Skip to content

Commit b41d12c

Browse files
aidangarskeaidangarske
authored
Add CI that builds and runs every example (#598)
* Regenerate the CRL that expired in September 2025 * Refresh the expired certificates embedded in certloadverifybuffer * Return 0 from tls servers that returned a wolfSSL_write byte count * Send a client certificate from client-tls and client-tls13-resume * Return 0 from certverify instead of WOLFSSL_SUCCESS * Give the XTS demo key two different halves * Exit success after ml_dsa prints its parameter table * Report failure from the custom io file client and server * Latch failures across every ecc-params curve lookup * Ignore SIGPIPE in the btle fifo transport * Fix the dtls rw-threads certificate paths * Make runall.sh fail when an example fails * Make openssl-verify.sh actually verify and actually fail * Raise the generate_ssl.sh common name length limit * Port the PQ examples to the current wolfSSL API * Return 0 from csr_w_ed25519_example and rsa-public-decrypt-app * Build the x509_acert openssl example against the right headers * Give the examples Makefiles a consistent wolfSSL prefix * Fix the double free and NULL derefs in the custom io cleanup paths * Stop forcing the ESP32 examples to include a developer private config * Add the missing WiFi Kconfig to the DTLS13 station examples * Use XSTRLCPY in client-dtls13 since wolfSSL has no XSTRCPY * Make the DTLS13 example ctx static so it stops colliding with libnet80211 * Set SO_REUSEADDR on the tls servers that lacked it * Give puf the wolfSSL sources and stop building the IDF 4.4 only ENC28J60 examples * Set SO_REUSEADDR on server-tcp as well * Exit the can-bus client on EOF and give it real input in CI * Re-arm the select timeout each pass in the nonblocking dtls server * Keep the shared memory BIOs alive until both sides are done * Port the ebpf tracers to the libbpf 1.0 perf_buffer__new signature * Clone wolfSSL before make builds its graph so uefi-static builds from a clean tree * Raise wolfcryptjni compileSdk to 32 for the BigInteger API its submodule uses * Link wolfentropy.o and keep wc_port socket helpers out of the UEFI build * Track the wolfSSL dilithium.c to wc_mldsa.c rename and drop a stale java import * Move uefi-library to the wc_MlDsa API after the wolfSSL dilithium rename * Declare the launcher activity exported, required from API 31 * Configure wolfSSL before make in the fullstack setup script * Track the wolfSSL io.c to wolfio.c rename in the ndk sample * Keep glibc headers out of the freestanding uefi-library build * Track the wolfSSL mlkem.h rename and give RT1060 the SDK name it selects on * Track the wolfIP struct ll rename and pin wolfIP to its v1.0 release * Use getaddrinfo in the ndk sample since bionic does not declare gethostbyname * Cross compile RT1060 with arm-none-eabi and document the SDK value the Makefile matches * Enable wolfIP HTTP so its httpd.h actually declares the API the example calls * Define HAVE_NETDB_H so wolfio.c includes the header its getaddrinfo path needs * Link pkcs12.o, which RT1060 enables by default and wolfcrypt test calls * Port the ENC28J60 examples to the ESP-IDF 5.x ethernet API * Compile dtls.c in the ndk sample, which enables WOLFSSL_DTLS * Define the PHY identifier registers the removed IDF header supplied * Compile kdf.c in the ndk sample for the TLS PRF * Give RT1060 a current_time so the benchmark stops needing clock_gettime * Port the ENC28J60 PHY to the IDF 5.x autonego_ctrl vtable * Remove the ENC28J60 server's duplicate driver copy that main already builds * Return the DTLS server to accept on close_notify so a resume is heard * Run the C# pq client/server pair under mono * Define WOLFSSL_CERT_REQ so the ndk-gradle app links wolfssljni's X509_REQ calls * Refresh the expired client ECC DER certificate * Add CI that builds and runs every example against wolfSSL