1709 lines
63 KiB
YAML
1709 lines
63 KiB
YAML
# Source of truth for what CI builds and runs.
|
|
#
|
|
# Every directory holding buildable source must appear here, or
|
|
# `manifest.py check` fails. That is deliberate: a new example is a CI failure
|
|
# until someone decides what to do with it.
|
|
#
|
|
# tier: host (default) | emulated | cross -- which workflow owns it
|
|
# mode: run (default) | build-only | skip -- skip REQUIRES a reason
|
|
# profile: which wolfSSL build it needs (a property of the dir, never a matrix axis)
|
|
# build: make (default) | none | [literal, argv]
|
|
#
|
|
# Every entry gets its own CI job, so a red tile names the example that broke.
|
|
#
|
|
# Adding an example: add an entry. If it cannot run in CI, say so in `reason`.
|
|
#
|
|
# PIN EVERY EXTERNAL PROJECT. wolfSSL is the only thing CI follows a moving ref
|
|
# for -- that is the point. Anything else (picoTCP, mbedTLS, ibmswtpm2, newt,
|
|
# wolfTPM, an SDK) gets the version the example's README documents, or a tag if
|
|
# the README is silent. Tracking someone else's master means their drift lands
|
|
# as our red, on a PR that changed none of it.
|
|
|
|
# Each profile is derived from the READMEs of the examples that use it -- NOT
|
|
# from --enable-all. --enable-all is not a superset: it omits mlkem, acert,
|
|
# ascon and trackmemory, so examples that need those fail to compile against it.
|
|
# Testing what the README documents is also the only honest thing for a repo
|
|
# whose whole job is showing people how to build.
|
|
#
|
|
# Where a README and the source disagree, the source wins (noted inline).
|
|
# A profile is built once per (profile, wolfSSL ref) and cached; every example
|
|
# using it then restores rather than rebuilds.
|
|
profiles:
|
|
# plain ./configure -- examples whose README asks for nothing special
|
|
default:
|
|
flags: "--enable-static --enable-shared"
|
|
|
|
all:
|
|
# Only for the emulated/cross tiers, whose workflows either build wolfSSL
|
|
# in-tree (ESP32, Pico) or pass their own flags (tpm, sgx). Host examples
|
|
# must name the profile their README documents instead.
|
|
flags: "--enable-all --enable-static --enable-shared"
|
|
|
|
crl:
|
|
# certmanager/README: certverify loads a CRL and fails rc=1 without it
|
|
flags: "--enable-crl --enable-ocsp --enable-static --enable-shared"
|
|
|
|
debug:
|
|
# custom-io-callbacks/README: the file-io callback pair needs debug output
|
|
flags: "--enable-debug --enable-static --enable-shared"
|
|
|
|
opensslextra:
|
|
# certfields/* and certstore. keyUsage/extendedKeyUsage READMEs say plain
|
|
# ./configure but their sources print "configure with --enable-opensslextra"
|
|
# and produce nothing without it.
|
|
flags: "--enable-opensslall --enable-opensslextra --enable-static --enable-shared"
|
|
|
|
crypto:
|
|
# union of crypto/* and hash/*: 3des, aes, aes-modes, camellia, ascon,
|
|
# keywrap, kdf, pkcs12, siphash, blake2
|
|
flags: >-
|
|
--enable-pwdbased --enable-des3 --enable-camellia --enable-ascon
|
|
--enable-experimental --enable-aesgcm-stream --enable-aesccm --enable-aesctr
|
|
--enable-aescfb --enable-aesofb --enable-aeseax --enable-aessiv
|
|
--enable-aesxts --enable-aeskeywrap --enable-keygen --enable-certgen
|
|
--enable-certext --enable-pkcs12 --enable-blake2 --enable-blake2s
|
|
--enable-siphash --enable-hkdf --enable-scrypt
|
|
--enable-static --enable-shared
|
|
# aes-cts and aes-ecb have no configure flag: without these defines both
|
|
# compile to a stub main() that prints "not compiled in" and returns 0.
|
|
# WC_RNG_SEED_CB likewise has no --enable of its own (only opensslextra and
|
|
# the FIPS paths set it), and aes/rdseed exits 1 with "requires __x86_64__
|
|
# and WC_RNG_SEED_CB" without it.
|
|
cflags: "-DWOLFSSL_AES_CTS -DHAVE_AES_ECB -DWC_RNG_SEED_CB"
|
|
|
|
sm:
|
|
# crypto/sm/README: SM2/SM3/SM4 ship in the wolfSSL/wolfsm overlay, not in
|
|
# wolfSSL itself, so these --enable flags do not exist until install.sh has
|
|
# run against the source tree. setup-wolfssl applies the overlay before
|
|
# autogen; nothing in an example's own build can reach that far back.
|
|
# Bare name means latest on wolfsm's master: the repo publishes no tags and
|
|
# has no other branch, so there is nothing to pin to short of a raw commit.
|
|
overlay: wolfsm
|
|
flags: "--enable-sm2 --enable-sm3 --enable-sm4-gcm --enable-static --enable-shared"
|
|
|
|
certgen:
|
|
flags: >-
|
|
--enable-certgen --enable-certreq --enable-certext --enable-keygen
|
|
--enable-ecc --enable-ed25519 --enable-cryptocb --enable-static --enable-shared
|
|
cflags: "-DWOLFSSL_TEST_CERT -DHAVE_OID_DECODING -DHAVE_OID_ENCODING -DWOLFSSL_CUSTOM_OID -DOPENSSL_EXTRA_X509_SMALL"
|
|
|
|
ecc:
|
|
flags: >-
|
|
--enable-ecc --enable-ecccustcurves --enable-trackmemory
|
|
--enable-static --enable-shared
|
|
# trackmemory is not in the README, but ecc-stack.c includes mem_track.h and
|
|
# fails to link with "undefined reference to InitMemoryTracker" without it.
|
|
cflags: "-DWOLFSSL_TEST_CERT -DWOLFSSL_DER_TO_PEM -DHAVE_ECC_KOBLITZ -DWOLFSSL_PUBLIC_MP"
|
|
|
|
pk:
|
|
# union of pk/*: ecc, ed25519, ed448, curve25519/448, srp, hpke, rsa-pss, keygen
|
|
flags: >-
|
|
--enable-ecc --enable-ed25519 --enable-ed448 --enable-curve25519
|
|
--enable-curve448 --enable-keygen --enable-rsapss --enable-srp --enable-hpke
|
|
--enable-aesgcm --enable-eccsi --enable-sakke --enable-static --enable-shared
|
|
# WOLFSSL_RSA_KEY_CHECK has no configure option: pk/rsa-kg calls
|
|
# wc_CheckRsaKey, which rsa.c only defines under that macro.
|
|
cflags: "-DWOLFSSL_PUBLIC_MP -DUSE_CERT_BUFFERS_2048 -DWOLFSSL_ECDSA_DETERMINISTIC_K -DWOLFSSL_RSA_KEY_CHECK"
|
|
|
|
pkcs7:
|
|
# --enable-indef is required by the streaming examples: without it
|
|
# envelopedData-ktri-stream prints "Must build wolfSSL using ./configure
|
|
# --enable-pkcs7 --enable-indef" and signedData-stream fails encode with -173.
|
|
flags: >-
|
|
--enable-pkcs7 --enable-indef --enable-pwdbased --enable-cryptocb --with-libz
|
|
--enable-static --enable-shared
|
|
cflags: "-DWOLFSSL_DER_TO_PEM"
|
|
|
|
pkcs7smime:
|
|
# Split from pkcs7 because --enable-smime forces opensslall on, and the other
|
|
# eight targets do not need that surface. Without it smime and smime-verify
|
|
# print "wolfSSL was compiled with out HAVE_SMIME support" and return 0.
|
|
flags: >-
|
|
--enable-pkcs7 --enable-indef --enable-pwdbased --enable-cryptocb --with-libz
|
|
--enable-smime --enable-static --enable-shared
|
|
cflags: "-DWOLFSSL_DER_TO_PEM"
|
|
|
|
tls:
|
|
# union of tls/ and tls-options/ READMEs. --enable-asynccrypt is deliberately
|
|
# absent: it needs the separate wolfAsyncCrypt repo patched in.
|
|
# keygen + des3: client-tls-pkcs12 needs both (PKCS12 default PBE is 3DES) or
|
|
# it prints "not configured with ..." and exits 0.
|
|
flags: >-
|
|
--enable-tls13 --enable-ech --enable-writedup --enable-pkcallbacks
|
|
--enable-postauth --enable-cryptocb --enable-opensslall --enable-session-ticket
|
|
--enable-earlydata --enable-keygen --enable-des3 --enable-static --enable-shared
|
|
cflags: "-DHAVE_SECRET_CALLBACK"
|
|
|
|
dtls:
