The dependency assertion checked only that wolfssl was present with a
DEPENDS_ON edge, never that the recorded version matched WOLFSSL_DIR, so
the SBOM could attest a version wolfSSH was not built against and still
pass. Compare versionInfo against the tree.
That assertion alone would not have caught it: the runner installs
wolfssl from the same tree it passes as WOLFSSL_DIR, so pkg-config and
wolfssl/version.h always agree and a wrong source is indistinguishable
from a right one. Add a step that forces them apart -- a stub pkg-config
reports a sentinel version, and a distclean'd copy of the tree has no
generated version.h, so the configure.ac fallback is the only route to a
correct answer. Reverting the recipe fix makes this step fail with the
sentinel, and the fallback path now has CI coverage it lacked.
The gate skipped SBOM generation and exited 0 whenever wolfssl's
scripts/gen-sbom was absent, so the job could report success having
never exercised `make sbom`. That was deliberate while the script was
unmerged, but it landed on master in wolfSSL/wolfssl#10343.
On master, a missing gen-sbom or one too old for --dep-wolfssl is a
regression, so fail instead of skipping: a green run now always means
the target was exercised and the wolfssl-dependency assertions ran.
Only a deliberately pinned older wolfssl_ref still degrades to a skip.
The ref is passed through env rather than interpolated into the shell
script, to keep the workflow expression out of the command line.
wolfSSL/wolfssl#10343 merged on 2026-07-27, but the SBOM workflow still
checked out wolfssl at refs/pull/10343/head. GitHub keeps PR refs alive
after merge, so CI stayed green while validating a pre-merge snapshot
rather than master. Point wolfssl_ref and its fallback at master.
Distinguish the two gen-sbom lookup failures. A set-but-wrong
WOLFSSL_DIR previously printed the "re-run with WOLFSSL_DIR=..." advice
to someone who had already set it; it now names the path that was
probed and states that WOLFSSL_DIR is a source tree, not an install
prefix.
Refresh the README and in-recipe notes that still told users to track
the #10343 branch until it merged.
Re-sync scripts/sbom.am with the canonical wolfSSL copy ($(docdir)
sbomdir, [[:space:]] version parse, GNU-make and uninstall-sbom docs)
and widen the SBOM workflow pull_request filter to '**'.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Move the make sbom / install-sbom / uninstall-sbom recipe out of
Makefile.am into a reusable scripts/sbom.am fragment; Makefile.am now
just declares the product facts (name, LICENSING, wolfssl dependency,
GPL-3.0-only default) and includes it.
Add a GitHub Actions workflow covering both SBOM paths:
- autotools: build wolfSSL + wolfSSH, run make sbom, assert SPDX
validity, CycloneDX identity, reproducibility, and the wolfssl
dependency edge.
- embedded: run gen-sbom against user_settings.h (via pcpp) + the
wolfSSH source set, asserting the same identity/validity/reproducibility
plus that user_settings.h options and the wolfssl dependency are
captured.
Both gracefully skip on a gen-sbom that predates the wolfSSL SBOM
change.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
- --enable-sshclient defaults to no, so the app was built only by the
configs that use --enable-all, and never under the multi-compiler
warning flags. Add it to the multi-compiler matrix.
- Add scripts/sshclient.test, run by make check. It covers the client's
sessions and the -E log file against the echoserver.
- The script is not gated on BUILD_SSHCLIENT. It exits 77 when the
client app or the echoserver isn't there, so every build runs it and
the ones without the app report it as a skip.
- Check the client and the echoserver by asking each for its usage
message, not by looking for the file. Both are libtool wrapper
scripts in the build tree, and a wrapper outlives a reconfigure that
drops the program it wraps, then runs only far enough to say so.
- The echoserver runs in echo mode and the client's stdin comes from a
fifo written a piece at a time, so the session carries data and ends
on its own. Each client run has a watchdog.
