Make example check targets catch real failures with pipefail exit checks and inputs

aidangarske · aidangarske · commit 5edb6f14cb07 · 2026-07-22T12:19:21.000-07:00
diff --git a/X9.146/Makefile b/X9.146/Makefile
@@ -56,6 +56,8 @@ clean:
 	rm -f *.der
 	rm -f *.pem
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: gen_rsa_mldsa_dual_keysig_root_cert gen_rsa_mldsa_dual_keysig_server_cert
 	./gen_rsa_mldsa_dual_keysig_root_cert | grep -q 'SUCCESS!'
 	./gen_rsa_mldsa_dual_keysig_server_cert | grep -q 'SUCCESS!'
diff --git a/certfields/all-fields/Makefile b/certfields/all-fields/Makefile
@@ -12,6 +12,8 @@ app: main.o
 clean:
 	rm -f *.o app
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: app
 	./app ../../certs/client-cert.der RSA | grep -q 'CN = www.wolfssl.com (15)'
 	! ./app ../../certs/client-key.pem RSA >/dev/null 2>&1
diff --git a/certfields/extendedKeyUsage/Makefile b/certfields/extendedKeyUsage/Makefile
@@ -11,6 +11,8 @@ run: test.o
 clean:
 	rm -f *.o run
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: run
 	ASAN_OPTIONS=detect_leaks=0 ./run | grep -q 'extKeyUsage OID:'
 	@echo "PASS: certfields-extendedkeyusage checks"
diff --git a/certfields/extract-pubkey-from-certfile/Makefile b/certfields/extract-pubkey-from-certfile/Makefile
@@ -12,6 +12,8 @@ app: main.o
 clean:
 	rm -f *.o app
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: app
 	./app | grep -q '3082010A0282010100C303D12BFE39A432'
 	@echo "PASS: certfields-extract-pubkey checks"
diff --git a/certfields/keyUsage/Makefile b/certfields/keyUsage/Makefile
@@ -11,6 +11,8 @@ run: test.o
 clean:
 	rm -f *.o run
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: run
 	./run | grep -q 'cert can be used for'
 	@echo "PASS: certfields-keyusage checks"
diff --git a/certgen/Makefile b/certgen/Makefile
@@ -61,6 +61,8 @@ clean:
 	rm -f *.o certgen_example certgen_ca_example csr_example csr_w_ed25519_example csr_sign csr_cryptocb custom_ext custom_ext_callback
 	rm -f newCert.*
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: certgen_example certgen_ca_example csr_w_ed25519_example csr_example csr_sign csr_cryptocb custom_ext custom_ext_callback
 	./certgen_example | grep -q 'Tests passed'
 	./certgen_ca_example | grep -q 'Tests passed'
diff --git a/certmanager/Makefile b/certmanager/Makefile
@@ -17,6 +17,8 @@ certverify_ocsp: certverify_ocsp.o
 clean:
 	rm -f *.o certverify certloadverifybuffer certverify_ocsp
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: certverify certloadverifybuffer
 	./certverify | grep -q 'CRL Verification Successful!'
 	./certloadverifybuffer | grep -q 'Verification successful on cert2!'
diff --git a/certstore/Makefile b/certstore/Makefile
@@ -13,6 +13,8 @@ certverify: certverify.o
 clean:
 	rm -f *.o certverify
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: certverify
 	./certverify | grep -q 'Verified certificate'
 	@echo "PASS: certstore checks"
diff --git a/certvfy/Makefile b/certvfy/Makefile
@@ -17,6 +17,8 @@ sigvfycert: sigvfycert.o
 clean:
 	rm -f *.o certvfy certsigvfy sigvfycert
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: certvfy certsigvfy sigvfycert
 	./certvfy | grep -q 'Verification Successful!'
 	./certsigvfy | grep -q 'Verification Successful!'
diff --git a/crypto/3des/Makefile b/crypto/3des/Makefile
@@ -11,6 +11,9 @@ LIBS=-L$(WOLFSSL_INSTALL_DIR)/lib -lwolfssl
 clean:
 	rm -f *.o 3des-file-encrypt
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: 3des-file-encrypt
+	printf '3des ci input\n' > in.txt
 	printf 'ciphertestpw\n' | script -qec './3des-file-encrypt -e 168 -i in.txt -o out.enc' /dev/null | grep -q 'Success: 3DES encrypt complete'
 	@echo "PASS: crypto-3des checks"
diff --git a/crypto/aes-modes/Makefile b/crypto/aes-modes/Makefile
@@ -66,6 +66,8 @@ aes-cts: aes-cts.o
 clean:
 	rm -f *.o $(EXAMPLES) temp_*.bin
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: aes-cbc aes-cfb aes-cfb1 aes-cfb8 aes-ofb aes-ecb aes-ctr aes-direct aes-gcm aes-gmac aes-ccm aes-keywrap aes-xts aes-siv aes-eax aes-cts
 	./aes-cbc in.txt out-cbc.bin | grep -q 'Success!'
 	./aes-cfb in.txt out-cfb.bin | grep -q 'Success!'
diff --git a/crypto/aes/Makefile b/crypto/aes/Makefile
@@ -31,6 +31,8 @@ aesgcm-file-minimal: aesgcm-file-minimal.o
 clean:
 	rm -f *.o aes-file-encrypt aescfb-file-encrypt aesctr-file-encrypt aesgcm-file-encrypt aesgcm-file-minimal text* aesgcm-oneshot aesgcm-minimal
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: aesgcm-minimal aesgcm-oneshot aesgcm-file-encrypt
 	./aesgcm-minimal | grep -q 'Decrypted: 73696e676c6520626c6f636b206d736700'
 	./aesgcm-oneshot | grep -q 'Decrypted: 090909090909090909090909090909090909090909090909090909090909090909'
diff --git a/crypto/aes/rdseed/Makefile b/crypto/aes/rdseed/Makefile
@@ -17,6 +17,8 @@ clean:
 
 .PHONY: all clean check
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: aesgcm-rdseed
 	./aesgcm-rdseed | grep -q 'Decrypted'
 	@echo "PASS: crypto-aes-rdseed checks"
diff --git a/crypto/ascon/Makefile b/crypto/ascon/Makefile
@@ -11,6 +11,9 @@ ascon-file-encrypt: ascon-file-encrypt.o
 clean:
 	rm -f *.o ascon-file-encrypt
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ascon-file-encrypt
+	printf 'ascon ci input\n' > in.txt
 	printf 'ciphertestpw\n' | script -qec './ascon-file-encrypt -e -i in.txt -o out.enc' /dev/null | grep -q 'Success: Ascon encrypt complete'
 	@echo "PASS: crypto-ascon checks"
diff --git a/crypto/camellia/Makefile b/crypto/camellia/Makefile
@@ -11,6 +11,9 @@ camellia-encrypt: camellia-encrypt.o
 clean:
 	rm -f *.o camellia-encrypt
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: camellia-encrypt
+	printf 'camellia ci input\n' > in.txt
 	printf 'ciphertestpw\n' | script -qec './camellia-encrypt -e 128 -i in.txt -o out.enc' /dev/null | grep -q 'Success: Camellia encrypt complete'
 	@echo "PASS: crypto-camellia checks"
diff --git a/crypto/keywrap/Makefile b/crypto/keywrap/Makefile
@@ -14,6 +14,8 @@ keywrap: keywrap.o
 clean:
 	rm -f *.o keywrap
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: keywrap
 	./keywrap | grep -q 'Decrypted Random Key: '
 	@echo "PASS: crypto-keywrap checks"
diff --git a/crypto/pkcs12/Makefile b/crypto/pkcs12/Makefile
@@ -16,6 +16,8 @@ pkcs12-create-example: pkcs12-create-example.o
 clean:
 	rm -f *.o pkcs12-example pkcs12-create-example output.p12
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: pkcs12-example pkcs12-create-example
 	./pkcs12-example | grep -q 'return value of parsing pkcs12 = 0 SUCCESS'
 	./pkcs12-create-example | grep -q 'Printing PKCS12 DER file to output.p12'
diff --git a/ecc/Makefile b/ecc/Makefile
@@ -29,6 +29,8 @@ debug: CFLAGS+=$(DEBUG_FLAGS)
 debug: all
 
