Skip to content

avocado-vt: add support for shim parameter#4355

Open
XueqiangWei wants to merge 1 commit intoavocado-framework:masterfrom
XueqiangWei:add_support_for_shim
Open

avocado-vt: add support for shim parameter#4355
XueqiangWei wants to merge 1 commit intoavocado-framework:masterfrom
XueqiangWei:add_support_for_shim

Conversation

@XueqiangWei
Copy link
Copy Markdown
Contributor

Signed-off-by: Xueqiang Wei xuwei@redhat.com
ID: 5099

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for a "shim" bootloader component within unattended installations and QEMU VM configurations, including updates to RHEL configuration and setup logic for CDROM, URL, and NFS. The review feedback identifies several instances where the new shim-related logic lacks necessary conditional guards, which could lead to failures in installations where a shim is not utilized. Suggestions are provided to ensure these operations only occur when a shim is explicitly defined.

Comment thread virttest/tests/unattended_install.py Outdated
Comment on lines +991 to +992
i.copy(os.path.join(self.shim_target_efi_path, os.path.basename(self.shim)), self.shim)
assert os.path.getsize(self.shim) > 0
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The shim file is copied and its size is asserted without checking if the shim attribute is actually set. This will cause failures in unattended installations that do not use a shim (where self.shim is an empty string).

Suggested change
i.copy(os.path.join(self.shim_target_efi_path, os.path.basename(self.shim)), self.shim)
assert os.path.getsize(self.shim) > 0
if self.shim:
i.copy(os.path.join(self.shim_target_efi_path, os.path.basename(self.shim)), self.shim)
assert os.path.getsize(self.shim) > 0

Comment on lines +1091 to +1098
sha1sum_shim_cmd = "sha1sum %s" % shim_basename
sha1sum_shim_output = process.run(
sha1sum_shim_cmd, ignore_status=True, verbose=DEBUG
).stdout_text
try:
sha1sum_shim = sha1sum_shim_output.split()[0]
except IndexError:
sha1sum_shim = ""
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The sha1sum calculation for the shim should only occur if self.shim is defined. If the calculation fails, the test should fail explicitly rather than falling back to an empty string, as per the repository guidelines to avoid masking configuration issues.

Suggested change
sha1sum_shim_cmd = "sha1sum %s" % shim_basename
sha1sum_shim_output = process.run(
sha1sum_shim_cmd, ignore_status=True, verbose=DEBUG
).stdout_text
try:
sha1sum_shim = sha1sum_shim_output.split()[0]
except IndexError:
sha1sum_shim = ""
sha1sum_shim = ""
if self.shim:
sha1sum_shim_cmd = "sha1sum %s" % shim_basename
sha1sum_shim_output = process.run(
sha1sum_shim_cmd, verbose=DEBUG
).stdout_text
sha1sum_shim = sha1sum_shim_output.split()[0]
References
  1. When a test's intent is to use a specific feature (e.g., an OVS bridge), it should fail explicitly if that feature or its dependencies are unavailable. Do not silently ignore the error or fall back to a different behavior, as this can mask configuration issues and lead to misleading results.

Comment on lines +1106 to +1108
url_shim = os.path.join(
self.url, self.shim_target_efi_path, os.path.basename(self.shim)
)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The url_shim construction should be guarded by a check for self.shim and initialized to an empty string to prevent errors in the download block.

Suggested change
url_shim = os.path.join(
self.url, self.shim_target_efi_path, os.path.basename(self.shim)
)
url_shim = ""
if self.shim:
url_shim = os.path.join(
self.url, self.shim_target_efi_path, os.path.basename(self.shim)
)

Comment on lines +1128 to +1135
if not sha1sum_shim == self.params.get("sha1sum_shim", None):
if os.path.isfile(self.shim):
os.remove(self.shim)
LOG.info("Downloading %s -> %s", url_shim, self.image_path)
download.get_file(
url_shim,
os.path.join(self.image_path, os.path.basename(self.shim)),
)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The download logic for the shim must be guarded to avoid errors when self.shim is not used. Without this guard, the code will attempt to download from an invalid URL for every installation.

Suggested change
if not sha1sum_shim == self.params.get("sha1sum_shim", None):
if os.path.isfile(self.shim):
os.remove(self.shim)
LOG.info("Downloading %s -> %s", url_shim, self.image_path)
download.get_file(
url_shim,
os.path.join(self.image_path, os.path.basename(self.shim)),
)
if self.shim and not sha1sum_shim == self.params.get("sha1sum_shim", None):
if os.path.isfile(self.shim):
os.remove(self.shim)
LOG.info("Downloading %s -> %s", url_shim, self.image_path)
download.get_file(
url_shim,
os.path.join(self.image_path, os.path.basename(self.shim)),
)

Comment on lines +1185 to +1191
shim_fetch_cmd = "cp %s/%s/%s %s" % (
self.nfs_mount,
self.shim_target_efi_path,
os.path.basename(self.shim),
self.image_path,
)
process.run(shim_fetch_cmd, verbose=DEBUG)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Fetching the shim via NFS should be conditional on self.shim being set. Unconditional execution will cause the cp command to fail for installations that do not provide a shim.

Suggested change
shim_fetch_cmd = "cp %s/%s/%s %s" % (
self.nfs_mount,
self.shim_target_efi_path,
os.path.basename(self.shim),
self.image_path,
)
process.run(shim_fetch_cmd, verbose=DEBUG)
if self.shim:
shim_fetch_cmd = "cp %s/%s/%s %s" % (
self.nfs_mount,
self.shim_target_efi_path,
os.path.basename(self.shim),
self.image_path,
)
process.run(shim_fetch_cmd, verbose=DEBUG)


kernel_basename = os.path.basename(self.kernel)
initrd_basename = os.path.basename(self.initrd)
shim_basename = os.path.basename(self.shim)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Accessing self.shim here without checking if it's set can lead to issues if the parameter is missing or empty. It should be guarded to avoid errors in subsequent logic.

Suggested change
shim_basename = os.path.basename(self.shim)
shim_basename = os.path.basename(self.shim) if self.shim else ""

@XueqiangWei XueqiangWei marked this pull request as draft April 6, 2026 22:05
@XueqiangWei XueqiangWei force-pushed the add_support_for_shim branch from 2203e95 to 596b788 Compare April 7, 2026 08:57
@XueqiangWei XueqiangWei marked this pull request as ready for review April 8, 2026 02:48
to support direct kernel boot with secure boot protection

Signed-off-by: Xueqiang Wei <xuwei@redhat.com>
@XueqiangWei XueqiangWei force-pushed the add_support_for_shim branch from 596b788 to c3a7592 Compare April 8, 2026 03:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant