AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0+ |
| 2 | # Copyright (c) 2019, Linaro Limited |
| 3 | # Author: AKASHI Takahiro <takahiro.akashi@linaro.org> |
| 4 | |
| 5 | import os |
| 6 | import os.path |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 7 | from subprocess import call, check_call, check_output, CalledProcessError |
AKASHI Takahiro | be5dbf0 | 2020-07-08 14:01:59 +0900 | [diff] [blame] | 8 | import pytest |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 9 | from defs import * |
| 10 | |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 11 | |
| 12 | # |
| 13 | # Fixture for UEFI secure boot test |
| 14 | # |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 15 | |
| 16 | |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 17 | @pytest.fixture(scope='session') |
| 18 | def efi_boot_env(request, u_boot_config): |
| 19 | """Set up a file system to be used in UEFI secure boot test. |
| 20 | |
| 21 | Args: |
| 22 | request: Pytest request object. |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 23 | u_boot_config: U-boot configuration. |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 24 | |
| 25 | Return: |
| 26 | A path to disk image to be used for testing |
| 27 | """ |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 28 | image_path = u_boot_config.persistent_data_dir |
AKASHI Takahiro | 6834fda | 2020-07-21 19:35:23 +0900 | [diff] [blame] | 29 | image_path = image_path + '/test_efi_secboot.img' |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 30 | |
| 31 | try: |
Heinrich Schuchardt | 33424ea | 2020-07-11 23:05:18 +0200 | [diff] [blame] | 32 | mnt_point = u_boot_config.build_dir + '/mnt_efisecure' |
| 33 | check_call('rm -rf {}'.format(mnt_point), shell=True) |
Heinrich Schuchardt | b7e1d65 | 2020-04-21 18:44:39 +0200 | [diff] [blame] | 34 | check_call('mkdir -p {}'.format(mnt_point), shell=True) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 35 | |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 36 | # suffix |
| 37 | # *.key: RSA private key in PEM |
| 38 | # *.crt: X509 certificate (self-signed) in PEM |
| 39 | # *.esl: signature list |
| 40 | # *.hash: message digest of image as signature list |
| 41 | # *.auth: signed signature list in signature database format |
| 42 | # *.efi: UEFI image |
| 43 | # *.efi.signed: signed UEFI image |
| 44 | |
| 45 | # Create signature database |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 46 | # PK |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 47 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 48 | % mnt_point, shell=True) |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 49 | check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -t "2020-04-01" -c PK.crt -k PK.key PK PK.esl PK.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 50 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 51 | shell=True) |
| 52 | # PK_null for deletion |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 53 | check_call('cd %s; touch PK_null.esl; %ssign-efi-sig-list -t "2020-04-02" -c PK.crt -k PK.key PK PK_null.esl PK_null.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 54 | % (mnt_point, EFITOOLS_PATH), shell=True) |
| 55 | # KEK |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 56 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 57 | % mnt_point, shell=True) |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 58 | check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -t "2020-04-03" -c PK.crt -k PK.key KEK KEK.esl KEK.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 59 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 60 | shell=True) |
| 61 | # db |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 62 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 63 | % mnt_point, shell=True) |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 64 | check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -t "2020-04-04" -c KEK.crt -k KEK.key db db.esl db.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 65 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 66 | shell=True) |
| 67 | # db1 |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 68 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 69 | % mnt_point, shell=True) |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 70 | check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key db db1.esl db1.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 71 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 72 | shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 73 | # dbx (TEST_dbx certificate) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 74 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 75 | % mnt_point, shell=True) |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 76 | check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 77 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 78 | shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 79 | # dbx_hash (digest of TEST_db certificate) |
