Skip to content
PQC Examples (v1.85)

Fix RSA 4096 public area buffer sizing and packet overflow checks #800

Sign in to view logs

Fix RSA 4096 public area buffer sizing and packet overflow checks

Fix RSA 4096 public area buffer sizing and packet overflow checks #800

Workflow file for this run

.github/workflows/pqc-examples.yml at 1976fac
name: PQC Examples (v1.85)
on:
push:
branches: [ 'master', 'main', 'release/**' ]
pull_request:
branches: [ '*' ]
types: [opened, synchronize, reopened, ready_for_review]
repository_dispatch:
types: [nightly-trigger]
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
pqc-examples:
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
runs-on: ubuntu-latest
container:
image: ghcr.io/wolfssl/wolftpm-ci:v1.1
options: --cap-add=SYS_ADMIN --cap-add=NET_ADMIN --cap-add=NET_RAW
defaults:
run:
shell: bash
timeout-minutes: 30
steps:
- name: Checkout wolfTPM
uses: actions/checkout@v4
with:
submodules: true
- name: Setup wolfSSL with PQC
uses: ./.github/actions/setup-wolfssl
with:
configure-flags: >-
--enable-wolftpm --enable-pkcallbacks --enable-keygen
--enable-dilithium --enable-mlkem --enable-experimental --enable-harden
cflags: -DWC_RSA_NO_PADDING
- name: Build wolfTPM with v1.85 + fwTPM + debug
run: |
./autogen.sh
# --enable-swtpm omitted: it's the Linux configure default
# (configure.ac:287). Passing it explicitly was redundant.
# --enable-debug=verbose: full client + fwTPM dispatch logs so
# CI failures (e.g. keyload integrity) come with TPM-side trace.
./configure --enable-v185 --enable-fwtpm --enable-debug=verbose
make -j"$(nproc)"
# ----- Tier 1: make check -----
# Runs unit.test (wrapper) + fwtpm_unit.test (handler) + tpm2-tools
# compatibility + tests/pqc_mssim_e2e.sh in one shot via fwtpm_check.sh.
- name: make check (unit + fwtpm_unit + tpm2-tools + pqc_mssim_e2e.sh)
env:
WOLFSSL_PATH: ${{ github.workspace }}/wolfssl
run: |
FWTPM_USE_FIXED_PORT=1 \
sudo -E unshare --net /bin/bash -c '
set -e
ip link set lo up
make check
'
# Standalone examples share one simulator lifetime in this step.
- name: PQC standalone examples and control tool
run: |
rm -f fwtpm_nv.bin
./src/fwtpm/fwtpm_server > /tmp/fwtpm_server.log 2>&1 &
server_pid=$!
trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT
sleep 1
kill -0 "$server_pid"
echo '::group::PQC keygen: every parameter set'
for ps in 44 65 87; do
./examples/keygen/keygen mldsa_sk.bin -mldsa=$ps
./examples/keygen/keygen hmldsa_sk.bin -hash_mldsa=$ps
done
for ps in 512 768 1024; do
./examples/keygen/keygen mlkem_sk.bin -mlkem=$ps
done
echo '::endgroup::'
echo '::group::ML-DSA sign and verify'
./examples/pqc/mldsa_sign
echo '::endgroup::'
echo '::group::ML-KEM encapsulate and decapsulate'
./examples/pqc/mlkem_encap
echo '::endgroup::'
# Leave PQC_CTRL_CLEAR off so the shared server is not wiped.
echo '::group::PQC control tool and argument validation'
./examples/pqc/pqc_ctrl.sh
echo '::endgroup::'
- name: PQC mssim E2E (MLKEM-768 + HashMLDSA-65 round-trips)
run: ./tests/pqc_mssim_e2e.sh
- name: Doc constants parity check
run: |
./tests/check_doc_constants.sh
rc=$?
if [ $rc -eq 77 ]; then
echo "Step skipped (exit 77 — header or doc missing)"
exit 0
fi
exit $rc