|
|
# earlydata requires session tickets or PSK: without session-ticket,
|
|
# configure dies with "cannot enable earlydata without enabling session
|
|
# tickets and/or PSK".
|
|
flags: >-
|
|
--enable-dtls --enable-dtls13 --enable-tls13 --enable-sessionexport
|
|
--enable-dtls-mtu --enable-earlydata --enable-session-ticket
|
|
--enable-dtlscid --enable-opensslextra --enable-ipv6
|
|
--enable-static --enable-shared
|
|
# No configure flag for this one; dtls/README.md says to define it so
|
|
# server-dtls13-earlydata can call wolfSSL_dtls13_no_hrr_on_resume().
|
|
cflags: "-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME -DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"
|
|
|
|
psk:
|
|
flags: "--enable-psk --enable-opensslextra --enable-tls13 --enable-static --enable-shared"
|
|
cflags: "-DWOLFSSL_STATIC_PSK"
|
|
|
|
pq:
|
|
# pq/ml_kem, pq/ml_dsa, pq/stateful_hash_sig. --enable-all omits mlkem
|
|
# entirely, which is what made pq-ml-kem fail on mlkem.h.
|
|
# extra-pqc-hybrids (default off) is what gates WOLFSSL_SECP521R1MLKEM1024
|
|
# behind WOLFSSL_EXTRA_PQC_HYBRIDS in tls.c; pq/tls asks for that exact group,
|
|
# so without it the client dies on "failed to set the requested group".
|
|
flags: >-
|
|
--enable-mlkem --enable-dilithium --enable-lms --enable-xmss
|
|
--enable-extra-pqc-hybrids --enable-slhdsa=yes,sha2
|
|
--enable-experimental --enable-tls13 --enable-static --enable-shared
|
|
|
|
acert:
|
|
flags: "--enable-acert --enable-opensslextra --enable-rsapss --enable-static --enable-shared"
|
|
|
|
staticmemory:
|
|
# README says plain ./configure, but size-calculation.c has a hard
|
|
# `#error requires --enable-staticmemory`.
|
|
flags: "--enable-staticmemory --enable-static --enable-shared"
|
|
# DEBUG_MEMORY_PRINT makes every wolfSSL allocation print "Alloc: ... -> N",
|
|
# which is exactly what memory_bucket_optimizer parses. Its README reaches for
|
|
# testwolfcrypt, but that is just a convenient allocator -- any program linked
|
|
# against this build emits the same lines, so debug-callback-example next door
|
|
# is the log source and no crypttests build is needed.
|
|
cflags: "-DWOLFSSL_STATIC_MEMORY_DEBUG_CALLBACK -DWOLFSSL_DEBUG_MEMORY -DWOLFSSL_DEBUG_MEMORY_PRINT"
|
|
|
|
staticmemory-nomalloc:
|
|
# the bucket tester replays allocations against wolfSSL's static pool with no
|
|
# heap fallback, so it needs WOLFSSL_NO_MALLOC -- and cannot share the
|
|
# optimizer's debug-print build, whose log source allocates.
|
|
flags: "--enable-staticmemory --enable-static --enable-shared"
|
|
cflags: "-DWOLFSSL_NO_MALLOC"
|
|
|
|
eccencrypt:
|
|
flags: "--enable-eccencrypt --enable-tls13 --enable-static --enable-shared"
|
|
|
|
httpsig:
|
|
flags: "--enable-ed25519 --enable-coding --enable-static --enable-shared"
|
|
|
|
x9146:
|
|
flags: >-
|
|
--enable-experimental --enable-dual-alg-certs --enable-dilithium
|
|
--enable-debug --enable-static --enable-shared
|
|
|
|
certvfy:
|
|
flags: "--enable-cryptonly --enable-singlethreaded --enable-static --enable-shared"
|
|
cflags: "-DWOLFSSL_SMALL_CERT_VERIFY"
|
|
|
|
ocsp:
|
|
flags: >-
|
|
--enable-ocsp --enable-ocspstapling --enable-ocspstapling2
|
|
--enable-ocsp-responder --enable-cert-setup-cb --enable-sessioncerts
|
|
--enable-tls13 --enable-static --enable-shared
|
|
|
|
pkcs11:
|
|
flags: "--enable-pkcs11 --enable-cryptocb --enable-static --enable-shared"
|
|
|
|
fastmath:
|
|
# Not irreconcilable with --enable-all: configure.ac lets fastmath win and
|
|
# sets SP_MATH_ALL=no, so it configures cleanly. Kept separate as a coverage
|
|
# choice -- folding it in would flip every other dir off the sp-math default
|
|
# that users actually ship. Drop this profile if pk/rsa gains an sp-math
|
|
# nonblock path.
|
|
flags: "--enable-all --enable-fastmath --enable-static --enable-shared"
|
|
cflags: "-DWC_RSA_NONBLOCK -DWC_RSA_NONBLOCK_TIME"
|
|
|
|
cryptonly:
|
|
# Genuinely separate: removes the TLS API every other dir links against.
|
|
# This is signature/rsa_vfy_only's README line in full -- an abridged version
|
|
# fails configure with "please disable rsa if disabling asn", because
|
|
# --enable-rsavfy is what reconciles RSA with --disable-asn.
|
|
flags: >-
|
|
--disable-asn --disable-filesystem --enable-cryptonly
|
|
--enable-sp=smallrsa2048 --enable-sp-math
|
|
--disable-dh --disable-ecc --disable-sha224 --enable-rsavfy
|
|
--enable-static --enable-shared
|
|
cflags: "-DWOLFSSL_PUBLIC_MP"
|
|
|
|
examples:
|
|
# ---------------------------------------------------------------- host: run
|
|
# cmake.yml, not here: add_subdirectory(wolfssl) needs a wolfSSL source tree
|
|
# beside it, and cloning one is impossible inside this harness's netns.
|
|
- id: cmake
|
|
path: cmake
|
|
tier: cross
|
|
profile: default
|
|
|
|
- id: pkcs7
|
|
path: pkcs7
|
|
profile: pkcs7
|
|
deps: [zlib1g-dev]
|
|
run:
|
|
# runall.sh drives the binaries in dependency order (envelopedData-ktri
|
|
# before envelopedDataDecode). It does not cover the targets driven
|
|
# explicitly below.
|
|
# openssl-verify.sh runs runall.sh and then validates every bundle it
|
|
# produced with openssl cms. runall.sh alone only checks exit codes, which
|
|
# is how signedData-stream shipped an empty eContent unnoticed.
|
|
- script: [./scripts/openssl-verify.sh]
|
|
timeout: 300
|
|
expect: "all openssl verifications passed"
|
|
# Every expect: below is also the --enable-pkcs7 gate: without it these
|
|
# print "Must build wolfSSL using ./configure --enable-pkcs7" and return 0,
|
|
# so exit code alone cannot tell a real pass from PKCS#7 never running.
|
|
- exec: [./signedData-p7b]
|
|
expect: "Successfully verified SignedData bundle."
|
|
# later and stricter than "PKCS7 Verify Success": the DER round-trip matched
|
|
- exec: [./pkcs7-verify]
|
|
expect: "DER output matches the original PEM"
|
|
- exec: [./envelopedData-ktri-stream, content.txt]
|
|
expect: "bytes for encrypted file found"
|
|
- exec: [./signedData-DetachedSignature]
|
|
expect: "Successfully verified SignedData bundle."
|
|
- exec: [./signedData-verifyFile, -b, signedData_detached_attrs.der, -c, content.txt]
|
|
expect: "Successfully verified SignedData bundle!"