- Rename sshd-test.yml's job to cover both apps. That workflow builds
the client app along with wolfsshd.
- Check that the command reaches the server, now that the client sends
it rather than discarding it.
- Make the SINGLE_THREADED guard a preprocessor #error. The runtime
err_sys() only caught the misconfiguration in an autotools build that
got as far as running; the #error catches it at compile time for the
IDE and plain Makefile builds too.
- Treat WS_WANT_READ and WS_WANT_WRITE out of wolfSSH_worker() as a
clean shutdown. The socket is non-blocking, so the peer having
nothing ready is not a session failure.
- No job compiled a wolfSSH test binary with WOLFSSH_TPM defined, so a
test guarded on it compiled out everywhere and could not gate a
merge. This job enables TPM but only builds; the jobs that run make
check do not enable it.
- Add a make check step. automake's check-am builds every check_PROGRAM
regardless of the TESTS override, so this is the only job that
compiles wolfSSH's tests with TPM support.
- Override TESTS to run only tests/api.test, the one suite with
TPM-specific tests. kex.test also aborts in the example client, which
demands -K in a TPM build.
- Restrict it to one matrix cell. The 2x2x2 matrix varies the simulator
and the host key, neither of which these tests touch.
- Assert -DWOLFSSH_TPM in AM_CPPFLAGS first. A build without it
compiles the guarded tests out and still exits 0, a hollow pass.
- Dump tests/api.log on failure and archive it.
- add a v4.4.0 matrix leg alongside v3.4.0
- run each leg in the Zephyr CI image with the matching SDK
(ci:v0.26.4/SDK 0.16.1, ci:v0.29.0/SDK 1.0.0); drops the manual
deps, west, pip and SDK install steps
- scope twister by --testsuite-root and drop --test: the scenario
id is path-prefixed on 3.4.0 but bare on 4.x
- replace zip with tar caf logs.tar.xz for the failure-log artifact
1. Update WOLFSSL_REF to v5.9.1-stable in the ML-KEM and single-thread
tests (interop-mlkem.yml, singlethread-check.yml).
2. Drop kyber.yml; its coverage is a strict subset of interop-mlkem.yml.
Fold its push and workflow_dispatch triggers into interop-mlkem.yml so
ML-KEM still runs on master/release pushes and via manual dispatch.
3. Drop liboqs from the ML-KEM test. It isn't in configure.ac any more.
Simulate netowrk latency using netem and use it to test the non-blocking
mode of SFTP. This helps find issues which would affect running an SFTP
server on a microcontroller. It helped find the bug fixed in #876.
1. Update caching the download of the FatFS source archive to the
pattern other tests are using to cache items. It was downloading
the FatFS source archive every time, despite it being in the cache.
2. Update building wolfSSL to follow the pattern of the other tests.
When wolfSSH_SFTP_buffer_send() called wolfSSH_stream_send(), the data
would be consumed into the SSH output buffer even if the underlying
socket returned EWOULDBLOCK/EAGAIN. SendChannelData() returns the
positive dataSz on WS_WANT_WRITE, causing the SFTP layer to advance
its buffer index as if the data was sent. The SSH output buffer still
had pending data that was never flushed, leading to an indefinite hang.
Fix: At the start of wolfSSH_SFTP_buffer_send(), check if there's
pending data in ssh->outputBuffer from a previous WS_WANT_WRITE. If
so, attempt to flush it first and return WS_WANT_WRITE if the flush
fails. This ensures the caller retries until all pending data is sent.
Also expose WS_SFTP_BUFFER and wolfSSH_SFTP_buffer_send() as
WOLFSSH_LOCAL for unit testing, and add regression test that verifies
the fix catches the bug.
Fixes ZD 21157
Mark Atwood
Sameeh Jubran
John Safranek
Paul Adelsbach
Yosuke Shimizu
Emma Stensland
aidan garske
JacobBarthelmeh
Andrew Hutchings
David Garske