From a304c7bf12c85a4d8b760850da4017fce694cada Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexis=20Lothor=C3=A9?= <alexis.lothore@bootlin.com>
Date: Mon, 7 Sep 2026 15:47:37 +0200
Subject: [PATCH] support/testing: add tests for openscap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add basic tests for openscap, ensuring that it builds and runs a minimal
command with different cryptographic backends:
- libgcrypt
- libnss
- no crypto backend

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
 DEVELOPERS                                    |  2 +
 .../testing/tests/package/test_openscap.py    | 63 +++++++++++++++++++
 .../rootfs-overlay/root/benchmark.xml         |  5 ++
 3 files changed, 70 insertions(+)
 create mode 100644 support/testing/tests/package/test_openscap.py
 create mode 100644 support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml

diff --git a/DEVELOPERS b/DEVELOPERS
index 0a6d4e455e..cbca07f9fa 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -159,6 +159,8 @@ F:	package/libxmlsec1/
 F:	package/openscap/
 F: 	package/python-scp/
 F:	support/testing/tests/package/test_libldns.py
+F:	support/testing/tests/package/test_openscap/
+F:	support/testing/tests/package/test_openscap.py
 F:	support/testing/tests/package/test_python_scp.py
 
 N:	Alistair Francis <alistair@alistair23.me>
diff --git a/support/testing/tests/package/test_openscap.py b/support/testing/tests/package/test_openscap.py
new file mode 100644
index 0000000000..08527d28aa
--- /dev/null
+++ b/support/testing/tests/package/test_openscap.py
@@ -0,0 +1,63 @@
+import os
+
+import infra.basetest
+
+
+class TestOpenSCAPBase(infra.basetest.BRTest):
+    config = """
+        BR2_arm=y
+        BR2_cortex_a8=y
+        BR2_ARM_EABIHF=y
+        BR2_TOOLCHAIN_EXTERNAL=y
+        BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+        BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
+        BR2_PACKAGE_OPENSCAP=y
+        BR2_ROOTFS_OVERLAY="{}"
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """.format(
+                infra.filepath("tests/package/test_openscap/rootfs-overlay"))
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(
+            arch="armv7",
+            kernel="builtin",
+            options=["-m", "512M", "-initrd", cpio_file],
+        )
+        self.emulator.login()
+
+        out, ret = self.emulator.run("oscap --version")
+        self.assertEqual(ret, 0)
+
+        out, ret = self.emulator.run("oscap info /root/benchmark.xml")
+        self.assertEqual(ret, 0)
+        self.assertIn("Document type: XCCDF Checklist", "\n".join(out))
+
+
+class TestOpenSCAPGcrypt(TestOpenSCAPBase):
+    """Test openscap using the gcrypt crypto backend."""
+
+    config = (
+        TestOpenSCAPBase.config
+        + """
+        BR2_PACKAGE_LIBGCRYPT=y
+        """
+    )
+
+
+class TestOpenSCAPNss(TestOpenSCAPBase):
+    """Test openscap using the nss crypto backend."""
+
+    config = (
+        TestOpenSCAPBase.config
+        + """
+        BR2_PACKAGE_LIBNSS=y
+        """
+    )
+
+
+class TestOpenSCAPNoCrypto(TestOpenSCAPBase):
+    """Test openscap without any crypto backend."""
+
+    config = TestOpenSCAPBase.config
diff --git a/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
new file mode 100644
index 0000000000..aac0f1e0fa
--- /dev/null
+++ b/support/testing/tests/package/test_openscap/rootfs-overlay/root/benchmark.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Benchmark xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.buildroot.benchmark">
+  <xccdf:status>accepted</xccdf:status>
+  <xccdf:version>1.0</xccdf:version>
+</xccdf:Benchmark>