|
|
|
|
# Split out of pkcs7 above purely so the other 8 targets keep testing the
|
|
# released library. This one CANNOT pass on v5.9.2-stable:
|
|
# wc_PKCS7_EncodeContentStreamHelper() leaves ret at its BAD_FUNC_ARG
|
|
# initializer when the caller passes a precomputed hash, so the content is
|
|
# never written and the bundle verifies nowhere (ret = -140).
|
|
# wolfSSL 9b1aad457 (wolfSSL/wolfssl#10904) fixed it after the tag, and no
|
|
# release contains it yet -- drop the pin and fold this back into pkcs7 once
|
|
# a release does.
|
|
- id: pkcs7-signeddata-stream
|
|
path: pkcs7
|
|
profile: pkcs7
|
|
wolfssl_ref: master
|
|
deps: [zlib1g-dev]
|
|
# make check asserts the real verify result, not a mid-stream "bytes from file"
|
|
mode: check
|
|
|
|
# Both commands come from pkcs7/README.md "Creating an SMIME bundle and
|
|
# verifying it"; smime-verify consumes the bundle smime writes.
|
|
- id: pkcs7-smime
|
|
path: pkcs7
|
|
profile: pkcs7smime
|
|
deps: [zlib1g-dev]
|
|
run:
|
|
- exec: [./smime, ../certs/client-key.der, ../certs/client-cert.der]
|
|
expect: "output to file ./smime-created.p7s"
|
|
- exec: [./smime-verify, smime-created.p7s, ../certs/client-cert.der, content.txt]
|
|
expect: "Verify Success"
|
|
# negative: verifying the bundle against the wrong signer cert must fail
|
|
- exec: [./smime-verify, smime-created.p7s, ../certs/server-cert.der, content.txt]
|
|
must_fail: true
|
|
expect: "Verify Failed"
|
|
|
|
- id: certgen
|
|
path: certgen
|
|
profile: certgen
|
|
mode: check
|
|
|
|
- id: certmanager
|
|
path: certmanager
|
|
profile: crl
|
|
mode: check
|
|
# certverify_ocsp is not run: it needs the wolfssl source tree as a sibling
|
|
# and a manually launched openssl responder on :22221.
|
|
|
|
- id: certstore
|
|
path: certstore
|
|
profile: opensslextra
|
|
mode: check
|
|
|
|
- id: certvfy
|
|
path: certvfy
|
|
profile: certvfy
|
|
mode: check
|
|
|
|
- id: certfields-all-fields
|
|
path: certfields/all-fields
|
|
profile: opensslextra
|
|
mode: check
|
|
|
|
- id: certfields-keyusage
|
|
path: certfields/keyUsage
|
|
profile: opensslextra
|
|
mode: check
|
|
|
|
- id: certfields-extendedkeyusage
|
|
path: certfields/extendedKeyUsage
|
|
profile: opensslextra
|
|
mode: check
|
|
env:
|
|
# this Makefile bakes in -fsanitize=address; leak reports against a shared
|
|
# libwolfssl would fail the run without this
|
|
ASAN_OPTIONS: "detect_leaks=0"
|
|
|
|
- id: certfields-extract-pubkey
|
|
path: certfields/extract-pubkey-from-certfile
|
|
profile: opensslextra
|
|
mode: check
|
|
|
|
- id: ecc
|
|
path: ecc
|
|
profile: ecc
|
|
# asserts via ecc/Makefile's check target
|
|
mode: check
|
|
|
|
- id: hash
|
|
path: hash
|
|
profile: crypto
|
|
mode: check
|
|
# Known-answer tests: every digest below was cross-checked against shasum and
|
|
# openssl dgst, so these assert the algorithm is right, not just that it ran.
|
|
# input.txt is tracked -- if it changes on purpose, recompute these.
|
|
|
|
- id: hash-blake2
|
|
path: hash/blake2
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: embedded
|
|
path: embedded
|
|
profile: default
|
|
run:
|
|
# the client receives the server's HTML: proves the full round-trip, not "Done"
|
|
- exec: [./tls-client-server]
|
|
expect: "wolfSSL has successfully performed handshake!"
|
|
- exec: [./tls-threaded]
|
|
expect: "wolfSSL has successfully performed handshake!"
|
|
- exec: [./tls-sock-threaded]
|
|
expect: "wolfSSL has successfully performed handshake!"
|
|
- pair:
|
|
server: [./tls-sock-server]
|
|
client: [./tls-sock-client]
|
|
server_exit: killed
|
|
expect: "wolfSSL has successfully performed handshake!"
|
|
- pair:
|
|
server: [./tls-sock-server-ca]
|
|
client: [./tls-sock-client-ca]
|
|
server_exit: killed
|
|
expect: "wolfSSL has successfully performed handshake!"
|
|
# tls-server-size is deliberately not run: its buffer-IO recv callback returns
|
|
# WANT_READ forever with no client, so it spins at 100% CPU and never exits.
|
|
# It is a code-size demo, not a runnable example.
|
|
|
|
- id: crypto-3des
|
|
path: crypto/3des
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-aes
|
|
path: crypto/aes
|
|
profile: crypto
|
|
mode: check
|
|
# aes/aescfb/aesctr-file-encrypt share crypto/3des's tcsetattr blocker and
|
|
# are deliberately absent from run:.
|
|
|
|
- id: crypto-aes-modes
|
|
path: crypto/aes-modes
|
|
profile: crypto
|
|
mode: check
|
|
# Every one prints "<MODE> not compiled in" and returns 0 when its feature is
|
|
# off, so exit code alone cannot tell a round-trip from a no-op. "Success!"
|
|
# is the last line before return and only the round-trip reaches it.
|
|
|
|
- id: crypto-aes-rdseed
|
|
path: crypto/aes/rdseed
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-ascon
|
|
path: crypto/ascon
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-camellia
|
|
path: crypto/camellia
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-kdf
|
|
path: crypto/kdf
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-keywrap
|
|
path: crypto/keywrap
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-pkcs12
|
|
path: crypto/pkcs12
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-siphash
|
|
path: crypto/siphash
|
|
profile: crypto
|
|
mode: check
|
|
|
|
- id: crypto-sm
|
|
path: crypto/sm
|
|
profile: sm
|
|
mode: check
|
|
|
|
- id: signature
|
|
path: signature
|
|
profile: default
|
|
mode: check
|
|
|
|
- id: signature-ecc-sign-verify
|
|
path: signature/ecc-sign-verify
|
|
profile: default
|
|
mode: check
|
|
|
|
- id: signature-rsa-buffer
|
|
path: signature/rsa_buffer
|
|
profile: default
|
|
mode: check
|
|
|
|
- id: signature-sigtest
|
|
path: signature/sigtest
|
|
profile: certgen
|
|
mode: check
|
|
deps: [libssl-dev]
|
|
# eccsiglentest is not run: 1000 loops across ~26 curves takes minutes.
|
|
|
|
- id: staticmemory
|
|
path: staticmemory
|
|
profile: staticmemory
|
|
mode: check
|
|
|
|
- id: staticmemory-bucket-optimizer
|
|
path: staticmemory/memory-bucket-optimizer/optimizer
|
|
profile: staticmemory
|
|
mode: check
|
|
|
|
- id: staticmemory-bucket-tester
|
|
path: staticmemory/memory-bucket-optimizer/tester
|
|
profile: staticmemory-nomalloc
|
|
mode: check
|
|
|
|
- id: x509-acert
|
|
path: x509_acert
|
|
profile: acert
|
|
mode: check
|
|
deps: [libssl-dev]
|
|
# `make` also builds openssl_acert, which needs openssl/x509_acert.h -- that
|
|
# is OpenSSL 3.4+, and ubuntu-24.04 ships 3.0.
|
|
build: [make, wolfssl_acert]
|
|
# openssl_acert is not run: X509_ACERT is not in distro OpenSSL.
|
|
|
|
- id: x9146
|
|
path: X9.146
|
|
profile: x9146
|
|
mode: check
|
|
deps: [openssl]
|
|
# ca-key.der / server-key.der are not committed, so the generators fopen()
|
|
# NULL on a fresh clone. The README documents this openssl step.
|
|
|
|
- id: tls-options
|
|
path: tls-options
|
|
profile: tls
|
|
run:
|
|
# -e prints the enabled cipher list; TLS1.3 is on, so this suite is present
|
|
- exec: [./client-tls-cipher, -e]
|
|
expect: "TLS13-AES128-GCM-SHA256"
|
|
- exec: [./server-tls-cipher, -e]
|
|
expect: "TLS13-AES128-GCM-SHA256"
|
|
- pair:
|
|
server: [./server-tls-cipher]
|
|
client: [./client-tls-cipher, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# both need -a <mode>: a bare IP arg prints usage and exits 0 (a no-op).
|
|
# NONE keeps the self-signed test certs from failing peer verification.
|
|
- pair:
|
|
server: [./server-tls-peerauth, -a, NONE]
|
|
client: [./client-tls-peerauth, -a, NONE]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# The session/resume pair needs ../tls/server-tls13 built first and writes
|
|
# session.bin; client-tls-resume silently falls back to a fresh session when
|
|
# session.bin is absent, so a naive run would pass without testing resumption.
|
|
|
|
- id: psk
|
|
path: psk
|
|
profile: psk
|
|
run:
|
|
# psk clients do NOT read stdin (the message is hardcoded), and no psk
|
|
# server honours a "shutdown" string -- that terminator exists only in
|
|
# tls/. Every server here accept-loops, so all pairs are server_exit: killed.
|
|
- pair:
|
|
server: [./server-tcp]
|
|
client: [./client-tcp, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Server Message: I hear ya for shizzle"
|
|
- pair:
|
|
server: [./server-psk]
|
|
client: [./client-psk, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Server Message: I hear ya for shizzle"
|
|
- pair:
|
|
server: [./server-psk-nonblocking]
|
|
client: [./client-psk-nonblocking, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Server Message: I hear ya for shizzle"
|
|
- pair:
|
|
server: [./server-psk-threaded]
|
|
client: [./client-psk, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Server Message: I hear ya for shizzle"
|
|
- pair:
|
|
server: [./server-psk-tls13-multi-id]
|
|
client: [./client-psk-tls13-multi-id, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Server Message: I hear ya for shizzle"
