feat: add auto secure boot to new kernel update

tests/test_package_manager_secure_boot.py

@@ -0,0 +1,55 @@
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+
+import package_manager
+from secure_boot import SecureBootResult
+
+
+class SecureBootTransactionTests(unittest.TestCase):
+    @patch.object(package_manager.subprocess, "run")
+    @patch.object(package_manager, "prepare_secure_boot")
+    def test_aborts_before_pacman_when_preflight_fails(
+        self, prepare_mock, run_mock
+    ):
+        prepare_mock.return_value = SecureBootResult(
+            success=False,
+            configured=True,
+            error="ESP indisponible",
+        )
+
+        result = package_manager.install_packages(["linux-cachyos"])
+
+        self.assertFalse(result.success)
+        self.assertIn("ESP indisponible", result.error)
+        run_mock.assert_not_called()
+
+    @patch.object(package_manager, "refresh_secure_boot")
+    @patch.object(package_manager.subprocess, "run")
+    @patch.object(package_manager, "prepare_secure_boot")
+    def test_reports_post_transaction_signing_failure(
+        self, prepare_mock, run_mock, refresh_mock
+    ):
+        prepare_mock.return_value = SecureBootResult(
+            success=True,
+            configured=True,
+        )
+        run_mock.return_value = Mock(returncode=0, stdout="", stderr="")
+        refresh_mock.return_value = SecureBootResult(
+            success=False,
+            configured=True,
+            error="signature invalide",
+        )
+
+        result = package_manager.upgrade_cached_packages(["linux"])
+
+        self.assertFalse(result.success)
+        self.assertIn("paquets ont été installés", result.error)
+        self.assertIn("signature invalide", result.error)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_secure_boot.py

@@ -0,0 +1,53 @@
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+
+import secure_boot
+
+
+class BootArtifactsMayChangeTests(unittest.TestCase):
+    def test_detects_kernel_and_bootloader_packages(self):
+        for name in ("linux", "linux-cachyos", "linux-zen", "grub", "shim-signed"):
+            with self.subTest(name=name):
+                self.assertTrue(secure_boot.boot_artifacts_may_change([name]))
+
+    def test_ignores_unrelated_packages(self):
+        self.assertFalse(
+            secure_boot.boot_artifacts_may_change(["firefox", "mesa", "curl"])
+        )
+
+
+class PrepareSecureBootTests(unittest.TestCase):
+    @patch.object(secure_boot, "SIGNER_PATH")
+    def test_skips_when_signer_is_not_configured(self, signer_path):
+        signer_path.is_file.return_value = False
+        result = secure_boot.prepare_secure_boot(["linux-cachyos"])
+        self.assertTrue(result.success)
+        self.assertFalse(result.configured)
+
+    @patch.object(secure_boot, "_run")
+    @patch.object(os, "access", return_value=True)
+    @patch.object(os, "geteuid", return_value=0)
+    @patch.object(secure_boot, "SIGNER_PATH")
+    def test_mounts_and_validates_esp(
+        self, signer_path, _geteuid, _access, run_mock
+    ):
+        signer_path.is_file.return_value = True
+        signer_path.__str__ = Mock(return_value="/usr/local/sbin/signer")
+        run_mock.return_value = Mock(returncode=0, stdout="", stderr="")
+
+        result = secure_boot.prepare_secure_boot(["linux-cachyos"])
+
+        self.assertTrue(result.success)
+        self.assertTrue(result.configured)
+        run_mock.assert_called_once_with(
+            ["/usr/local/sbin/signer", "--prepare"]
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()