diff --git a/dasharo-stability/capsule-update-files/CapsuleApp.efi b/dasharo-stability/capsule-update-files/CapsuleApp.efi new file mode 100644 index 00000000..cb39ef6e Binary files /dev/null and b/dasharo-stability/capsule-update-files/CapsuleApp.efi differ diff --git a/dasharo-stability/capsule-update.robot b/dasharo-stability/capsule-update.robot new file mode 100644 index 00000000..67d0b399 --- /dev/null +++ b/dasharo-stability/capsule-update.robot @@ -0,0 +1,280 @@ +*** Settings *** +Library Collections +Library OperatingSystem +Library Process +Library String +Library Telnet timeout=20 seconds connection_timeout=120 seconds +Library SSHLibrary timeout=90 seconds +Library RequestsLibrary +# TODO: maybe have a single file to include if we need to include the same +# stuff in all test cases +Resource ../variables.robot +Resource ../keywords.robot +Resource ../keys.robot + +# TODO: +# - document which setup/teardown keywords to use and what are they doing +# - go threough them and make sure they are doing what the name suggest (not +# exactly the case right now) +Suite Setup Run Keywords +... Display Preparation Instructions +... AND +... Prepare Test Suite +... AND +... Skip If not ${CAPSULE_UPDATE_SUPPORT} Capsule Update not supported +... AND +... Check If CAPSULE FW FILE Is Present +... AND +... Flash Firmware If Not QEMU +... AND +... Upload Required Files +... AND +... Turn Off Active ME +Suite Teardown Run Keywords +... Log Out And Close Connection + + +*** Variables *** +${FUM_DIALOG_TOP}= Update Mode. All firmware write protections are disabled in this mode. +${FUM_DIALOG_BOTTOM}= The platform will automatically reboot and disable Firmware Update Mode + + +*** Test Cases *** +CUP001.001 Capsule Update With Wrong Keys + [Documentation] Check that DUT rejects flashing a capsule signed with invalid certificate. + Boot Into UEFI Shell + ${original_bios_version}= Get BIOS Version before update + + Perform Capsule Update wrong_cert.cap + + Select UEFI Shell Boot Option + ${updated_bios_version}= Get BIOS Version after update + Should Be Equal ${original_bios_version} ${updated_bios_version} + + Enter Capsule Testing Folder + ${out}= Execute UEFI Shell Command CapsuleApp.efi -S + Should Contain ${out} Capsule Status: Security Violation + +CUP002.001 Capsule Update With Wrong GUID + [Documentation] Check that DUT rejects flashing a capsule with invalid GUID. + Boot Into UEFI Shell + ${original_bios_version}= Get BIOS Version before update + + Perform Capsule Update invalid_guid.cap + + Select UEFI Shell Boot Option + ${updated_bios_version}= Get BIOS Version after update + Should Be Equal ${original_bios_version} ${updated_bios_version} + + Enter Capsule Testing Folder + ${out}= Execute UEFI Shell Command CapsuleApp.efi -S + Should