From c1fd4506e60d0dfb25c5b5c7d7cac6ebaafa6e68 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Tue, 14 Nov 2023 09:20:06 +0100
Subject: [PATCH] test: validate defconfigs, ensure root login is disabled

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 board/x86_64/board.mk       |  3 ++-
 test/case/all-repo.yaml     |  5 ++++
 test/case/repo/all.yaml     |  3 +++
 test/case/repo/defconfig.sh | 53 +++++++++++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 test/case/all-repo.yaml
 create mode 100644 test/case/repo/all.yaml
 create mode 100755 test/case/repo/defconfig.sh

diff --git a/board/x86_64/board.mk b/board/x86_64/board.mk
index 0747b796..4356d6a1 100644
--- a/board/x86_64/board.mk
+++ b/board/x86_64/board.mk
@@ -1,5 +1,6 @@
 test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
-INFIX_TESTS ?= $(test-dir)/case/all-unit.yaml $(test-dir)/case/all.yaml
+INFIX_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml \
+	$(test-dir)/case/all.yaml
 
 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
diff --git a/test/case/all-repo.yaml b/test/case/all-repo.yaml
new file mode 100644
index 00000000..68923979
--- /dev/null
+++ b/test/case/all-repo.yaml
@@ -0,0 +1,5 @@
+---
+# Tests in this suite sanity check the repo, e.g. defconfigs
+
+- name:  repo
+  suite: repo/all.yaml
diff --git a/test/case/repo/all.yaml b/test/case/repo/all.yaml
new file mode 100644
index 00000000..54045375
--- /dev/null
+++ b/test/case/repo/all.yaml
@@ -0,0 +1,3 @@
+---
+- case: defconfig.sh
+  name: "validate defconfigs"
diff --git a/test/case/repo/defconfig.sh b/test/case/repo/defconfig.sh
new file mode 100755
index 00000000..e774acf0
--- /dev/null
+++ b/test/case/repo/defconfig.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+SCRIPT_PATH="$(dirname "$(readlink -f "$0")")"
+CONFIGS="$SCRIPT_PATH/../../../configs"
+
+whitelist()
+{
+    nm=$(basename "$1")
+    case $nm in
+	aarch64_classic_defconfig | cn9130_crb_boot_defconfig | fireant_boot_defconfig | x86_64_classic_defconfig)
+	    return 0
+	    ;;
+	*)
+	    return 1
+	    ;;
+    esac
+}
+
+# Check for disabled root login
+disabled_root_login()
+{
+    txt="# BR2_TARGET_ENABLE_ROOT_LOGIN is not set"
+    fn=$(realpath "$1")
+
+    if ! grep -q "$txt" "$fn"; then
+	if ! whitelist "$fn"; then
+	    echo "Missing '$txt' in $fn!"
+	    return 1
+	fi
+    fi
+}
+
+# For all defconfigs
+check()
+{
+    total=$#
+    num=1
+
+    echo "1..$total"
+    for defconfig in "$@"; do
+	fn=$(basename "$defconfig")
+	if disabled_root_login "$defconfig"; then
+	    echo "ok $num - $fn"
+	else
+	    echo "not ok $num - $fn has not disabled root login"
+	fi
+	num=$((num + 1))
+    done
+}
+
+check "$CONFIGS"/* || exit 1
+
+exit 0