Skip to content

Commit ae08bf6

Browse files
hanno-beckerhanno-becker
committed
Add basic AWS-LC integration test
This commit extends the CI with an integration test for AWS-LC. The CI checks that mlkem-native successfully integrates into AWS-LC by building and running basic tests of AWS-LC in FIPS and non-FIPS mode. Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
1 parent 05be89d commit ae08bf6

3 files changed

Lines changed: 176 additions & 1 deletion

File tree

‎.github/actions/setup-aws-lc/action.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Setup AWS-LC
4+
description: Setup AWS-LC
5+
6+
inputs:
7+
dir:
8+
description: Directory to fetch AWS-LC into
9+
default: 'AWS-LC'
10+
repository:
11+
description: Repository to fetch from
12+
default: 'aws/AWS-LC'
13+
commit:
14+
description: Commit to fetch
15+
default: 'HEAD'
16+
gh_token:
17+
description: Github access token to use
18+
required: true
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- name: Fetch AWS-LC
24+
shell: bash
25+
run: |
26+
mkdir ${{ inputs.dir }} && cd ${{ inputs.dir }}
27+
git config --global --add safe.directory $GITHUB_WORKSPACE/${{ inputs.dir }}
28+
git init
29+
git remote add origin $GITHUB_SERVER_URL/${{ inputs.repository }}
30+
git fetch origin --depth 1 ${{ inputs.commit }}
31+
git checkout FETCH_HEAD
32+
33+
# Remember AWS-LC directory
34+
echo AWSLC_DIR="$GITHUB_WORKSPACE/${{ inputs.dir }}" >> $GITHUB_ENV

‎.github/workflows/all.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,21 @@ jobs:
4040
uses: ./.github/workflows/cbmc.yml
4141
secrets: inherit
4242
oqs_integration:
43-
name: Integration
43+
name: libOQS
4444
permissions:
4545
contents: 'read'
4646
id-token: 'write'
4747
needs: [ base ]
4848
uses: ./.github/workflows/integration-liboqs.yml
4949
secrets: inherit
50+
awslc_integration:
51+
name: AWS-LC
52+
permissions:
53+
contents: 'read'
54+
id-token: 'write'
55+
needs: [ base ]
56+
uses: ./.github/workflows/integration-awslc.yml
57+
secrets: inherit
5058
ct-test:
5159
name: Constant-time
5260
permissions:

‎.github/workflows/integration-awslc.yml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: AWS-LC
4+
permissions:
5+
contents: read
6+
on:
7+
workflow_dispatch:
8+
workflow_call:
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
env:
15+
AWSLC_REPO: 'aws/aws-lc'
16+
AWSLC_COMMIT: 'main'
17+
DEPENDENCIES: 'cmake golang unifdef'
18+
19+
jobs:
20+
aws_lc_integration_fips:
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
system: [ubuntu-latest, pqcp-arm64]
25+
fips: [0,1]
26+
name: AWS-LC FIPS test (${{ matrix.system }}, FIPS=${{ matrix.fips }})
27+
runs-on: ${{ matrix.system }}
28+
steps:
29+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
- uses: ./.github/actions/setup-os
31+
with:
32+
packages: ${{ env.DEPENDENCIES }}
33+
- uses: ./.github/actions/setup-aws-lc
34+
with:
35+
repository: ${{ env.AWSLC_REPO }}
36+
commit: ${{ env.AWSLC_COMMIT }}
37+
- name: Run importer
38+
run: |
39+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
40+
rm -rf mlkem
41+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
42+
- name: Build+Test AWS-LC (FIPS=${{ matrix.fips }})
43+
run: |
44+
cd $AWSLC_DIR
45+
mkdir build
46+
cd build
47+
cmake -DFIPS=${{ matrix.fips }} ..
48+
cd ..
49+
50+
cmake --build ./build --target all
51+
cmake --build ./build --target run_tests
52+
posix:
53+
# This is a partial parallelization of the run_posix_tests.sh script
54+
strategy:
55+
max-parallel: 16
56+
fail-fast: false
57+
matrix:
58+
system: [ubuntu-latest, pqcp-arm64]
59+
test:
60+
- name: Debug mode
61+
flags: -DENABLE_DILITHIUM=ON
62+
- name: Release mode
63+
flags: -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
64+
- name: Dilithium disabled
65+
flags: -DENABLE_DILITHIUM=OFF
66+
- name: Small compilation
67+
flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
68+
- name: LibSSL off.
69+
flags: -DBUILD_LIBSSL=OFF -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
70+
- name: No-ASM
71+
flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
72+
- name: Shared
73+
flags: -DBUILD_SHARED_LIBS=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
74+
- name: Pre-Gen ASM
75+
flags: -DDISABLE_PERL=ON -DENABLE_DILITHIUM=ON
76+
- name: DIT
77+
flags: -DENABLE_DATA_INDEPENDENT_TIMING=ON -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
78+
name: Posix test (${{ matrix.test.name }}, ${{ matrix.system }})
79+
runs-on: ${{ matrix.system }}
80+
steps:
81+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
82+
- uses: ./.github/actions/setup-os
83+
with:
84+
packages: ${{ env.DEPENDENCIES }}
85+
- uses: ./.github/actions/setup-aws-lc
86+
with:
87+
repository: ${{ env.AWSLC_REPO }}
88+
commit: ${{ env.AWSLC_COMMIT }}
89+
- name: Run importer
90+
run: |
91+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
92+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
93+
- name: Run test
94+
run: |
95+
cd $AWSLC_DIR
96+
source tests/ci/common_posix_setup.sh
97+
build_and_test ${{ matrix.test.flags }}
98+
prefix:
99+
# This is a parallelization of the run_prefix_tests.sh script
100+
strategy:
101+
max-parallel: 8
102+
fail-fast: false
103+
matrix:
104+
system: [ubuntu-latest, pqcp-arm64, macos-latest, macos-13]
105+
test:
106+
- name: Testing a prefix build of AWS-LC in debug mode.
107+
flags:
108+
- name: Testing a prefix build of AWS-LC in release mode.
109+
flags: -DCMAKE_BUILD_TYPE=Release
110+
- name: Testing a prefix build of AWS-LC small compilation.
111+
flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release
112+
- name: Testing a prefix build of AWS-LC in no asm mode.
113+
flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release
114+
name: Prefix test (${{ matrix.test.name }}, ${{ matrix.system }})
115+
runs-on: ${{ matrix.system }}
116+
steps:
117+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
118+
- uses: ./.github/actions/setup-os
119+
with:
120+
packages: ${{ env.DEPENDENCIES }}
121+
- uses: ./.github/actions/setup-aws-lc
122+
with:
123+
repository: ${{ env.AWSLC_REPO }}
124+
commit: ${{ env.AWSLC_COMMIT }}
125+
- name: Run importer
126+
run: |
127+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
128+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
129+
- name: Run test
130+
run: |
131+
cd $AWSLC_DIR
132+
source tests/ci/common_posix_setup.sh
133+
build_prefix_and_test ${{ matrix.flags }}

0 commit comments

Comments
 (0)