 # ecc-export-Qx-Qy reads the .der ecc-key-export writes, so keep that order
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: all
 	./ecc-key-decode     | grep -q "Success"
 	./ecc-params         | grep -q "Gy: 32"
diff --git a/ecc/ecc-stack.c b/ecc/ecc-stack.c
@@ -35,6 +35,7 @@
 
 static WC_RNG mRng;
 static ecc_key mGenKey;
+static int mEccErr = 0;
 
 static void* do_it(void* args)
 {
@@ -50,6 +51,7 @@ static void* do_it(void* args)
     }
     if (ret != 0) {
         printf("ecc make key failed %d\n", ret);
+        mEccErr = ret;
     }
 
     if (initKey)
@@ -73,6 +75,7 @@ int main()
     ret = wc_InitRng(&mRng);
     if (ret != 0) {
         printf("Init RNG failed %d\n", ret);
+        return 1;
     }
 
     StackSizeCheck(NULL, do_it);
@@ -85,5 +88,5 @@ int main()
     }
     wolfCrypt_Cleanup();
 
-    return 0;
+    return (mEccErr == 0 && ret == 0) ? 0 : 1;
 }
diff --git a/hash/Makefile b/hash/Makefile
@@ -35,6 +35,8 @@ debug: all
 clean:
 	rm -f $(TARGETS)
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: sha256-hash sha512-hash sha3-256-hash hash-file sha256-hash-string sha256-hash-oneshot-string sha3-256-hash-oneshot-string
 	./sha256-hash input.txt | grep -q '75294625788129796c09fcbf313ea16e2883356e322adc2f956b37dbdc10b6a7'
 	./sha512-hash input.txt | grep -q 'ead56209da2dfb3562263aadc57d9382f0f7cb579ebb6dbf2f20bfd3cb68aaaad422f6ce6f1a88ec6c326edcf8456f650579b6e20eb39f3bb444bee8b65615ed'
diff --git a/ocsp/responder/Makefile b/ocsp/responder/Makefile
@@ -25,6 +25,8 @@ clean:
 