# ----- Tier 5: full run_examples.sh sweep -----
# run_examples.sh does not start its own TPM — it expects one already
# listening. Start a fresh server in the same step. Trace each
# command (set -x) so the failing call line is in the CI log; on
# failure, dump run.out (where the script redirects example stdout).
- name: run_examples.sh full pass (auto-detects v1.85, runs 18-way matrix)
env:
WOLFSSL_PATH: ${{ github.workspace }}/wolfssl
run: |
rm -f fwtpm_nv.bin
./src/fwtpm/fwtpm_server > /tmp/fwtpm_server.log 2>&1 &
server_pid=$!
trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT
sleep 1
kill -0 "$server_pid"
set +e
bash -x ./examples/run_examples.sh
rc=$?
set -e
if [ $rc -ne 0 ]; then
echo "=== run.out (last 200 lines) ==="
tail -200 run.out
echo "=== fwtpm_server.log (last 100 lines) ==="
tail -100 /tmp/fwtpm_server.log
fi
exit $rc
- name: Upload failure logs
if: failure()
uses: actions/upload-artifact@v4
with:
name: pqc-examples-logs
path: |
/tmp/fwtpm_server.log
/tmp/fwtpm_check_*.log
test-suite.log
tests/*.log
config.log
run.out
retention-days: 5
# Full TPM-backed PQC TLS 1.3 handshake: ML-KEM key exchange + ML-DSA
# CertificateVerify signed on the TPM (device key never leaves the chip).
pqc-tls-examples:
name: PQC TLS 1.3 examples (ML-DSA auth + ML-KEM)
permissions:
contents: read
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
runs-on: ubuntu-latest
defaults:
run:
shell: bash
container:
image: ghcr.io/wolfssl/wolftpm-ci:v1.1
timeout-minutes: 30
steps:
- name: Checkout wolfTPM
uses: actions/checkout@v4
with:
submodules: true
persist-credentials: false
- name: Setup wolfSSL with PQC TLS
uses: ./.github/actions/setup-wolfssl
with:
configure-flags: >-
--enable-wolftpm --enable-pkcallbacks --enable-keygen
--enable-certgen --enable-dilithium --enable-mlkem
--enable-experimental --enable-tls-mlkem-standalone --enable-harden
cflags: -DWOLFSSL_TLSX_PQC_MLKEM_STORE_OBJ -DWC_RSA_NO_PADDING
prefix: $HOME/wolfssl-install
- name: wolfSSL version info
run: grep LIBWOLFSSL_VERSION_STRING "$HOME/wolfssl-install/include/wolfssl/version.h"
- name: Build wolfTPM with v1.85 + fwTPM + debug
run: |
./autogen.sh
CPPFLAGS="-I$HOME/wolfssl-install/include" \
LDFLAGS="-L$HOME/wolfssl-install/lib -Wl,-rpath,$HOME/wolfssl-install/lib" \
./configure --enable-v185 --enable-fwtpm --enable-debug=verbose
make -j"$(nproc)"
# A stub means wolfSSL was missing a required feature (cert-gen, ML-DSA
# keygen/sign, private-key-id, or TLS 1.3) — fail loudly rather than skip.
- name: Verify PQC TLS examples built (not stubs)
run: |
for b in examples/pqc/gen_pqc_certs \
examples/tls/tls_server examples/tls/tls_client; do
if ./$b -h 2>&1 | grep -q "Requires"; then
echo "FAIL: $b is a stub — wolfSSL missing a required feature"
exit 1
fi
done
- name: PQC TLS handshake E2E (ML-KEM x ML-DSA matrix)
run: |
set +e
export LD_LIBRARY_PATH="$HOME/wolfssl-install/lib"
# run_examples.sh pairs the classical TLS tests with the wolfSSL
# example client/server, so point it at the clone built above
export WOLFSSL_PATH="$GITHUB_WORKSPACE/wolfssl"
./src/fwtpm/fwtpm_server >/tmp/fwtpm_tls.log 2>&1 &
server_pid=$!
trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT
sleep 2
ENABLE_PQC_TLS=1 ./examples/run_examples.sh
rc=$?
exit $rc
- name: Upload failure logs
if: failure()
uses: actions/upload-artifact@v4
with:
name: pqc-tls-examples-logs
path: |
/tmp/fwtpm_tls.log
run.out
pqtls.out
config.log
tests/*.log
retention-days: 5