From 3f7db5894388ccce07bf732a4017bac9410eb756 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Mon, 27 Apr 2026 10:53:27 -0700
Subject: [PATCH] fix keyload ecc 159 in CI: writeKeyBlob silent write failure

---
 .github/workflows/pqc-examples.yml |  5 +++
 examples/run_examples.sh           |  4 +-
 examples/tpm_test_keys.c           | 64 ++++++++++++++++++------------
 3 files changed, 47 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/pqc-examples.yml b/.github/workflows/pqc-examples.yml
index 2034a9db..2cccbaa8 100644
--- a/.github/workflows/pqc-examples.yml
+++ b/.github/workflows/pqc-examples.yml
@@ -62,6 +62,11 @@ jobs:
             ip link set lo up
             make check
           '
+          # make check runs as root via sudo -E unshare; restore ownership of
+          # any files left in the workspace so later steps (running as the
+          # unprivileged runner) can rewrite them — otherwise stale root-owned
+          # blobs (e.g. eccblob.bin) silently break run_examples.sh later.
+          sudo chown -R "$(id -u):$(id -g)" .
 
       # ----- Tier 2: per-example standalone runs -----
       # Each example gets its own GitHub Actions check so a regression
diff --git a/examples/run_examples.sh b/examples/run_examples.sh
index 4691bece..2b9d0fd2 100755
--- a/examples/run_examples.sh
+++ b/examples/run_examples.sh
@@ -65,6 +65,8 @@ wait_for_port() {
 # Clean stale key blobs and certs from prior runs.
 # These depend on TPM NV state (SRK seed), so they're invalid after NV wipe.
 rm -f keyblob.bin rsa_test_blob.raw ecc_test_blob.raw
+rm -f eccblob.bin ecckeyblob.bin ecckeyblobeh.bin
+rm -f rsakeyblob.bin rsakeyblobeh.bin
 rm -f ./certs/tpm-rsa-cert.pem ./certs/tpm-ecc-cert.pem
 rm -f ./certs/tpm-rsa-cert.csr ./certs/tpm-ecc-cert.csr
 rm -f ./certs/server-rsa-cert.pem ./certs/server-ecc-cert.pem
@@ -273,7 +275,7 @@ if [ $WOLFCRYPT_ENABLE -eq 1 ]; then
         fi
     fi
 fi
-rm -f ececcblob.bin
+rm -f eccblob.bin
 
 if [ $ENABLE_V185 -eq 1 ]; then
     echo -e "PQC Key Generation Tests (v1.85)"
diff --git a/examples/tpm_test_keys.c b/examples/tpm_test_keys.c
index 18ac8715..03b4b8e1 100644
--- a/examples/tpm_test_keys.c
+++ b/examples/tpm_test_keys.c
@@ -136,40 +136,54 @@ int readBin(const char* filename, byte *buf, word32* bufSz)
 int writeKeyBlob(const char* filename,
                         WOLFTPM2_KEYBLOB* key)
 {
-    int rc = 0;
+    int rc = TPM_RC_FAILURE;
 #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
     XFILE  fp = NULL;
     size_t fileSz = 0;
+    size_t expectedSz;
     byte pubAreaBuffer[sizeof(TPM2B_PUBLIC)];
     int pubAreaSize;
 
     fp = XFOPEN(filename, "wb");
-    if (fp != XBADFILE) {
-        /* Make publicArea in encoded format to eliminate empty fields,
-         * save space */
-        rc = TPM2_AppendPublic(pubAreaBuffer, (word32)sizeof(pubAreaBuffer),
-            &pubAreaSize, &key->pub);
-        if (rc != TPM_RC_SUCCESS) {
-            XFCLOSE(fp);
-            return rc;
-        }
-        if (pubAreaSize != (key->pub.size + (int)sizeof(key->pub.size))) {
-            printf("writeKeyBlob: Sanity check for publicArea size failed\n");
-            XFCLOSE(fp);
-            return BUFFER_E;
-        }
-    #ifdef WOLFTPM_DEBUG_VERBOSE
-        TPM2_PrintBin(pubAreaBuffer, pubAreaSize);
-    #endif
-        /* Write size marker for the public part */
-        fileSz += XFWRITE(&key->pub.size, 1, sizeof(key->pub.size), fp);
-        /* Write the public part with bytes aligned */
-        fileSz += XFWRITE(pubAreaBuffer, 1, sizeof(UINT16) + key->pub.size, fp);
-        /* Write the private part, size marker is included */
-        fileSz += XFWRITE(&key->priv, 1, sizeof(UINT16) + key->priv.size, fp);
-        XFCLOSE(fp);
+    if (fp == XBADFILE) {
+        printf("writeKeyBlob: cannot open %s for writing\n", filename);
+        return TPM_RC_FAILURE;
     }
+
+    /* Make publicArea in encoded format to eliminate empty fields,
+     * save space */
+    rc = TPM2_AppendPublic(pubAreaBuffer, (word32)sizeof(pubAreaBuffer),
+        &pubAreaSize, &key->pub);
+    if (rc != TPM_RC_SUCCESS) {
+        XFCLOSE(fp);
+        return rc;
+    }
+    if (pubAreaSize != (key->pub.size + (int)sizeof(key->pub.size))) {
+        printf("writeKeyBlob: Sanity check for publicArea size failed\n");
+        XFCLOSE(fp);
+        return BUFFER_E;
+    }
+#ifdef WOLFTPM_DEBUG_VERBOSE
+    TPM2_PrintBin(pubAreaBuffer, pubAreaSize);
+#endif
+    /* Write size marker for the public part */
+    fileSz += XFWRITE(&key->pub.size, 1, sizeof(key->pub.size), fp);
+    /* Write the public part with bytes aligned */
+    fileSz += XFWRITE(pubAreaBuffer, 1, sizeof(UINT16) + key->pub.size, fp);
+    /* Write the private part, size marker is included */
+    fileSz += XFWRITE(&key->priv, 1, sizeof(UINT16) + key->priv.size, fp);
+    XFCLOSE(fp);
+
+    expectedSz = sizeof(key->pub.size)
+               + sizeof(UINT16) + key->pub.size
+               + sizeof(UINT16) + key->priv.size;
     printf("Wrote %d bytes to %s\n", (int)fileSz, filename);
+    if (fileSz != expectedSz) {
+        printf("writeKeyBlob: short write %d/%d to %s\n",
+            (int)fileSz, (int)expectedSz, filename);
+        return TPM_RC_FAILURE;
+    }
+    rc = TPM_RC_SUCCESS;
 #else
     (void)filename;
     (void)key;