# Source of truth for what CI builds and runs. # # Every directory holding buildable source must appear here, or # `manifest.py check` fails. That is deliberate: a new example is a CI failure # until someone decides what to do with it. # # tier: host (default) | emulated | cross -- which workflow owns it # mode: run (default) | build-only | skip -- skip REQUIRES a reason # profile: which wolfSSL build it needs (a property of the dir, never a matrix axis) # build: make (default) | none | [literal, argv] # # Every entry gets its own CI job, so a red tile names the example that broke. # # Adding an example: add an entry. If it cannot run in CI, say so in `reason`. # # PIN EVERY EXTERNAL PROJECT. wolfSSL is the only thing CI follows a moving ref # for -- that is the point. Anything else (picoTCP, mbedTLS, ibmswtpm2, newt, # wolfTPM, an SDK) gets the version the example's README documents, or a tag if # the README is silent. Tracking someone else's master means their drift lands # as our red, on a PR that changed none of it. # Each profile is derived from the READMEs of the examples that use it -- NOT # from --enable-all. --enable-all is not a superset: it omits mlkem, acert, # ascon and trackmemory, so examples that need those fail to compile against it. # Testing what the README documents is also the only honest thing for a repo # whose whole job is showing people how to build. # # Where a README and the source disagree, the source wins (noted inline). # A profile is built once per (profile, wolfSSL ref) and cached; every example # using it then restores rather than rebuilds. profiles: # plain ./configure -- examples whose README asks for nothing special default: flags: "--enable-static --enable-shared" all: # Only for the emulated/cross tiers, whose workflows either build wolfSSL # in-tree (ESP32, Pico) or pass their own flags (tpm, sgx). Host examples # must name the profile their README documents instead. flags: "--enable-all --enable-static --enable-shared" crl: # certmanager/README: certverify loads a CRL and fails rc=1 without it flags: "--enable-crl --enable-ocsp --enable-static --enable-shared" debug: # custom-io-callbacks/README: the file-io callback pair needs debug output flags: "--enable-debug --enable-static --enable-shared" opensslextra: # certfields/* and certstore. keyUsage/extendedKeyUsage READMEs say plain # ./configure but their sources print "configure with --enable-opensslextra" # and produce nothing without it. flags: "--enable-opensslall --enable-opensslextra --enable-static --enable-shared" crypto: # union of crypto/* and hash/*: 3des, aes, aes-modes, camellia, ascon, # keywrap, kdf, pkcs12, siphash, blake2 flags: >- --enable-pwdbased --enable-des3 --enable-camellia --enable-ascon --enable-experimental --enable-aesgcm-stream --enable-aesccm --enable-aesctr --enable-aescfb --enable-aesofb --enable-aeseax --enable-aessiv --enable-aesxts --enable-aeskeywrap --enable-keygen --enable-certgen --enable-certext --enable-pkcs12 --enable-blake2 --enable-blake2s --enable-siphash --enable-hkdf --enable-scrypt --enable-static --enable-shared # aes-cts and aes-ecb have no configure flag: without these defines both # compile to a stub main() that prints "not compiled in" and returns 0. # WC_RNG_SEED_CB likewise has no --enable of its own (only opensslextra and # the FIPS paths set it), and aes/rdseed exits 1 with "requires __x86_64__ # and WC_RNG_SEED_CB" without it. cflags: "-DWOLFSSL_AES_CTS -DHAVE_AES_ECB -DWC_RNG_SEED_CB" sm: # crypto/sm/README: SM2/SM3/SM4 ship in the wolfSSL/wolfsm overlay, not in # wolfSSL itself, so these --enable flags do not exist until install.sh has # run against the source tree. setup-wolfssl applies the overlay before # autogen; nothing in an example's own build can reach that far back. # Bare name means latest on wolfsm's master: the repo publishes no tags and # has no other branch, so there is nothing to pin to short of a raw commit. overlay: wolfsm flags: "--enable-sm2 --enable-sm3 --enable-sm4-gcm --enable-static --enable-shared" certgen: flags: >- --enable-certgen --enable-certreq --enable-certext --enable-keygen --enable-ecc --enable-ed25519 --enable-cryptocb --enable-static --enable-shared cflags: "-DWOLFSSL_TEST_CERT -DHAVE_OID_DECODING -DHAVE_OID_ENCODING -DWOLFSSL_CUSTOM_OID -DOPENSSL_EXTRA_X509_SMALL" ecc: flags: >- --enable-ecc --enable-ecccustcurves --enable-trackmemory --enable-static --enable-shared # trackmemory is not in the README, but ecc-stack.c includes mem_track.h and # fails to link with "undefined reference to InitMemoryTracker" without it. cflags: "-DWOLFSSL_TEST_CERT -DWOLFSSL_DER_TO_PEM -DHAVE_ECC_KOBLITZ -DWOLFSSL_PUBLIC_MP" pk: # union of pk/*: ecc, ed25519, ed448, curve25519/448, srp, hpke, rsa-pss, keygen flags: >- --enable-ecc --enable-ed25519 --enable-ed448 --enable-curve25519 --enable-curve448 --enable-keygen --enable-rsapss --enable-srp --enable-hpke --enable-aesgcm --enable-eccsi --enable-sakke --enable-static --enable-shared # WOLFSSL_RSA_KEY_CHECK has no configure option: pk/rsa-kg calls # wc_CheckRsaKey, which rsa.c only defines under that macro. cflags: "-DWOLFSSL_PUBLIC_MP -DUSE_CERT_BUFFERS_2048 -DWOLFSSL_ECDSA_DETERMINISTIC_K -DWOLFSSL_RSA_KEY_CHECK" pkcs7: # --enable-indef is required by the streaming examples: without it # envelopedData-ktri-stream prints "Must build wolfSSL using ./configure # --enable-pkcs7 --enable-indef" and signedData-stream fails encode with -173. flags: >- --enable-pkcs7 --enable-indef --enable-pwdbased --enable-cryptocb --with-libz --enable-static --enable-shared cflags: "-DWOLFSSL_DER_TO_PEM" pkcs7smime: # Split from pkcs7 because --enable-smime forces opensslall on, and the other # eight targets do not need that surface. Without it smime and smime-verify # print "wolfSSL was compiled with out HAVE_SMIME support" and return 0. flags: >- --enable-pkcs7 --enable-indef --enable-pwdbased --enable-cryptocb --with-libz --enable-smime --enable-static --enable-shared cflags: "-DWOLFSSL_DER_TO_PEM" tls: # union of tls/ and tls-options/ READMEs. --enable-asynccrypt is deliberately # absent: it needs the separate wolfAsyncCrypt repo patched in. # keygen + des3: client-tls-pkcs12 needs both (PKCS12 default PBE is 3DES) or # it prints "not configured with ..." and exits 0. flags: >- --enable-tls13 --enable-ech --enable-writedup --enable-pkcallbacks --enable-postauth --enable-cryptocb --enable-opensslall --enable-session-ticket --enable-earlydata --enable-keygen --enable-des3 --enable-static --enable-shared cflags: "-DHAVE_SECRET_CALLBACK" dtls: # earlydata requires session tickets or PSK: without session-ticket, # configure dies with "cannot enable earlydata without enabling session # tickets and/or PSK". flags: >- --enable-dtls --enable-dtls13 --enable-tls13 --enable-sessionexport --enable-dtls-mtu --enable-earlydata --enable-session-ticket --enable-dtlscid --enable-opensslextra --enable-ipv6 --enable-static --enable-shared # No configure flag for this one; dtls/README.md says to define it so # server-dtls13-earlydata can call wolfSSL_dtls13_no_hrr_on_resume(). cflags: "-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME -DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS" psk: flags: "--enable-psk --enable-opensslextra --enable-tls13 --enable-static --enable-shared" cflags: "-DWOLFSSL_STATIC_PSK" pq: # pq/ml_kem, pq/ml_dsa, pq/stateful_hash_sig. --enable-all omits mlkem # entirely, which is what made pq-ml-kem fail on mlkem.h. # extra-pqc-hybrids (default off) is what gates WOLFSSL_SECP521R1MLKEM1024 # behind WOLFSSL_EXTRA_PQC_HYBRIDS in tls.c; pq/tls asks for that exact group, # so without it the client dies on "failed to set the requested group". flags: >- --enable-mlkem --enable-dilithium --enable-lms --enable-xmss --enable-extra-pqc-hybrids --enable-slhdsa=yes,sha2 --enable-experimental --enable-tls13 --enable-static --enable-shared acert: flags: "--enable-acert --enable-opensslextra --enable-rsapss --enable-static --enable-shared" staticmemory: # README says plain ./configure, but size-calculation.c has a hard # `#error requires --enable-staticmemory`. flags: "--enable-staticmemory --enable-static --enable-shared" # DEBUG_MEMORY_PRINT makes every wolfSSL allocation print "Alloc: ... -> N", # which is exactly what memory_bucket_optimizer parses. Its README reaches for # testwolfcrypt, but that is just a convenient allocator -- any program linked # against this build emits the same lines, so debug-callback-example next door # is the log source and no crypttests build is needed. cflags: "-DWOLFSSL_STATIC_MEMORY_DEBUG_CALLBACK -DWOLFSSL_DEBUG_MEMORY -DWOLFSSL_DEBUG_MEMORY_PRINT" staticmemory-nomalloc: # the bucket tester replays allocations against wolfSSL's static pool with no # heap fallback, so it needs WOLFSSL_NO_MALLOC -- and cannot share the # optimizer's debug-print build, whose log source allocates. flags: "--enable-staticmemory --enable-static --enable-shared" cflags: "-DWOLFSSL_NO_MALLOC" eccencrypt: flags: "--enable-eccencrypt --enable-tls13 --enable-static --enable-shared" httpsig: flags: "--enable-ed25519 --enable-coding --enable-static --enable-shared" x9146: flags: >- --enable-experimental --enable-dual-alg-certs --enable-dilithium --enable-debug --enable-static --enable-shared certvfy: flags: "--enable-cryptonly --enable-singlethreaded --enable-static --enable-shared" cflags: "-DWOLFSSL_SMALL_CERT_VERIFY" ocsp: flags: >- --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 --enable-ocsp-responder --enable-cert-setup-cb --enable-sessioncerts --enable-tls13 --enable-static --enable-shared pkcs11: flags: "--enable-pkcs11 --enable-cryptocb --enable-static --enable-shared" fastmath: # Not irreconcilable with --enable-all: configure.ac lets fastmath win and # sets SP_MATH_ALL=no, so it configures cleanly. Kept separate as a coverage # choice -- folding it in would flip every other dir off the sp-math default # that users actually ship. Drop this profile if pk/rsa gains an sp-math # nonblock path. flags: "--enable-all --enable-fastmath --enable-static --enable-shared" cflags: "-DWC_RSA_NONBLOCK -DWC_RSA_NONBLOCK_TIME" cryptonly: # Genuinely separate: removes the TLS API every other dir links against. # This is signature/rsa_vfy_only's README line in full -- an abridged version # fails configure with "please disable rsa if disabling asn", because # --enable-rsavfy is what reconciles RSA with --disable-asn. flags: >- --disable-asn --disable-filesystem --enable-cryptonly --enable-sp=smallrsa2048 --enable-sp-math --disable-dh --disable-ecc --disable-sha224 --enable-rsavfy --enable-static --enable-shared cflags: "-DWOLFSSL_PUBLIC_MP" examples: # ---------------------------------------------------------------- host: run # cmake.yml, not here: add_subdirectory(wolfssl) needs a wolfSSL source tree # beside it, and cloning one is impossible inside this harness's netns. - id: cmake path: cmake tier: cross profile: default - id: pkcs7 path: pkcs7 profile: pkcs7 deps: [zlib1g-dev] run: # runall.sh drives the binaries in dependency order (envelopedData-ktri # before envelopedDataDecode). It does not cover the targets driven # explicitly below. # openssl-verify.sh runs runall.sh and then validates every bundle it # produced with openssl cms. runall.sh alone only checks exit codes, which # is how signedData-stream shipped an empty eContent unnoticed. - script: [./scripts/openssl-verify.sh] timeout: 300 expect: "all openssl verifications passed" # Every expect: below is also the --enable-pkcs7 gate: without it these # print "Must build wolfSSL using ./configure --enable-pkcs7" and return 0, # so exit code alone cannot tell a real pass from PKCS#7 never running. - exec: [./signedData-p7b] expect: "Successfully verified SignedData bundle." # later and stricter than "PKCS7 Verify Success": the DER round-trip matched - exec: [./pkcs7-verify] expect: "DER output matches the original PEM" - exec: [./envelopedData-ktri-stream, content.txt] expect: "bytes for encrypted file found" - exec: [./signedData-DetachedSignature] expect: "Successfully verified SignedData bundle." - exec: [./signedData-verifyFile, -b, signedData_detached_attrs.der, -c, content.txt] expect: "Successfully verified SignedData bundle!" # Split out of pkcs7 above purely so the other 8 targets keep testing the # released library. This one CANNOT pass on v5.9.2-stable: # wc_PKCS7_EncodeContentStreamHelper() leaves ret at its BAD_FUNC_ARG # initializer when the caller passes a precomputed hash, so the content is # never written and the bundle verifies nowhere (ret = -140). # wolfSSL 9b1aad457 (wolfSSL/wolfssl#10904) fixed it after the tag, and no # release contains it yet -- drop the pin and fold this back into pkcs7 once # a release does. - id: pkcs7-signeddata-stream path: pkcs7 profile: pkcs7 wolfssl_ref: master deps: [zlib1g-dev] # make check asserts the real verify result, not a mid-stream "bytes from file" mode: check # Both commands come from pkcs7/README.md "Creating an SMIME bundle and # verifying it"; smime-verify consumes the bundle smime writes. - id: pkcs7-smime path: pkcs7 profile: pkcs7smime deps: [zlib1g-dev] run: - exec: [./smime, ../certs/client-key.der, ../certs/client-cert.der] expect: "output to file ./smime-created.p7s" - exec: [./smime-verify, smime-created.p7s, ../certs/client-cert.der, content.txt] expect: "Verify Success" # negative: verifying the bundle against the wrong signer cert must fail - exec: [./smime-verify, smime-created.p7s, ../certs/server-cert.der, content.txt] must_fail: true expect: "Verify