|
|
|
|
- id: btle-ecies
|
|
path: btle/ecies
|
|
profile: eccencrypt
|
|
# Transport is a pair of FIFOs in /tmp, not sockets. Stale FIFOs from a
|
|
# previous run make ecc-server hang on open(), so clear them first.
|
|
setup:
|
|
- [rm, -f, /tmp/btleMiso, /tmp/btleMosi]
|
|
run:
|
|
# the client decrypting the echoed "exit" proves the ECIES round-trip
|
|
- pair:
|
|
server: [./ecc-server]
|
|
client: [./ecc-client]
|
|
stdin: "exit\n"
|
|
server_exit: killed
|
|
port: none
|
|
expect: "Recv 16: exit"
|
|
|
|
- id: btle-tls
|
|
path: btle/tls
|
|
profile: eccencrypt
|
|
setup:
|
|
- [rm, -f, /tmp/btleMiso, /tmp/btleMosi]
|
|
run:
|
|
# the client reading the echoed "exit" proves the TLS1.3-over-BTLE handshake
|
|
- pair:
|
|
server: [./server-tls13-btle]
|
|
client: [./client-tls13-btle]
|
|
stdin: "exit\n"
|
|
server_exit: killed
|
|
port: none
|
|
expect: "Read (5): exit"
|
|
|
|
- id: http-message-signatures
|
|
path: http-message-signatures
|
|
profile: httpsig
|
|
run:
|
|
# test_vectors covers the RFC 9421 B.2.6 vector and is self-contained
|
|
- exec: [./test_vectors]
|
|
expect: "17/17 tests passed"
|
|
- exec: [./sign_request]
|
|
expect: "Success"
|
|
# the client's 3 demos include a tampered-signature 401, so this proves
|
|
# both accept and reject paths
|
|
- pair:
|
|
server: [./http_server_verify]
|
|
client: [./http_client_signed]
|
|
port: 8080
|
|
server_exit: killed
|
|
expect: "3/3 demos passed"
|
|
|
|
- id: pq-ml-dsa
|
|
path: pq/ml_dsa
|
|
profile: pq
|
|
mode: check
|
|
|
|
- id: pq-ml-kem
|
|
path: pq/ml_kem
|
|
profile: pq
|
|
mode: check
|
|
|
|
- id: pq-slh-dsa
|
|
path: pq/slh_dsa
|
|
profile: pq
|
|
mode: check
|
|
|
|
- id: pq-stateful-hash-sig
|
|
path: pq/stateful_hash_sig
|
|
profile: pq
|
|
mode: check
|
|
|
|
- id: ocsp-nonblock
|
|
path: ocsp/ocsp_nonblock
|
|
profile: ocsp
|
|
mode: build-only
|
|
reason: "ocsp_nonblock_async connects to an external responder on :443"
|
|
|
|
- id: ocsp-responder
|
|
path: ocsp/responder
|
|
profile: ocsp
|
|
mode: check
|
|
# ocsp-responder-http serves OCSP over HTTP and needs a client driving it; that
|
|
# is the N-process recipe ocsp-stapling also waits on.
|
|
|
|
- id: ocsp-stapling
|
|
path: ocsp/stapling
|
|
profile: ocsp
|
|
# Three processes, not two, which is why this waited on the procs: step.
|
|
# Certs are pre-generated and checked in (valid to 2027-09-14), so no cert
|
|
# step -- but they DO expire, and this is the example CI exists to catch.
|
|
run:
|
|
# `make responder` verbatim: openssl's own OCSP responder on :22221.
|
|
- procs: &stapling
|
|
background:
|
|
- argv: [openssl, ocsp, -index, responder-certs/index.txt, -port, "22221",
|
|
-rsigner, responder-certs/ocsp-responder-int1-cert.pem,
|
|
-rkey, responder-certs/ocsp-responder-int1-key.pem,
|
|
-CA, client-certs/intermediate1-ca-cert.pem]
|
|
port: 22221
|
|
- argv: [./ocsp-server]
|
|
port: 11111
|
|
client: [./ocsp-client, --tls12]
|
|
# exit 0 only means the client ran; this means it got a stapled response
|
|
# back and the handshake completed.
|
|
expect: "Client: TLS handshake success"
|
|
# ocsp-server accepts once and exits, so tls13 needs its own chain.
|
|
- procs:
|
|
<<: *stapling
|
|
client: [./ocsp-client, --tls13]
|
|
expect: "Client: TLS handshake success"
|
|
# wolfSSL bug (not the example): a CTX-set status_request is dropped from
|
|
# the TLS1.3 Certificate msg (-429). Fixed on master by wolfSSL/wolfssl#10936,
|
|
# still in v5.9.2-stable; drop expect_fail + fixed_on once a stable tag has it.
|
|
expect_fail: "wolfSSL drops a CTX-set status_request in the TLS1.3 Certificate msg (-429)"
|
|
fixed_on: [master]
|
|
|
|
- id: custom-io-file-client
|
|
path: custom-io-callbacks/file-client
|
|
profile: debug
|
|
deps: [clang]
|
|
mode: build-only
|
|
reason: "client half of the file-server pair; custom-io-file-server runs both"
|
|
|
|
- id: custom-io-file-server
|
|
path: custom-io-callbacks/file-server
|
|
profile: debug
|
|
deps: [clang]
|
|
setup:
|
|
# the pair talks over files in file-client/, and stale ones desync the handshake
|
|
- [sh, -c, "cd ../file-client && ./clean-io-files.sh 2>/dev/null || true"]
|
|
- [make, -C, ../file-client]
|
|
run:
|
|
# check.sh drives both halves; they live in different dirs and share io
|
|
# files by relative path, so neither runs standalone.
|
|
- script: [./check.sh]
|
|
timeout: 60
|
|
expect: "custom-io file transfer succeeded"
|
|
|
|
- id: dtls-mcast
|
|
path: dtls-mcast
|
|
profile: dtls
|
|
mode: build-only
|
|
reason: >-
|
|
Built here as a stub; run end-to-end by the dedicated dtls-mcast.yml job,
|
|
which the manifest harness cannot host. mcast-peer is a while(running) loop
|
|
with no foreground driver, and multicast needs a full network stack, not
|
|
the harness's loopback-only netns. That job runs all three peers on the
|
|
host, SIGTERMs them, and asserts a peer decrypted another's message.
|
|
|
|
- id: pq-pqc-proxy
|
|
path: pq/pqc_proxy
|
|
profile: pq
|
|
# Not the "4-process chain" this used to claim: it is TWO independent
|
|
# 3-process chains on disjoint ports (11111/11112 and 22221/22222), and the
|
|
# README says both can run at once. Six binaries, two directions.
|
|
run:
|
|
# Direction 1 -- quantum-safe front door: a modern client reaches a legacy
|
|
# TLS 1.2 origin through a PQ-terminating proxy.
|
|
- procs:
|
|
background:
|
|
- argv: [./legacy-server]
|
|
port: 11112
|
|
- argv: [./pq-proxy]
|
|
port: 11111
|
|
client: [./pq-client, 127.0.0.1]
|
|
stdin: "hello over pq\n"
|
|
# kex= is the negotiated key exchange: this asserts ML-KEM actually ran,
|
|
# not merely that some TLS handshake succeeded.
|
|
expect: "kex="
|
|
# Direction 2 -- quantum-safe upgrade: a legacy client is upgraded to PQ
|
|
# by the proxy in front of a PQ origin.
|
|
- procs:
|
|
background:
|
|
- argv: [./pq-server]
|
|
port: 22222
|
|
- argv: [./upgrade-proxy]
|
|
port: 22221
|
|
client: [./legacy-client, 127.0.0.1]
|
|
stdin: "hello over legacy\n"
|
|
expect: "Connected to proxy:"
|
|
|
|
# pk/* -- each subdir is its own Makefile and its own example
|
|
- id: pk-curve25519
|
|
path: pk/curve25519
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-dh-pg
|
|
path: pk/dh-pg
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-ecc
|
|
path: pk/ecc
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-ecdh-generate-secret
|
|
path: pk/ecdh_generate_secret
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-ed25519
|
|
path: pk/ed25519
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-ed25519-gen
|
|
path: pk/ed25519_gen
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-ed448
|
|
path: pk/ed448
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-enc-through-sign-rsa
|
|
path: pk/enc-through-sign-rsa
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-hpke
|
|
path: pk/hpke
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-mikey-sakke
|
|
path: pk/mikey-sakke
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-rsa-kg
|
|
path: pk/rsa-kg
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-rsa-pss
|
|
path: pk/rsa-pss
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-srp
|
|
path: pk/srp
|
|
profile: pk
|
|
mode: check
|
|
- id: pk-test-cert-keypair
|
|
path: pk/test_cert_and_private_keypair
|
|
profile: pk
|
|
mode: check
|
|
|
|
# ------------------------------------------------- host: own shard (heavy)
|
|
- id: tls
|
|
path: tls
|
|
profile: tls
|
|
run:
|
|
# memory-tls needs no sockets and no stdin: the safest target here.
|
|
- exec: [./memory-tls]
|
|
expect: "client msg = hello memory wolfSSL!"