 .PHONY: check
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ocsp-request-response
 	./ocsp-request-response | grep -q '=== Example complete ==='
 	@echo "PASS: ocsp-responder checks"
diff --git a/pk/curve25519/Makefile b/pk/curve25519/Makefile
@@ -11,6 +11,8 @@ curve25519_test: curve25519_test.o
 clean:
 	rm -f *.o curve25519_test
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: curve25519_test
 	./curve25519_test | grep -q 'Curve25519 test success'
 	@echo "PASS: pk-curve25519 checks"
diff --git a/pk/dh-pg/Makefile b/pk/dh-pg/Makefile
@@ -16,6 +16,8 @@ dh-pg-ka: dh-pg-ka.o
 clean:
 	rm -f *.o dh-pg-ka
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: dh-pg-ka
 	./dh-pg-ka -ffdhe >/dev/null
 	@echo "PASS: pk-dh-pg checks"
diff --git a/pk/ecc/Makefile b/pk/ecc/Makefile
@@ -16,6 +16,8 @@ all: $(TARGETS)
 clean:
 	rm -f $(TARGETS) *.der *.x963 
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ecc_keys ecc_pub ecc_sign ecc_sign_deterministic ecc_verify
 	./ecc_keys | grep -q 'storing public key into ecc-public.x963 (65 bytes)'
 	./ecc_pub | grep -q 'Public Key Qy: 32'
diff --git a/pk/ecdh_generate_secret/Makefile b/pk/ecdh_generate_secret/Makefile
@@ -11,6 +11,8 @@ ecdh_gen_secret: ecdh_gen_secret.o
 clean:
 	rm -f *.der *.x963 *.o ecdh_gen_secret
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ecdh_gen_secret
 	./ecdh_gen_secret 1 | grep -q 'Successfully generated a common secret'
 	./ecdh_gen_secret 2 | grep -q 'Successfully generated a common 25519 secret'
diff --git a/pk/ed25519/Makefile b/pk/ed25519/Makefile
@@ -16,6 +16,8 @@ all: $(TARGETS)
 clean:
 	rm -f $(TARGETS) *.der
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ed25519_keys ed25519_pub ed25519_sign ed25519_verify
 	./ed25519_keys | grep -q 'writing public key to ed25519-pubkey.der (32 bytes)'
 	./ed25519_pub | grep -q 'Public Key: 32'
diff --git a/pk/ed25519_gen/Makefile b/pk/ed25519_gen/Makefile
@@ -16,6 +16,8 @@ all: $(TARGETS)
 clean:
 	rm -f $(TARGETS) 
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: sign_and_verify
 	./sign_and_verify | grep -q 'Successfully validated signature'
 	@echo "PASS: pk-ed25519-gen checks"
diff --git a/pk/ed448/Makefile b/pk/ed448/Makefile
@@ -16,6 +16,8 @@ all: $(TARGETS)
 clean:
 	rm -f $(TARGETS) *.der
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ed448_keys ed448_pub ed448_sign ed448_verify
 	./ed448_keys | grep -q 'writing public key to ed448-pubkey.der (57 bytes)'
 	./ed448_pub | grep -q 'Public Key: 57'
diff --git a/pk/enc-through-sign-rsa/Makefile b/pk/enc-through-sign-rsa/Makefile
@@ -16,6 +16,8 @@ all: $(TARGETS)
 clean:
 	rm -f $(TARGETS) encryptedAesKey
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: rsa-private-encrypt-app rsa-public-decrypt-app
 	./rsa-private-encrypt-app >/dev/null
 	./rsa-public-decrypt-app | grep -q 'Thisismyfakeaeskeythatis32bytes!'
diff --git a/pk/hpke/Makefile b/pk/hpke/Makefile
@@ -11,6 +11,8 @@ hpke_test: hpke_test.o
 clean:
 	rm -f *.o hpke_test
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: hpke_test
 	./hpke_test | grep -q 'HPKE test success'
 	@echo "PASS: pk-hpke checks"
diff --git a/pk/rsa-kg/Makefile b/pk/rsa-kg/Makefile
@@ -22,6 +22,8 @@ rsa-kg: rsa-kg.o
 clean:
 	rm -f *.o rsa-kg-sv rsa-kg
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: rsa-kg-sv rsa-kg
 	./rsa-kg-sv -load-key >/dev/null
 	./rsa-kg -bits 2048 | grep -q 'writing public key to ./rsa-private.der'
diff --git a/pk/rsa-pss/Makefile b/pk/rsa-pss/Makefile
@@ -35,6 +35,8 @@ debug: all
 clean:
 	rm -f $(TARGETS)
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: rsa-pss
 	./rsa-pss -s sign.bin | grep -q 'Writing to file: sign.bin'