Failed" - id: certgen path: certgen profile: certgen mode: check - id: certmanager path: certmanager profile: crl mode: check # certverify_ocsp is not run: it needs the wolfssl source tree as a sibling # and a manually launched openssl responder on :22221. - id: certstore path: certstore profile: opensslextra mode: check - id: certvfy path: certvfy profile: certvfy mode: check - id: certfields-all-fields path: certfields/all-fields profile: opensslextra mode: check - id: certfields-keyusage path: certfields/keyUsage profile: opensslextra mode: check - id: certfields-extendedkeyusage path: certfields/extendedKeyUsage profile: opensslextra mode: check env: # this Makefile bakes in -fsanitize=address; leak reports against a shared # libwolfssl would fail the run without this ASAN_OPTIONS: "detect_leaks=0" - id: certfields-extract-pubkey path: certfields/extract-pubkey-from-certfile profile: opensslextra mode: check - id: ecc path: ecc profile: ecc # asserts via ecc/Makefile's check target mode: check - id: hash path: hash profile: crypto mode: check # Known-answer tests: every digest below was cross-checked against shasum and # openssl dgst, so these assert the algorithm is right, not just that it ran. # input.txt is tracked -- if it changes on purpose, recompute these. - id: hash-blake2 path: hash/blake2 profile: crypto mode: check - id: embedded path: embedded profile: default run: # the client receives the server's HTML: proves the full round-trip, not "Done" - exec: [./tls-client-server] expect: "wolfSSL has successfully performed handshake!" - exec: [./tls-threaded] expect: "wolfSSL has successfully performed handshake!" - exec: [./tls-sock-threaded] expect: "wolfSSL has successfully performed handshake!" - pair: server: [./tls-sock-server] client: [./tls-sock-client] server_exit: killed expect: "wolfSSL has successfully performed handshake!" - pair: server: [./tls-sock-server-ca] client: [./tls-sock-client-ca] server_exit: killed expect: "wolfSSL has successfully performed handshake!" # tls-server-size is deliberately not run: its buffer-IO recv callback returns # WANT_READ forever with no client, so it spins at 100% CPU and never exits. # It is a code-size demo, not a runnable example. - id: crypto-3des path: crypto/3des profile: crypto mode: check - id: crypto-aes path: crypto/aes profile: crypto mode: check # aes/aescfb/aesctr-file-encrypt share crypto/3des's tcsetattr blocker and # are deliberately absent from run:. - id: crypto-aes-modes path: crypto/aes-modes profile: crypto mode: check # Every one prints " not compiled in" and returns 0 when its feature is # off, so exit code alone cannot tell a round-trip from a no-op. "Success!" # is the last line before return and only the round-trip reaches it. - id: crypto-aes-rdseed path: crypto/aes/rdseed profile: crypto mode: check - id: crypto-ascon path: crypto/ascon profile: crypto mode: check - id: crypto-camellia path: crypto/camellia profile: crypto mode: check - id: crypto-kdf path: crypto/kdf profile: crypto mode: check - id: crypto-keywrap path: crypto/keywrap profile: crypto mode: check - id: crypto-pkcs12 path: crypto/pkcs12 profile: crypto mode: check - id: crypto-siphash path: crypto/siphash profile: crypto mode: check - id: crypto-sm path: crypto/sm profile: sm mode: check - id: signature path: signature profile: default mode: check - id: signature-ecc-sign-verify path: signature/ecc-sign-verify profile: default mode: check - id: signature-rsa-buffer path: signature/rsa_buffer profile: default mode: check - id: signature-sigtest path: signature/sigtest profile: certgen mode: check deps: [libssl-dev] # eccsiglentest is not run: 1000 loops across ~26 curves takes minutes. - id: staticmemory path: staticmemory profile: staticmemory mode: check - id: staticmemory-bucket-optimizer path: staticmemory/memory-bucket-optimizer/optimizer profile: staticmemory mode: check - id: staticmemory-bucket-tester path: staticmemory/memory-bucket-optimizer/tester profile: staticmemory-nomalloc mode: check - id: x509-acert path: x509_acert profile: acert mode: check deps: [libssl-dev] # `make` also builds openssl_acert, which needs openssl/x509_acert.h -- that # is OpenSSL 3.4+, and ubuntu-24.04 ships 3.0. build: [make, wolfssl_acert] # openssl_acert is not run: X509_ACERT is not in distro OpenSSL. - id: x9146 path: X9.146 profile: x9146 mode: check deps: [openssl] # ca-key.der / server-key.der are not committed, so the generators fopen() # NULL on a fresh clone. The README documents this openssl step. - id: tls-options path: tls-options profile: tls run: # -e prints the enabled cipher list; TLS1.3 is on, so this suite is present - exec: [./client-tls-cipher, -e] expect: "TLS13-AES128-GCM-SHA256" - exec: [./server-tls-cipher, -e] expect: "TLS13-AES128-GCM-SHA256" - pair: server: [./server-tls-cipher] client: [./client-tls-cipher, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "Server: I hear ya fa shizzle" # both need -a : a bare IP arg prints usage and exits 0 (a no-op). # NONE keeps the self-signed test certs from failing peer verification. - pair: server: [./server-tls-peerauth, -a, NONE] client: [./client-tls-peerauth, -a, NONE] stdin: "hello\n" server_exit: killed expect: "Server: I hear ya fa shizzle" # The session/resume pair needs ../tls/server-tls13 built first and writes # session.bin; client-tls-resume silently falls back to a fresh session when # session.bin is absent, so a naive run would pass without testing resumption. - id: psk path: psk profile: psk run: # psk clients do NOT read stdin (the message is hardcoded), and no psk # server honours a "shutdown" string -- that terminator exists only in # tls/. Every server here accept-loops, so all pairs are server_exit: killed. - pair: server: [./server-tcp] client: [./client-tcp, 127.0.0.1] server_exit: killed expect: "Server Message: I hear ya for shizzle" - pair: server: [./server-psk] client: [./client-psk, 127.0.0.1] server_exit: killed expect: "Server Message: I hear ya for shizzle" - pair: server: [./server-psk-nonblocking] client: [./client-psk-nonblocking, 127.0.0.1] server_exit: killed expect: "Server Message: I hear ya for shizzle" - pair: server: [./server-psk-threaded] client: [./client-psk, 127.0.0.1] server_exit: killed expect: "Server Message: I hear ya for shizzle" - pair: server: [./server-psk-tls13-multi-id] client: [./client-psk-tls13-multi-id, 127.0.0.1] server_exit: killed expect: "Server Message: I hear ya for shizzle" - id: btle-ecies path: btle/ecies profile: eccencrypt # Transport is a pair of FIFOs in /tmp, not sockets. Stale FIFOs from a # previous run make ecc-server hang on open(), so clear them first. setup: - [rm, -f, /tmp/btleMiso, /tmp/btleMosi] run: # the client decrypting the echoed "exit" proves the