|
| 1 | +name: wolfPKCS11 Storage Format Upgrade Test (TPM) |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + branches: [ '*' ] |
| 6 | + |
| 7 | +env: |
| 8 | + WOLFSSL_VERSION: v5.8.0-stable |
| 9 | + |
| 10 | +jobs: |
| 11 | + storage-upgrade-test-tpm: |
| 12 | + runs-on: ubuntu-latest |
| 13 | + strategy: |
| 14 | + matrix: |
| 15 | + base-ref: |
| 16 | + - name: master |
| 17 | + ref: master |
| 18 | + branch-dir: master-branch |
| 19 | + - name: v1.3.0 |
| 20 | + ref: v1.3.0-stable |
| 21 | + branch-dir: v1.3.0-stable-branch |
| 22 | + |
| 23 | + steps: |
| 24 | + # Checkout the PR branch |
| 25 | + - name: Checkout PR branch |
| 26 | + uses: actions/checkout@v4 |
| 27 | + with: |
| 28 | + path: pr-branch |
| 29 | + |
| 30 | + # Checkout base branch/tag separately |
| 31 | + - name: Checkout ${{ matrix.base-ref.name }} branch |
| 32 | + uses: actions/checkout@v4 |
| 33 | + with: |
| 34 | + ref: ${{ matrix.base-ref.ref }} |
| 35 | + path: ${{ matrix.base-ref.branch-dir }} |
| 36 | + |
| 37 | + - name: Cache wolfSSL |
| 38 | + id: cache-wolfssl |
| 39 | + uses: actions/cache@v4 |
| 40 | + with: |
| 41 | + path: wolfssl |
| 42 | + key: wolfssl-${{ env.WOLFSSL_VERSION }} |
| 43 | + |
| 44 | + # Setup wolfssl (required dependency) |
| 45 | + - name: Checkout wolfssl |
| 46 | + if: steps.cache-wolfssl.outputs.cache-hit != 'true' |
| 47 | + uses: actions/checkout@v4 |
| 48 | + with: |
| 49 | + repository: wolfssl/wolfssl |
| 50 | + path: wolfssl |
| 51 | + ref: ${{ env.WOLFSSL_VERSION }} |
| 52 | + |
| 53 | + - name: Build wolfssl |
| 54 | + if: steps.cache-wolfssl.outputs.cache-hit != 'true' |
| 55 | + working-directory: ./wolfssl |
| 56 | + run: | |
| 57 | + ./autogen.sh |
| 58 | + ./configure --enable-md5 --enable-cryptocb --enable-aescfb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt \ |
| 59 | + C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT" |
| 60 | + make |
| 61 | +
|
| 62 | + - name: Install wolfssl |
| 63 | + working-directory: ./wolfssl |
| 64 | + run: | |
| 65 | + sudo make install |
| 66 | + sudo ldconfig |
| 67 | +
|
| 68 | + # Setup IBM Software TPM simulator |
| 69 | + - name: Setup IBM Software TPM |
| 70 | + run: | |
| 71 | + git clone https://github.com/kgoldman/ibmswtpm2.git |
| 72 | + cd ibmswtpm2/src |
| 73 | + make |
| 74 | + ./tpm_server & |
| 75 | + sleep 2 |
| 76 | + cd ../.. |
| 77 | +
|
| 78 | + # Build and install wolfTPM (required for TPM operations) |
| 79 | + - name: Build and install wolfTPM |
| 80 | + run: | |
| 81 | + git clone https://github.com/wolfSSL/wolftpm.git |
| 82 | + cd wolftpm |
| 83 | + ./autogen.sh |
| 84 | + ./configure --enable-swtpm --enable-debug |
| 85 | + make -j$(nproc) |
| 86 | + sudo make install |
| 87 | + sudo ldconfig |
| 88 | + cd .. |
| 89 | +
|
| 90 | + # Phase 1: Build and test base branch/tag with TPM |
| 91 | + - name: Modify pkcs11test.c for TPM storage generation |
| 92 | + working-directory: ./${{ matrix.base-ref.branch-dir }} |
| 93 | + run: | |
| 94 | + echo "=== Modifying pkcs11test.c for TPM storage generation ===" |
| 95 | + # Check if WOLFPKCS11_NO_STORE is used and change it to use token path |
