Merge pull request #902 from pq-code-package/slothy-ortools_9_12

SLOTHY: Update ortools to 9.12 + LLVM nix clean-up

Author: hanno-becker

.github/actions/functest/action.yml

@@ -46,6 +46,9 @@ inputs:
   examples:
     description: Determine whether to run examples or not
     default: "true"
+  check_namespace:
+    description: Determine whether to check namespacing or not
+    default: "true"
 runs:
   using: composite
   steps:
@@ -95,6 +98,7 @@ runs:
           make clean
           ./scripts/tests all --exec-wrapper="${{ inputs.exec_wrapper }}" --cross-prefix="${{ inputs.cross_prefix }}" --cflags="${{ inputs.cflags }}" --opt=${{ inputs.opt }} --${{ env.FUNC }} --${{ env.KAT }} --${{ env.NISTKAT }} --${{ env.ACVP }} --${{ env.EXAMPLES }} -v
       - name: Check namespacing ${{ env.MODE }} ${{ inputs.opt }} tests (${{ env.FUNC }}, ${{ env.KAT }}, ${{ env.NISTKAT }}, ${{ env.EXAMPLES }})
+        if: ${{ inputs.check_namespace == 'true' }}
         shell: ${{ env.SHELL }}
         run: |
           ./scripts/check-namespace

.github/actions/multi-functest/action.yml

@@ -43,6 +43,9 @@ inputs:
   examples:
     description: Determine whether to run examples or not
     default: "true"
+  check_namespace:
+    description: Determine whether to check namespacing or not
+    default: "true"
 runs:
   using: composite
   steps:
@@ -62,6 +65,7 @@ runs:
           nistkat: ${{ inputs.nistkat }}
           acvp: ${{ inputs.acvp }}
           examples: ${{ inputs.examples }}
+          check_namespace: ${{ inputs.check_namespace }}
       - name: Cross x86_64 Tests
         if: ${{ (inputs.compile_mode == 'all' || inputs.compile_mode == 'cross-x86_64') && (success() || failure()) }}
         uses: ./.github/actions/functest
@@ -80,6 +84,7 @@ runs:
           nistkat: ${{ inputs.nistkat }}
           acvp: ${{ inputs.acvp }}
           examples: ${{ inputs.examples }}
+          check_namespace: ${{ inputs.check_namespace }}
       - name: Cross aarch64 Tests
         if: ${{ (inputs.compile_mode == 'all' || inputs.compile_mode == 'cross-aarch64') && (success() || failure()) }}
         uses: ./.github/actions/functest
@@ -98,6 +103,7 @@ runs:
           nistkat: ${{ inputs.nistkat }}
           acvp: ${{ inputs.acvp }}
           examples: ${{ inputs.examples }}
+          check_namespace: ${{ inputs.check_namespace }}
       - name: Cross aarch64_be Tests
         if: ${{ (inputs.compile_mode == 'all' || inputs.compile_mode == 'cross-aarch64_be') && (success() || failure()) }}
         uses: ./.github/actions/functest
@@ -116,6 +122,7 @@ runs:
           nistkat: ${{ inputs.nistkat }}
           acvp: ${{ inputs.acvp }}
           examples: ${{ inputs.examples }}
+          check_namespace: ${{ inputs.check_namespace }}
       - name: Cross riscv64 Tests
         if: ${{ (inputs.compile_mode == 'all' || inputs.compile_mode == 'cross-riscv64') && (success() || failure()) }}
         uses: ./.github/actions/functest
@@ -134,3 +141,4 @@ runs:
           nistkat: ${{ inputs.nistkat }}
           acvp: ${{ inputs.acvp }}
           examples: ${{ inputs.examples }}
+          check_namespace: ${{ inputs.check_namespace }}

.github/workflows/ci.yml

@@ -110,6 +110,7 @@ jobs:
           gh_token: ${{ secrets.GITHUB_TOKEN }}
           compile_mode: native
           cflags: "-DMLKEM_DEBUG -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
+          check_namespace: 'false'
   backend_tests:
     name: AArch64 FIPS202 backends (${{ matrix.backend }})
     strategy:
@@ -129,6 +130,7 @@ jobs:
           opt: 'opt'
           examples: 'false'
           cflags: "-DMLKEM_DEBUG -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all -DMLK_FORCE_AARCH64 -DMLK_FIPS202_BACKEND_FILE=\\\\\\\"fips202/native/aarch64/${{ matrix.backend }}.h\\\\\\\""
+          check_namespace: 'false'
   compiler_tests:
     name: Compiler tests  (${{ matrix.compiler.name }}, ${{ matrix.target.name }})
     strategy:

mlkem/debug.h

@@ -59,7 +59,7 @@ void mlk_debug_check_bounds(const char *file, int line, const int16_t *ptr,
  * value_ub: Exclusive upper value bound */
 #define mlk_assert_bound(ptr, len, value_lb, value_ub)                      \
   mlk_debug_check_bounds(__FILE__, __LINE__, (const int16_t *)(ptr), (len), \
-                         (value_lb)-1, (value_ub))
+                         (value_lb) - 1, (value_ub))
 