ECIES round-trip - pair: server: [./ecc-server] client: [./ecc-client] stdin: "exit\n" server_exit: killed port: none expect: "Recv 16: exit" - id: btle-tls path: btle/tls profile: eccencrypt setup: - [rm, -f, /tmp/btleMiso, /tmp/btleMosi] run: # the client reading the echoed "exit" proves the TLS1.3-over-BTLE handshake - pair: server: [./server-tls13-btle] client: [./client-tls13-btle] stdin: "exit\n" server_exit: killed port: none expect: "Read (5): exit" - id: http-message-signatures path: http-message-signatures profile: httpsig run: # test_vectors covers the RFC 9421 B.2.6 vector and is self-contained - exec: [./test_vectors] expect: "17/17 tests passed" - exec: [./sign_request] expect: "Success" # the client's 3 demos include a tampered-signature 401, so this proves # both accept and reject paths - pair: server: [./http_server_verify] client: [./http_client_signed] port: 8080 server_exit: killed expect: "3/3 demos passed" - id: pq-ml-dsa path: pq/ml_dsa profile: pq mode: check - id: pq-ml-kem path: pq/ml_kem profile: pq mode: check - id: pq-slh-dsa path: pq/slh_dsa profile: pq mode: check - id: pq-stateful-hash-sig path: pq/stateful_hash_sig profile: pq mode: check - id: ocsp-nonblock path: ocsp/ocsp_nonblock profile: ocsp mode: build-only reason: "ocsp_nonblock_async connects to an external responder on :443" - id: ocsp-responder path: ocsp/responder profile: ocsp mode: check # ocsp-responder-http serves OCSP over HTTP and needs a client driving it; that # is the N-process recipe ocsp-stapling also waits on. - id: ocsp-stapling path: ocsp/stapling profile: ocsp # Three processes, not two, which is why this waited on the procs: step. # Certs are pre-generated and checked in (valid to 2027-09-14), so no cert # step -- but they DO expire, and this is the example CI exists to catch. run: # `make responder` verbatim: openssl's own OCSP responder on :22221. - procs: &stapling background: - argv: [openssl, ocsp, -index, responder-certs/index.txt, -port, "22221", -rsigner, responder-certs/ocsp-responder-int1-cert.pem, -rkey, responder-certs/ocsp-responder-int1-key.pem, -CA, client-certs/intermediate1-ca-cert.pem] port: 22221 - argv: [./ocsp-server] port: 11111 client: [./ocsp-client, --tls12] # exit 0 only means the client ran; this means it got a stapled response # back and the handshake completed. expect: "Client: TLS handshake success" # ocsp-server accepts once and exits, so tls13 needs its own chain. - procs: <<: *stapling client: [./ocsp-client, --tls13] expect: "Client: TLS handshake success" # wolfSSL bug (not the example): a CTX-set status_request is dropped from # the TLS1.3 Certificate msg (-429). Fixed on master by wolfSSL/wolfssl#10936, # still in v5.9.2-stable; drop expect_fail + fixed_on once a stable tag has it. expect_fail: "wolfSSL drops a CTX-set status_request in the TLS1.3 Certificate msg (-429)" fixed_on: [master] - id: custom-io-file-client path: custom-io-callbacks/file-client profile: debug deps: [clang] mode: build-only reason: "client half of the file-server pair; custom-io-file-server runs both" - id: custom-io-file-server path: custom-io-callbacks/file-server profile: debug deps: [clang] setup: # the pair talks over files in file-client/, and stale ones desync the handshake - [sh, -c, "cd ../file-client && ./clean-io-files.sh 2>/dev/null || true"] - [make, -C, ../file-client] run: # check.sh drives both halves; they live in different dirs and share io # files by relative path, so neither runs standalone. - script: [./check.sh] timeout: 60 expect: "custom-io file transfer succeeded" - id: dtls-mcast path: dtls-mcast profile: dtls mode: build-only reason: >- Built here as a stub; run end-to-end by the dedicated dtls-mcast.yml job, which the manifest harness cannot host. mcast-peer is a while(running) loop with no foreground driver, and multicast needs a full network stack, not the harness's loopback-only netns. That job runs all three peers on the host, SIGTERMs them, and asserts a peer decrypted another's message. - id: pq-pqc-proxy path: pq/pqc_proxy profile: pq # Not the "4-process chain" this used to claim: it is TWO independent # 3-process chains on disjoint ports (11111/11112 and 22221/22222), and the # README says both can run at once. Six binaries, two directions. run: # Direction 1 -- quantum-safe front door: a modern client reaches a legacy # TLS 1.2 origin through a PQ-terminating proxy. - procs: background: - argv: [./legacy-server] port: 11112 - argv: [./pq-proxy] port: 11111 client: [./pq-client, 127.0.0.1] stdin: "hello over pq\n" # kex= is the negotiated key exchange: this asserts ML-KEM actually ran, # not merely that some TLS handshake succeeded. expect: "kex=" # Direction 2 -- quantum-safe upgrade: a legacy client is upgraded to PQ # by the proxy in front of a PQ origin. - procs: background: - argv: [./pq-server] port: 22222 - argv: [./upgrade-proxy] port: 22221 client: [./legacy-client, 127.0.0.1] stdin: "hello over legacy\n" expect: "Connected to proxy:" # pk/* -- each subdir is its own Makefile and its own example - id: pk-curve25519 path: pk/curve25519 profile: pk mode: check - id: pk-dh-pg path: pk/dh-pg profile: pk mode: check - id: pk-ecc path: pk/ecc profile: pk mode: check - id: pk-ecdh-generate-secret path: pk/ecdh_generate_secret profile: pk mode: check - id: pk-ed25519 path: pk/ed25519 profile: pk mode: check - id: pk-ed25519-gen path: pk/ed25519_gen profile: pk mode: check - id: pk-ed448 path: pk/ed448 profile: pk mode: check - id: pk-enc-through-sign-rsa path: pk/enc-through-sign-rsa profile: pk mode: check - id: pk-hpke path: pk/hpke profile: pk mode: check - id: pk-mikey-sakke path: pk/mikey-sakke profile: pk mode: check - id: pk-rsa-kg path: pk/rsa-kg profile: pk mode: check - id: pk-rsa-pss path: pk/rsa-pss profile: pk mode: check - id: pk-srp path: pk/srp profile: pk mode: check - id: pk-test-cert-keypair path: pk/test_cert_and_private_keypair profile: pk mode: check # ------------------------------------------------- host: own shard (heavy) - id: tls path: tls profile: tls run: # memory-tls needs no sockets and no stdin: the safest target here. - exec: [./memory-tls] expect: "client msg = hello memory wolfSSL!" # `shutdown` is the literal terminator (strncmp(buff, "shutdown", 8)). # Only these servers check for it; the rest accept-loop and must be killed. - pair: server: [./server-tls13] client: [./client-tls13, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" # interop: an OpenSSL client must complete a mutual TLS 1.3 handshake with the # wolfSSL server and read its reply (no "Server:" prefix -- that is our client's). - pair: server: [./server-tls13] client: [openssl, s_client, -connect, 127.0.0.1:11111, -CAfile, ../certs/ca-cert.pem, -cert, ../certs/client-cert.pem, -key, ../certs/client-key.pem, -quiet] stdin: "shutdown\n" server_exit: clean expect: "I hear ya fa shizzle" # interop, reverse: our wolfSSL client completes a mutual TLS 1.3 handshake with # an OpenSSL server and reads the reply fed to s_server over server_stdin. - pair: server: [openssl, s_server, -accept, "11111", -cert, ../certs/server-cert.pem, -key, ../certs/server-key.pem, -CAfile, ../certs/ca-cert.pem, -Verify, "1", -quiet] server_stdin: "I hear ya from openssl\n" client: [./client-tls13, 127.0.0.1] stdin: "hello\n" server_exit: term expect: "Server: I hear ya from openssl" - pair: server: [./server-tls-cryptocb] client: [./client-tls-cryptocb, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-posthsauth] client: [./client-tls-posthsauth, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-threaded] client: [./client-tls, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls] client: [./client-tls, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-ecdhe] client: [./client-tls-ecdhe, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" # nonblocking connect is timing-sensitive and could not be run locally, but # the client prints the same echo as its siblings once connected. - pair: server: [./server-tls-nonblocking] client: [./client-tls-nonblocking, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-callback] client: [./client-tls-callback, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" # the 0.5-RTT reply only prints if the 2nd connection resumed and the # server accepted the client's 0-RTT early data - pair: server: [./server-tls13-earlydata] client: [./client-tls13-earlydata, 127.0.0.1] server_exit: killed expect: "0.5-RTT data hello from early data server" - pair: server: [./server-tls13-certauth-clienthello] client: [./client-tls13-certauth-clienthello, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-pkcallback] client: [./client-tls-pkcallback, 127.0.0.1] stdin: "shutdown\n" server_exit: clean expect: "Server: I hear ya fa shizzle" # client-tls-cacb prints the reply in "Received: ...I hear ya fa shizzle" # form, not the "Server:" prefix the others use - pair: server: [./server-tls] client: [./client-tls-cacb, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "I hear ya fa shizzle" # server-tcp/client-tcp link no wolfSSL (tls/Makefile strips -lwolfssl); the # server returns its write() byte count, so it cannot be server_exit: clean. - pair: server: [./server-tcp] client: [./client-tcp, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-verifycallback] client: [./client-tls, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls-writedup] client: [./client-tls-writedup, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls] client: [./client-tls-bio, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" - pair: server: [./server-tls] client: [./client-tls-pkcs12, 127.0.0.1] stdin: "shutdown\n" server_exit: killed expect: "Server: I hear ya fa shizzle" # client-tls-resume calls fgets twice, so it needs two lines. - pair: server: [./server-tls] client: [./client-tls-resume, 127.0.0.1] stdin: "hello\nshutdown\n" server_exit: killed expect: "Successful resume." - pair: server: [./server-tls13] client: [./client-tls13-resume, 127.0.0.1] stdin: "hello\nshutdown\n" server_exit: killed expect: "Successful resume" # Deliberately not run: client-ech (external crypto.cloudflare.com:443), # {client,server}-tls-uart (needs /dev/ttyUSB0), and the four *-perf # benchmarks. All still build. - id: dtls path: dtls profile: dtls deps: [libevent-dev] run: # No dtls server honours any in-band terminator -- "shutdown" does not # exist in this dir. Every server loops until SIGINT, so all pairs are # server_exit: killed. # BIO_s_mem is a byte stream, so a DTLS record can end mid-read; without # RECORDS_CAN_SPAN_DATAGRAMS (set in the profile) wolfSSL treats that as a # truncated datagram and drops it, and nothing retransmits. - exec: [./memory-bio-dtls] expect: "client msg = hello memory wolfSSL!" # A complete DTLS server rather than a self-contained demo: bare exec just # blocks in poll() until the step times out. It has no dedicated client. # export writes dtls_{server,client}_session.bin; import reads them, so this # order is load bearing. - pair: server: [./server-dtls-export] proto: udp client: [./client-dtls-export, 127.0.0.1] stdin: "hello\n" server_exit: clean - pair: server: [./server-dtls-import] proto: udp client: [./client-dtls-import, 127.0.0.1] stdin: "hello\nquit\n" server_exit: killed # clients that pair with servers this dir already runs. Each client fputs # the server's reply; server-dtls/server-dtls13 send "I hear you fashizzle". - pair: server: [./server-dtls] proto: udp client: [./client-dtls-cid, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls13] proto: udp client: [./client-dtls13-cid, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls] proto: udp client: [./client-dtls-resume, 127.0.0.1] server_exit: killed # proves the resumed session carried data back -- the whole point of # the pair the close_notify fix was for. Repeat to stress that fix: this # pair used to flake, so a single green proved little. repeat: 5 expect: "info: server response:" - pair: server: [./server-dtls] proto: udp client: [./client-dtls-shared, 127.0.0.1] server_exit: killed expect: "got msg" - pair: server: [./server-dtls13-event] proto: udp client: [./client-dtls13, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls-rw-threads] proto: udp client: [./client-dtls-rw-threads, 127.0.0.1] server_exit: killed - pair: server: [./server-dtls-threaded] proto: udp client: [./client-dtls-threaded, 127.0.0.1] server_exit: killed # no expect: over IPv6 loopback in the harness netns the reply is not # delivered to the client (all IPv4 dtls pairs print it; only ::1 does not), # so exit code is the only reliable signal here. - pair: server: [./server-dtls-ipv6] proto: udp client: [./client-dtls-ipv6, "::1"] server_exit: killed - pair: server: [./server-dtls-demux] proto: udp client: [./client-dtls, 127.0.0.1] stdin: "hello\n" server_exit: killed - pair: server: [./server-udp] proto: udp client: [./client-udp, 127.0.0.1] stdin: "hello\n" server_exit: killed - pair: server: [./server-dtls] proto: udp client: [./client-dtls, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls13] proto: udp client: [./client-dtls13, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls-nonblocking] proto: udp client: [./client-dtls-nonblocking, 127.0.0.1] stdin: "hello\n" server_exit: killed expect: "I hear you fashizzle" - pair: server: [./server-dtls-callback] proto: udp client: [./client-dtls-callback, 127.0.0.1] stdin: "hello\n" server_exit: killed # "Handshake complete after early data" only prints if the 2nd connection # resumed with the ticket and the server