Skip to content

Commit c26c178

Browse files
hanno-beckerhanno-becker
committed
Add basic AWS-LC integration test
This commit extends the CI with an integration test for AWS-LC. The CI checks that mlkem-native successfully integrates into AWS-LC by building and running basic tests of AWS-LC in FIPS and non-FIPS mode. Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
1 parent e00101e commit c26c178

3 files changed

Lines changed: 180 additions & 1 deletion

File tree

‎.github/actions/setup-aws-lc/action.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Setup AWS-LC
4+
description: Setup AWS-LC
5+
6+
inputs:
7+
dir:
8+
description: Directory to fetch AWS-LC into
9+
default: 'AWS-LC'
10+
repository:
11+
description: Repository to fetch from
12+
default: 'aws/AWS-LC'
13+
commit:
14+
description: Commit to fetch
15+
default: 'HEAD'
16+
gh_token:
17+
description: Github access token to use
18+
required: true
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- name: Fetch AWS-LC
24+
shell: bash
25+
run: |
26+
mkdir ${{ inputs.dir }} && cd ${{ inputs.dir }}
27+
git config --global --add safe.directory $GITHUB_WORKSPACE/${{ inputs.dir }}
28+
git init
29+
git remote add origin $GITHUB_SERVER_URL/${{ inputs.repository }}
30+
git fetch origin --depth 1 ${{ inputs.commit }}
31+
git checkout FETCH_HEAD
32+
33+
# Remember AWS-LC directory
34+
echo AWSLC_DIR="$GITHUB_WORKSPACE/${{ inputs.dir }}" >> $GITHUB_ENV

‎.github/workflows/all.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,21 @@ jobs:
4040
uses: ./.github/workflows/cbmc.yml
4141
secrets: inherit
4242
oqs_integration:
43-
name: Integration
43+
name: libOQS
4444
permissions:
4545
contents: 'read'
4646
id-token: 'write'
4747
needs: [ base ]
4848
uses: ./.github/workflows/integration-liboqs.yml
4949
secrets: inherit
50+
awslc_integration:
51+
name: AWS-LC
52+
permissions:
53+
contents: 'read'
54+
id-token: 'write'
55+
needs: [ base ]
56+
uses: ./.github/workflows/integration-awslc.yml
57+
secrets: inherit
5058
ct-test:
5159
name: Constant-time
5260
permissions:

