testSignedPackages: init

pkgs/by-name/au/autopen/tests/default.nix

@@ -1,8 +1,12 @@
 {
+  lib,
+  stdenvNoCC,
   writeText,
   autopen,
+  testSignedPackages,
   linkFarm,
   runCommand,
+  openssl_4_0,
 }:
 
 {
@@ -17,29 +21,63 @@ let
   signature = autopen.sign {
     inherit signingKey message;
   };
+
+  signedPackages = testSignedPackages.override {
+    uefiSigningKey = signingKey;
+  };
 in
-linkFarm "autopen-test" {
-  inherit signingKey;
-  inherit (signingKey) verificationKey;
+linkFarm "autopen-test" (
+  {
+    inherit signingKey;
+    inherit (signingKey) verificationKey;
 
-  inherit message signature;
+    inherit message signature;
 
-  signature-check =
-    runCommand "autopen-test-signature-check"
-      {
-        nativeBuildInputs = [
-          autopen
-        ];
-        inherit (signingKey) verificationKey;
-        inherit signature message;
-        strictDeps = true;
-        __structuredAttrs = true;
-      }
-      ''
-        autopen verify \
-          --verification-key="$verificationKey" \
-          --signature="$signature" \
-          -- "$message"
-        touch -- "$out"
-      '';
-}
+    signature-check =
+      runCommand "autopen-test-signature-check"
+        {
+          nativeBuildInputs = [
+            autopen
+          ];
+          inherit (signingKey) verificationKey;
+          inherit signature message;
+          strictDeps = true;
+          __structuredAttrs = true;
+        }
+        ''
+          autopen verify \
+            --verification-key="$verificationKey" \
+            --signature="$signature" \
+            -- "$message"
+          touch -- "$out"
+        '';
+
+    certificate-check =
+      runCommand "autopen-test-certificate-check"
+        {
+          nativeBuildInputs = [
+            # Versions prior to 4.0 suffer from
+            # <https://github.com/openssl/openssl/issues/15124>…
+            openssl_4_0
+          ];
+          inherit (signedPackages) uefiCertificate;
+          strictDeps = true;
+          __structuredAttrs = true;
+        }
+        ''
+          exec &> >(tee -- "$out")
+          openssl asn1parse -in "$uefiCertificate" -inform DER -i
+          openssl x509 -in "$uefiCertificate" -noout -text
+          openssl verify \
+            -verbose \
+            -CAfile "$uefiCertificate" \
+            -attime "$(date --date=1970-01-01T23:59:59Z +%s)" \
+            -check_ss_sig \
+            -x509_strict \
+            -- "$uefiCertificate"
+        '';
+  }
+  // lib.optionalAttrs stdenvNoCC.hostPlatform.isLinux (
+    lib.filterAttrs (_: lib.isDerivation) signedPackages
+  )
+)

pkgs/misc/signed-packages/test-signed-packages.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  mkSignedPackages,
+  autopen,
+
+  uefiSigningKey ? autopen.testSigningKey,
+}:
+
+mkSignedPackages {
+  inherit uefiSigningKey;
+
+  uefiCertificate = autopen.x509.mkSelfSignedCertificate {
+    name = "insecure-test-uefi-certificate";
+
+    signingKey = uefiSigningKey;
+
+    certificateParams = {
+      purpose = "code-signing";
+      commonName = "INSECURE TEST CERTIFICATE, DO NOT TRUST";
+      notBefore = "1970-01-01T00:00:00Z";
+      lifetimeDays = 1;
+    };
+
+    passthru = {
+      signingKey = uefiSigningKey;
+    };
+
+    meta = {
+      description = "Insecure test UEFI Secure Boot certificate";
+      license = lib.licenses.free;
+      inherit (autopen.meta) platforms;
+      teams = [ lib.teams.boot-security ];
+    };
+  };
+}

pkgs/top-level/all-packages.nix

@@ -760,6 +760,9 @@ with pkgs;
   mkShellNoCC = mkShell.override { stdenv = stdenvNoCC; };
 
   mkSignedPackages = callPackage ../misc/signed-packages { };
+  testSignedPackages = recurseIntoAttrs (
+    callPackage ../misc/signed-packages/test-signed-packages.nix { }
+  );
 
   nixBufferBuilders = import ../applications/editors/emacs/build-support/buffer.nix {
     inherit lib writeText;