accepted the 0-RTT early data - pair: server: [./server-dtls13-earlydata] proto: udp client: [./client-dtls13-earlydata, 127.0.0.1] server_exit: killed expect: "Handshake complete after early data" - id: pkcs11 path: pkcs11 profile: pkcs11 deps: [softhsm2] # softhsm2-init.sh does README steps 3-4 (config, token init) and reads back # the slot id SoftHSM reassigns at random, then runs the 8 examples. # The 3 TLS binaries need wolfSSL's own client as the peer, which is not in # this repo, so 8 of 11 is the honest ceiling here. run: # 7 of the 8 pass. pkcs11_test is run separately rather than folded in # here, so a regression in these 7 still turns the job red. - script: [./softhsm2-init.sh, pkcs11_rsa, pkcs11_ecc, pkcs11_genecc, pkcs11_aesgcm, pkcs11_aescbc, pkcs11_hmac, pkcs11_rand] # softhsm2.sh only prints this once every example it ran returned 0. expect: "All PKCS#11 examples passed" timeout: 300 - script: [./softhsm2-init.sh, pkcs11_test] expect: "All PKCS#11 examples passed" timeout: 300 # gen_ec_keys_label() then wc_ecc_verify_hash() on the PKCS#11 public key # returns WC_HW_E (-248); signing and the no-label path pass. Fixed on # master by wolfSSL/wolfssl#10954 (keygen destroys the HSM public key, so # verify must use the exported point), still in the latest stable tag; # drop expect_fail + fixed_on once a stable tag has it. Not reproducible # locally -- brew SoftHSM 2.7 reports PKCS#11 3.2 but exports no # C_GetInterface, which wolfSSL rejects first. expect_fail: "wc_ecc_verify_hash on a label-generated PKCS#11 EC key returns WC_HW_E (-248)" fixed_on: [master] # ------------------------------------------------- host: separate profiles - id: pk-rsa path: pk/rsa profile: fastmath mode: check - id: signature-rsa-vfy-only path: signature/rsa_vfy_only # Keep cryptonly. This used to say "try under the `all` profile and drop this # one" -- but `all` is documented above as emulated/cross only, it supplies # none of --disable-asn/--enable-cryptonly/--enable-rsavfy/-DWOLFSSL_PUBLIC_MP # that verify.c's mp_read_unsigned_bin() needs, and --enable-all would defeat # the point of a minimum-footprint demo anyway. profile: cryptonly mode: check # -------------------------------------------------------------- emulated # csharp.yml compiles the wrapper's .cs with mcs and plays the client against # each server under mono; the .csproj targets .NET Framework v4.8 and pulls in # wolfSSL's own wolfSSL_CSharp.csproj, so it is not buildable here. - id: csharp-pq-client path: CSharp/wolfSSL-TLS-pq-Client tier: cross profile: pq - id: csharp-pq-server path: CSharp/wolfSSL-TLS-pq-Server tier: cross profile: pq - id: csharp-pq-server-threaded path: CSharp/wolfSSL-TLS-pq-ServerThreaded tier: cross profile: pq - id: tpm path: tpm tier: emulated profile: all # emulated.yml runs it against wolfTPM's own fwTPM simulator on :2321 run: - exec: [./evp_tpm] expect: "Create/Load ECC Key: Handle" - id: sgx-linux path: SGX_Linux tier: emulated profile: all # emulated.yml builds the enclave and runs ./App in SGX_MODE=SIM - id: can-bus path: can-bus tier: emulated profile: all # emulated.yml runs server/client over vcan0 (root + linux-modules-extra) - id: uefi-library path: uefi-library tier: cross profile: all mode: build-only reason: >- REAL, UNDIAGNOSED wolfCrypt BUG under UEFI. Booting works (OVMF, -cpu qemu64, ESP as a real FAT image via mtools -- QEMU's vvfat "fat:rw:" SIGABRTs on a runner) and the suite runs: AES, SHA, HMAC, CMAC, KDF and RNG all pass, then "Running RSA ... wc_CheckRsaKey failed: -262" and "Test suite FAILED: Aborted". RULED OUT: key size. The test used a 1024-bit asset while RSA_MIN_SIZE defaults to 2048, which looked like the cause -- it is not; the key is now wolfSSL's 2048-bit certs/client-key.der and -262 is unchanged. -262 comes from _ifc_pairwise_consistency_test (rsa.c), which signs and verifies "Everyone gets Friday off." and collapses ANY non-zero into RSA_KEY_PAIR_E, so the real error is hidden. NEXT: instrument that call, and look at this dir's user_settings.h, which sets both WC_RSA_BLINDING and WC_NO_HARDEN (the latter cancels the former), plus RSA_LOW_MEM (no CRT) and XMALLOC_USER. Needs someone who can run a UEFI build. Restore the boot step from this file's history once fixed; it asserts "All tests passed!". # ----------------------------------------------------------------- cross - id: esp32-dtls13-client path: ESP32/DTLS13-wifi-station-client tier: cross profile: all mode: build-only - id: esp32-dtls13-server path: ESP32/DTLS13-wifi-station-server tier: cross profile: all mode: build-only - id: esp32-tls13-enc28j60-client path: ESP32/TLS13-ENC28J60-client tier: cross profile: all mode: build-only - id: esp32-tls13-enc28j60-server path: ESP32/TLS13-ENC28J60-server tier: cross profile: all mode: build-only - id: esp32-tls13-wifi-client path: ESP32/TLS13-wifi_station-client tier: cross profile: all mode: build-only - id: esp32-tls13-wifi-server path: ESP32/TLS13-wifi_station-server tier: cross profile: all mode: build-only - id: rpi-pico path: RPi-Pico tier: cross profile: all mode: build-only - id: rpi-pico-benchmark path: RPi-Pico/benchmark tier: cross profile: all mode: build-only - id: rpi-pico-testwolfcrypt path: RPi-Pico/testwolfcrypt tier: cross profile: all mode: build-only - id: rpi-pico-tcp-client path: RPi-Pico/tcp_client tier: cross profile: all mode: build-only - id: rpi-pico-tcp-server path: RPi-Pico/tcp_server tier: cross profile: all mode: build-only - id: rpi-pico-tls-client path: RPi-Pico/tls_client tier: cross profile: all mode: build-only - id: rpi-pico-tls-server path: RPi-Pico/tls_server tier: cross profile: all mode: build-only - id: rpi-pico-wifi path: RPi-Pico/wifi tier: cross profile: all mode: build-only - id: rt1060 path: RT1060 tier: cross profile: all mode: build-only - id: puf path: puf tier: cross profile: all mode: build-only - id: uefi-static path: uefi-static tier: cross profile: all mode: build-only - id: arduino-template path: Arduino/sketches/template tier: cross profile: all mode: build-only - id: ebpf-syscall-write-trace path: ebpf/syscall-write-trace tier: cross profile: all mode: build-only - id: ebpf-tls-uprobe-trace path: ebpf/tls-uprobe-trace tier: cross profile: all mode: build-only - id: fullstack-https path: fullstack/freertos-wolfip-wolfssl-https tier: cross profile: all - id: android-wolfcryptjni path: android/wolfcryptjni-ndk-gradle tier: cross profile: all mode: build-only reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet" - id: android-wolfcryptjni-app path: android/wolfcryptjni-ndk-gradle/app tier: cross profile: all mode: build-only reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet" - id: android-wolfssljni path: android/wolfssljni-ndk-gradle tier: cross profile: all mode: