From ebcc2e1d0e94080d9b046b0937bdfd238d59a0bd Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Wed, 7 Oct 2026 14:49:28 -0300
Subject: [PATCH] test(xcat-core): capture the install source shim in the
 Genesis boot script

The shell, discover, standby and runcmd destinies load the Genesis kernel
through the same UEFI script as an osimage kernel. setstate asks for a shim
with the os of the node, so an install source answers for a kernel that no
distribution signed.

The new node keeps the install source of the first node of the test, so both
shims are on disk and the order decides the answer. Two assertions of twelve
fail: the script names /install/alma9.8/x86_64/EFI/BOOT/BOOTX64.EFI.

The nodeset helper takes currstate and provmethod, so the node reads as the
shell destiny it is.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 xCAT-test/unit/secureboot_ipxe_node_shim.t | 30 +++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/xCAT-test/unit/secureboot_ipxe_node_shim.t b/xCAT-test/unit/secureboot_ipxe_node_shim.t
index f77534698..4c1ded841 100644
--- a/xCAT-test/unit/secureboot_ipxe_node_shim.t
+++ b/xCAT-test/unit/secureboot_ipxe_node_shim.t
@@ -77,9 +77,13 @@ sub install_source {
 sub nodeset {
     my ( $plugin, $node, %attrib ) = @_;
     $rows{noderes}{$node} = { tftpdir => $tftp, netboot => $plugin };
-    $rows{chain}{$node}   = { currstate => 'install rhels9-x86_64-compute' };
-    $rows{nodetype}{$node} =
-      { provmethod => 'install', os => $attrib{os}, arch => $attrib{arch} };
+    $rows{chain}{$node} =
+      { currstate => $attrib{currstate} || 'install rhels9-x86_64-compute' };
+    $rows{nodetype}{$node} = {
+        provmethod => exists( $attrib{provmethod} ) ? $attrib{provmethod} : 'install',
+        os         => $attrib{os},
+        arch       => $attrib{arch},
+    };
     my $subreq = sub {
         my ($request) = @_;
         $request->{bootparams}{$node} = [ { map { $_ => $attrib{$_} } qw(kernel initrd kcmdline) } ]
@@ -163,6 +167,26 @@ like(
     'the install source answers even when the shim of ipxe-xcat is also on disk'
 );
 
+# The shell, discover, standby and runcmd destinies load the Genesis kernel through the same UEFI
+# script. No distribution signs that kernel, so the vendor certificate of an install source cannot
+# verify it and only the shim of ipxe-xcat can. cn08 keeps the install source of cn01, which does
+# carry a shim.
+nodeset(
+    ipxe       => 'cn08',
+    os         => 'alma9.8', arch => 'x86_64',
+    currstate  => 'shell',
+    provmethod => '',
+    kernel     => kernel_with_efistub('xcat/genesis.kernel.x86_64'),
+    initrd     => 'xcat/genesis.fs.x86_64.gz', kcmdline => 'quiet destiny=shell',
+);
+like(
+    script('xcat/ipxe/nodes/cn08.uefi'),
+    ipxe_shim_line('/tftpboot/xcat/ipxe/x86_64-sb/shimx64.efi'),
+    'a node that loads the Genesis kernel names the shim of ipxe-xcat'
+);
+unlike( script('xcat/ipxe/nodes/cn08.uefi'), qr{^shim \S*/install/}m,
+    'and never the shim of an install source, which signs no Genesis kernel' );
+
 # ppc64le has no UEFI shim, and netboot=xnba loads an unsigned loader that Secure Boot refuses.
 nodeset(
     ipxe => 'cn04',