|
|
# `shutdown` is the literal terminator (strncmp(buff, "shutdown", 8)).
|
|
# Only these servers check for it; the rest accept-loop and must be killed.
|
|
- pair:
|
|
server: [./server-tls13]
|
|
client: [./client-tls13, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# interop: an OpenSSL client must complete a mutual TLS 1.3 handshake with the
|
|
# wolfSSL server and read its reply (no "Server:" prefix -- that is our client's).
|
|
- pair:
|
|
server: [./server-tls13]
|
|
client: [openssl, s_client, -connect, 127.0.0.1:11111, -CAfile, ../certs/ca-cert.pem, -cert, ../certs/client-cert.pem, -key, ../certs/client-key.pem, -quiet]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "I hear ya fa shizzle"
|
|
# interop, reverse: our wolfSSL client completes a mutual TLS 1.3 handshake with
|
|
# an OpenSSL server and reads the reply fed to s_server over server_stdin.
|
|
- pair:
|
|
server: [openssl, s_server, -accept, "11111", -cert, ../certs/server-cert.pem, -key, ../certs/server-key.pem, -CAfile, ../certs/ca-cert.pem, -Verify, "1", -quiet]
|
|
server_stdin: "I hear ya from openssl\n"
|
|
client: [./client-tls13, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: term
|
|
expect: "Server: I hear ya from openssl"
|
|
- pair:
|
|
server: [./server-tls-cryptocb]
|
|
client: [./client-tls-cryptocb, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls-posthsauth]
|
|
client: [./client-tls-posthsauth, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls-threaded]
|
|
client: [./client-tls, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls]
|
|
client: [./client-tls, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls-ecdhe]
|
|
client: [./client-tls-ecdhe, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# nonblocking connect is timing-sensitive and could not be run locally, but
|
|
# the client prints the same echo as its siblings once connected.
|
|
- pair:
|
|
server: [./server-tls-nonblocking]
|
|
client: [./client-tls-nonblocking, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls-callback]
|
|
client: [./client-tls-callback, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# the 0.5-RTT reply only prints if the 2nd connection resumed and the
|
|
# server accepted the client's 0-RTT early data
|
|
- pair:
|
|
server: [./server-tls13-earlydata]
|
|
client: [./client-tls13-earlydata, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "0.5-RTT data hello from early data server"
|
|
|
|
- pair:
|
|
server: [./server-tls13-certauth-clienthello]
|
|
client: [./client-tls13-certauth-clienthello, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
|
|
- pair:
|
|
server: [./server-tls-pkcallback]
|
|
client: [./client-tls-pkcallback, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: clean
|
|
expect: "Server: I hear ya fa shizzle"
|
|
|
|
# client-tls-cacb prints the reply in "Received: ...I hear ya fa shizzle"
|
|
# form, not the "Server:" prefix the others use
|
|
- pair:
|
|
server: [./server-tls]
|
|
client: [./client-tls-cacb, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "I hear ya fa shizzle"
|
|
|
|
# server-tcp/client-tcp link no wolfSSL (tls/Makefile strips -lwolfssl); the
|
|
# server returns its write() byte count, so it cannot be server_exit: clean.
|
|
- pair:
|
|
server: [./server-tcp]
|
|
client: [./client-tcp, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
|
|
- pair:
|
|
server: [./server-tls-verifycallback]
|
|
client: [./client-tls, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls-writedup]
|
|
client: [./client-tls-writedup, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls]
|
|
client: [./client-tls-bio, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- pair:
|
|
server: [./server-tls]
|
|
client: [./client-tls-pkcs12, 127.0.0.1]
|
|
stdin: "shutdown\n"
|
|
server_exit: killed
|
|
expect: "Server: I hear ya fa shizzle"
|
|
# client-tls-resume calls fgets twice, so it needs two lines.
|
|
- pair:
|
|
server: [./server-tls]
|
|
client: [./client-tls-resume, 127.0.0.1]
|
|
stdin: "hello\nshutdown\n"
|
|
server_exit: killed
|
|
expect: "Successful resume."
|
|
- pair:
|
|
server: [./server-tls13]
|
|
client: [./client-tls13-resume, 127.0.0.1]
|
|
stdin: "hello\nshutdown\n"
|
|
server_exit: killed
|
|
expect: "Successful resume"
|
|
# Deliberately not run: client-ech (external crypto.cloudflare.com:443),
|
|
# {client,server}-tls-uart (needs /dev/ttyUSB0), and the four *-perf
|
|
# benchmarks. All still build.
|
|
|
|
- id: dtls
|
|
path: dtls
|
|
profile: dtls
|
|
deps: [libevent-dev]
|
|
run:
|
|
# No dtls server honours any in-band terminator -- "shutdown" does not
|
|
# exist in this dir. Every server loops until SIGINT, so all pairs are
|
|
# server_exit: killed.
|
|
# BIO_s_mem is a byte stream, so a DTLS record can end mid-read; without
|
|
# RECORDS_CAN_SPAN_DATAGRAMS (set in the profile) wolfSSL treats that as a
|
|
# truncated datagram and drops it, and nothing retransmits.
|
|
- exec: [./memory-bio-dtls]
|
|
expect: "client msg = hello memory wolfSSL!"
|
|
# A complete DTLS server rather than a self-contained demo: bare exec just
|
|
# blocks in poll() until the step times out. It has no dedicated client.
|
|
# export writes dtls_{server,client}_session.bin; import reads them, so this
|
|
# order is load bearing.
|
|
- pair:
|
|
server: [./server-dtls-export]
|
|
proto: udp
|
|
client: [./client-dtls-export, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: clean
|
|
|
|
- pair:
|
|
server: [./server-dtls-import]
|
|
proto: udp
|
|
client: [./client-dtls-import, 127.0.0.1]
|
|
stdin: "hello\nquit\n"
|
|
server_exit: killed
|
|
|
|
# clients that pair with servers this dir already runs. Each client fputs
|
|
# the server's reply; server-dtls/server-dtls13 send "I hear you fashizzle".
|
|
- pair:
|
|
server: [./server-dtls]
|
|
proto: udp
|
|
client: [./client-dtls-cid, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
|
|
- pair:
|
|
server: [./server-dtls13]
|
|
proto: udp
|
|
client: [./client-dtls13-cid, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
|
|
- pair:
|
|
server: [./server-dtls]
|
|
proto: udp
|
|
client: [./client-dtls-resume, 127.0.0.1]
|
|
server_exit: killed
|
|
# proves the resumed session carried data back -- the whole point of
|
|
# the pair the close_notify fix was for. Repeat to stress that fix: this
|
|
# pair used to flake, so a single green proved little.
|
|
repeat: 5
|
|
expect: "info: server response:"
|
|
|
|
- pair:
|
|
server: [./server-dtls]
|
|
proto: udp
|
|
client: [./client-dtls-shared, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "got msg"
|
|
|
|
- pair:
|
|
server: [./server-dtls13-event]
|
|
proto: udp
|
|
client: [./client-dtls13, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
|
|
- pair:
|
|
server: [./server-dtls-rw-threads]
|
|
proto: udp
|
|
client: [./client-dtls-rw-threads, 127.0.0.1]
|
|
server_exit: killed
|
|
|
|
- pair:
|
|
server: [./server-dtls-threaded]
|
|
proto: udp
|
|
client: [./client-dtls-threaded, 127.0.0.1]
