Skip to content

Commit ff61212

Browse files
aidangarskeaidangarske
committed
ci: honest wolfssl version resolution + fix sanitizer WOLFSSL_CONFIG_CFLAGS
Two real bugs the latest sanitizer + osp-version failures surfaced. Sanitizer build failure ======================= sanitizers.yml's overridden WOLFSSL_CONFIG_CFLAGS dropped all the defaults that scripts/utils-wolfssl.sh would have provided when the env var is unset. wolfprov then built without -DWC_RSA_NO_PADDING and the compiler treated wc_RsaDirect as an implicit declaration: src/wp_rsa_sig.c:817: error: implicit declaration of function 'wc_RsaDirect'; did you mean 'wc_ReadDirNext'? Fix: spell out the defaults explicitly in the workflow and append the sanitizer flags. (Keep this in sync with the default in scripts/utils-wolfssl.sh -- if that default changes, the workflow needs to track it.) wolfssl_ref now reflects the actual .deb on ghcr ================================================ The old _discover-versions.yml computed wolfssl_ref via `git ls-remote upstream wolfssl/wolfssl 'v*-stable'`. That gives "what's the latest -stable tag" (v5.9.1-stable today), but the OSP workflows install the wolfprov .deb on ghcr.io which Jenkins built against a different tag (v5.8.4-stable today). The matrix label lied. _discover-versions.yml now probes the actual non-FIPS .deb: oras pull ghcr.io/wolfssl/wolfprovider/debs:nonfips -> parse libwolfssl_<VER>+...amd64.deb filename for VER -> wolfssl_ref = "v<VER>-stable" Two outputs now: wolfssl_ref / wolfssl_ref_array Actual version installed by the wolfprov .deb on ghcr. Used by the 40 OSP workflows (they use the .deb). wolfssl_latest_ref / wolfssl_latest_ref_array Latest upstream v*-stable tag. Used by source-built workflows (smoke, simple, sanitizers, libtss2, cmdline, seed-src, openssl-version) that clone wolfssl from git. If the .deb probe fails (network blip, packages-read scope missing on a fork PR token, future filename change), the resolver falls back to upstream-latest with a ::warning:: so it's visible in the run log. Updates to consumer workflows: simple, smoke-test, libtss2, sanitizers, cmdline, seed-src, openssl-version -> switch from wolfssl_ref to wolfssl_latest_ref
1 parent b5c4358 commit ff61212

8 files changed

Lines changed: 126 additions & 49 deletions

File tree

‎.github/workflows/_discover-versions.yml‎

Lines changed: 93 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,48 @@
11
name: Discover wolfSSL + OpenSSL versions
22

33
# Reusable workflow that resolves at run time:
4-
# - latest wolfSSL v*-stable tag (from upstream wolfssl/wolfssl)
5-
# - Debian Bookworm's stock OpenSSL version (matches what the
6-
# wolfprov-patched .deb on ghcr.io was built against)
74
#
8-
# Consumers use these outputs to populate matrix values so the
9-
# matrix labels honestly reflect what the test actually installed.
10-
# Today: latest -> v5.8.4-stable, openssl -> 3.0.20 (Bookworm stock).
11-
# When Bookworm bumps OpenSSL or wolfSSL ships a new -stable, the
12-
# resolver picks it up without a CI edit.
5+
# wolfssl_ref / wolfssl_ref_array -- "what's the actual wolfSSL
6+
# version installed by the wolfprov .deb on ghcr.io". Probes the
7+
# deb itself so the matrix label matches what's tested, not what
8+
# upstream wolfSSL last tagged.
9+
#
10+
# wolfssl_latest_ref -- "what's the latest v*-stable
11+
# tag upstream has". For source-built workflows (smoke, simple,
12+
# sanitizers, libtss2) that pull wolfSSL from git directly.
13+
#
14+
# openssl_ref / openssl_ref_array -- Debian Bookworm's stock
15+
# OpenSSL version (matches the wolfprov-patched .deb).
16+
#
17+
# openssl_latest_ref / *_array -- Latest upstream openssl-3.x.y
18+
# release tag. For source-built workflows.
19+
#
20+
# openssl_all_releases_array -- Every upstream openssl-3.X.Y
21+
# release tag, sorted. Used by openssl-version.yml.
1322

