diff options
| -rw-r--r-- | scripts/tpm_nvpcr.py | 8 | ||||
| -rw-r--r-- | tests/test_nvpcr.py | 8 |
2 files changed, 14 insertions, 2 deletions
diff --git a/scripts/tpm_nvpcr.py b/scripts/tpm_nvpcr.py index 14a250c..4f110fa 100644 --- a/scripts/tpm_nvpcr.py +++ b/scripts/tpm_nvpcr.py @@ -30,7 +30,11 @@ INITRD_UNITS = ( def run(*command: str) -> str: - result = subprocess.run(command, capture_output=True, text=True, check=True) + try: + result = subprocess.run(command, capture_output=True, text=True, check=True) + except subprocess.CalledProcessError as exc: + detail = (exc.stderr or exc.stdout or "no error output").strip() + raise RuntimeError(f"{command[0]} exited {exc.returncode}: {detail}") from exc return result.stdout @@ -142,6 +146,6 @@ def main() -> int: if __name__ == "__main__": try: sys.exit(main()) - except (OSError, TypeError, ValueError, subprocess.CalledProcessError) as exc: + except (OSError, TypeError, ValueError, RuntimeError) as exc: print(f"NvPCR check failed: {exc}", file=sys.stderr) sys.exit(1) diff --git a/tests/test_nvpcr.py b/tests/test_nvpcr.py index 5f36bb7..02bafb1 100644 --- a/tests/test_nvpcr.py +++ b/tests/test_nvpcr.py @@ -83,6 +83,14 @@ def sections(public_key, *, policies=None, options=None): class NvPCRImageTests(unittest.TestCase): + def test_command_failure_reports_stderr(self): + error = subprocess.CalledProcessError(1, ["ukify"], stderr="file not found") + with ( + mock.patch.object(tpm_nvpcr.subprocess, "run", side_effect=error), + self.assertRaisesRegex(RuntimeError, "ukify exited 1: file not found"), + ): + tpm_nvpcr.run("ukify", "inspect", "missing.efi") + def test_initrd_has_required_units(self): listing = "\n".join( f"usr/lib/systemd/system/{unit}" for unit in tpm_nvpcr.INITRD_UNITS |