 /* Check absolute bounds in array of int16_t's
  * ptr: Base of array, expression of type int16_t*

nix/slothy/default.nix

@@ -2,10 +2,9 @@
 
 { stdenvNoCC
 , fetchFromGitHub
-, python311
+, python312
 , pkgs
-, callPackage
-, python311Packages
+, python312Packages
 , fetchPypi
 , stdenv
 , cmake
@@ -16,54 +15,87 @@
 
 
 let
-  ortools97 = python311Packages.buildPythonPackage rec {
+  # TODO: switch to protobuf from nixpkgs
+  # ortools 9.12 requires protobuf >= 5.29.3 - currently nixpkgs 24.11 has
+  # protobuf 5.28.3
+  protobuf_6_30_1 = python312Packages.buildPythonPackage rec {
+    pname = "protobuf";
+    version = "6.30.1";
+
+    propagatedBuildInputs = [
+      python312Packages.setuptools
+    ];
+
+    build-system = with python312Packages; [
+      setuptools
+    ];
+
+    dontConfigure = true;
+    nativeBuildInputs =
+      [
+        cmake
+        pkg-config
+      ];
+
+    src = fetchPypi {
+      inherit pname version;
+      hash = "sha256-U1+05E0CNok9XPEmOg9wbxFgtomnq5YunaipzkBQt4A=";
+    };
+  };
+
+
+  ortools912 = python312Packages.buildPythonPackage rec {
     pname = "ortools";
-    version = "9.7.2996";
+    version = "9.12.4544";
 
     format = "wheel";
 
     src = fetchPypi {
       inherit pname version;
       format = "wheel";
-      dist = "cp311";
-      python = "cp311";
-      abi = "cp311";
+      dist = "cp312";
+      python = "cp312";
+      abi = "cp312";
       platform =
         if stdenv.isDarwin then
           if stdenv.isAarch64 then "macosx_11_0_arm64"
           else "macosx_10_15_x86_64"
         else if stdenv.isLinux then
-          if stdenv.isAarch64 then "manylinux_2_17_aarch64.manylinux2014_aarch64"
-          else "manylinux_2_17_x86_64.manylinux2014_x86_64"
+          if stdenv.isAarch64 then "manylinux_2_27_aarch64.manylinux_2_28_aarch64"
+          else "manylinux_2_27_x86_64.manylinux_2_28_x86_64"
         else throw "Unsupported platform";
 
       hash =
         if stdenv.isDarwin then
-          if stdenv.isAarch64 then "sha256-Oc8xz9iRuOiDyZBc85qlS57u0efP/f4cDpi2k9ZlCQI="
-          else "sha256-0ax/I7604BumV+VRV7Y5fNDs0XrxkK+ocr9yU1oFMDQ="
+          if stdenv.isAarch64 then "sha256-Z/4bhlMndFZ4okBm2CbbJaEBmqIH6pAXygGvLPIUVlI="
+          else "sha256-FnaLGfyzBT9EvYTEYMuXjyop1046XZugYSNYn+sQrxI="
         else if stdenv.isLinux then
-          if stdenv.isAarch64 then "sha256-B8QfDoYT2OxrpoUzSQTNduRbxG2j1S8XPpMBZo/yI90="
-          else "sha256-pUerlb2cykE9cYraz68MnuBKDM4V1Du0Ta3yve16K/o="
+          if stdenv.isAarch64 then "sha256-VVD+nuVSt7jtAcrZHVimjsDkjNQN0necELGZFCmncFg="
+          else "sha256-kiEh1vSPjuseuIqMZF/wC2H2CFYxkxTOK48iD6uJYIM="
         else throw "Unsupported platform";
     };
 
-    propagatedBuildInputs = with python311Packages; [
+    propagatedBuildInputs = with python312Packages; [
       numpy
       pandas
-      protobuf
+      protobuf_6_30_1
     ];
 
   };
 
-  unicorn_2_1_3 = python311Packages.buildPythonPackage rec {
+  # TODO: switch to unicorn from nixpkgs
+  # nixpkgs 24.11 currently has 2.1.1 - we are experiencing some issues with 
+  # that version on MacOS. 2.1.2/2.1.3 (and also some older versions) don't 
+  # have that problem
+  unicorn_2_1_3 = python312Packages.buildPythonPackage rec {
     pname = "unicorn";
     version = "2.1.3";
 
     propagatedBuildInputs = [
-      python311Packages.setuptools
+      python312Packages.setuptools
     ];
 
-    build-system = with python311Packages; [
+    build-system = with python312Packages; [
       setuptools
     ];
 
@@ -80,8 +112,8 @@ let
     };
   };
 
-  pythonEnv = python311.withPackages (ps: with ps; [
-    ortools97
+  pythonEnv = python312.withPackages (ps: with ps; [
+    ortools912
     sympy
     unicorn_2_1_3
   ]);

nix/util.nix

@@ -17,7 +17,7 @@ rec {
 
   native-gcc =
     if pkgs.stdenv.isDarwin
-    then pkgs.clang_15
+    then pkgs.clang_16
     else wrap-gcc pkgs;
 
   # cross is for determining whether to install the cross toolchain dependencies or not
@@ -74,10 +74,10 @@ rec {
     name = "pqcp-linters";
     paths = builtins.attrValues {
       clang-tools = pkgs.clang-tools.overrideAttrs {
-        unwrapped = pkgs.llvmPackages_17.clang-unwrapped;
+        unwrapped = pkgs.llvmPackages_18.clang-unwrapped;
       };
 
-      inherit (pkgs.llvmPackages_17)
+      inherit (pkgs.llvmPackages_18)
         bintools;
 
       inherit (pkgs)