AKASHI Takahiro | d4ece53 | 2020-07-08 14:02:01 +0900 | [diff] [blame] | 80 | check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth' |
| 81 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 82 | shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 83 | # dbx_hash1 (digest of TEST_db1 certificate) |
AKASHI Takahiro | a59ffd3 | 2020-08-14 14:39:24 +0900 | [diff] [blame^] | 84 | check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth' |
AKASHI Takahiro | db20a3e | 2020-07-08 14:02:02 +0900 | [diff] [blame] | 85 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 86 | shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 87 | # dbx_db (with TEST_db certificate) |
AKASHI Takahiro | 0f6e3eb | 2020-07-08 14:02:03 +0900 | [diff] [blame] | 88 | check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth' |
| 89 | % (mnt_point, EFITOOLS_PATH), |
| 90 | shell=True) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 91 | |
| 92 | # Copy image |
AKASHI Takahiro | 6834fda | 2020-07-21 19:35:23 +0900 | [diff] [blame] | 93 | check_call('cp %s/lib/efi_loader/helloworld.efi %s' % |
| 94 | (u_boot_config.build_dir, mnt_point), shell=True) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 95 | |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 96 | # Sign image |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 97 | check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 98 | % mnt_point, shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 99 | # Sign already-signed image with another key |
AKASHI Takahiro | db20a3e | 2020-07-08 14:02:02 +0900 | [diff] [blame] | 100 | check_call('cd %s; sbsign --key db1.key --cert db1.crt --output helloworld.efi.signed_2sigs helloworld.efi.signed' |
| 101 | % mnt_point, shell=True) |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 102 | # Digest image |
Heinrich Schuchardt | 446b148 | 2020-07-02 08:25:46 +0200 | [diff] [blame] | 103 | check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth' |
AKASHI Takahiro | 719e89d | 2020-07-08 14:01:58 +0900 | [diff] [blame] | 104 | % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH), |
| 105 | shell=True) |
AKASHI Takahiro | 0f6e3eb | 2020-07-08 14:02:03 +0900 | [diff] [blame] | 106 | check_call('cd %s; %shash-to-efi-sig-list helloworld.efi.signed db_hello_signed.hash; %ssign-efi-sig-list -t "2020-04-03" -c KEK.crt -k KEK.key db db_hello_signed.hash db_hello_signed.auth' |
| 107 | % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH), |
| 108 | shell=True) |
| 109 | check_call('cd %s; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key dbx db_hello_signed.hash dbx_hello_signed.auth' |
| 110 | % (mnt_point, EFITOOLS_PATH), |
| 111 | shell=True) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 112 | |
AKASHI Takahiro | 798f306 | 2020-07-20 15:33:39 +0900 | [diff] [blame] | 113 | check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format( |
| 114 | mnt_point, image_path), shell=True) |
Heinrich Schuchardt | 33424ea | 2020-07-11 23:05:18 +0200 | [diff] [blame] | 115 | check_call('rm -rf {}'.format(mnt_point), shell=True) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 116 | |
AKASHI Takahiro | be5dbf0 | 2020-07-08 14:01:59 +0900 | [diff] [blame] | 117 | except CalledProcessError as exception: |
| 118 | pytest.skip('Setup failed: %s' % exception.cmd) |
AKASHI Takahiro | 58c95c2 | 2020-04-14 11:51:49 +0900 | [diff] [blame] | 119 | return |
| 120 | else: |
| 121 | yield image_path |
| 122 | finally: |
| 123 | call('rm -f %s' % image_path, shell=True) |
AKASHI Takahiro | 79f428e | 2020-07-21 19:35:24 +0900 | [diff] [blame] | 124 | |
| 125 | # |
| 126 | # Fixture for UEFI secure boot test of intermediate certificates |
| 127 | # |
| 128 | |
| 129 | |
| 130 | @pytest.fixture(scope='session') |
| 131 | def efi_boot_env_intca(request, u_boot_config): |
| 132 | """Set up a file system to be used in UEFI secure boot test |
| 133 | of intermediate certificates. |
| 134 | |
| 135 | Args: |
| 136 | request: Pytest request object. |
| 137 | u_boot_config: U-boot configuration. |
| 138 | |
| 139 | Return: |
| 140 | A path to disk image to be used for testing |
| 141 | """ |
| 142 | image_path = u_boot_config.persistent_data_dir |
| 143 | image_path = image_path + '/test_efi_secboot_intca.img' |
| 144 | |
| 145 | try: |
| 146 | mnt_point = u_boot_config.persistent_data_dir + '/mnt_efi_secboot_intca' |
| 147 | check_call('rm -rf {}'.format(mnt_point), shell=True) |
| 148 | check_call('mkdir -p {}'.format(mnt_point), shell=True) |
| 149 | |
| 150 | # Create signature database |
| 151 | # PK |
| 152 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365' |
| 153 | % mnt_point, shell=True) |
| 154 | check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth' |
| 155 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 156 | shell=True) |
| 157 | # KEK |
| 158 | check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365' |
| 159 | % mnt_point, shell=True) |
