depot/third_party/nixpkgs/nixos/tests/systemd-cryptenroll.nix

import ./make-test-python.nix (
  { pkgs, ... }:
  {
    name = "systemd-cryptenroll";
    meta = with pkgs.lib.maintainers; {
      maintainers = [ ymatsiuk ];
    };

    nodes.machine =
      { pkgs, lib, ... }:
      {
        environment.systemPackages = [ pkgs.cryptsetup ];
        virtualisation = {
          emptyDiskImages = [ 512 ];
          tpm.enable = true;
        };
      };

    testScript = ''
      machine.start()

      # Verify the TPM device is available and accessible by systemd-cryptenroll
      machine.succeed("test -e /dev/tpm0")
      machine.succeed("test -e /dev/tpmrm0")
      machine.succeed("systemd-cryptenroll --tpm2-device=list")

      # Create LUKS partition
      machine.succeed("echo -n lukspass | cryptsetup luksFormat -q /dev/vdb -")
      # Enroll new LUKS key and bind it to Secure Boot state
      # For more details on PASSWORD variable, check the following issue:
      # https://github.com/systemd/systemd/issues/20955
      machine.succeed("PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/vdb")
      # Add LUKS partition to /etc/crypttab to test auto unlock
      machine.succeed("echo 'luks /dev/vdb - tpm2-device=auto' >> /etc/crypttab")

      machine.shutdown()
      machine.start()

      # Test LUKS partition automatic unlock on boot
      machine.wait_for_unit("systemd-cryptsetup@luks.service")
      # Wipe TPM2 slot
      machine.succeed("systemd-cryptenroll --wipe-slot=tpm2 /dev/vdb")
    '';
  }
)