master and stable * Sign OCSP staples with a responder intermediate1 actually delegated * Report a failing PKCS#11 example instead of always exiting 0 * Link the PSA library the README's PSA_LIB_PATH names * Widen the mynewt pointer prints so they build on a 64 bit native BSP * Test RSA under UEFI with a 2048 bit key so it clears wolfSSL's minimum * Left pad the ECDSA r and s so a leading zero cannot shift the signature * Document the smime and indef flags the pkcs7 examples need * Fail ecc-verify when the signature does not verify * Fail ecc-sign when a round produces an invalid signature * Fail aesgcm-file-encrypt when its sanity test does not pass * Check that ML-KEM derives the same shared secret on both sides * Fail ecdh_gen_secret when the two sides derive different secrets * Return the DH key agreement error instead of always exiting 0 * Retry the fullstack HTTPS probe so a slow sim start does not fail it * Confirm the custom-io file transfer succeeded so CI can assert it * Print a success line from the silent file-encrypt and ecc-export examples * Add device-sims job running ATECC608 STSAFE and TROPIC01 sim wolfcrypt tests * Extend device-sims to STM32 and PIC32MZ for the full sim fleet * Mount wolfSSL for the STM32 and PIC32MZ sim wolfcrypt runs * Accept the zero success return from wolfSSL_CTX_set_max_early_data * Read the earlydata reply so the client processes the session ticket before resuming * Read the earlydata reply in the DTLS client so it processes the session ticket * Run the tls13 and dtls13 earlydata pairs now that the clients process the ticket * Let expect_fail clear on refs that carry the fix via a fixed_on marker * Retry the PSA TLS 1.3 handshake so an intermittent ECC reject does not fail CI * Retry network fetches across CI so a transient blip does not fail a job * Normalize do_ecc and do_25519 exit codes like do_448 so an error is never masked to 0 * Build and run the merged-in hsm dtls_client example in CI via a dedicated hsm.yml job * Add a make check target to each applicable example * Run only the example and lint smoke set on draft PRs * Only run a per-target workflow when its own example dir changes * Assert the real se050 wolfcrypt result instead of an early sub-test line * Size the RSA 2048 key export buffers so the UEFI test does not fail on BUFFER_E * Call the always-present MLDSA context API from the UEFI driver * Cross uefi-static and uefi-library with both wolfSSL refs in the matrix * Give each tpm matrix leg a ref-unique results file and artifact * Add a codespell spellcheck pass to the lint job * Run push CI on master only so a PR branch does not double-trigger * Select valgrind by caller_run_id since event_name is the caller under workflow_call * Make example check targets catch real failures with pipefail exit checks and inputs * Wire the harness to run make check for mode check examples starting with ecc * Migrate the single-entry exec examples to mode check and fold their inputs into the check targets * Fix four make check assertions that misfired under pipefail * Give the tpm manifest entry a run step so it asserts output * Skip uefi-static in the lint make -n loop so it does not clone * Assert the actual verify result in the pkcs7 and rsa-nb checks * Return nonzero from pkcs12-create-example on a failed create so the check is not a false pass * Return nonzero from rsa-kg on any key generate or write failure * Assert the static memory checks by exit code instead of a pipefail grep that BSD make lacks * Run pkcs7 signedData stream through make check so it asserts the real verify result * Check DER certificates and CRLs in the expiry canary too * Feed the wolfHSM client its stdin so run_client actually exchanges data * Assert every make check by exit code and captured output instead of a pipefail grep so they hold under BSD make
1 parent c586428 commit b41d12c