 	./rsa-pss -v sign.bin | grep -q 'RSA PSS verify success'
diff --git a/pk/rsa/Makefile b/pk/rsa/Makefile
@@ -35,6 +35,8 @@ debug: all
 clean:
 	rm -f $(TARGETS)
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: rsa-nb
 	./rsa-nb | grep -q 'RSA non-block verify:'
 	@echo "PASS: pk-rsa checks"
diff --git a/pk/srp/Makefile b/pk/srp/Makefile
@@ -23,6 +23,8 @@ srp_gen: srp_gen.o
 clean:
 	rm -f *.der *.x963 *.o srp srp_gen
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: srp srp_gen
 	./srp wolfssl password | grep -q 'Client verified server proof'
 	./srp_gen wolfssl password | grep -q 'static const byte verifier['
diff --git a/pk/test_cert_and_private_keypair/Makefile b/pk/test_cert_and_private_keypair/Makefile
@@ -37,6 +37,8 @@ debug: all
 clean:
 	rm -f $(TARGETS)
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: test-cert-privkey-pair
 	./test-cert-privkey-pair ../../certs/client-key.pem ../../certs/client-cert.pem | grep -q 'Congratulations, this private key and cert'
 	! ./test-cert-privkey-pair ../../certs/client-cert.pem ../../certs/client-cert.pem >/dev/null 2>&1
diff --git a/pkcs7/Makefile b/pkcs7/Makefile
@@ -59,6 +59,8 @@ clean:
         authEnvelopedDataKEKRI.der compressedData.der \
         smime-created.p7s
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: signedData-stream
 	./signedData-stream content.txt | grep -q 'bytes from file'
 	@echo "PASS: pkcs7-signeddata-stream checks"
diff --git a/pq/ml_dsa/Makefile b/pq/ml_dsa/Makefile
@@ -17,6 +17,8 @@ ml_dsa_test: ml_dsa.c
 clean:
 	rm -f *.o ml_dsa_test
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ml_dsa_test
 	./ml_dsa_test -c 2 | grep -q 'info: verify message good'
 	./ml_dsa_test -c 3 | grep -q 'info: verify message good'
diff --git a/pq/ml_kem/Makefile b/pq/ml_kem/Makefile
@@ -17,6 +17,8 @@ ml_kem: ml_kem.c
 clean:
 	rm -f *.o ml_kem
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ml_kem
 	./ml_kem | grep -q 'Shared secrets match'
 	@echo "PASS: pq-ml-kem checks"
diff --git a/pq/stateful_hash_sig/Makefile b/pq/stateful_hash_sig/Makefile
@@ -40,6 +40,8 @@ clean:
 	rm -f lms_example.key
 	rm -f xmss_example.key
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: lms_example xmss_example
 	./lms_example 1 5 1 | grep -q 'finished'
 	./xmss_example XMSS-SHA2_10_256 10 | grep -q 'finished'
diff --git a/signature/Makefile b/signature/Makefile
@@ -13,6 +13,8 @@ signature: signature.o
 clean:
 	rm -f *.o signature
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: signature
 	./signature Makefile | grep -q 'ECC Signature Verification: Pass (0)'
 	@echo "PASS: signature checks"
diff --git a/signature/ecc-sign-verify/Makefile b/signature/ecc-sign-verify/Makefile
@@ -17,6 +17,8 @@ ecc_sign_verify:ecc_sign_verify.o
 clean:
 	rm -f *.o ecc_sign_verify
 
+check: SHELL := /bin/bash
+check: .SHELLFLAGS := -eo pipefail -c
 check: ecc_sign_verify
 	./ecc_sign_verify | grep -q 'Successfully verified signature w/ ecc key size 521!'
 	@echo "PASS: signature-ecc-sign-verify checks"
diff --git a/signature/rsa_buffer/Makefile b/signature/rsa_buffer/Makefile
diff --git a/signature/rsa_vfy_only/Makefile b/signature/rsa_vfy_only/Makefile
diff --git a/signature/sigtest/Makefile b/signature/sigtest/Makefile
diff --git a/staticmemory/Makefile b/staticmemory/Makefile
diff --git a/staticmemory/memory-bucket-optimizer/optimizer/Makefile b/staticmemory/memory-bucket-optimizer/optimizer/Makefile
diff --git a/staticmemory/memory-bucket-optimizer/tester/Makefile b/staticmemory/memory-bucket-optimizer/tester/Makefile
diff --git a/x509_acert/Makefile b/x509_acert/Makefile