| 160 | check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth' |
| 161 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 162 | shell=True) |
| 163 | |
| 164 | # We will have three-tier hierarchy of certificates: |
| 165 | # TestRoot: Root CA (self-signed) |
| 166 | # TestSub: Intermediate CA (signed by Root CA) |
| 167 | # TestCert: User certificate (signed by Intermediate CA, and used |
| 168 | # for signing an image) |
| 169 | # |
| 170 | # NOTE: |
| 171 | # I consulted the following EDK2 document for certificate options: |
| 172 | # BaseTools/Source/Python/Pkcs7Sign/Readme.md |
| 173 | # Please not use them as they are in product system. They are |
| 174 | # for test purpose only. |
| 175 | |
| 176 | # TestRoot |
| 177 | check_call('cp %s/test/py/tests/test_efi_secboot/openssl.cnf %s' |
| 178 | % (u_boot_config.source_dir, mnt_point), shell=True) |
| 179 | check_call('cd %s; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestRoot.key 2048; openssl req -extensions v3_ca -new -x509 -days 365 -key TestRoot.key -out TestRoot.crt -subj "/CN=TEST_root/"; touch index.txt; touch index.txt.attr' |
| 180 | % mnt_point, shell=True) |
| 181 | # TestSub |
| 182 | check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestSub.key 2048; openssl req -new -key TestSub.key -out TestSub.csr -subj "/CN=TEST_sub/"; openssl ca -in TestSub.csr -out TestSub.crt -extensions v3_int_ca -days 365 -batch -rand_serial -cert TestRoot.crt -keyfile TestRoot.key' |
| 183 | % mnt_point, shell=True) |
| 184 | # TestCert |
| 185 | check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestCert.key 2048; openssl req -new -key TestCert.key -out TestCert.csr -subj "/CN=TEST_cert/"; openssl ca -in TestCert.csr -out TestCert.crt -extensions usr_cert -days 365 -batch -rand_serial -cert TestSub.crt -keyfile TestSub.key' |
| 186 | % mnt_point, shell=True) |
| 187 | # db |
| 188 | # for TestCert |
| 189 | check_call('cd %s; %scert-to-efi-sig-list -g %s TestCert.crt TestCert.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db TestCert.esl db_a.auth' |
| 190 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 191 | shell=True) |
| 192 | # for TestSub |
| 193 | check_call('cd %s; %scert-to-efi-sig-list -g %s TestSub.crt TestSub.esl; %ssign-efi-sig-list -t "2020-07-16" -c KEK.crt -k KEK.key db TestSub.esl db_b.auth' |
| 194 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 195 | shell=True) |
| 196 | # for TestRoot |
| 197 | check_call('cd %s; %scert-to-efi-sig-list -g %s TestRoot.crt TestRoot.esl; %ssign-efi-sig-list -t "2020-07-17" -c KEK.crt -k KEK.key db TestRoot.esl db_c.auth' |
| 198 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 199 | shell=True) |
| 200 | ## dbx (hash of certificate with revocation time) |
| 201 | # for TestCert |
| 202 | check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-20" -s 256 TestCert.crt TestCert.crl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx TestCert.crl dbx_a.auth' |
| 203 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 204 | shell=True) |
| 205 | # for TestSub |
| 206 | check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-21" -s 256 TestSub.crt TestSub.crl; %ssign-efi-sig-list -t "2020-07-18" -c KEK.crt -k KEK.key dbx TestSub.crl dbx_b.auth' |
| 207 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 208 | shell=True) |
| 209 | # for TestRoot |
| 210 | check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-22" -s 256 TestRoot.crt TestRoot.crl; %ssign-efi-sig-list -t "2020-07-19" -c KEK.crt -k KEK.key dbx TestRoot.crl dbx_c.auth' |
| 211 | % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), |
| 212 | shell=True) |
| 213 | |
| 214 | # Sign image |
| 215 | # additional intermediate certificates may be included |
| 216 | # in SignedData |
| 217 | |
| 218 | check_call('cp %s/lib/efi_loader/helloworld.efi %s' % |
| 219 | (u_boot_config.build_dir, mnt_point), shell=True) |
| 220 | # signed by TestCert |
| 221 | check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --out helloworld.efi.signed_a helloworld.efi' |
| 222 | % (mnt_point, SBSIGN_PATH), shell=True) |
| 223 | # signed by TestCert with TestSub in signature |
| 224 | check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSub.crt --out helloworld.efi.signed_ab helloworld.efi' |
| 225 | % (mnt_point, SBSIGN_PATH), shell=True) |
| 226 | # signed by TestCert with TestSub and TestRoot in signature |
| 227 | check_call('cd %s; cat TestSub.crt TestRoot.crt > TestSubRoot.crt; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSubRoot.crt --out helloworld.efi.signed_abc helloworld.efi' |
| 228 | % (mnt_point, SBSIGN_PATH), shell=True) |
| 229 | |
| 230 | check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(mnt_point, image_path), shell=True) |
| 231 | check_call('rm -rf {}'.format(mnt_point), shell=True) |
| 232 | |
| 233 | except CalledProcessError as e: |
| 234 | pytest.skip('Setup failed: %s' % e.cmd) |
| 235 | return |
| 236 | else: |
| 237 | yield image_path |
| 238 | finally: |
| 239 | call('rm -f %s' % image_path, shell=True) |