Contain ${out} Capsule Status: Not Ready + +CUP999.001 Capsule Update + [Documentation] Check for a successful Capsule Update. + ... Please note that the test number is high on purpose. This test will flash FW! In future + ... if additional test cases will be created - when running the whole suite - It will be good + ... to keep the number of actual FW updates to minimum to prevent chip degradation. + Boot Into UEFI Shell + ${original_bios_version}= Get BIOS Version before update + + Perform Capsule Update max_fw_ver.cap + + Select UEFI Shell Boot Option + ${updated_bios_version}= Get BIOS Version after update + Should Not Be Equal ${original_bios_version} ${updated_bios_version} + + Enter Capsule Testing Folder + ${out}= Execute UEFI Shell Command CapsuleApp.efi -S + Should Contain ${out} CapsuleMax + Should Not Contain ${out} CapsuleLast + + +*** Keywords *** +Flash Firmware If Not QEMU + IF '${MANUFACTURER}' != 'QEMU' + Flash Firmware ${FW_FILE} + Power Cycle On + END + +Get Key To Press + [Arguments] ${text} + ${matches}= Get Regexp Matches ${text} [0-9] + ${digit}= Set Variable ${matches[0]} + Log Found digit: ${digit} + RETURN ${digit} + +Select UEFI Shell Boot Option + ${boot_menu}= Enter Boot Menu Tianocore And Return Construction + Enter Submenu From Snapshot ${boot_menu} UEFI Shell + Read From Terminal Until Shell> + +Boot Into UEFI Shell + Power On + Select UEFI Shell Boot Option + +Extract BIOS Version + [Arguments] ${text} + ${lines}= Split To Lines ${text} + ${bios_version}= Set Variable None + FOR ${line} IN @{lines} + IF 'BIOS Version' in '${line}' + ${bios_version}= Set Variable ${line} + END + END + IF '${bios_version}' == 'None' + FOR ${line} IN @{lines} + IF 'BIOSVersion' in '${line}' + ${bios_version}= Set Variable ${line} + END + END + END + + RETURN ${bios_version} + +Get BIOS Version + [Arguments] ${label} + ${out}= Execute UEFI Shell Command smbiosview -t 0 + ${bios_version}= Extract BIOS Version ${out} + Log To Console \n[${label}] ${bios_version} + RETURN ${bios_version} + +Upload Required Files + ${file_name}= Get File Name Without Extension ${CAPSULE_FW_FILE} + + Check If Capsule File Exists ../edk2/${file_name}_max_fw_ver.cap + Check If Capsule File Exists ../edk2/${file_name}_wrong_cert.cap + Check If Capsule File Exists ../edk2/${file_name}_invalid_guid.cap + + Power On + Boot System Or From Connected Disk ubuntu + + IF '${DUT_CONNECTION_METHOD}' == 'pikvm' + Set Global Variable ${DUT_CONNECTION_METHOD} SSH + END + + Login To Linux + Switch To Root User + + # Send File To DUT uses regular user, so prepare target directory in as root + Execute Command In Terminal rm -r /capsule_testing + Execute Command In Terminal mkdir /capsule_testing + Execute Command In Terminal chmod 777 /capsule_testing + + Log To Console