` field to track Secure Boot certificate status per
VM. The field indicates whether UEFI Secure Boot certificates need
updating.

- Invoke `varstore-nvram-certcheck` to determine certificate state from
the NVRAM EFI-variables blob
- On DB upgrade: compute state for existing UEFI Secure Boot VMs,
skipping control domains and default templates
- On import: compute state for VMs imported
- On clone/snapshot: copy the state to the new VM

### 2. CP-311908: Add versioned `update` parameter to
`VM.set_NVRAM_EFI_variables`

Add a versioned `update` parameter (enum: `yes`/`no`/`unspecified`) so
varstored can report whether certificates were changed during an NVRAM
write. This avoids invoking the certcheck binary on every NVRAM write.

- `update=yes`: certificates were updated → set state to `ok`
- `update=no`: certificates not changed → preserve current state
- `update=unspecified` (default for legacy v1 callers): run certcheck to
determine state
- Register `set_NVRAM_v2` RPC in xapi-guard, mapping the string
parameter to the enum


## Testing

Tested the following scenarios with the updated varstored:

- State transitions: `ok` → `update_available` → `update_on_boot` → `ok`
verified correct
- VM reboot with certificate update: varstored sends `update=yes`, state
transitions to `ok`
- VM reboot without certificate update: varstored sends `updat... (continued)

3504 of 4355 relevant lines covered (80.46%)

0.8 hits per line

Jobs
ID Job ID Ran Files Coverage
1 python3.11 - 24662365561.1 34
80.46
 GitHub Action Run
Source Files on build 24662365561