1423
on:
1524
workflow_call:
1625
outputs:
1726
wolfssl_ref:
18-
description: 'Plain string, latest -stable e.g. v5.8.4-stable'
27+
description: 'Plain string, actual wolfSSL version in the wolfprov nonfips .deb on ghcr (e.g. v5.8.4-stable)'
1928
value: ${{ jobs.discover.outputs.wolfssl_ref }}
2029
wolfssl_ref_array:
21-
description: 'JSON array of master + latest -stable for matrix use'
30+
description: 'JSON array of master + actual .deb wolfssl ref for matrix use'
2231
value: ${{ jobs.discover.outputs.wolfssl_ref_array }}
32+
wolfssl_latest_ref:
33+
description: 'Plain string, latest v*-stable tag upstream wolfssl has'
34+
value: ${{ jobs.discover.outputs.wolfssl_latest_ref }}
35+
wolfssl_latest_ref_array:
36+
description: 'JSON array form: master + latest upstream stable'
37+
value: ${{ jobs.discover.outputs.wolfssl_latest_ref_array }}
2338
openssl_ref:
2439
description: 'Plain string. Bookworm stock OpenSSL (matches the wolfprov .deb).'
2540
value: ${{ jobs.discover.outputs.openssl_ref }}
2641
openssl_ref_array:
2742
description: 'JSON array form of openssl_ref'
2843
value: ${{ jobs.discover.outputs.openssl_ref_array }}
2944
openssl_latest_ref:
30-
description: 'Plain string, latest upstream openssl-3.x.y release tag (e.g. openssl-3.5.4)'
45+
description: 'Plain string, latest upstream openssl-3.x.y release tag (e.g. openssl-3.6.2)'
3146
value: ${{ jobs.discover.outputs.openssl_latest_ref }}
3247
openssl_latest_ref_array:
3348
description: 'JSON array form of openssl_latest_ref'
@@ -40,35 +55,84 @@ jobs:
4055
discover:
4156
name: Resolve wolfSSL + OpenSSL refs
4257
runs-on: ubuntu-latest
43-
timeout-minutes: 5
58+
timeout-minutes: 10
59+
permissions:
60+
contents: read
61+
packages: read
4462
outputs:
4563
wolfssl_ref: ${{ steps.resolve.outputs.wolfssl_ref }}
4664
wolfssl_ref_array: ${{ steps.resolve.outputs.wolfssl_ref_array }}
65+
wolfssl_latest_ref: ${{ steps.resolve.outputs.wolfssl_latest_ref }}
66+
wolfssl_latest_ref_array: ${{ steps.resolve.outputs.wolfssl_latest_ref_array }}
4767
openssl_ref: ${{ steps.resolve.outputs.openssl_ref }}
4868
openssl_ref_array: ${{ steps.resolve.outputs.openssl_ref_array }}
4969
openssl_latest_ref: ${{ steps.resolve.outputs.openssl_latest_ref }}
5070
openssl_latest_ref_array: ${{ steps.resolve.outputs.openssl_latest_ref_array }}
5171
openssl_all_releases_array: ${{ steps.resolve.outputs.openssl_all_releases_array }}
5272
steps:
73+
- name: Install ORAS
74+
run: |
75+
set -euo pipefail
76+
ORAS_VERSION="1.2.2"
77+
curl -fsSLO "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_amd64.tar.gz"
78+
tar xzf "oras_${ORAS_VERSION}_linux_amd64.tar.gz" oras