Sending ./dasharo-stability/capsule-update-files/CapsuleApp.efi + Send File To DUT ./dasharo-stability/capsule-update-files/CapsuleApp.efi /capsule_testing/CapsuleApp.efi + Log To Console Sending ${CAPSULE_FW_FILE} + Send File To DUT ${CAPSULE_FW_FILE} /capsule_testing/valid_capsule.cap + Log To Console Sending ../edk2/${file_name}_max_fw_ver.cap + Send File To DUT ../edk2/${file_name}_max_fw_ver.cap /capsule_testing/max_fw_ver.cap + Log To Console Sending ../edk2/${file_name}_wrong_cert.cap + Send File To DUT ../edk2/${file_name}_wrong_cert.cap /capsule_testing/wrong_cert.cap + Log To Console Sending ../edk2/${file_name}_invalid_guid.cap + Send File To DUT ../edk2/${file_name}_invalid_guid.cap /capsule_testing/invalid_guid.cap + + # Move the directory to ESP partition so the tests work even if root + # file-system is part of LVM + Execute Command In Terminal rm -r /boot/efi/capsule_testing + Execute Command In Terminal mv /capsule_testing /boot/efi + + # Make sure file-system data is pushed to disks before resetting a platform + Execute Command In Terminal sync + +Perform Capsule Update + [Arguments] ${capsule_file} + # Submit capsule to firmware without an automatic reset and verify that it + # was accepted without error + Enter Capsule Testing Folder + ${out}= Execute UEFI Shell Command CapsuleApp.efi ${capsule_file} -NR + Should Not Contain ${out} is not recognised + Should Not Contain ${out} Command Error Status + Should Not Contain ${out} is not a valid capsule. + Should Not Contain ${out} failed to query capsule capability + Should Contain ${out} CapsuleApp: creating capsule descriptors at + Should Contain ${out} :\\capsule_testing\\> + + # Reset the system manually + Execute UEFI Shell Command reset 3m + + # Confirm update by following instructions of Firmware Update Mode dialog + Read From Terminal Until ${FUM_DIALOG_TOP} + ${out}= Read From Terminal Until ${FUM_DIALOG_BOTTOM} + ${digit}= Get Key To Press ${out} + Write Bare Into Terminal ${digit} + +Get File Name Without Extension + [Arguments] ${file_path} + ${path_components}= Split String ${file_path} / + ${base_name}= Get From List ${path_components} -1 + ${name_parts}= Split String From Right ${base_name} . 1 + ${result}= Get From List ${name_parts} 0 + RETURN ${result} + +Check If Capsule File Exists + [Arguments] ${file_path} + ${file_exists}= OperatingSystem.File Should Exist ${file_path} + IF '${file_exists}' == 'False' + Fail + ... File ${file_path} does not exist!