wolfBoot/.github/workflows/test-wolfhsm-simulator.yml

name: wolfHSM simulator test

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
  workflow_dispatch:

jobs:
  wolfhsm_simulator_test:
    # Matrix strategy runs all steps below for each config specified.
    # This allows testing multiple configurations without duplicating the workflow.
    strategy:
      matrix:
        config:
          - name: "wolfHSM client ECC"
            file: "config/examples/sim-wolfHSM-client-ecc.config"
            needs_posix_server: true
            posix_server_nvminit: false
            needs_nvm_image: false
          - name: "wolfHSM client ML-DSA"
            file: "config/examples/sim-wolfHSM-client-mldsa.config"
            needs_posix_server: true
            posix_server_nvminit: false
            needs_nvm_image: false
          - name: "wolfHSM client cert chain verify ECC"
            file: "config/examples/sim-wolfHSM-client-certchain-ecc.config"
            needs_posix_server: true
            posix_server_nvminit: true
            needs_nvm_image: false
          - name: "wolfHSM client cert chain verify RSA4096"
            file: "config/examples/sim-wolfHSM-client-certchain-rsa4096.config"
            needs_posix_server: true
            posix_server_nvminit: true
            needs_nvm_image: false
          - name: "wolfHSM server cert chain verify ECC"
            file: "config/examples/sim-wolfHSM-server-certchain-ecc.config"
            needs_posix_server: false
            posix_server_nvminit: false
            needs_nvm_image: true
          - name: "wolfHSM server cert chain verify RSA4096"
            file: "config/examples/sim-wolfHSM-server-certchain-rsa4096.config"
            needs_posix_server: false
            posix_server_nvminit: false
            needs_nvm_image: true

      fail-fast: false

    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Workaround for sources.list
        run: |
            # Replace sources

            set -euxo pipefail

            # Peek (what repos are active now)
            apt-cache policy
            grep -RInE '^(deb|Types|URIs)' /etc/apt || true

            # Enable nullglob so *.list/*.sources that don't exist don't break sed
            shopt -s nullglob

            echo "Replace sources.list (legacy)"
            sudo sed -i \
              -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
              /etc/apt/sources.list || true

            echo "Replace sources.list.d/*.list (legacy)"
            for f in /etc/apt/sources.list.d/*.list; do
              sudo sed -i \
                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
                "$f"
            done

            echo "Replace sources.list.d/*.sources (deb822)"
            for f in /etc/apt/sources.list.d/*.sources; do
              sudo sed -i \
                -e "s|https\?://azure\.archive\.ubuntu\.com/ubuntu/?|http://mirror.arizona.edu/ubuntu/|g" \
                -e "s|https\?://azure\.archive\.ubuntu\.com|http://mirror.arizona.edu|g" \
                "$f"
            done

            echo "Fix /etc/apt/apt-mirrors.txt (used by URIs: mirror+file:...)"
            if grep -qE '^[[:space:]]*https?://azure\.archive\.ubuntu\.com/ubuntu/?' /etc/apt/apt-mirrors.txt; then
              # Replace azure with our mirror (idempotent)
              sudo sed -i 's|https\?://azure\.archive\.ubuntu\.com/ubuntu/|http://mirror.arizona.edu/ubuntu/|g' /etc/apt/apt-mirrors.txt
            fi

            # Peek (verify changes)
            grep -RIn "azure.archive.ubuntu.com" /etc/apt || true
            grep -RInE '^(deb|Types|URIs)' /etc/apt || true
            echo "--- apt-mirrors.txt ---"
            cat /etc/apt/apt-mirrors.txt || true            

      - name: Update repository
        run: sudo apt-get update

      - name: make clean
        run: |
          make distclean          

      - name: Select config (${{ matrix.config.name }})
        run: |
          cp ${{ matrix.config.file }} .config          

      - name: Build tools
        run: |
          make -C tools/keytools && make -C tools/bin-assemble          

      - name: Build wolfboot.elf
        run: |
          make clean && make test-sim-internal-flash-with-update          

      - name: Build example POSIX TCP server
        if: matrix.config.needs_posix_server
        run: cd lib/wolfHSM/examples/posix/wh_posix_server && make WOLFSSL_DIR=../../../../wolfssl

      # Start the server in the background
      - name: Run POSIX TCP server
        if: matrix.config.needs_posix_server
        run: |
          cd lib/wolfHSM/examples/posix/wh_posix_server
          if [ "${{ matrix.config.posix_server_nvminit }}" = "true" ]; then
            tmpfile=$(mktemp)
            echo "obj 1 0xFFFF 0x0000 \"cert CA\" ../../../../../test-dummy-ca/root-cert.der" >> $tmpfile
            ./Build/wh_posix_server.elf --type tcp --nvminit $tmpfile &
          else
            # --flags=0x100 sets the WH_NVM_FLAGS_USAGE_VERIFY flag
            ./Build/wh_posix_server.elf --type tcp --client 12 --id 255 --flags 0x100 --key ../../../../../wolfboot_signing_private_key_pub.der &
          fi
          TCP_SERVER_PID=$!
          echo "TCP_SERVER_PID=$TCP_SERVER_PID" >> $GITHUB_ENV          

      # For testing the wolfHSM server cert chain verify feature, we need to create an NVM image containing our root CA that
      # the internal wolfHSM server can load.
      - name: Create NVM image for wolfHSM server cert chain verify
        if: matrix.config.needs_nvm_image
        run: |
          make -C lib/wolfHSM/tools/whnvmtool
          tmpfile=$(mktemp)
          echo "obj 1 0xFFFF 0x0000 \"cert CA\" test-dummy-ca/root-cert.der" >> $tmpfile
          ./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size=16348 --invert-erased-byte $tmpfile          

      # Run the sunny day update test against the server
      - name: Run sunny day update test
        run: |
          tools/scripts/sim-sunnyday-update.sh          

      # Kill the server if it is still running
      - name: Kill POSIX TCP server
        if: always() && matrix.config.needs_posix_server
        run: |
          kill $TCP_SERVER_PID || true