build-only reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet" - id: android-wolfssljni-app path: android/wolfssljni-ndk-gradle/app tier: cross profile: all mode: build-only reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet" - id: android-wolfssljni-sample path: android/wolfssljni-ndk-sample/jni tier: cross profile: all mode: build-only reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet" # ------------------------------------------------------------------ skip - id: btle-common path: btle/common mode: skip reason: "shared helper (btle-sim.c) linked by btle/ecies and btle/tls; not an example" - id: puf-host-test path: puf/host_test mode: skip reason: >- Host behavioral test harness for puf's interactive demo, not an example: puf.yml builds it and runs driver.py against wolfSSL master (the demo needs post-v5.9.2 PUF APIs, so the stable ref is excluded there) - id: hsm-dtls-client path: hsm/dtls_client mode: skip reason: >- Built and run end-to-end by the dedicated hsm.yml job (wolfHSM posix server + wolfSSL DTLS server + this client, asserting the HSM-backed handshake); master-only since wolfHSM tracks wolfSSL master # arduino.yml does NOT cover these: it copies compile-all-examples.sh into # $ARDUINO_ROOT/wolfssl/examples and runs it there, compiling the examples that # ship inside the installed Arduino wolfSSL library, not this repo's sketches. # Building them needs arduino-cli plus a core per board. - id: arduino-client path: Arduino/sketches/wolfssl_client tier: cross profile: all mode: build-only - id: arduino-server path: Arduino/sketches/wolfssl_server tier: cross profile: all mode: build-only - id: arduino-client-dtls path: Arduino/sketches/wolfssl_client_dtls tier: cross profile: all mode: build-only - id: arduino-server-dtls path: Arduino/sketches/wolfssl_server_dtls tier: cross profile: all mode: build-only - id: arduino-AES-CTR path: Arduino/sketches/wolfssl_AES_CTR tier: cross profile: all mode: build-only - id: arduino-version path: Arduino/sketches/wolfssl_version tier: cross profile: all mode: build-only - id: esp32-hello-world path: ESP32/ESP32-hello-world tier: cross mode: skip reason: >- Not worth wiring: hello_world.ino is 12 lines and does not include wolfSSL at all, so compiling it would test arduino-cli rather than wolfSSL. It is also an arduino-cli sketch rather than an ESP-IDF project (the esp32 job builds idf.py projects), and its dir name does not match the .ino basename, which arduino-cli requires -- so even Arduino/sketches/compile-all-examples.sh could not pick it up as-is. Delete or fold into Arduino/sketches if anyone wants it covered. - id: sgx-windows-benchmarks path: SGX_Windows/Benchmarks mode: skip reason: >- Tried on windows-latest and reverted: the Intel SGX SDK for Windows has no download URL that can be verified from here. Intel serves it from registrationcenter-download.intel.com behind a per-release GUID (a guessed one returns AccessDenied), intel/linux-sgx's releases carry no Windows assets, and there is no chocolatey package. Someone with a browser needs to get the current installer link, or host it. Beyond that: README.md targets Visual Studio 2013 with the Intel compiler so the project files likely need retargeting, and wolfssl.lib must be built first from wolfSSL's own IDE/WIN-SGX solution and copied in. sgx-linux already covers the same wolfSSL code under SGX_MODE=SIM, so the payoff is small either way. - id: sgx-windows-enclave path: SGX_Windows/Enclave mode: skip reason: >- Tried on windows-latest and reverted: the Intel SGX SDK for Windows has no download URL that can be verified from here. Intel serves it from registrationcenter-download.intel.com behind a per-release GUID (a guessed one returns AccessDenied), intel/linux-sgx's releases carry no Windows assets, and there is no chocolatey package. Someone with a browser needs to get the current installer link, or host it. Beyond that: README.md targets Visual Studio 2013 with the Intel compiler so the project files likely need retargeting, and wolfssl.lib must be built first from wolfSSL's own IDE/WIN-SGX solution and copied in. sgx-linux already covers the same wolfSSL code under SGX_MODE=SIM, so the payoff is small either way. - id: java-https-url path: java/https-url tier: cross profile: default mode: build-only # java.yml builds wolfSSL with JNI, builds wolfssljni on top and javac's # URLClient against wolfssl-jsse.jar -- so `build: none` here means the # harness does not build it, not that nothing does. build: none reason: >- URLClient fetches a real URL over the public internet (the README's own invocation is -h https://www.google.com with example-keystores/external.jks), so running it in CI would test GitHub's network, not wolfJSSE. Compiling it against the jar is the honest ceiling. Same call as ocsp-nonblock. - id: kernel-bsdkm path: kernel/bsdkm tier: cross profile: default # bsdkm.yml runs it in a real FreeBSD 14.2 VM (vmactions/freebsd-vm), the # version README.md says it was tested on. It also fetches src.txz, because # the Makefile includes /usr/src/sys/conf/kmod.mk -- the live kernel source, # not the bsd.kmod.mk in base. kldload then proves it in-kernel. build: none - id: meta-wolfssl-linux-fips path: meta-wolfssl-linux-fips mode: skip reason: "full Yocto bitbake: hours of build time and tens of GB" - id: stsafe path: stsafe mode: skip reason: "needs a real STSAFE-A120 over /dev/i2c-N; platform layer is hard-wired to Linux I2C with no transport abstraction, so wolfSSL/simulators' STSAFEA120Sim cannot drive it without a new platform shim" - id: rtl8735b path: rtl8735b mode: skip reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain" - id: rtl8735b-test path: rtl8735b/test mode: skip reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain" - id: rtl8735b-tls path: rtl8735b/tls mode: skip reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain" - id: ti-c2000-f28p55x path: embedded/ti-c2000-f28p55x mode: skip reason: "TI LAUNCHXL-F28P55X bare metal; licensed C2000 CGT (cl2000) compiler plus C2000Ware, and the KAT output only comes back over the board's XDS110 JTAG/CIO link" - id: renesas-rh850 path: Renesas/cs+/RH850/rsapss_sign_verify mode: skip reason: "Renesas CS+ IDE project; licensed Windows-only CC-RH compiler" - id: ccb-vaultic path: ccb_vaultic mode: skip reason: "Wisekey VaultIC dev kit + Android NDK ($NDK_CC)" - id: caam-seco path: caam/seco mode: skip reason: "NXP SECO HSM ($HSM_DIR) + aarch64-poky cross toolchain" - id: caam-seco-cryptodev path: caam/seco/cryptodev mode: skip reason: "NXP SECO HSM ($HSM_DIR) + aarch64-poky cross toolchain" - id: maxq10xx path: maxq10xx mode: skip reason: "Analog Devices MAXQ10xx SDK and hardware" - id: crypto-magiccrypto path: crypto/MagicCrypto mode: skip