/nTo create capsule files required for this test run: 'sudo bash + ... ./scripts/capsules/capsule_update_tests.sh ${CAPSULE_FW_FILE}' and start the test again. + END + +Check If CAPSULE FW FILE Is Present + IF '${CAPSULE_FW_FILE}' == '${EMPTY}' + Log To Console capsule_fw_file parameter missing. + ... Please add: -v capsule_fw_file:.cap to the robot command line and try again. + Fail + END + +Enter Capsule Testing Folder + ${fss}= Get FS From Uefi Shell + FOR ${fs} IN @{fss} + ${out}= Execute UEFI Shell Command ${fs}: + IF 'is not a valid mapping.' in '''${out}''' + Fail Failed to find a file-system with capsule_testing/ + END + + ${out}= Execute UEFI Shell Command cd capsule_testing + IF 'is not a directory.' not in '''${out}''' BREAK + END + +Get FS From Uefi Shell + ${map}= Execute UEFI Shell Command map + ${fss}= Get Regexp Matches ${map} FS[0-9]{,2} + RETURN ${fss} + +Turn Off Active ME + IF ${DASHARO_INTEL_ME_MENU_SUPPORT} == ${TRUE} + Power On + ${setup_menu}= Enter Setup Menu Tianocore And Return Construction + ${dasharo_menu}= Enter Dasharo System Features ${setup_menu} + ${me_menu}= Enter Dasharo Submenu ${dasharo_menu} Intel Management Engine Options + Set Option State ${me_menu} Intel ME mode Disabled (HAP) + Save Changes And Reset + END + +Display Preparation Instructions + Log To Console ******************************************************************************\n + Log To Console To run tests first prepare a valid capsule file(*) and then use this capsule + Log To Console file to generate invalid capsules required by the tests by running the script: + Log To Console \ \ \ \ ./scripts/capsules/capsule_update_tests.sh .cap + Log To Console then start the tests:\n + Log To Console \ on QEMU: + Log To Console \ \ \ \ robot -v snipeit:no -L TRACE -v rte_ip:127.0.0.1 -v config:qemu \\ + Log To Console \ \ \ \ \ \ -v capsule_fw_file:dasharo.cap dasharo-stability/capsule-update.robot + Log To Console \n on other platforms: + Log To Console \ \ \ \ robot -v snipeit:no -L TRACE -v rte_ip: -v config: \\ + Log To Console \ \ \ \ \ \ -v sonoff_ip: -v pikvm_ip: -v device_ip: \\ + Log To Console \ \ \ \ \ \ -v fw_file: -v capsule_fw_file:.cap \\ + Log To Console \ \ \ \ \ \ dasharo-stability/capsule-update.robot + Log To Console \ \ or: + Log To Console \ \ \ \ robot -L TRACE -v rte_ip: -v config: -v device_ip: \\ + Log To Console \ \ \ \ \ \ -v fw_file: -v capsule_fw_file:.cap \\ + Log To Console \ \ \ \ \ \ dasharo-stability/capsule-update.robot + Log To Console \n(*) To start tests on DUT which use PIKVM: Before preparing the capsule please + Log To Console edit FW to enable Console Serial Redirection. Use the guide: + Log To Console + ... \ \ https://github.com/Dasharo/open-source-firmware-validation/blob/develop/docs/troubleshooting.md + Log To Console Without it, a successful flash of DUT will prevent tests from working + Log To Console correctly. + Log To Console \n****************************************************************************** diff --git a/platform-configs/include/default.robot b/platform-configs/include/default.robot