| 96 | + if grep -q 'XSETENV("WOLFPKCS11_NO_STORE"' tests/pkcs11test.c; then |
| 97 | + echo "Found WOLFPKCS11_NO_STORE, changing to WOLFPKCS11_TOKEN_PATH" |
| 98 | + sed -i 's/XSETENV("WOLFPKCS11_NO_STORE", "1", 1);/XSETENV("WOLFPKCS11_TOKEN_PATH", ".\/store\/pkcs11test", 1);/' tests/pkcs11test.c |
| 99 | + else |
| 100 | + echo "WOLFPKCS11_NO_STORE not found, assuming WOLFPKCS11_TOKEN_PATH is already set" |
| 101 | + fi |
| 102 | + echo "=== pkcs11test.c modification completed ===" |
| 103 | +
|
| 104 | + - name: Build wolfPKCS11 ${{ matrix.base-ref.name }} with TPM |
| 105 | + working-directory: ./${{ matrix.base-ref.branch-dir }} |
| 106 | + run: | |
| 107 | + echo "=== Building wolfPKCS11 ${{ matrix.base-ref.name }} branch with TPM support ===" |
| 108 | + ./autogen.sh |
| 109 | + ./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE" |
| 110 | + make |
| 111 | +
|
| 112 | + - name: Run TPM tests on ${{ matrix.base-ref.name }} to generate storage files |
| 113 | + working-directory: ./${{ matrix.base-ref.branch-dir }} |
| 114 | + run: | |
| 115 | + echo "=== Running TPM tests on ${{ matrix.base-ref.name }} branch ===" |
| 116 | + # Run specific TPM tests that generate storage files |
| 117 | + ./tests/pkcs11test |
| 118 | + echo "=== ${{ matrix.base-ref.name }} branch TPM test completed ===" |
| 119 | +
|
| 120 | + # Phase 2: Build PR branch with TPM and copy storage files from base |
| 121 | + - name: Build wolfPKCS11 PR branch with TPM |
| 122 | + working-directory: ./pr-branch |
| 123 | + run: | |
| 124 | + echo "=== Building wolfPKCS11 PR branch with TPM support ===" |
| 125 | + ./autogen.sh |
| 126 | + ./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE" |
| 127 | + make |
| 128 | +
|
| 129 | + - name: Test TPM storage format compatibility (${{ matrix.base-ref.name }} → PR) |
| 130 | + working-directory: ./pr-branch |
| 131 | + run: | |
| 132 | + echo "=== Testing TPM storage format compatibility with PR branch ===" |
| 133 | + echo "This tests that the PR can read TPM storage files created by ${{ matrix.base-ref.name }} branch" |
| 134 | +
|
| 135 | + # Run the TPM-specific tests with the copied storage files |
| 136 | + echo "=== Running TPM compatibility tests ===" |
| 137 | + ./tests/pkcs11test |
| 138 | + echo "=== TPM storage format upgrade test (${{ matrix.base-ref.name }} → PR) completed successfully ===" |
| 139 | +
|
| 140 | + # Capture logs on failure with TPM-specific information |
| 141 | + - name: Upload TPM failure logs |
| 142 | + if: failure() || cancelled() |
| 143 | + uses: actions/upload-artifact@v4 |
| 144 | + with: |
| 145 | + name: tpm-storage-upgrade-test-failure-logs-${{ matrix.base-ref.name }} |
| 146 | + path: | |
| 147 | + pr-branch/test-suite.log |
| 148 | + pr-branch/config.log |
| 149 | + ${{ matrix.base-ref.branch-dir }}/test-suite.log |
| 150 | + ${{ matrix.base-ref.branch-dir }}/config.log |
| 151 | + retention-days: 5 |
| 152 | + |
| 153 | + # Clean up TPM simulator on exit |
| 154 | + - name: Cleanup TPM simulator |
| 155 | + if: always() |
| 156 | + run: | |
| 157 | + echo "=== Cleaning up TPM simulator ===" |
| 158 | + pkill -f tpm_server || echo "TPM server was not running" |
0 commit comments