|
|
server_exit: killed
|
|
|
|
# no expect: over IPv6 loopback in the harness netns the reply is not
|
|
# delivered to the client (all IPv4 dtls pairs print it; only ::1 does not),
|
|
# so exit code is the only reliable signal here.
|
|
- pair:
|
|
server: [./server-dtls-ipv6]
|
|
proto: udp
|
|
client: [./client-dtls-ipv6, "::1"]
|
|
server_exit: killed
|
|
|
|
- pair:
|
|
server: [./server-dtls-demux]
|
|
proto: udp
|
|
client: [./client-dtls, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
- pair:
|
|
server: [./server-udp]
|
|
proto: udp
|
|
client: [./client-udp, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
- pair:
|
|
server: [./server-dtls]
|
|
proto: udp
|
|
client: [./client-dtls, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
- pair:
|
|
server: [./server-dtls13]
|
|
proto: udp
|
|
client: [./client-dtls13, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
- pair:
|
|
server: [./server-dtls-nonblocking]
|
|
proto: udp
|
|
client: [./client-dtls-nonblocking, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
expect: "I hear you fashizzle"
|
|
- pair:
|
|
server: [./server-dtls-callback]
|
|
proto: udp
|
|
client: [./client-dtls-callback, 127.0.0.1]
|
|
stdin: "hello\n"
|
|
server_exit: killed
|
|
# "Handshake complete after early data" only prints if the 2nd connection
|
|
# resumed with the ticket and the server accepted the 0-RTT early data
|
|
- pair:
|
|
server: [./server-dtls13-earlydata]
|
|
proto: udp
|
|
client: [./client-dtls13-earlydata, 127.0.0.1]
|
|
server_exit: killed
|
|
expect: "Handshake complete after early data"
|
|
|
|
|
|
- id: pkcs11
|
|
path: pkcs11
|
|
profile: pkcs11
|
|
deps: [softhsm2]
|
|
# softhsm2-init.sh does README steps 3-4 (config, token init) and reads back
|
|
# the slot id SoftHSM reassigns at random, then runs the 8 examples.
|
|
# The 3 TLS binaries need wolfSSL's own client as the peer, which is not in
|
|
# this repo, so 8 of 11 is the honest ceiling here.
|
|
run:
|
|
# 7 of the 8 pass. pkcs11_test is run separately rather than folded in
|
|
# here, so a regression in these 7 still turns the job red.
|
|
- script: [./softhsm2-init.sh, pkcs11_rsa, pkcs11_ecc, pkcs11_genecc,
|
|
pkcs11_aesgcm, pkcs11_aescbc, pkcs11_hmac, pkcs11_rand]
|
|
# softhsm2.sh only prints this once every example it ran returned 0.
|
|
expect: "All PKCS#11 examples passed"
|
|
timeout: 300
|
|
- script: [./softhsm2-init.sh, pkcs11_test]
|
|
expect: "All PKCS#11 examples passed"
|
|
timeout: 300
|
|
# gen_ec_keys_label() then wc_ecc_verify_hash() on the PKCS#11 public key
|
|
# returns WC_HW_E (-248); signing and the no-label path pass. Fixed on
|
|
# master by wolfSSL/wolfssl#10954 (keygen destroys the HSM public key, so
|
|
# verify must use the exported point), still in the latest stable tag;
|
|
# drop expect_fail + fixed_on once a stable tag has it. Not reproducible
|
|
# locally -- brew SoftHSM 2.7 reports PKCS#11 3.2 but exports no
|
|
# C_GetInterface, which wolfSSL rejects first.
|
|
expect_fail: "wc_ecc_verify_hash on a label-generated PKCS#11 EC key returns WC_HW_E (-248)"
|
|
fixed_on: [master]
|
|
|
|
# ------------------------------------------------- host: separate profiles
|
|
- id: pk-rsa
|
|
path: pk/rsa
|
|
profile: fastmath
|
|
mode: check
|
|
|
|
- id: signature-rsa-vfy-only
|
|
path: signature/rsa_vfy_only
|
|
# Keep cryptonly. This used to say "try under the `all` profile and drop this
|
|
# one" -- but `all` is documented above as emulated/cross only, it supplies
|
|
# none of --disable-asn/--enable-cryptonly/--enable-rsavfy/-DWOLFSSL_PUBLIC_MP
|
|
# that verify.c's mp_read_unsigned_bin() needs, and --enable-all would defeat
|
|
# the point of a minimum-footprint demo anyway.
|
|
profile: cryptonly
|
|
mode: check
|
|
|
|
# -------------------------------------------------------------- emulated
|
|
# csharp.yml compiles the wrapper's .cs with mcs and plays the client against
|
|
# each server under mono; the .csproj targets .NET Framework v4.8 and pulls in
|
|
# wolfSSL's own wolfSSL_CSharp.csproj, so it is not buildable here.
|
|
- id: csharp-pq-client
|
|
path: CSharp/wolfSSL-TLS-pq-Client
|
|
tier: cross
|
|
profile: pq
|
|
|
|
- id: csharp-pq-server
|
|
path: CSharp/wolfSSL-TLS-pq-Server
|
|
tier: cross
|
|
profile: pq
|
|
|
|
- id: csharp-pq-server-threaded
|
|
path: CSharp/wolfSSL-TLS-pq-ServerThreaded
|
|
tier: cross
|
|
profile: pq
|
|
|
|
- id: tpm
|
|
path: tpm
|
|
tier: emulated
|
|
profile: all
|
|
# emulated.yml runs it against wolfTPM's own fwTPM simulator on :2321
|
|
run:
|
|
- exec: [./evp_tpm]
|
|
expect: "Create/Load ECC Key: Handle"
|
|
|
|
|
|
- id: sgx-linux
|
|
path: SGX_Linux
|
|
tier: emulated
|
|
profile: all
|
|
# emulated.yml builds the enclave and runs ./App in SGX_MODE=SIM
|
|
|
|
|
|
- id: can-bus
|
|
path: can-bus
|
|
tier: emulated
|
|
profile: all
|
|
# emulated.yml runs server/client over vcan0 (root + linux-modules-extra)
|
|
|
|
|
|
- id: uefi-library
|
|
path: uefi-library
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: >-
|
|
REAL, UNDIAGNOSED wolfCrypt BUG under UEFI. Booting works (OVMF, -cpu
|
|
qemu64, ESP as a real FAT image via mtools -- QEMU's vvfat "fat:rw:"
|
|
SIGABRTs on a runner) and the suite runs: AES, SHA, HMAC, CMAC, KDF and RNG
|
|
all pass, then "Running RSA ... wc_CheckRsaKey failed: -262" and "Test suite
|
|
FAILED: Aborted". RULED OUT: key size. The test used a 1024-bit asset while
|
|
RSA_MIN_SIZE defaults to 2048, which looked like the cause -- it is not; the
|
|
key is now wolfSSL's 2048-bit certs/client-key.der and -262 is unchanged.
|
|
-262 comes from _ifc_pairwise_consistency_test (rsa.c), which signs and
|
|
verifies "Everyone gets Friday off." and collapses ANY non-zero into
|
|
RSA_KEY_PAIR_E, so the real error is hidden. NEXT: instrument that call, and
|
|
look at this dir's user_settings.h, which sets both WC_RSA_BLINDING and
|
|
WC_NO_HARDEN (the latter cancels the former), plus RSA_LOW_MEM (no CRT) and
|
|
XMALLOC_USER. Needs someone who can run a UEFI build. Restore the boot step
|
|
from this file's history once fixed; it asserts "All tests passed!".
|
|
|
|
# ----------------------------------------------------------------- cross
|
|
- id: esp32-dtls13-client
|
|
path: ESP32/DTLS13-wifi-station-client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: esp32-dtls13-server
|
|
path: ESP32/DTLS13-wifi-station-server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: esp32-tls13-enc28j60-client
|
|
path: ESP32/TLS13-ENC28J60-client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: esp32-tls13-enc28j60-server
|
|
path: ESP32/TLS13-ENC28J60-server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: esp32-tls13-wifi-client
|
|
path: ESP32/TLS13-wifi_station-client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: esp32-tls13-wifi-server
|
|
path: ESP32/TLS13-wifi_station-server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: rpi-pico
|
|
path: RPi-Pico
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-benchmark
|
|
path: RPi-Pico/benchmark
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-testwolfcrypt
|
|
path: RPi-Pico/testwolfcrypt
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-tcp-client
|
|
path: RPi-Pico/tcp_client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-tcp-server
|
|
path: RPi-Pico/tcp_server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-tls-client
|
|
path: RPi-Pico/tls_client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-tls-server
|
|
path: RPi-Pico/tls_server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: rpi-pico-wifi
|
|
path: RPi-Pico/wifi
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: rt1060
|
|
path: RT1060
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: puf
|
|
path: puf
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: uefi-static
|
|
path: uefi-static
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: arduino-template
|
|
path: Arduino/sketches/template
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: ebpf-syscall-write-trace
|
|
path: ebpf/syscall-write-trace
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: ebpf-tls-uprobe-trace
|
|
path: ebpf/tls-uprobe-trace
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
- id: fullstack-https
|
|
path: fullstack/freertos-wolfip-wolfssl-https
|
|
tier: cross
|
|
profile: all
|
|
- id: android-wolfcryptjni
|
|
path: android/wolfcryptjni-ndk-gradle
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet"
|
|
- id: android-wolfcryptjni-app
|
|
path: android/wolfcryptjni-ndk-gradle/app
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet"
|
|
- id: android-wolfssljni
|
|
path: android/wolfssljni-ndk-gradle
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet"
|
|
- id: android-wolfssljni-app
|
|
path: android/wolfssljni-ndk-gradle/app
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet"
|
|
- id: android-wolfssljni-sample
|
|
path: android/wolfssljni-ndk-sample/jni
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
reason: "gradle + NDK; assembleDebug is the honest ceiling (no instrumentation harness). No job wired yet"
|
|
|
|
# ------------------------------------------------------------------ skip
|
|
- id: btle-common
|
|
path: btle/common
|
|
mode: skip
|
|
reason: "shared helper (btle-sim.c) linked by btle/ecies and btle/tls; not an example"
|
|
|
|
- id: puf-host-test
|
|
path: puf/host_test
|
|
mode: skip
|
|
reason: >-
|
|
Host behavioral test harness for puf's interactive demo, not an example:
|
|
puf.yml builds it and runs driver.py against wolfSSL master (the demo
|
|
needs post-v5.9.2 PUF APIs, so the stable ref is excluded there)
|
|
|
|
- id: hsm-dtls-client
|
|
path: hsm/dtls_client
|
|
mode: skip
|
|
reason: >-
|
|
Built and run end-to-end by the dedicated hsm.yml job (wolfHSM posix server +
|
|
wolfSSL DTLS server + this client, asserting the HSM-backed handshake);