79+
sudo mv oras /usr/local/bin/oras
80+
rm -f "oras_${ORAS_VERSION}_linux_amd64.tar.gz"
81+
oras version
82+
83+
- name: Login to ghcr.io (best-effort)
84+
continue-on-error: true
85+
run: |
86+
echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io \
87+
--username "${{ github.actor }}" --password-stdin
88+
5389
- name: Resolve versions
5490
id: resolve
5591
run: |
5692
set -euo pipefail
5793
58-
# ---- wolfSSL: highest v*-stable tag from upstream ----
59-
WOLFSSL=$(git ls-remote --tags --refs https://github.com/wolfSSL/wolfssl.git 'v*-stable' \
60-
| awk -F/ '{print $NF}' | sort -V | tail -n 1)
61-
if [ -z "${WOLFSSL:-}" ]; then
94+
# ---- wolfSSL: probe the actual .deb on ghcr.io ----
95+
# The wolfprov non-FIPS .deb embeds the wolfSSL version in
96+
# its filename (e.g. libwolfssl_5.8.4+commercial...amd64.deb).
97+
# Pulling the .deb is the only honest way to know which
98+
# wolfSSL the OSP workflows actually link against, because
99+
# Jenkins (not this PR) chooses the source ref it builds from.
100+
WOLFSSL_DEB_REF=""
101+
PROBE_DIR=$(mktemp -d)
102+
if oras pull ghcr.io/wolfssl/wolfprovider/debs:nonfips -o "$PROBE_DIR" >/dev/null 2>&1; then
103+
DEB_FILE=$(find "$PROBE_DIR" -name 'libwolfssl_*.deb' | head -1)
104+
if [ -n "${DEB_FILE:-}" ]; then
105+
# libwolfssl_5.8.4+commercial.fips.linuxv5.2.4+1_amd64.deb
106+
# -> 5.8.4
107+
VER=$(basename "$DEB_FILE" \
108+
| sed -E 's|^libwolfssl_([0-9]+\.[0-9]+\.[0-9]+).*|\1|')
109+
if [ -n "$VER" ]; then
110+
WOLFSSL_DEB_REF="v${VER}-stable"
111+
fi
112+
fi
113+
fi
114+
rm -rf "$PROBE_DIR"
115+
116+
# ---- wolfSSL: latest -stable tag upstream has ----
117+
# Used by workflows that build wolfSSL from source.
118+
WOLFSSL_LATEST=$(git ls-remote --tags --refs https://github.com/wolfSSL/wolfssl.git 'v*-stable' \
119+
| awk -F/ '{print $NF}' | sort -V | tail -n 1)
120+
if [ -z "${WOLFSSL_LATEST:-}" ]; then
62121
echo "::error::Could not resolve latest wolfSSL -stable tag"
63122
exit 1
64123
fi
65124
125+
# If the .deb probe failed (no auth, or .deb naming changed),
126+
# fall back to the upstream-latest value so downstream jobs
127+
# still have a valid ref to use. Log loud so we notice.
128+
if [ -z "${WOLFSSL_DEB_REF:-}" ]; then
129+
echo "::warning::Could not probe wolfssl version from ghcr .deb; falling back to upstream latest ($WOLFSSL_LATEST). Matrix label may not match the actual installed library."
130+
WOLFSSL_DEB_REF="$WOLFSSL_LATEST"
131+
fi
132+
66133
# ---- OpenSSL (Debian Bookworm stock) ----
67134
# The wolfprov-patched .deb on ghcr.io is built by patching
68-
# Bookworm's stock libssl3 source, so this is the actual
69-