reason: "Aria vendor SDK (ships MagicCrypto.patch); not redistributable" - id: psa path: psa tier: cross profile: default # psa.yml owns this one: the example's own build_with_mbedtls_psa.sh pins an # mbedTLS commit and runs ./configure --enable-psa itself, so it cannot be a # profile here. That script is why the old "needs a PSA implementation" skip # was too pessimistic -- the implementation builds from source in ~2 minutes. build: none - id: pq-tls path: pq/tls profile: pq # "needs liboqs" was stale: it predates wolfSSL's native ML-KEM/ML-DSA. # Neither the sources nor the Makefile mention oqs -- they gate on # WOLFSSL_HAVE_MLKEM and HAVE_DILITHIUM, which the pq profile already # supplies, and the README asks for plain --enable-kyber --enable-dilithium. # The mldsa87 certs it wants are checked in under certs/. run: - pair: server: [./server-pq-tls13] client: [./client-pq-tls13, 127.0.0.1] stdin: "hello pq tls\n" server_exit: term # the server sends a fixed reply rather than echoing # (server-pq-tls13.c:156), so this is the proof that a # SECP521R1MLKEM1024 session carried data back. expect: "Server: I hear ya fa shizzle" - id: pq-tls-stm32 path: pq/tls/stm32 mode: skip reason: "STM32 board project for the liboqs TLS example" - id: se050 path: SE050/wolfssl mode: skip reason: >- Built and run end-to-end by the dedicated se050.yml job, which the examples matrix cannot host: it builds the whole SE050 stack -- the SE050Sim TCP applet sim (wolfSSL/simulators), the NXP plug-and-trust SDK v04.07.01 with wolfSSL osp's simw-top-v040701.patch, and wolfSSL --with-se050 (a two-pass bootstrap) -- then grafts this demo onto the sim's own CMakeLists (the GitHub plug-and-trust tree has no demos/ scaffolding) and runs wolfcrypt_test through the ex_sss boot over the sim, asserting "Ran wolfCrypt test". The other five demos build the same way; the two TLS clients also need a peer server, so wolfcrypt_test is the first one wired. - id: se050-benchmark path: SE050/wolfssl/wolfcrypt_benchmark mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: se050-generate-csr path: SE050/wolfssl/wolfcrypt_generate_csr mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: se050-key-cert-insert path: SE050/wolfssl/wolfcrypt_key_cert_insert mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: se050-test path: SE050/wolfssl/wolfcrypt_test mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: se050-client path: SE050/wolfssl/wolfssl_client mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: se050-client-cert-key path: SE050/wolfssl/wolfssl_client_cert_key mode: skip reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in - id: toppers path: TOPPERS/WolfSSLDemo mode: skip reason: "Renesas RX72N + TOPPERS/ASP3 RTOS; needs the Renesas software package" - id: toppers-wolfdemo path: TOPPERS/WolfSSLDemo/src/wolfDemo mode: skip reason: "Renesas RX72N + TOPPERS/ASP3 RTOS" - id: tirtos-tcpecho-client path: tirtos_ccs_examples/tcpEcho_Client_TivaTM4C1294NCPDT mode: skip reason: "TI Code Composer Studio + XDCtools + TI-RTOS" - id: tirtos-tcpecho-server path: tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT mode: skip reason: "TI Code Composer Studio + XDCtools + TI-RTOS" - id: tirtos-tests path: tirtos_ccs_examples/wolfssl_tests mode: skip reason: "TI Code Composer Studio + XDCtools + TI-RTOS" - id: tirtos-benchmark path: tirtos_ccs_examples/wolfssl_tirtos_benchmark mode: skip reason: "TI Code Composer Studio + XDCtools + TI-RTOS" - id: mynewt path: mynewt mode: skip reason: >- The full newt build (native bsp sim + TLS run) is a follow-up: jenkins.sh here has been unrun since 2018 and pulls the whole Apache Mynewt RTOS, which is a lot of unproven CI surface. What IS covered now: the wolfSSL Mynewt PORT compiles. Found by wiring this up, it did not -- settings.h set XMALLOC_USER (for user-provided FUNCTIONS) yet defined XFREE as a MACRO, so types.h's "extern void XFREE(void *p, ...)" under the XMALLOC_USER branch had the macro expand into it: "expected identifier". Fixed on wolfSSL master 2026-07-20 (XMALLOC_USER -> XMALLOC_OVERRIDE); v5.9.2-stable still has it. mynewt.yml compiles that exact header path on both refs (patching the ones that predate the fix) via ci-compile-check.sh, so the bug cannot come back unseen. Un-skip for the full newt build once stable carries the fix. (Also fixed here: client-tls-mn.c cast pointers through int, which -Werror rejects on the 64-bit native BSP.) - id: picotcp path: picotcp profile: default mode: build-only # v1.7.0, not master: README.md:10 asks for "PicoTCP v.1.7 or later", and # picoTCP is archived upstream so master has drifted from what this was # written against. fetch: runs outside the netns; nothing is redirected, # because hiding this build is what made an earlier attempt a mystery. fetch: - [sh, -c, "test -d ../../picotcp || git clone -q --depth 1 --branch v1.7.0 https://github.com/tass-belgium/picotcp ../../picotcp"] # cd, NOT make -C: picotcp's Makefile:16 is PREFIX?=$(PWD)/build, and -C # leaves PWD at the caller, so it built into wolfssl-examples/picotcp/build. # deps before lib as well: lib cp's headers into $(PREFIX)/include but only # deps mkdir's it (Makefile:367-380). - [sh, -c, "cd ../../picotcp && make ARCH=shared TAP=1 deps && make ARCH=shared TAP=1 lib"] - [sh, -c, "ls ../../picotcp/build/include/pico_stack.h"] reason: >- picotcp-server opens /dev/net/tun and brings up 10.0.0.1 itself, so running it needs a tun device in the netns. Building against a real picoTCP is the honest ceiling until that is probed. - id: riot-os-posix-lwip path: riot-os-posix-lwip mode: skip reason: >- Got further than the old "needs a RIOT tree at $RIOTBASE" suggested, and found two things that matter. (1) RIOT does NOT use the wolfSSL under test: it vendors its own pinned wolfSSL package via pkg/pkg.mk, so a green here would say nothing about master or stable -- the point of this CI. (2) That pinned wolfSSL does not compile on a current toolchain anyway: build/pkg/wolfssl/wolfcrypt/src/sp_int.c:13390 "implicit declaration of _sp_exptmod_ex" under gcc-13 -Werror=implicit-function-declaration. Wiring it needs RIOT's pkg pointed at the ref under test first (see RIOT's PKG_URL/PKG_VERSION), which is real work upstream. Mechanics that DO work and are worth reusing: clone RIOT to ../../RIOT (the Makefile's default, BOARD ?= native) via fetch:, then `make pkg-prepare` in fetch: so RIOT downloads its packages before the run enters the netns. - id: lwip path: lwip mode: skip reason: "needs an lwIP source tree; no Makefile in this dir" - id: freertos path: freertos mode: skip reason: "orphan source (tls_client_freertos_tcp.c): no Makefile and no README" - id: utasker path: utasker mode: skip reason: "uTasker project task files; no standalone build"