|
|
master-only since wolfHSM tracks wolfSSL master
|
|
|
|
# arduino.yml does NOT cover these: it copies compile-all-examples.sh into
|
|
# $ARDUINO_ROOT/wolfssl/examples and runs it there, compiling the examples that
|
|
# ship inside the installed Arduino wolfSSL library, not this repo's sketches.
|
|
# Building them needs arduino-cli plus a core per board.
|
|
- id: arduino-client
|
|
path: Arduino/sketches/wolfssl_client
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: arduino-server
|
|
path: Arduino/sketches/wolfssl_server
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: arduino-client-dtls
|
|
path: Arduino/sketches/wolfssl_client_dtls
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: arduino-server-dtls
|
|
path: Arduino/sketches/wolfssl_server_dtls
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: arduino-AES-CTR
|
|
path: Arduino/sketches/wolfssl_AES_CTR
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: arduino-version
|
|
path: Arduino/sketches/wolfssl_version
|
|
tier: cross
|
|
profile: all
|
|
mode: build-only
|
|
|
|
- id: esp32-hello-world
|
|
path: ESP32/ESP32-hello-world
|
|
tier: cross
|
|
mode: skip
|
|
reason: >-
|
|
Not worth wiring: hello_world.ino is 12 lines and does not include wolfSSL
|
|
at all, so compiling it would test arduino-cli rather than wolfSSL. It is
|
|
also an arduino-cli sketch rather than an ESP-IDF project (the esp32 job
|
|
builds idf.py projects), and its dir name does not match the .ino basename,
|
|
which arduino-cli requires -- so even Arduino/sketches/compile-all-examples.sh
|
|
could not pick it up as-is. Delete or fold into Arduino/sketches if anyone
|
|
wants it covered.
|
|
|
|
- id: sgx-windows-benchmarks
|
|
path: SGX_Windows/Benchmarks
|
|
mode: skip
|
|
reason: >-
|
|
Tried on windows-latest and reverted: the Intel SGX SDK for Windows has no
|
|
download URL that can be verified from here. Intel serves it from
|
|
registrationcenter-download.intel.com behind a per-release GUID (a guessed
|
|
one returns AccessDenied), intel/linux-sgx's releases carry no Windows
|
|
assets, and there is no chocolatey package. Someone with a browser needs to
|
|
get the current installer link, or host it. Beyond that: README.md targets
|
|
Visual Studio 2013 with the Intel compiler so the project files likely need
|
|
retargeting, and wolfssl.lib must be built first from wolfSSL's own
|
|
IDE/WIN-SGX solution and copied in. sgx-linux already covers the same
|
|
wolfSSL code under SGX_MODE=SIM, so the payoff is small either way.
|
|
|
|
- id: sgx-windows-enclave
|
|
path: SGX_Windows/Enclave
|
|
mode: skip
|
|
reason: >-
|
|
Tried on windows-latest and reverted: the Intel SGX SDK for Windows has no
|
|
download URL that can be verified from here. Intel serves it from
|
|
registrationcenter-download.intel.com behind a per-release GUID (a guessed
|
|
one returns AccessDenied), intel/linux-sgx's releases carry no Windows
|
|
assets, and there is no chocolatey package. Someone with a browser needs to
|
|
get the current installer link, or host it. Beyond that: README.md targets
|
|
Visual Studio 2013 with the Intel compiler so the project files likely need
|
|
retargeting, and wolfssl.lib must be built first from wolfSSL's own
|
|
IDE/WIN-SGX solution and copied in. sgx-linux already covers the same
|
|
wolfSSL code under SGX_MODE=SIM, so the payoff is small either way.
|
|
|
|
- id: java-https-url
|
|
path: java/https-url
|
|
tier: cross
|
|
profile: default
|
|
mode: build-only
|
|
# java.yml builds wolfSSL with JNI, builds wolfssljni on top and javac's
|
|
# URLClient against wolfssl-jsse.jar -- so `build: none` here means the
|
|
# harness does not build it, not that nothing does.
|
|
build: none
|
|
reason: >-
|
|
URLClient fetches a real URL over the public internet (the README's own
|
|
invocation is -h https://www.google.com with example-keystores/external.jks),
|
|
so running it in CI would test GitHub's network, not wolfJSSE. Compiling it
|
|
against the jar is the honest ceiling. Same call as ocsp-nonblock.
|
|
|
|
- id: kernel-bsdkm
|
|
path: kernel/bsdkm
|
|
tier: cross
|
|
profile: default
|
|
# bsdkm.yml runs it in a real FreeBSD 14.2 VM (vmactions/freebsd-vm), the
|
|
# version README.md says it was tested on. It also fetches src.txz, because
|
|
# the Makefile includes /usr/src/sys/conf/kmod.mk -- the live kernel source,
|
|
# not the bsd.kmod.mk in base. kldload then proves it in-kernel.
|
|
build: none
|
|
|
|
- id: meta-wolfssl-linux-fips
|
|
path: meta-wolfssl-linux-fips
|
|
mode: skip
|
|
reason: "full Yocto bitbake: hours of build time and tens of GB"
|
|
|
|
- id: stsafe
|
|
path: stsafe
|
|
mode: skip
|
|
reason: "needs a real STSAFE-A120 over /dev/i2c-N; platform layer is hard-wired to Linux I2C with no transport abstraction, so wolfSSL/simulators' STSAFEA120Sim cannot drive it without a new platform shim"
|
|
|
|
- id: rtl8735b
|
|
path: rtl8735b
|
|
mode: skip
|
|
reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain"
|
|
- id: rtl8735b-test
|
|
path: rtl8735b/test
|
|
mode: skip
|
|
reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain"
|
|
- id: rtl8735b-tls
|
|
path: rtl8735b/tls
|
|
mode: skip
|
|
reason: "RealTek AmebaPro2 SDK + licensed ASDK 10.3.0 toolchain"
|
|
|
|
- id: ti-c2000-f28p55x
|
|
path: embedded/ti-c2000-f28p55x
|
|
mode: skip
|
|
reason: "TI LAUNCHXL-F28P55X bare metal; licensed C2000 CGT (cl2000) compiler plus C2000Ware, and the KAT output only comes back over the board's XDS110 JTAG/CIO link"
|
|
|
|
- id: renesas-rh850
|
|
path: Renesas/cs+/RH850/rsapss_sign_verify
|
|
mode: skip
|
|
reason: "Renesas CS+ IDE project; licensed Windows-only CC-RH compiler"
|
|
|
|
- id: ccb-vaultic
|
|
path: ccb_vaultic
|
|
mode: skip
|
|
reason: "Wisekey VaultIC dev kit + Android NDK ($NDK_CC)"
|
|
|
|
- id: caam-seco
|
|
path: caam/seco
|
|
mode: skip
|
|
reason: "NXP SECO HSM ($HSM_DIR) + aarch64-poky cross toolchain"
|
|
- id: caam-seco-cryptodev
|
|
path: caam/seco/cryptodev
|
|
mode: skip
|
|
reason: "NXP SECO HSM ($HSM_DIR) + aarch64-poky cross toolchain"
|
|
|
|
- id: maxq10xx
|
|
path: maxq10xx
|
|
mode: skip
|
|
reason: "Analog Devices MAXQ10xx SDK and hardware"
|
|
|
|
- id: crypto-magiccrypto
|
|
path: crypto/MagicCrypto
|
|
mode: skip
|
|
reason: "Aria vendor SDK (ships MagicCrypto.patch); not redistributable"