# OpenSSL the Debian-container workflows end up linking against.
70-
# Use docker to ask Bookworm's apt directly, then strip the
71-
# Debian revision (3.0.20-1~deb12u1 -> 3.0.20).
135+
# Bookworm's stock libssl3 source. Ask Bookworm's apt directly.
72136
OSSL_RAW=$(docker run --rm debian:bookworm sh -c \
73137
'apt-get update -qq >/dev/null 2>&1 && apt-cache madison openssl | head -1' \
74138
| awk '{print $3}')
@@ -79,12 +143,6 @@ jobs:
79143
OSSL=$(echo "$OSSL_RAW" | sed 's/-.*//')
80144
81145
# ---- OpenSSL (all upstream release tags, sorted) ----
82-
# Used by openssl-version.yml so the sweep tracks upstream
83-
# automatically as new releases ship. Release-shaped only:
84-
# openssl-X.Y.Z, no -alpha/-beta/-pre. Floored at the
85-
# historical oldest-supported version below so we don't
86-
# silently re-introduce coverage of openssl-3.0.0/3.0.1/3.0.2
87-
# that the static matrix used to exclude.
88146
OSSL_FLOOR="openssl-3.0.3"
89147
OSSL_ALL=$(git ls-remote --tags --refs https://github.com/openssl/openssl.git 'openssl-3.*' \
90148
| awk -F/ '{print $NF}' \
@@ -95,21 +153,20 @@ jobs:
95153
echo "::error::Could not resolve upstream OpenSSL release tags (floor=$OSSL_FLOOR)"
96154
exit 1
97155
fi
98-
# JSON array. jq -R reads each line as a string, -s collects
99-
# them into an array, -c emits compact single-line JSON.
100156
OSSL_ALL_JSON=$(printf '%s\n' "$OSSL_ALL" | jq -R . | jq -s -c .)
101-
# Highest version (last after sort -V) is the resolved
102-
# "latest" used by source-built workflows.
103157
OSSL_LATEST=$(echo "$OSSL_ALL" | tail -n 1)
104158
105-
echo "wolfSSL latest -stable: $WOLFSSL (also testing master)"
106-
echo "Bookworm OpenSSL: openssl-$OSSL (raw: $OSSL_RAW)"
107-
echo "Upstream OpenSSL latest: $OSSL_LATEST"
108-
echo "Upstream OpenSSL releases ($(echo "$OSSL_ALL" | wc -l) tags)"
159+
echo "wolfSSL .deb ref (actual ghcr deb): $WOLFSSL_DEB_REF"
160+
echo "wolfSSL upstream latest -stable: $WOLFSSL_LATEST"
161+
echo "OpenSSL Bookworm stock: openssl-$OSSL (raw: $OSSL_RAW)"
162+
echo "OpenSSL upstream latest: $OSSL_LATEST"
163+
echo "OpenSSL upstream releases tracked: $(echo "$OSSL_ALL" | wc -l) tags"
109164
110165
{
111-
echo "wolfssl_ref=$WOLFSSL"
112-
echo "wolfssl_ref_array=[\"master\",\"$WOLFSSL\"]"
166+
echo "wolfssl_ref=$WOLFSSL_DEB_REF"
167+
echo "wolfssl_ref_array=[\"master\",\"$WOLFSSL_DEB_REF\"]"
168+
echo "wolfssl_latest_ref=$WOLFSSL_LATEST"
169+
echo "wolfssl_latest_ref_array=[\"master\",\"$WOLFSSL_LATEST\"]"
113170
echo "openssl_ref=openssl-$OSSL"
114171
echo "openssl_ref_array=[\"openssl-$OSSL\"]"
115172
echo "openssl_latest_ref=$OSSL_LATEST"

