From 5d6190bae479c380d06d4230a2f0106723f0f397 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dhorak@redhat.com>
Date: Wed, 3 Jun 2026 12:32:48 +0200
Subject: [PATCH] tests/sanity - check for SecureBoot trailer presence

Related: https://github.com/ibm-s390-linux/s390-tools/commit/50f909db8f53011b00c5819e593504264d23bb82
---
 tests/sanity/main.fmf   | 1 +
 tests/sanity/runtest.sh | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/sanity/main.fmf b/tests/sanity/main.fmf
index 5cec1d7..e6118f7 100644
--- a/tests/sanity/main.fmf
+++ b/tests/sanity/main.fmf
@@ -8,6 +8,7 @@ test: ./runtest.sh
 framework: beakerlib
 require:
   - s390utils-base
+  - xxd
 duration: 5m
 enabled: true
 adjust:
diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh
index 5885c69..dc889e4 100755
--- a/tests/sanity/runtest.sh
+++ b/tests/sanity/runtest.sh
@@ -31,6 +31,7 @@
 PACKAGE="s390utils-base"
 
 EXTRACT="$PWD/extract-module-sig.pl"
+STAGE3="/usr/lib/s390-tools/stage3.bin"
 
 rlJournalStart
     rlPhaseStartSetup
@@ -171,9 +172,10 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "Bootloader signature"
+        rlRun "xxd -s 16380 -l 4 -g 4 $STAGE3 | grep -q zIPL" 0 "Check SecureBoot trailer presence"
         # only RHEL has signed bootloader
         if rlIsRHEL '>=8'; then
-            rlRun "$EXTRACT -s /usr/lib/s390-tools/stage3.bin > stage3.bin.sig" 0 "Check bootloader signature"
+            rlRun "$EXTRACT -s $STAGE3 > stage3.bin.sig" 0 "Check bootloader signature"
         else
             rlLog "Skipping bootloader signature check, not on RHEL"
         fi