index 7dc03cbf..d98323d6 100644 --- a/platform-configs/include/default.robot +++ b/platform-configs/include/default.robot @@ -213,6 +213,7 @@ ${TPM_DETECT_SUPPORT}= ${FALSE} ${NVME_DETECTION_SUPPORT}= ${FALSE} ${USB_TYPE-A_DEVICES_DETECTION_SUPPORT}= ${FALSE} ${NETWORK_INTERFACE_AFTER_SUSPEND_SUPPORT}= ${FALSE} +${CAPSULE_UPDATE_SUPPORT}= ${FALSE} # Test module: trenchboot ${TRENCHBOOT_SUPPORT}= ${FALSE} diff --git a/platform-configs/include/msi-z690-common.robot b/platform-configs/include/msi-z690-common.robot index 72e15710..968627d6 100644 --- a/platform-configs/include/msi-z690-common.robot +++ b/platform-configs/include/msi-z690-common.robot @@ -110,6 +110,7 @@ ${TPM_DETECT_SUPPORT}= ${TRUE} ${NVME_DETECTION_SUPPORT}= ${TRUE} ${USB_TYPE-A_DEVICES_DETECTION_SUPPORT}= ${TRUE} ${NETWORK_INTERFACE_AFTER_SUSPEND_SUPPORT}= ${TRUE} +${CAPSULE_UPDATE_SUPPORT}= ${TRUE} *** Keywords *** diff --git a/platform-configs/qemu.robot b/platform-configs/qemu.robot index ba2d20ee..ffc06cac 100644 --- a/platform-configs/qemu.robot +++ b/platform-configs/qemu.robot @@ -80,6 +80,9 @@ ${TRENCHBOOT_SUPPORT}= ${TRUE} ${AUTO_BOOT_TIME_OUT_DEFAULT_VALUE}= 0 +# Test module: dasharo-stability +${CAPSULE_UPDATE_SUPPORT}= ${TRUE} + *** Keywords *** Power On diff --git a/scripts/capsules/capsule_update_tests.sh b/scripts/capsules/capsule_update_tests.sh new file mode 100755 index 00000000..01e5fffb --- /dev/null +++ b/scripts/capsules/capsule_update_tests.sh @@ -0,0 +1,183 @@ +#!/bin/bash + +here=$(realpath "$(dirname "$0")") + +capsule=$(realpath "$1") +capsule_name=$(basename "$capsule") +capsule_name="${capsule_name%.*}" + +cd .. +if [ ! -d "./edk2" ]; then + git clone --depth 1 --branch osfv-capsule-tests https://github.com/Dasharo/edk2.git + chmod 777 edk2 +fi + +cd edk2 || exit + +# Decoding the capsule +BaseTools/BinWrappers/PosixLike/GenerateCapsule \ + --decode "$capsule" \ + --output decoded + +# Extracting data +json_file="decoded.json" + +dependencies=$(jq -r '.Payloads[0].Dependencies' "$json_file") +fw_version=$(jq -r '.Payloads[0].FwVersion' "$json_file") +guid=$(jq -r '.Payloads[0].Guid' "$json_file") +hardware_instance=$(jq -r '.Payloads[0].HardwareInstance' "$json_file") +lowest_supported_version=$(jq -r '.Payloads[0].LowestSupportedVersion' "$json_file") +monotonic_count=$(jq -r '.Payloads[0].MonotonicCount' "$json_file") +payload=$(jq -r '.Payloads[0].Payload' "$json_file") +update_image_index=$(jq -r '.Payloads[0].UpdateImageIndex' "$json_file") + +echo +echo "\"Dependencies\": \"$dependencies\"" +echo "\"FwVersion\": \"$fw_version\"" +echo "\"Guid\": \"$guid\"" +echo "\"HardwareInstance\": \"$hardware_instance\"" +echo "\"LowestSupportedVersion\": \"$lowest_supported_version\"" +echo "\"MonotonicCount\": \"$monotonic_count\"" +echo "\"Payload\": \"$payload\"" +echo "\"UpdateImageIndex\": \"$update_image_index\"" +echo + +# Create json config files with capsule configs +echo "--- CREATING CAPSULE WITH MAX POSSIBLE VERSION NUMBER ---" + +file_descriptor="_max_fw_ver" +output_file="$capsule_name$file_descriptor.json" + +if [ -f $output_file ]; then + rm $output_file +fi + +# There might be an issue if more than one driver is present +content=$(cat < "$output_file" + +echo "Json file: $output_file" +echo "Output file: $capsule_name$file_descriptor.cap" + +BaseTools/BinWrappers/PosixLike/GenerateCapsule --encode \ + --capflag PersistAcrossReset \ + --json-file $output_file \ + --output $capsule_name$file_descriptor.cap + + +echo "--- CREATING CAPSULE WITH WRONG CERTIFICATES ---" + +file_descriptor="_wrong_cert" + +output_file="$capsule_name$file_descriptor.json" + +if [ -f $output_file ]; then + rm $output_file +fi + +invalid_cert_file="$here/sign.p12" +invalid_sub_file="$here/sub.pub.pem" +invalid_root_file="$here/root.pub.pem" + +if [ ! -f $invalid_cert_file ]; then + echo "!!!WARNING!!! Cert file not found!" + fi +if [ ! -f $invalid_sub_file ]; then + echo "!!!WARNING!!! Sub file not found!" +fi +if [ ! -f $invalid_root_file ]; then + echo "!!!WARNING!!! Root file not found!" +fi + +# There might be an issue if more than one driver is present +content=$(cat < "$output_file" + +BaseTools/BinWrappers/PosixLike/GenerateCapsule --encode \ + --capflag PersistAcrossReset \ + --json-file $output_file \ + --output $capsule_name$file_descriptor.cap + +echo "--- CREATING CAPSULE WITH WRONG GUID ---" + +file_descriptor="_invalid_guid" +output_file="$capsule_name$file_descriptor.json" + +if [ -f $output_file ]; then + rm $output_file +fi + +# There might be an issue if more than one driver is present +content=$(cat < "$output_file" + +echo "Json file: $output_file" +echo "Output file: $capsule_name$file_descriptor.cap" + +BaseTools/BinWrappers/PosixLike/GenerateCapsule --encode \ + --capflag PersistAcrossReset \ + --json-file $output_file \ + --output $capsule_name$file_descriptor.cap diff --git a/scripts/capsules/root.pub.pem b/scripts/capsules/root.pub.pem new file mode 100644 index 00000000..5511e94d --- /dev/null +++ b/scripts/capsules/root.pub.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDWzCCAkOgAwIBAgIUN6TUIj8GstcO9IUwTMEXmkCxeK8wDQYJKoZIhvcNAQEL +BQAwPTELMAkGA1UEBhMCWFgxETAPBgNVBAgMCFByb3ZpbmNlMQwwCgYDVQQKDANP +cmcxDTALBgNVBAMMBHJvb3QwHhcNMjQwODMwMTA0MDA3WhcNMzQwODI4MTA0MDA3 +WjA9MQswCQYDVQQGEwJYWDERMA8GA1UECAwIUHJvdmluY2UxDDAKBgNVBAoMA09y +ZzENMAsGA1UEAwwEcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AMvqsqkyL9ggFheoliT5CD43TlQe7G37nj0MeURhe/PaihMiNIttryudy69vauBr +sA534KaGZrWGVKdfldZLXhPPMuqtUIXEqxvhXLyLjyTyJiTRPVSSwOGSssVIUPT2 +Rm6h40SROoa02pHH19UMtutJi6jxZifMa9kZc6B15XPEYdEyMDwzbsbr3xQ3Pfrv +GeSRQ5ykMXZC532NZXg7rLRUGr9+M/hE6ixOm8ClQYn3djmsDHuVPk1we07YBZqq +ga2GrzPTmQ101wT1NfbrwSFn4aNhBhZwnWW55VCZ4yOgYDBp8qY1oomKzD8vYgTk +XZXvxSn2K5hv4R+1UJuhfvMCAwEAAaNTMFEwHQYDVR0OBBYEFEXDOVb1XqQovr4F +YddXtxQSrHYqMB8GA1UdIwQYMBaAFEXDOVb1XqQovr4FYddXtxQSrHYqMA8GA1Ud +EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBACjYXNpdhgVpO2YG36nT2Spv +R6EeSaZsfjJvnHTkpFqp2QBelRPHGmCM564NCG5/hVnPPG+zMWleI481zrEX0LK+ +X+VhUgNkWkltkY08GO/IHJbIiWhK8SexKluDj0uCRHqvPseolZoyFRwwPOzJDKjw +78sMppYcZY65N/9ce9Zo7s2/HSqqhCUy7vC+Z5D7AvnSFLcSalQUOxD4rGNOkoX2 +TATEJObeXfu46E7ZTR5/1EC23ian/quAGY6VPDTH/odHtsVQGFmWBbFv/lqjSi7O +hg9KPCuhnhQL56j9k8LJFYs3deuO00g3vjhaEOKSNQM2PTXUONHavm0y/0PGO0Q= +-----END CERTIFICATE----- diff --git a/scripts/capsules/sign.p12 b/scripts/capsules/sign.p12 new file mode 100644 index 00000000..5dbd626c --- /dev/null +++ b/scripts/capsules/sign.p12 @@ -0,0 +1,55 @@ +Bag Attributes + localKeyID: 08 28 0D A4 86 E1 C9 AA E8 E6 7F 5B 50 FC 44 50 17 39 8B 82 +subject=C = XX, ST = Province, O = Org, CN = sign +issuer=C = XX, ST = Province, O = Org, CN = sub +-----BEGIN CERTIFICATE----- +MIIDQTCCAimgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA8MQswCQYDVQQGEwJYWDER +MA8GA1UECAwIUHJvdmluY2UxDDAKBgNVBAoMA09yZzEMMAoGA1UEAwwDc3ViMB4X +DTI0MDgzMDEwNDAwN1oXDTM0MDgyODEwNDAwN1owPTELMAkGA1UEBhMCWFgxETAP +BgNVBAgMCFByb3ZpbmNlMQwwCgYDVQQKDANPcmcxDTALBgNVBAMMBHNpZ24wggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCnGfIocBNhZkRVCL7YitvIr3NQ +xMqoBEQNDno0hRAYnfePixyy0N5v2V0dWILC2MruMsQpo+7cCHjuA1K9Apvtdv2l +edMdIah9GhhAvebEum6ovCruff1c9kxvyqoGNHlEeMe2TwHMFSVh6AwntfBDozvq +4B9IdUF/rykYqsqJkyOBI74t3jxUbeFCxgx2csGNmP2dsNn0OLR5zjlHogjkwwUK +g7Tf/xwM2GzkEog+UFqZvM83PuyM3GLiRgrN4bOx/XDQKbhQKWNTrYq3EFEbptKD +nE+ktHY/BFJqyW9l5wJaaTGUYZApILL40s7OpZrMq83pCruoIQ0WQHxXMqGNAgMB +AAGjTTBLMAkGA1UdEwQCMAAwHQYDVR0OBBYEFDDlJK6LQ493J1nw8zlOigpdb1zL +MB8GA1UdIwQYMBaAFI0iQVKo0Ao237SXBWOEa3iuFbaCMA0GCSqGSIb3DQEBCwUA +A4IBAQDRogL6A61e6tu1/mJE14LS43Zq+i08KOkSqh2u+7LN78yhMhZcojCPcBaw +ZCfIrEUgaKaOIBArsCKv9i5WXHONzrfB2rBoHlUWXmHKS/LhWRS6BHpuYhjKZ3bC +UE7gHfSnK2Ckmj7JO+KYXDk1uE+liL2S4bRrePKbpoSLvy1/mh0smJUOUOgYkA10 +3PCi/WEv/oqBTeambVsqHVmnhEQfId3BC0uTS/NJNeIGxlxw51Rt71FSjNvN4WED +SJmCUERecyi5dCEUJDnqYNBPETEWLbV8YvMU+xSrYBeIHG4EgJILtDYtWshI4Iuw +EhFitmOb/LpQM2SSRAPCeAn1quQ2 +-----END CERTIFICATE----- +Bag Attributes + localKeyID: 08 28 0D A4 86 E1 C9 AA E8 E6 7F 5B 50 FC 44 50 17 39 8B 82 +Key Attributes: +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCnGfIocBNhZkRV +CL7YitvIr3NQxMqoBEQNDno0hRAYnfePixyy0N5v2V0dWILC2MruMsQpo+7cCHju +A1K9Apvtdv2ledMdIah9GhhAvebEum6ovCruff1c9kxvyqoGNHlEeMe2TwHMFSVh +6AwntfBDozvq4B9IdUF/rykYqsqJkyOBI74t3jxUbeFCxgx2csGNmP2dsNn0OLR5 +zjlHogjkwwUKg7Tf/xwM2GzkEog+UFqZvM83PuyM3GLiRgrN4bOx/XDQKbhQKWNT +rYq3EFEbptKDnE+ktHY/BFJqyW9l5wJaaTGUYZApILL40s7OpZrMq83pCruoIQ0W +QHxXMqGNAgMBAAECggEAHvkIsSUg+n89sDNISJPobBjVO4XWeHEd+fuSfDSjyKRT +FDi5T422hS3ZfAyBZENRzff78ynvJrqtS5SzG9SleU0Cc88SagZomBOjpjBs208h +HsaOAJm6wiXnAhujCzZjueTXQ7v+Pck3nh+oTR4ElEzn2L/FHKWbR+L8L5XMp9Yg +XtIKqV6n/2MySWhNUvnU6CqfSiY3qatclDquLSB2VJHIA6TT+YAFDxzs3EXFdJKk +dMDn4NzToSTx0hdWN0J5NCNLhtu0+YTHW+OODMZqEZlWexGHIo8HLQpuaxrNGAsU +oV0x8pHca9fjdl398z3CfgwUUcUwLQiGDWNN1U/RgwKBgQDobYrwRY2dxNe6MSdN +qsK7HIArgGvqaLvEtTVGyTR5lDA0r7kcXI1/Ag82Upj1RVbIuytcwiaEPXMGXr7X +bBeWFfl1RiZ8Bd139VQJVcuSGRZ4yJnmmM6fRQP9+d8R4+kkCNMHhPsOXhs7wZQp +uZDkDdwbX8iQwjxN7NmKoSfcrwKBgQC4DFlkY+4W3NHaOB73ivnG8em4e3Xv+rJS +tblcizTkVpvidYRU4Q5SFq7JW2qjXyQY3O1hhL/M/kYi7XG4M2FC4zRdnZtXvso4 +YYtQ1sIsT8LPrL3vh799ePtxBF4h+eaWlT0ea+us+FBjjwJzMc+wy8KMw39DWZ5r +hQv2N/OMgwKBgQCjk2yD2r9m+IDGpg8+Jt5zZwSBGRlZ2KnFL662CaanpfYjLkR9 +xFlEuINSPOEvRMRl8uv6lR0cVk7cfdObspQK6Z4tvdgZ0trhsMOa6kmhoYxiJvPB +CWvpRV4g4Tjv01FiLd+u3BUAMJTEAmGu180z4tk0Xr29uyVLxlP3r6FpOwKBgQCk +i2XgOvdBuWpkjoghCD8HfoBWTwrB4oBLMezmsA45lrUHYclNmWgUO/NIUlKkfQro +r5wK84QG4c4Sq/ZfmI/8HOVUTPP1Hr3sakkDnP08YJLq2KV24QZyRxeFk0IVXjap +qgNaj2HE4rv8Rn8KPh5REdp9vsqojBb2SZzIJH25wQKBgErIfKNhnNB34r3L41bo +7eG7q56ah4qoqrp5o4CM5KnW+Zb0YUFRpaFYemq9Lc7tPLv6VVCkOGugn/c8JzYh +NBm6pBwVYzxNVXViY8oUHS4Oya4RdgkLtR/spIU3Pi3vNBvrfWvIrpH9ObnzGciW +D7rsiUY/WQf2zkdVpTzI593q +-----END PRIVATE KEY----- diff --git a/scripts/capsules/sub.pub.pem b/scripts/capsules/sub.pub.pem new file mode 100644 index 00000000..b1b5aec3 --- /dev/null +++ b/scripts/capsules/sub.pub.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDRzCCAi+gAwIBAgIBATANBgkqhkiG9w0BAQsFADA9MQswCQYDVQQGEwJYWDER +MA8GA1UECAwIUHJvdmluY2UxDDAKBgNVBAoMA09yZzENMAsGA1UEAwwEcm9vdDAe +Fw0yNDA4MzAxMDQwMDdaFw0zNDA4MjgxMDQwMDdaMDwxCzAJBgNVBAYTAlhYMREw +DwYDVQQIDAhQcm92aW5jZTEMMAoGA1UECgwDT3JnMQwwCgYDVQQDDANzdWIwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDwo8FL8pAyTh7vBtKMToy/vFp6 ++pETes9sfR9dppkGCQ21t+7gFsnUAMbvXcAmISy9YhdAcN3kCNBr/qctdyi9C27O +m3HMsX8/ePZcALrNRuEVJqcnNVzwOn9SZsETA6VmKGf1agAER8YUoPwAFSiwzPVM +lIrtbb67OX3Pmha99x/Yc8x5x4pG45bTiv3fOEntgsfMGPbS3XyFCoA9PjMXtZNr +OeSw4ISH/yshelSCIG7I19zOzsb2T9DSB9EOC7fggEIi1qL2zDrSAbhXK9Rxn87K +e8fF9FBT4m7/sXok3MC0fjh7MxjB9Y1BHmaxMqFPLGsPyaIS+4Qk1H0pNXD5AgMB +AAGjUzBRMB0GA1UdDgQWBBSNIkFSqNAKNt+0lwVjhGt4rhW2gjAfBgNVHSMEGDAW +gBRFwzlW9V6kKL6+BWHXV7cUEqx2KjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 +DQEBCwUAA4IBAQAEwwGdh5IEKB9Qs1A0B+En+J2Uu2epkpX6TN/4JAMrTCghv+iq +U/WwAmJ8dg+CL0vT6nr+t6cIWcVvRwrT6ZfUzLYUhIGDqaJbwjJaeXE1zM5jCMvq +9kGLw7mqZUiSFFIfejo3TSo2nS45xMgmoiYdXWMe9FX1LII3Yqcx3PgdVuDcA+V5 +8cKxbwRQbt91g6SKoW13mfitm7XUJueT8I+9YovmkKfjIhqa1wK8ikDdG8b/t8vU +Jom/uQh3k6uU0QSURspkqJjF6uBVlCohA+bvJpAqOeTN+Zr45OSX8+ai5h2P12ZW +B+/ycVvhqeDKP7eJItQz0rQeaNgPQYFjp9Xc +-----END CERTIFICATE-----