215 files changed

Lines changed: 9790 additions & 2994 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/apt-update/action.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: 'apt update'
2+
description: 'Refresh apt, minus the runner vendor repos we never install from'
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- shell: bash
8+
run: |
9+
set -euo pipefail
10+
# the image ships azure-cli/msprod repos we install nothing from; when they 403 apt fails the whole update
11+
msft=$(grep -rl packages.microsoft.com /etc/apt/sources.list.d/ 2>/dev/null || true)
12+
if [ -n "$msft" ]; then
13+
sudo rm -f $msft
14+
fi
15+
sudo apt-get update -qq

‎.github/actions/setup-wolfssl/action.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: 'Setup wolfSSL'
2+
description: 'Build a wolfSSL profile, install it to /usr/local, and report its sha256'
3+
4+
inputs:
5+
ref:
6+
description: 'wolfSSL git ref (branch, tag, or SHA)'
7+
required: true
8+
default: 'master'
9+
flags:
10+
description: 'configure flags for this profile'
11+
required: true
12+
cflags:
13+
description: 'extra CFLAGS for this profile'
14+
required: false
15+
default: ''
16+
17+
outputs:
18+
sha256:
19+
description: 'sha256 of the installed libwolfssl.so - the identity gate compares against this'
20+
value: ${{ steps.identity.outputs.sha256 }}
21+
resolved-ref:
22+
description: 'the commit SHA the input ref resolved to'
23+
value: ${{ steps.resolve.outputs.sha }}
24+
25+
runs:
26+
using: composite
27+
steps:
28+
# Resolve to a commit SHA so the cache key is stable across a run. Keying on
29+
# a moving branch name lets two jobs in one nightly build different wolfSSLs.
30+
- name: Resolve wolfSSL ref
31+
id: resolve
32+
shell: bash
33+
run: |
34+
ref='${{ inputs.ref }}'
35+
if [[ "$ref" =~ ^[0-9a-f]{40}$ ]]; then
36+
sha="$ref"
37+
else
38+
# An annotated tag resolves to the tag object, not the commit, so ask
39+
# for the peeled ref first and fall back for branches.
40+
sha=$(git ls-remote https://github.com/wolfSSL/wolfssl.git \
41+
"refs/tags/$ref^{}" | cut -f1)
42+
[ -n "$sha" ] || sha=$(git ls-remote \
43+
https://github.com/wolfSSL/wolfssl.git "$ref" | head -n1 | cut -f1)
44+
fi
45+
[ -n "$sha" ] || { echo "could not resolve wolfSSL ref '$ref'"; exit 1; }
46+
echo "sha=$sha" >> "$GITHUB_OUTPUT"
47+
echo "resolved '$ref' -> $sha"
48+
49+
- name: Hash profile config
50+
id: cfg
51+
shell: bash
52+
run: |
53+
printf '%s|%s' '${{ inputs.flags }}' '${{ inputs.cflags }}' \
54+
| sha256sum | cut -c1-16 | sed 's/^/hash=/' >> "$GITHUB_OUTPUT"
55+
56+
# Key on the image, not runner.os: a binary built against a newer glibc must
57+
# not be restored onto an older runner image. ImageOS is set by the hosted
58+
# runner; fall back so a self-hosted or container runner still gets a key.
59+
- name: Compute cache key
60+
id: key
61+
shell: bash
62+
run: |
63+
img="${ImageOS:-$(. /etc/os-release 2>/dev/null && echo "$ID$VERSION_ID" || echo unknown)}"
64+
echo "key=wolfssl-${img}-${{ steps.resolve.outputs.sha }}-${{ steps.cfg.outputs.hash }}-v1" >> "$GITHUB_OUTPUT"
65+
echo "cache key: wolfssl-${img}-${{ steps.resolve.outputs.sha }}-${{ steps.cfg.outputs.hash }}-v1"
66+
67+
- name: Restore wolfSSL install
68+
id: cache
69+
uses: actions/cache@v5
70+
with:
71+
path: ~/wolfssl-install
72+
key: ${{ steps.key.outputs.key }}
73+
74+
- name: Build wolfSSL
75+
if: steps.cache.outputs.cache-hit != 'true'
76+
shell: bash
77+
run: |
78+
set -euo pipefail
79+
rm -rf /tmp/wolfssl && mkdir -p /tmp/wolfssl
80+
cd /tmp/wolfssl
81+
git init -q
82+
git fetch -q --depth 1 https://github.com/wolfSSL/wolfssl.git ${{ steps.resolve.outputs.sha }}
83+
git checkout -q FETCH_HEAD
84+
./autogen.sh
85+
# We need the library, not wolfSSL's own examples and test suite. Those
86+
# also fail to build under some profiles (the `tls` profile died on
87+
# tests/unit.test), and skipping them cuts every build substantially.
88+
./configure --prefix="$HOME/wolfssl-install" \
89+
--disable-examples --disable-crypttests \
90+
${{ inputs.flags }} \
91+
${{ inputs.cflags && format('CFLAGS="{0}"', inputs.cflags) || '' }}
92+
make -j"$(nproc)"
93+
make install
94+
95+
# Every README tells users to build against a wolfSSL at /usr/local, and 5
96+
# host-tier Makefiles have no -I/-L at all. Installing there means CI runs the
97+
# exact command sequence the docs document, with no overrides.
98+
- name: Install to /usr/local
99+
shell: bash
100+
run: |
101+
set -euo pipefail
102+
sudo cp -a "$HOME/wolfssl-install/." /usr/local/
103+
sudo ldconfig
104+
105+
- name: Report cache outcome
106+
shell: bash
107+
run: |
108+
if [ '${{ steps.cache.outputs.cache-hit }}' = 'true' ]; then
109+
echo "wolfSSL restored from cache (no rebuild)"
110+
else
111+
echo "wolfSSL cache MISS -- built from source and saved for later jobs"
112+
fi
113+
114+
- name: Record wolfSSL identity
115+
id: identity
116+
shell: bash
117+
run: |
118+
set -euo pipefail
119+
lib=$(ls /usr/local/lib/libwolfssl.so.*.*.* 2>/dev/null | head -n1 \
120+
|| readlink -f /usr/local/lib/libwolfssl.so)
121+
[ -f "$lib" ] || { echo "no libwolfssl.so installed under /usr/local/lib"; exit 1; }
122+
sha=$(sha256sum "$lib" | cut -d' ' -f1)
123+
echo "sha256=$sha" >> "$GITHUB_OUTPUT"
124+
echo "installed $lib"
125+
echo "sha256 $sha"
126+
/usr/local/bin/wolfssl-config --version 2>/dev/null || true

0 commit comments

Comments
 (0)