‎.github/workflows/integration-awslc.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: AWS-LC
4+
permissions:
5+
contents: read
6+
on:
7+
workflow_dispatch:
8+
push:
9+
branches: ["main"]
10+
pull_request:
11+
branches: ["main"]
12+
types: [ "opened", "synchronize" ]
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
env:
19+
AWSLC_REPO: 'aws/aws-lc'
20+
AWSLC_COMMIT: 'main'
21+
DEPENDENCIES: 'cmake golang unifdef'
22+
23+
jobs:
24+
aws_lc_integration_fips:
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
system: [ubuntu-latest, pqcp-arm64]
29+
fips: [0,1]
30+
name: AWS-LC FIPS test (${{ matrix.system }}, FIPS=${{ matrix.fips }})
31+
runs-on: ${{ matrix.system }}
32+
steps:
33+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
- uses: ./.github/actions/setup-os
35+
with:
36+
packages: ${{ env.DEPENDENCIES }}
37+
- uses: ./.github/actions/setup-aws-lc
38+
with:
39+
repository: ${{ env.AWSLC_REPO }}
40+
commit: ${{ env.AWSLC_COMMIT }}
41+
- name: Run importer
42+
run: |
43+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
44+
rm -rf mlkem
45+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
46+
- name: Build+Test AWS-LC (FIPS=${{ matrix.fips }})
47+
run: |
48+
cd $AWSLC_DIR
49+
mkdir build
50+
cd build
51+
cmake -DFIPS=${{ matrix.fips }} ..
52+
cd ..
53+
54+
cmake --build ./build --target all
55+
cmake --build ./build --target run_tests
56+
posix:
57+
# This is a partial parallelization of the run_posix_tests.sh script
58+
strategy:
59+
max-parallel: 16
60+
fail-fast: false
61+
matrix:
62+
system: [ubuntu-latest, pqcp-arm64]
63+
test:
64+
- name: Debug mode
65+
flags: -DENABLE_DILITHIUM=ON
66+
- name: Release mode
67+
flags: -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
68+
- name: Dilithium disabled
69+
flags: -DENABLE_DILITHIUM=OFF
70+
- name: Small compilation
71+
flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
72+
- name: LibSSL off.
73+
flags: -DBUILD_LIBSSL=OFF -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
74+
- name: No-ASM
75+
flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
76+
- name: Shared
77+
flags: -DBUILD_SHARED_LIBS=1 -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
78+
- name: Pre-Gen ASM
79+
flags: -DDISABLE_PERL=ON -DENABLE_DILITHIUM=ON
80+
- name: DIT
81+
flags: -DENABLE_DATA_INDEPENDENT_TIMING=ON -DCMAKE_BUILD_TYPE=Release -DENABLE_DILITHIUM=ON
82+
name: Posix test (${{ matrix.test.name }}, ${{ matrix.system }})
83+
runs-on: ${{ matrix.system }}
84+
steps:
85+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
86+
- uses: ./.github/actions/setup-os
87+
with:
88+
packages: ${{ env.DEPENDENCIES }}
89+
- uses: ./.github/actions/setup-aws-lc
90+
with:
91+
repository: ${{ env.AWSLC_REPO }}
92+
commit: ${{ env.AWSLC_COMMIT }}
93+
- name: Run importer
94+
run: |
95+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
96+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
97+
- name: Run test
98+
run: |
99+
cd $AWSLC_DIR
100+
source tests/ci/common_posix_setup.sh
101+
build_and_test ${{ matrix.test.flags }}
102+
prefix:
103+
# This is a parallelization of the run_prefix_tests.sh script
104+
strategy:
105+
max-parallel: 8
106+
fail-fast: false
107+
matrix:
108+
system: [ubuntu-latest, pqcp-arm64, macos-latest, macos-13]
109+
test:
110+
- name: Testing a prefix build of AWS-LC in debug mode.
111+
flags:
112+
- name: Testing a prefix build of AWS-LC in release mode.
113+
flags: -DCMAKE_BUILD_TYPE=Release
114+
- name: Testing a prefix build of AWS-LC small compilation.
115+
flags: -DOPENSSL_SMALL=1 -DCMAKE_BUILD_TYPE=Release
116+
- name: Testing a prefix build of AWS-LC in no asm mode.
117+
flags: -DOPENSSL_NO_ASM=1 -DCMAKE_BUILD_TYPE=Release
118+
name: Prefix test (${{ matrix.test.name }}, ${{ matrix.system }})
119+
runs-on: ${{ matrix.system }}
120+
steps:
121+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
122+
- uses: ./.github/actions/setup-os
123+
with:
124+
packages: ${{ env.DEPENDENCIES }}
125+
- uses: ./.github/actions/setup-aws-lc
126+
with:
127+
repository: ${{ env.AWSLC_REPO }}
128+
commit: ${{ env.AWSLC_COMMIT }}
129+
- name: Run importer
130+
run: |
131+
cd $AWSLC_DIR/crypto/fipsmodule/ml_kem
132+
GITHUB_REPOSITORY=$GITHUB_REPOSITORY GITHUB_SHA=$GITHUB_SHA ./importer.sh --force
133+
- name: Run test
134+
run: |
135+
cd $AWSLC_DIR
136+
source tests/ci/common_posix_setup.sh
137+
build_prefix_and_test ${{ matrix.flags }}

0 commit comments

Comments
 (0)