PR #501: enforce wolfSSL >= v5.8.0 floor for PQC + add nightly upstream-drift CI

configure.ac: add LIBWOLFSSL_VERSION_HEX check so --enable-v185/--enable-pqc fails fast against unsupported wolfSSL releases (kyber.h era), instead of relying on transitive header aliasing through wc_mlkem.h. Add .github/workflows/wolfssl-versions.yml matrix: builds wolfTPM PQC against wolfSSL v5.8.0-stable, v5.8.4-stable, v5.9.1-stable, and master. Catches the next upstream rename within the matrix run, not 9 days later. Add .github/workflows/nightly.yml: cron 02:17 UTC fan-out via repository_dispatch[nightly-trigger]. 12 workflows opt in (cmake-build, codespell, fwtpm-test, make-test-swtpm, multi-compiler, pqc-examples, release-checks, sanitizer, seal-test, win-test, wolfssl-versions, zephyr). hw-spdm-test deliberately does NOT opt in so the self-hosted Pi runner cannot be batch-triggered. repository_dispatch is API-only (no UI button) so only the nightly job can fire these.
2026-05-08 13:10:52 -07:00 · 2026-05-08 13:10:52 -07:00 · 182230c933
parent 6f8bae6c58
commit 182230c933
14 changed files with 178 additions and 6 deletions
--- a/.github/workflows/cmake-build.yml
+++ b/.github/workflows/cmake-build.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  build:
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
--- a/.github/workflows/fwtpm-test.yml
+++ b/.github/workflows/fwtpm-test.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  # ----------------------------------------------------------------
--- a/.github/workflows/make-test-swtpm.yml
+++ b/.github/workflows/make-test-swtpm.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  build:
--- a/.github/workflows/multi-compiler.yml
+++ b/.github/workflows/multi-compiler.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@ -0,0 +1,40 @@
+name: Nightly CI
+
+# Daily fan-out to every wolfTPM workflow that listens for the
+# 'nightly-trigger' repository_dispatch event. Catches upstream wolfSSL
+# drift (e.g. header renames, API breaks) within ~24h.
+#
+# Workflows opt in by adding the listener to their `on:` block:
+#   repository_dispatch:
+#     types: [nightly-trigger]
+#
+# repository_dispatch is API-only — there is no UI button to trigger
+# these workflows by hand. Maintainers cannot accidentally fire them.
+# Workflows that should never be batch-triggered (e.g. hw-spdm-test on
+# the self-hosted Pi runner) simply don't add the listener.
+
+on:
+  schedule:
+    # 02:00 UTC daily (offset from typical top-of-hour congestion).
+    - cron: '17 2 * * *'
+
+permissions:
+  contents: write
+
+jobs:
+  fan-out:
+    name: Dispatch nightly-trigger to all listening workflows
+    runs-on: ubuntu-latest
+    if: github.repository == 'wolfSSL/wolfTPM'
+
+    steps:
+      - name: Send repository_dispatch event
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.createDispatchEvent({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event_type: 'nightly-trigger',
+            });
+            core.info('Dispatched nightly-trigger; all listening workflows will fire.');
--- a/.github/workflows/pqc-examples.yml
+++ b/.github/workflows/pqc-examples.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  pqc-examples:
--- a/.github/workflows/release-checks.yml
+++ b/.github/workflows/release-checks.yml
@ -11,6 +11,8 @@ on:
    branches: [ 'master', 'main', 'release/**', 'rel_v*_prep' ]
  pull_request:
    branches: [ '**' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
--- a/.github/workflows/sanitizer.yml
+++ b/.github/workflows/sanitizer.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
--- a/.github/workflows/seal-test.yml
+++ b/.github/workflows/seal-test.yml
@ -19,6 +19,8 @@ on:
      - 'src/tpm2_wrap.c'
      - 'src/fwtpm/**'
      - 'wolftpm/tpm2_wrap.h'
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  seal-test:
--- a/.github/workflows/win-test.yml
+++ b/.github/workflows/win-test.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  build:
--- a/.github/workflows/wolfssl-versions.yml
+++ b/.github/workflows/wolfssl-versions.yml
@ -0,0 +1,97 @@
+name: wolfSSL Version Matrix (PQC)
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pqc-build-test:
+    name: wolfSSL ${{ matrix.wolfssl-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - wolfssl-version: 'v5.8.0-stable'
+            wolfssl-ref: 'v5.8.0-stable'
+            cache-key: 'wolfssl-pqc-v5.8.0-v1'
+          - wolfssl-version: 'v5.8.4-stable'
+            wolfssl-ref: 'v5.8.4-stable'
+            cache-key: 'wolfssl-pqc-v5.8.4-v1'
+          - wolfssl-version: 'v5.9.1-stable'
+            wolfssl-ref: 'v5.9.1-stable'
+            cache-key: 'wolfssl-pqc-v5.9.1-v1'
+          # master always rebuilds (no cache) so wolfSSL upstream renames /
+          # API breaks surface within ~24h on the next scheduled run.