|
|
|
|
- id: psa
|
|
path: psa
|
|
tier: cross
|
|
profile: default
|
|
# psa.yml owns this one: the example's own build_with_mbedtls_psa.sh pins an
|
|
# mbedTLS commit and runs ./configure --enable-psa itself, so it cannot be a
|
|
# profile here. That script is why the old "needs a PSA implementation" skip
|
|
# was too pessimistic -- the implementation builds from source in ~2 minutes.
|
|
build: none
|
|
|
|
- id: pq-tls
|
|
path: pq/tls
|
|
profile: pq
|
|
# "needs liboqs" was stale: it predates wolfSSL's native ML-KEM/ML-DSA.
|
|
# Neither the sources nor the Makefile mention oqs -- they gate on
|
|
# WOLFSSL_HAVE_MLKEM and HAVE_DILITHIUM, which the pq profile already
|
|
# supplies, and the README asks for plain --enable-kyber --enable-dilithium.
|
|
# The mldsa87 certs it wants are checked in under certs/.
|
|
run:
|
|
- pair:
|
|
server: [./server-pq-tls13]
|
|
client: [./client-pq-tls13, 127.0.0.1]
|
|
stdin: "hello pq tls\n"
|
|
server_exit: term
|
|
# the server sends a fixed reply rather than echoing
|
|
# (server-pq-tls13.c:156), so this is the proof that a
|
|
# SECP521R1MLKEM1024 session carried data back.
|
|
expect: "Server: I hear ya fa shizzle"
|
|
- id: pq-tls-stm32
|
|
path: pq/tls/stm32
|
|
mode: skip
|
|
reason: "STM32 board project for the liboqs TLS example"
|
|
|
|
- id: se050
|
|
path: SE050/wolfssl
|
|
mode: skip
|
|
reason: >-
|
|
Built and run end-to-end by the dedicated se050.yml job, which the examples
|
|
matrix cannot host: it builds the whole SE050 stack -- the SE050Sim TCP
|
|
applet sim (wolfSSL/simulators), the NXP plug-and-trust SDK v04.07.01 with
|
|
wolfSSL osp's simw-top-v040701.patch, and wolfSSL --with-se050 (a two-pass
|
|
bootstrap) -- then grafts this demo onto the sim's own CMakeLists (the
|
|
GitHub plug-and-trust tree has no demos/ scaffolding) and runs wolfcrypt_test
|
|
through the ex_sss boot over the sim, asserting "Ran wolfCrypt test". The
|
|
other five demos build the same way; the two TLS clients also need a peer
|
|
server, so wolfcrypt_test is the first one wired.
|
|
- id: se050-benchmark
|
|
path: SE050/wolfssl/wolfcrypt_benchmark
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
- id: se050-generate-csr
|
|
path: SE050/wolfssl/wolfcrypt_generate_csr
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
- id: se050-key-cert-insert
|
|
path: SE050/wolfssl/wolfcrypt_key_cert_insert
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
- id: se050-test
|
|
path: SE050/wolfssl/wolfcrypt_test
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
- id: se050-client
|
|
path: SE050/wolfssl/wolfssl_client
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
- id: se050-client-cert-key
|
|
path: SE050/wolfssl/wolfssl_client_cert_key
|
|
mode: skip
|
|
reason: same as se050 -- the public plug-and-trust tree has no demos/ scaffolding to build these in
|
|
|
|
- id: toppers
|
|
path: TOPPERS/WolfSSLDemo
|
|
mode: skip
|
|
reason: "Renesas RX72N + TOPPERS/ASP3 RTOS; needs the Renesas software package"
|
|
- id: toppers-wolfdemo
|
|
path: TOPPERS/WolfSSLDemo/src/wolfDemo
|
|
mode: skip
|
|
reason: "Renesas RX72N + TOPPERS/ASP3 RTOS"
|
|
|
|
- id: tirtos-tcpecho-client
|
|
path: tirtos_ccs_examples/tcpEcho_Client_TivaTM4C1294NCPDT
|
|
mode: skip
|
|
reason: "TI Code Composer Studio + XDCtools + TI-RTOS"
|
|
- id: tirtos-tcpecho-server
|
|
path: tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT
|
|
mode: skip
|
|
reason: "TI Code Composer Studio + XDCtools + TI-RTOS"
|
|
- id: tirtos-tests
|
|
path: tirtos_ccs_examples/wolfssl_tests
|
|
mode: skip
|
|
reason: "TI Code Composer Studio + XDCtools + TI-RTOS"
|
|
- id: tirtos-benchmark
|
|
path: tirtos_ccs_examples/wolfssl_tirtos_benchmark
|
|
mode: skip
|
|
reason: "TI Code Composer Studio + XDCtools + TI-RTOS"
|
|
|
|
- id: mynewt
|
|
path: mynewt
|
|
mode: skip
|
|
reason: >-
|
|
The full newt build (native bsp sim + TLS run) is a follow-up: jenkins.sh
|
|
here has been unrun since 2018 and pulls the whole Apache Mynewt RTOS, which
|
|
is a lot of unproven CI surface. What IS covered now: the wolfSSL Mynewt
|
|
PORT compiles. Found by wiring this up, it did not -- settings.h set
|
|
XMALLOC_USER (for user-provided FUNCTIONS) yet defined XFREE as a MACRO, so
|
|
types.h's "extern void XFREE(void *p, ...)" under the XMALLOC_USER branch had
|
|
the macro expand into it: "expected identifier". Fixed on wolfSSL master
|
|
2026-07-20 (XMALLOC_USER -> XMALLOC_OVERRIDE); v5.9.2-stable still has it.
|
|
mynewt.yml compiles that exact header path on both refs (patching the ones
|
|
that predate the fix) via ci-compile-check.sh, so the bug cannot come back
|
|
unseen. Un-skip for the full newt build once stable carries the fix. (Also
|
|
fixed here: client-tls-mn.c cast pointers through int, which -Werror rejects
|
|
on the 64-bit native BSP.)
|
|
|
|
- id: picotcp
|
|
path: picotcp
|
|
profile: default
|
|
mode: build-only
|
|
# v1.7.0, not master: README.md:10 asks for "PicoTCP v.1.7 or later", and
|
|
# picoTCP is archived upstream so master has drifted from what this was
|
|
# written against. fetch: runs outside the netns; nothing is redirected,
|
|
# because hiding this build is what made an earlier attempt a mystery.
|
|
fetch:
|
|
- [sh, -c, "test -d ../../picotcp || git clone -q --depth 1 --branch v1.7.0 https://github.com/tass-belgium/picotcp ../../picotcp"]
|
|
# cd, NOT make -C: picotcp's Makefile:16 is PREFIX?=$(PWD)/build, and -C
|
|
# leaves PWD at the caller, so it built into wolfssl-examples/picotcp/build.
|
|
# deps before lib as well: lib cp's headers into $(PREFIX)/include but only
|
|
# deps mkdir's it (Makefile:367-380).
|
|
- [sh, -c, "cd ../../picotcp && make ARCH=shared TAP=1 deps && make ARCH=shared TAP=1 lib"]
|
|
- [sh, -c, "ls ../../picotcp/build/include/pico_stack.h"]
|
|
reason: >-
|
|
picotcp-server opens /dev/net/tun and brings up 10.0.0.1 itself, so running
|
|
it needs a tun device in the netns. Building against a real picoTCP is the
|
|
honest ceiling until that is probed.
|
|
- id: riot-os-posix-lwip
|
|
path: riot-os-posix-lwip
|
|
mode: skip
|
|
reason: >-
|
|
Got further than the old "needs a RIOT tree at $RIOTBASE" suggested, and
|
|
found two things that matter. (1) RIOT does NOT use the wolfSSL under test:
|
|
it vendors its own pinned wolfSSL package via pkg/pkg.mk, so a green here
|
|
would say nothing about master or stable -- the point of this CI. (2) That
|
|
pinned wolfSSL does not compile on a current toolchain anyway:
|
|
build/pkg/wolfssl/wolfcrypt/src/sp_int.c:13390 "implicit declaration of
|
|
_sp_exptmod_ex" under gcc-13 -Werror=implicit-function-declaration.
|
|
Wiring it needs RIOT's pkg pointed at the ref under test first (see
|
|
RIOT's PKG_URL/PKG_VERSION), which is real work upstream. Mechanics that
|
|
DO work and are worth reusing: clone RIOT to ../../RIOT (the Makefile's
|
|
default, BOARD ?= native) via fetch:, then `make pkg-prepare` in fetch: so
|
|
RIOT downloads its packages before the run enters the netns.
|
|
|
|
- id: lwip
|
|
path: lwip
|
|
mode: skip
|
|
reason: "needs an lwIP source tree; no Makefile in this dir"
|
|
|
|
- id: freertos
|
|
path: freertos
|
|
mode: skip
|
|
reason: "orphan source (tls_client_freertos_tcp.c): no Makefile and no README"
|
|
|
|
- id: utasker
|
|
path: utasker
|
|
mode: skip
|
|
reason: "uTasker project task files; no standalone build"
|