Build and run the merged-in hsm dtls_client example in CI via a dedicated hsm.yml job

Author: aidangarske

.github/examples-manifest.yml

@@ -1645,6 +1645,14 @@ examples:
     mode: skip
     reason: "shared helper (btle-sim.c) linked by btle/ecies and btle/tls; not an example"
 
+  - id: hsm-dtls-client
+    path: hsm/dtls_client
+    mode: skip
+    reason: >-
+      Built and run end-to-end by the dedicated hsm.yml job (wolfHSM posix server +
+      wolfSSL DTLS server + this client, asserting the HSM-backed handshake);
+      master-only since wolfHSM tracks wolfSSL master
+
   # arduino.yml does NOT cover these: it copies compile-all-examples.sh into
   # $ARDUINO_ROOT/wolfssl/examples and runs it there, compiling the examples that
   # ship inside the installed Arduino wolfSSL library, not this repo's sketches.

.github/workflows/hsm.yml

@@ -0,0 +1,73 @@
+name: HSM
+
+on:
+  push:
+    paths:
+      - 'hsm/**'
+      - '.github/workflows/hsm.yml'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'hsm/**'
+      - '.github/workflows/hsm.yml'
+  workflow_call:
+    inputs:
+      caller_run_id:
+        description: 'run id of the calling workflow; keeps a called run in its own concurrency group'
+        type: string
+        default: ''
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ inputs.caller_run_id && format('hsm-call-{0}', inputs.caller_run_id) || format('hsm-{0}', github.ref) }}
+  cancel-in-progress: ${{ !inputs.caller_run_id }}
+
+permissions:
+  contents: read
+
+jobs:
+  hsm:
+    # wolfHSM tracks wolfSSL master, so make download_repos clones and builds both
+    # at master; a stable-tag matrix would not build. Hence master-only.
+    name: Run / hsm dtls_client (wolfHSM ECC over DTLS) wolfSSL master
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/apt-update
+      - name: Install build deps
+        run: sudo apt-get install -y --no-install-recommends autoconf automake libtool
+
+      # download_repos clones wolfSSL + wolfHSM; make all builds the wolfSSL DTLS
+      # server/client, the wolfHSM posix server, and this repo's DTLS client.
+      - name: Clone wolfSSL + wolfHSM and build the stack
+        working-directory: hsm/dtls_client
+        run: |
+          set -euo pipefail
+          bash "$GITHUB_WORKSPACE/.github/scripts/retry.sh" make download_repos
+          make all
+
+      # A successful DTLS handshake proves the client drove its ECC signing through
+      # the HSM: wolfHSM server on TCP 23456, wolfSSL DTLS server on UDP 11111.
+      - name: Run the wolfHSM-backed DTLS handshake
+        working-directory: hsm/dtls_client
+        run: |
+          set -uo pipefail
+          make run_hsm_server > hsm.log 2>&1 &
+          make run_dtls_server > dtls.log 2>&1 &
+          for _ in $(seq 1 150); do ss -tln 2>/dev/null | grep -q ':23456 ' && break; sleep 0.2; done
+          for _ in $(seq 1 150); do ss -uln 2>/dev/null | grep -q ':11111 ' && break; sleep 0.2; done
+          ss -tln | grep -q ':23456 ' \
+            || { echo "FAIL: wolfHSM server never listened on 23456"; cat hsm.log; exit 1; }
+          ss -uln | grep -q ':11111 ' \
+            || { echo "FAIL: DTLS server never listened on 11111"; cat dtls.log; exit 1; }
+          rc=0
+          make run_client > client.log 2>&1 || rc=$?
+          echo "--- client:"; cat client.log
+          pkill -f wh_posix_server 2>/dev/null || true
+          pkill -f 'examples/server/server' 2>/dev/null || true
+          [ "$rc" -eq 0 ] \
+            || { echo "FAIL: client rc=$rc"; echo '--- hsm:'; cat hsm.log; echo '--- dtls:'; cat dtls.log; exit 1; }
+          grep -q 'DTLS handshake successful' client.log \
+            || { echo "FAIL: no successful HSM-backed DTLS handshake"; exit 1; }
+          echo "verified: wolfHSM-backed DTLS handshake (ECC signing on the HSM)"

.github/workflows/nightly.yml

@@ -133,6 +133,12 @@ jobs:
     with:
       caller_run_id: ${{ github.run_id }}
 
+  hsm:
+    needs: [refs]
+    uses: ./.github/workflows/hsm.yml
+    with:
+      caller_run_id: ${{ github.run_id }}
+
   device-sims:
     needs: [refs]
     uses: ./.github/workflows/device-sims.yml