+          - wolfssl-version: 'master'
+            wolfssl-ref: 'master'
+
+    steps:
+      - name: Checkout wolfTPM
+        uses: actions/checkout@v4
+
+      - name: Install build deps
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y autoconf automake libtool
+
+      - name: Cache wolfSSL ${{ matrix.wolfssl-version }}
+        if: matrix.wolfssl-version != 'master'
+        id: cache-wolfssl
+        uses: actions/cache@v4
+        with:
+          path: ~/wolfssl-install
+          key: ${{ matrix.cache-key }}
+
+      - name: Build wolfSSL ${{ matrix.wolfssl-version }} with PQC
+        if: matrix.wolfssl-version == 'master' || steps.cache-wolfssl.outputs.cache-hit != 'true'
+        run: |
+          cd ~
+          git clone --depth 1 --branch ${{ matrix.wolfssl-ref }} \
+              https://github.com/wolfSSL/wolfssl.git
+          cd wolfssl
+          ./autogen.sh
+          ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen \
+                      --enable-dilithium --enable-mlkem --enable-experimental \
+                      --enable-harden CFLAGS="-DWC_RSA_NO_PADDING" \
+                      --prefix=$HOME/wolfssl-install
+          make -j"$(nproc)"
+          make install
+
+      - name: wolfSSL version info
+        run: |
+          grep LIBWOLFSSL_VERSION_STRING $HOME/wolfssl-install/include/wolfssl/version.h
+          grep LIBWOLFSSL_VERSION_HEX $HOME/wolfssl-install/include/wolfssl/version.h
+
+      - name: Build wolfTPM with v1.85 + fwTPM
+        run: |
+          ./autogen.sh
+          CPPFLAGS="-I$HOME/wolfssl-install/include" \
+          LDFLAGS="-L$HOME/wolfssl-install/lib -Wl,-rpath,$HOME/wolfssl-install/lib" \
+            ./configure --enable-v185 --enable-fwtpm --enable-debug=verbose
+          make -j"$(nproc)"
+
+      - name: Run fwtpm_unit.test (PQC KAT block)
+        run: |
+          export LD_LIBRARY_PATH=$HOME/wolfssl-install/lib
+          ./tests/fwtpm_unit.test
+
+      - name: Upload failure logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: wolfssl-versions-${{ matrix.wolfssl-version }}-logs
+          path: |
+            config.log
+            tests/*.log
+            test-suite.log
+          retention-days: 5
--- a/.github/workflows/zephyr.yml
+++ b/.github/workflows/zephyr.yml
@ -5,6 +5,8 @@ on:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '*' ]
+  repository_dispatch:
+    types: [nightly-trigger]

 jobs:
  run_test:
--- a/configure.ac
+++ b/configure.ac
@ -714,11 +714,11 @@ else
       test "x$ENABLED_WOLFCRYPT" = "xyes"
    then
        # Probe the actual symbols, not just the headers. wolfSSL ships
-        # dilithium.h / wc_mlkem.h even without the implementation compiled
-        # (function decls are gated behind HAVE_DILITHIUM / HAVE_MLKEM
-        # which only get defined via wolfssl/options.h after the right
-        # --enable-* flags). Include options.h first so the gate is set
-        # before the header decls are parsed.
+        # dilithium.h and wc_mlkem.h even without the implementation
+        # compiled (function decls are gated behind HAVE_DILITHIUM /
+        # HAVE_MLKEM which only get defined via wolfssl/options.h after
+        # the right --enable-* flags). Include options.h first so the
+        # gate is set before the header decls are parsed.
        AC_CHECK_DECL([wc_dilithium_init],
            [WOLFTPM_HAVE_DILITHIUM_FN=yes],
            [WOLFTPM_HAVE_DILITHIUM_FN=no],
@ -754,9 +754,22 @@ then
        [[#include <wolfssl/options.h>
          #include <wolfssl/wolfcrypt/dilithium.h>]])
    AC_CHECK_DECL([wc_MlKemKey_Init], [],
-        [AC_MSG_ERROR([--enable-v185/--enable-pqc requires wolfSSL built with --enable-mlkem --enable-experimental])],
+        [AC_MSG_ERROR([--enable-v185/--enable-pqc requires wolfSSL >= v5.8.0-stable built with --enable-mlkem --enable-experimental])],
        [[#include <wolfssl/options.h>
          #include <wolfssl/wolfcrypt/wc_mlkem.h>]])
+
+    AC_MSG_CHECKING([wolfSSL version >= v5.8.0 for PQC])
+    AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+        #include <wolfssl/version.h>
+        #if LIBWOLFSSL_VERSION_HEX < 0x05008000
+        #error "wolfSSL < v5.8.0"
+        #endif
+        int main(void) { return 0; }
+    ]])],
+    [AC_MSG_RESULT([yes])],
+    [AC_MSG_RESULT([no])
+     AC_MSG_ERROR([wolfTPM PQC requires wolfSSL >= v5.8.0-stable. Please upgrade wolfSSL.])])
+
    AM_CFLAGS="$AM_CFLAGS -DWOLFTPM_V185"
 fi
 AM_CONDITIONAL([BUILD_V185], [test "x$ENABLED_V185" = "xyes"])