recipes-tests/converged-security-suite: add

[macpijan]

This should replace: https://github.com/Dasharo/meta-dts/tree/main/meta-dts-distro/recipes-tests/converged-security-suite

Although not strictly dasharo project, it will make us easier to reuse this recipe. Right now, I could not reuse it under meta-trenchboot, if it was present in meta-dts.

Binaries are properly packaged:

macpijan in ~/projects/trenchboot/yocto/build/tmp/work/core2-64-tb-linux/converged-security-suite/2.8.1 λ tree packages-split                                
packages-split
├── converged-security-suite
├── converged-security-suite-amd
│   └── usr
│       └── bin
│           └── amd-suite
├── converged-security-suite-bg
│   └── usr
│       └── bin
│           ├── bg-prov
│           └── bg-suite
├── converged-security-suite-dbg
│   └── usr
│       └── bin
├── converged-security-suite-dev
├── converged-security-suite-doc
├── converged-security-suite-locale
├── converged-security-suite-src
├── converged-security-suite-staticdev
├── converged-security-suite-tools
│   └── usr
│       └── bin
│           └── pcr0tool
└── converged-security-suite-txt
    └── usr
        └── bin
            ├── txt-prov
            └── txt-suite

Not runtime tested yet.

[macpijan]

Unfortunately, it seems that those tools are broken, and it's pointless to include recipe for this version:

• txt-suite from v2.8.0/v2.8.1 fails to execute tests 9elements/converged-security-suite#406
• bg-suite fails to access MSRs and memory when running runtime subset of tests 9elements/converged-security-suite#404

The last known working version (at least for txt-suite) is from 4 years ago and we might include it here: https://github.com/9elements/converged-security-suite/releases/tag/v2.6.0

[DaniilKl]

Looks ok. I have not tested it in any system just verified if the package builds correctly.

[DaniilKl]

What do you think about adding bg-suite binary to the layer as was done here https://github.com/Dasharo/meta-dts/blob/2a634e361986aa16286469efd8c879191027458e/meta-dts-distro/recipes-tests/converged-security-suite/bg-suite_2.7.0.bb#L7 ? Consider adding it so we will include this package in DTS later.

[macpijan]

What do you think about adding bg-suite binary to the layer

I think that adding any binary to the layer is a truly terrible idea.
We can fetch this binary via SRC_URI from somewhere - if we cannot build it in yocto.

[DaniilKl]

https://dl.3mdeb.com/ ? 🤔

[DaniilKl]

Or the place where this binary was taken from.

[macpijan]

If there is no upstream release, you can possibly upload this binary to GH release in our fork.

[macpijan]

Looks ok. I have not tested it in any system just verified if the package builds correctly.

I tested in https://github.com/zarhus/meta-trenchboot/blob/master/recipes-tests/trenchboot-hcl-report/trenchboot-hcl-report/trenchboot-hcl-report.sh#L221 many times already