Repository navigation
Restore the 4096-byte trusted CA default from main #171
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Test | |
| on: | |
| push: | |
| branches: [ 'main', 'wolftpm-core', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| repository_dispatch: | |
| types: [nightly-trigger] | |
| jobs: | |
| build: | |
| name: ${{ matrix.os }} / debug=${{ matrix.debug }} / dynamic-mem=${{ matrix.dynamic-mem }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, ubuntu-22.04] | |
| debug: [yes, no] | |
| dynamic-mem: [yes, no] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y autoconf automake libtool | |
| - name: Cache wolfSSL | |
| id: cache-wolfssl | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/wolfssl-install | |
| key: wolfssl-${{ matrix.os }}-v1 | |
| - name: Build wolfSSL | |
| if: steps.cache-wolfssl.outputs.cache-hit != 'true' | |
| run: | | |
| cd ~ | |
| git clone --depth 1 https://github.com/wolfSSL/wolfssl.git | |
| cd wolfssl | |
| ./autogen.sh | |
| ./configure --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf \ | |
| --enable-ecccustcurves --enable-keygen \ | |
| --prefix=$HOME/wolfssl-install | |
| make -j$(nproc) | |
| make install | |
| - name: Generate configure | |
| run: ./autogen.sh | |
| - name: Configure | |
| run: | | |
| ./configure --with-wolfssl=$HOME/wolfssl-install --enable-nuvoton --enable-nations --enable-responder \ | |
| ${{ matrix.debug == 'yes' && '--enable-debug' || '' }} \ | |
| ${{ matrix.dynamic-mem == 'yes' && '--enable-dynamic-mem' || '' }} | |
| - name: Build | |
| run: make -j$(nproc) | |
| - name: Run unit tests | |
| run: make check | |
| env: | |
| LD_LIBRARY_PATH: ${{ github.workspace }}/src/.libs:$HOME/wolfssl-install/lib | |
| - name: Upload test logs on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-logs-${{ matrix.os }}-debug-${{ matrix.debug }}-dynmem-${{ matrix.dynamic-mem }} | |
| path: | | |
| test/*.log | |
| config.log | |
| feature-config: | |
| name: features / ${{ matrix.variant }} | |
| runs-on: ubuntu-latest | |
| env: | |
| # Standalone builds carry none of the TPM side, pure TCG builds none of | |
| # the standard requester | |
| TPM_SYMS: 'wolfSPDM_(TCG_.*|Nuvoton_.*|Nations_.*|Resp[A-Z].*|.*Psk.*|SetPSK|ConnectTCG|.*TcgClear.*|.*VendorDefined|SetRequesterKey.*|SignHash|GetConnectionHandle|GetFipsIndicator)' | |
| STD_SYMS: 'wolfSPDM_(GetCapabilities|BuildGetCapabilities|ParseCapabilities|NegotiateAlgorithms|BuildNegotiateAlgorithms|ParseAlgorithms|GetDigests|ParseDigests|GetCertificate|ParseCertificate|ValidateCertChain|SetTrustedCAs|AllowUntrustedCerts|ConnectStandard|.*Measurement.*|.*Challenge.*|M1Start|M1Add|AttestFree|ChunkExchange|ClearExchange|SendData|ReceiveData|EncryptMessage|DecryptMessage|.*MlDsa.*|.*MlKem.*|SetKeyExchangePref)' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - variant: core | |
| configure: '' | |
| forbid: tpm | |
| - variant: tcg | |
| configure: '--enable-tcg' | |
| - variant: tcg-psk | |
| configure: '--enable-tcg --enable-psk' | |
| - variant: nuvoton | |
| configure: '--enable-nuvoton' | |
| - variant: nations | |
| configure: '--enable-nations' | |
| - variant: tcg-responder | |
| configure: '--enable-tcg --enable-responder' | |
| - variant: tcg-pure | |
| configure: '--enable-nuvoton --enable-nations --enable-responder --disable-mctp' | |
| forbid: std | |
| - variant: no-session-ext | |
| configure: '--disable-heartbeat --disable-key-update' | |
| forbid: tpm | |
| - variant: no-attest | |
| configure: '--disable-meas --disable-challenge' | |
| forbid: tpm | |
| - variant: no-chunking | |
| configure: '--disable-chunking' | |
| forbid: tpm | |
| - variant: no-app-data | |
| configure: '--disable-app-data' | |
| forbid: tpm | |
| - variant: lean | |
| configure: '--disable-cert --disable-heartbeat --disable-key-update --disable-app-data' | |
| forbid: tpm | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y autoconf automake libtool | |
| - name: Cache wolfSSL | |
| id: cache-wolfssl | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/wolfssl-install | |
| key: wolfssl-ubuntu-latest-v1 | |
| - name: Build wolfSSL | |
| if: steps.cache-wolfssl.outputs.cache-hit != 'true' | |
| run: | | |
| cd ~ | |
| git clone --depth 1 https://github.com/wolfSSL/wolfssl.git | |
| cd wolfssl | |
| ./autogen.sh | |
| ./configure --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf \ | |
| --enable-ecccustcurves --enable-keygen \ | |
| --prefix=$HOME/wolfssl-install | |
| make -j$(nproc) | |
| make install | |
| - name: Generate configure | |
| run: ./autogen.sh | |
| - name: Configure | |
| run: ./configure --with-wolfssl=$HOME/wolfssl-install ${{ matrix.configure }} | |
| - name: Build | |
| run: make -j$(nproc) | |
| - name: Run unit tests | |
| run: make check | |
| env: | |
| LD_LIBRARY_PATH: ${{ github.workspace }}/src/.libs:$HOME/wolfssl-install/lib | |
| - name: Check the other side is compiled out | |
| if: matrix.forbid != '' | |
| run: | | |
| case "${{ matrix.forbid }}" in | |
| tpm) re="$TPM_SYMS" ;; | |
| std) re="$STD_SYMS" ;; | |
| esac | |
| bad=$(nm --defined-only .libs/libwolfspdm.so | awk '{print $3}' | | |
| grep -E "^${re}$" || true) | |
| if [ -n "$bad" ]; then | |
| echo "Unexpected symbols:"; echo "$bad"; exit 1 | |
| fi | |
| - name: Upload test logs on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-logs-chunk-${{ matrix.variant }} | |
| path: | | |
| test/*.log | |
| config.log |