mirror of https://github.com/wolfSSL/wolfBoot.git
119 lines
4.4 KiB
YAML
119 lines
4.4 KiB
YAML
name: wolfHSM simulator test
|
|
|
|
on:
|
|
push:
|
|
branches: [ 'master', 'main', 'release/**' ]
|
|
pull_request:
|
|
branches: [ '*' ]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
wolfhsm_simulator_test:
|
|
# Matrix strategy runs all steps below for each config specified.
|
|
# This allows testing multiple configurations without duplicating the workflow.
|
|
strategy:
|
|
matrix:
|
|
config:
|
|
- name: "wolfHSM client ECC"
|
|
file: "config/examples/sim-wolfHSM-client-ecc.config"
|
|
needs_posix_server: true
|
|
posix_server_nvminit: false
|
|
needs_nvm_image: false
|
|
- name: "wolfHSM client ML-DSA"
|
|
file: "config/examples/sim-wolfHSM-client-mldsa.config"
|
|
needs_posix_server: true
|
|
posix_server_nvminit: false
|
|
needs_nvm_image: false
|
|
- name: "wolfHSM client cert chain verify ECC"
|
|
file: "config/examples/sim-wolfHSM-client-certchain-ecc.config"
|
|
needs_posix_server: true
|
|
posix_server_nvminit: true
|
|
needs_nvm_image: false
|
|
- name: "wolfHSM client cert chain verify RSA4096"
|
|
file: "config/examples/sim-wolfHSM-client-certchain-rsa4096.config"
|
|
needs_posix_server: true
|
|
posix_server_nvminit: true
|
|
needs_nvm_image: false
|
|
- name: "wolfHSM server cert chain verify ECC"
|
|
file: "config/examples/sim-wolfHSM-server-certchain-ecc.config"
|
|
needs_posix_server: false
|
|
posix_server_nvminit: false
|
|
needs_nvm_image: true
|
|
- name: "wolfHSM server cert chain verify RSA4096"
|
|
file: "config/examples/sim-wolfHSM-server-certchain-rsa4096.config"
|
|
needs_posix_server: false
|
|
posix_server_nvminit: false
|
|
needs_nvm_image: true
|
|
|
|
fail-fast: false
|
|
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: ghcr.io/wolfssl/wolfboot-ci-sim:v0.9.3
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Trust workspace
|
|
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
|
|
- name: make clean
|
|
run: |
|
|
make distclean
|
|
|
|
- name: Select config (${{ matrix.config.name }})
|
|
run: |
|
|
cp ${{ matrix.config.file }} .config
|
|
|
|
- name: Build tools
|
|
run: |
|
|
make -C tools/keytools && make -C tools/bin-assemble
|
|
|
|
- name: Build wolfboot.elf
|
|
run: |
|
|
make clean && make test-sim-internal-flash-with-update
|
|
|
|
- name: Build example POSIX TCP server
|
|
if: matrix.config.needs_posix_server
|
|
run: cd lib/wolfHSM/examples/posix/wh_posix_server && make WOLFSSL_DIR=../../../../wolfssl
|
|
|
|
# Start the server in the background
|
|
- name: Run POSIX TCP server
|
|
if: matrix.config.needs_posix_server
|
|
run: |
|
|
cd lib/wolfHSM/examples/posix/wh_posix_server
|
|
if [ "${{ matrix.config.posix_server_nvminit }}" = "true" ]; then
|
|
tmpfile=$(mktemp)
|
|
echo "obj 1 0xFFFF 0x0000 \"cert CA\" ../../../../../test-dummy-ca/root-cert.der" >> $tmpfile
|
|
./Build/wh_posix_server.elf --type tcp --nvminit $tmpfile &
|
|
else
|
|
# --flags=0x100 sets the WH_NVM_FLAGS_USAGE_VERIFY flag
|
|
./Build/wh_posix_server.elf --type tcp --client 12 --id 255 --flags 0x100 --key ../../../../../wolfboot_signing_private_key_pub.der &
|
|
fi
|
|
TCP_SERVER_PID=$!
|
|
echo "TCP_SERVER_PID=$TCP_SERVER_PID" >> $GITHUB_ENV
|
|
|
|
# For testing the wolfHSM server cert chain verify feature, we need to create an NVM image containing our root CA that
|
|
# the internal wolfHSM server can load.
|
|
- name: Create NVM image for wolfHSM server cert chain verify
|
|
if: matrix.config.needs_nvm_image
|
|
run: |
|
|
make -C lib/wolfHSM/tools/whnvmtool
|
|
tmpfile=$(mktemp)
|
|
echo "obj 1 0xFFFF 0x0000 \"cert CA\" test-dummy-ca/root-cert.der" >> $tmpfile
|
|
./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size=16348 --invert-erased-byte $tmpfile
|
|
|
|
# Run the sunny day update test against the server
|
|
- name: Run sunny day update test
|
|
run: |
|
|
tools/scripts/sim-sunnyday-update.sh
|
|
|
|
# Kill the server if it is still running
|
|
- name: Kill POSIX TCP server
|
|
if: always() && matrix.config.needs_posix_server
|
|
run: |
|
|
kill $TCP_SERVER_PID || true
|