wolfPSA/.github/workflows/test-psa-api.yml at master · wolfSSL/wolfPSA · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: Test PSA API

on:
  push:
  pull_request:

jobs:
  # The baseline user_settings.h enables neither HAVE_ECC_KOBLITZ nor
  # HAVE_ECC_BRAINPOOL, so the ECC curve-pinning regression tests would
  # run without those families. This lane rebuilds the library and the
  # two curve tests with both curve families enabled, so the secp256k1
  # and Brainpool-P256 paths get real coverage. libwolfpsa.so exports
  # only the psa_* API and keeps its wolfCrypt objects local, so the
  # curve operations run on the variant wolfCrypt compiled into the
  # library itself; the sibling wolfSSL only provides the link.
  test-ecc-curve-families:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # master tracks upstream; the -stable tag is the release wolfPSA is
        # validated against. Bump it together with the wolfPSA version.
        wolfssl-ref: [ master, v5.9.4-stable ]

    steps:
      - name: Check out wolfPSA
        uses: actions/checkout@v4

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential autoconf automake libtool libtool-bin pkg-config

      - name: Clone sibling wolfSSL
        run: git clone --depth 1 --branch ${{ matrix.wolfssl-ref }} https://github.com/wolfSSL/wolfssl ../wolfssl

      - name: Build variant user_settings (Koblitz + Brainpool)
        run: |
          mkdir -p build-ecc-var
          cp user_settings.h build-ecc-var/baseline_user_settings.h
          cat > build-ecc-var/user_settings.h <<'EOF'
          /* wolfCrypt dependency: HAVE_ECC_BRAINPOOL requires
           * WOLFSSL_CUSTOM_CURVES. */
          #define WOLFSSL_CUSTOM_CURVES
          #define HAVE_ECC_KOBLITZ
          #define HAVE_ECC_BRAINPOOL
          #include "baseline_user_settings.h"
          EOF

      - name: Build wolfPSA with the variant
        # Absolute path: make -C test runs with CWD=test/, where a
        # relative USER_SETTINGS_PATH would silently resolve to the
        # repo-root baseline user_settings.h.
        run: make USER_SETTINGS_PATH="${GITHUB_WORKSPACE}/build-ecc-var"

      - name: Build sibling wolfSSL for wolfPSA tests
        run: make -C test rebuild-wolfssl-psa

      - name: Build and run the ECC curve tests
        env:
          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
        run: |
          make -C test USER_SETTINGS_PATH="${GITHUB_WORKSPACE}/build-ecc-var" \
            psa_ecc_verify_curve_test psa_ecc_ecdh_curve_test
          ./test/psa_ecc_verify_curve_test
          ./test/psa_ecc_ecdh_curve_test

  test-psa-api:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # master tracks upstream; the -stable tag is the release wolfPSA is
        # validated against. Bump it together with the wolfPSA version.
        wolfssl-ref: [ master, v5.9.4-stable ]

    steps:
      - name: Check out wolfPSA
        uses: actions/checkout@v4

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential autoconf automake libtool libtool-bin pkg-config

      - name: Clone sibling wolfSSL
        run: git clone --depth 1 --branch ${{ matrix.wolfssl-ref }} https://github.com/wolfSSL/wolfssl ../wolfssl

      - name: Build wolfPSA
        run: make

      - name: Build sibling wolfSSL for wolfPSA tests
        run: make -C test rebuild-wolfssl-psa

      - name: Build and run the PSA API tests
        env:
          LD_LIBRARY_PATH: ${{ github.workspace }}:${{ github.workspace }}/../wolfssl/src/.libs
        run: make unit-run

      # The crypto callback reads the HMAC key out of Hmac.keyRaw, which
      # wolfCrypt borrows rather than copies. Only a sanitizer notices when
      # the operation outlives that buffer.
      - name: Run the devId test under AddressSanitizer
        run: |
          make -C test psa_devid_cryptocb_test ASAN=1
          rm -rf .store test/.store
          ./test/psa_devid_cryptocb_test