‎.github/workflows/cmdline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
openssl_ref:
4242
- master
4343
- ${{ needs.discover_versions.outputs.openssl_latest_ref }}
44-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
44+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
4545
debug: ['WOLFPROV_DEBUG=1', '']
4646
# force_fail collapsed into sequential test runs below
4747
steps:

‎.github/workflows/libtss2.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
fail-fast: false
2626
matrix:
2727
tpm2_tss_ref: [ '4.1.3']
28-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
28+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
2929
openssl_ref: ${{ fromJson(needs.discover_versions.outputs.openssl_latest_ref_array) }}
3030
replace_default: [ true ]
3131
env:

‎.github/workflows/openssl-version.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
strategy:
2727
fail-fast: false
2828
matrix:
29-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
29+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
3030
# Every upstream openssl-3.X.Y release tag, resolved at run time
3131
# by _discover-versions.yml. New release ships -> next run picks
3232
# it up automatically; no PR needed to track the latest patch.

‎.github/workflows/sanitizers.yml‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
fail-fast: false
5151
matrix:
5252
# Test master + latest-stable (resolved at run time).
53-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
53+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
5454
env:
5555
# Surface every report. halt_on_error=1 fails the first time we
5656
# touch UB so we don't drown in cascades.
@@ -76,16 +76,36 @@ jobs:
7676
# Static libasan so the wolfProvider .so embeds it; otherwise
7777
# the runtime needs LD_PRELOAD and ordering issues bite.
7878
SAN_FLAGS: "-fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all -g"
79-
SAN_LDFLAGS: "-fsanitize=address,undefined -static-libasan"
8079
OPENSSL_CFLAGS: "-fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all -g -static-libasan"
8180
OPENSSL_CXXFLAGS: "-fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all -g -static-libasan"
8281
OPENSSL_LDFLAGS: "-fsanitize=address,undefined -static-libasan"
8382
run: |
84-
# wolfSSL and wolfProvider build scripts accept _CONFIG_CFLAGS
85-
# via env; append the sanitizer flags so all three layers
86-
# (OpenSSL, wolfSSL, wolfProvider) get instrumented.
87-
export WOLFSSL_CONFIG_CFLAGS="${WOLFSSL_CONFIG_CFLAGS:-} ${SAN_FLAGS}"
88-
export WOLFPROV_CONFIG_CFLAGS="${WOLFPROV_CONFIG_CFLAGS:-} ${SAN_FLAGS}"
83+
# The wolfSSL build script (scripts/utils-wolfssl.sh) treats
84+
# WOLFSSL_CONFIG_CFLAGS as a full override -- it only applies
85+
# the in-script default when the env var is unset/empty. So we
86+
# have to spell out the defaults explicitly here or wolfprov
87+
# ends up missing -DWC_RSA_NO_PADDING and the build fails with
88+
# "implicit declaration of wc_RsaDirect".
89+
#
90+
# Keep this in sync with the default in scripts/utils-wolfssl.sh.
91+
OPENSSL_INSTALL_DIR="${GITHUB_WORKSPACE}/openssl-install"
92+
export WOLFSSL_CONFIG_CFLAGS="\
93+
-I${OPENSSL_INSTALL_DIR}/include \
94+
-DWC_RSA_NO_PADDING \
95+
-DWOLFSSL_PUBLIC_MP \
96+
-DHAVE_PUBLIC_FFDHE \
97+
-DHAVE_FFDHE_6144 \
98+
-DHAVE_FFDHE_8192 \
99+
-DWOLFSSL_PSS_LONG_SALT \
100+
-DWOLFSSL_PSS_SALT_LEN_DISCOVER \
101+
-DRSA_MIN_SIZE=1024 \
102+
-DWOLFSSL_OLD_OID_SUM \
103+
${SAN_FLAGS}"
104+
105+
# wolfprov's default WOLFPROV_CONFIG_CFLAGS is empty and the
106+
# script appends its own -D defines after this override, so
107+
# only the sanitizer flags are needed here.
108+
export WOLFPROV_CONFIG_CFLAGS="${SAN_FLAGS}"
89109
90110
OPENSSL_TAG=${{ needs.discover_versions.outputs.openssl_latest_ref }} \
91111
WOLFSSL_TAG=${{ matrix.wolfssl_ref }} \

‎.github/workflows/seed-src.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
strategy:
3939
fail-fast: false
4040
matrix:
41-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
41+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
4242
openssl_ref:
4343
- ${{ needs.discover_versions.outputs.openssl_latest_ref }}
4444
- openssl-3.0.17

‎.github/workflows/simple.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
# 2 wolfssl (master + latest-stable, resolved at run time) x
4242
# 2 openssl (latest upstream release + oldest 3.0.x LTS)
4343
# x 2 replace-default = 8 jobs.
44-
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_ref_array) }}
44+
wolfssl_ref: ${{ fromJson(needs.discover_versions.outputs.wolfssl_latest_ref_array) }}
4545
openssl_ref:
4646
- ${{ needs.discover_versions.outputs.openssl_latest_ref }}
4747
- openssl-3.0.17

‎.github/workflows/smoke-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
- name: Build and test wolfProvider
6060
run: |
6161
# Substitute the resolved latest-stable for the "stable" matrix row.
62-
WOLFSSL_TAG="${{ matrix.wolfssl_ref || needs.discover_versions.outputs.wolfssl_ref }}"
62+
WOLFSSL_TAG="${{ matrix.wolfssl_ref || needs.discover_versions.outputs.wolfssl_latest_ref }}"
6363
OPENSSL_TAG=${{ needs.discover_versions.outputs.openssl_latest_ref }} \
6464
WOLFSSL_TAG="$WOLFSSL_TAG" \
6565
./scripts/build-wolfprovider.sh

0 commit comments

Comments
 (0)