From ae1ea4079b1f64060baf4ea84615a99e5b5fe604 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 22 Jul 2026 15:07:46 +0200 Subject: [PATCH 1/3] Retry flaky libssh2 Docker tests with make recheck The libssh2 integration tests start a fresh OpenSSH-server container per test with "docker run -d -p 22" and then immediately open the SSH connection. Docker maps the port as soon as the container starts, so the TCP connect succeeds before sshd inside the container is ready to send its banner, and the handshake fails with "Failed getting banner" (-43). This shows up as an intermittent failure of a single test, most often test_read, on unrelated pull requests. Fall back to "make recheck" when "make check" fails. The automake parallel test harness re-runs only the tests that did not pass, so a transient container-readiness race no longer fails the job while a genuine failure still does. --- .github/workflows/libssh2.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/libssh2.yml b/.github/workflows/libssh2.yml index 2b440e694c..db4679f87f 100644 --- a/.github/workflows/libssh2.yml +++ b/.github/workflows/libssh2.yml @@ -87,7 +87,12 @@ jobs: - name: Run libssh2 tests working-directory: libssh2 - run: make -j check + # The Docker OpenSSH-server tests hit a container-readiness race + # ("Failed getting banner"): the client connects before sshd in the + # freshly started container is ready to send its banner. Re-run only + # the tests that did not pass, so a transient race does not fail the + # job while a genuine failure still does. + run: make -j check || make recheck || make recheck - name: Confirm libssh2 built with wolfSSL run: ldd libssh2/src/.libs/libssh2.so | grep wolfssl From c5518f2c18d6d1f2b657963e4ad0e5f8510478e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 22 Jul 2026 15:26:36 +0200 Subject: [PATCH 2/3] Correct stale make-check timing weights in trackmemory CI parallel-make-check.py schedules configs longest-first by their "minutes" weight, but five of the seven trackmemory configs were weighted well below their real runtime, which the run summary flags every time ("ran X min but minutes says Y (>50% off)"). The underweighted configs include the two wolfEntropy jitter configs, whose runtime already varies severalfold with runner contention. Scheduling them last, on stale short weights, is what lets a contended run drift into the 40-minute timeout. Update the five flagged weights to the durations reported by the run summary and re-sort the list descending so the slowest, most variable configs start in the first scheduling wave and get the full time budget. Config coverage is unchanged. --- .github/workflows/trackmemory.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/trackmemory.yml b/.github/workflows/trackmemory.yml index f30d93d5e2..746114173d 100644 --- a/.github/workflows/trackmemory.yml +++ b/.github/workflows/trackmemory.yml @@ -70,25 +70,25 @@ jobs: run: | cat > "$RUNNER_TEMP/trackmemory-configs.json" <<'EOF' [ - {"name": "all-noasm-wolfentropy", "minutes": 3, + {"name": "all-noasm-wolfentropy", "minutes": 6.3, "configure": ["--disable-asm", "--enable-wolfEntropy", "--enable-smallstackcache", "--enable-smallstack", "--enable-all", "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY -DNO_WOLFSSL_CIPHER_SUITE_TEST"]}, - {"name": "all-trace-errcodes", "minutes": 2.5, - "configure": ["--enable-all", "--enable-debug-trace-errcodes", - "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"]}, - {"name": "all-smallstack", "minutes": 2.5, - "configure": ["--enable-smallstack", "--enable-all", - "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"]}, - {"name": "all-smallstack-cache-trace", "minutes": 2.5, + {"name": "all-smallstack-cache-trace", "minutes": 4.1, "configure": ["--enable-smallstackcache", "--enable-smallstack", "--enable-all", "--enable-debug-trace-errcodes", "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"]}, - {"name": "all-wolfentropy", "minutes": 2.5, + {"name": "all-wolfentropy", "minutes": 4.1, "comment": "smallstackcache coverage here is crucial for the Linux kernel module when targeting a kernel with the randomness patch (linuxkm/patches/) applied. Don't combine wolfEntropy with the full TLS cipher suite test - the implicit wc_InitRng()s in each suite have an enormous CPU footprint.", "configure": ["--enable-wolfEntropy", "--enable-smallstackcache", "--enable-smallstack", "--enable-all", "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY -DNO_WOLFSSL_CIPHER_SUITE_TEST"]}, + {"name": "all-trace-errcodes", "minutes": 3.9, + "configure": ["--enable-all", "--enable-debug-trace-errcodes", + "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"]}, + {"name": "all-smallstack", "minutes": 3.9, + "configure": ["--enable-smallstack", "--enable-all", + "CFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"]}, {"name": "all-intelrdseed", "minutes": 2.5, "configure": ["--enable-intelrdseed", "--enable-smallstackcache", "--enable-smallstack", "--enable-all", From adb0da74a90bd7199e00c261b2b7613a43138af7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 22 Jul 2026 16:51:31 +0200 Subject: [PATCH 3/3] Tolerate timing-flaky non-TLS socat tests via expect_fail A few socat core tests intermittently fail the interop job with diff or timeout mismatches. They exercise socat's own system()/socket/exec-pty plumbing, not the wolfSSL backend, and race under the deliberate CPU oversubscription of the parallel shard scheduling. With parallel-make-check running fail-fast, one such flake in any shard aborts the whole job. Add the observed offenders to the per-version socat test.sh --expect-fail list: 23 (DUALSYSTEMFDSFLUSH) on 1.8.0.3, and 205 (TCP4ENDCLOSE) and 227 (EXECPTYKILL) on 1.8.0.0. test.sh keys its exit status only on unexpected failures, so a listed test that later passes is reported as "OK unexpected" and does not fail the job. Numbers come from each version's own test output, so they match that version's numbering. --- .github/workflows/socat.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/socat.yml b/.github/workflows/socat.yml index 6b285653d0..d76b7f4e5c 100644 --- a/.github/workflows/socat.yml +++ b/.github/workflows/socat.yml @@ -50,9 +50,9 @@ jobs: matrix: include: - socat_version: "1.8.0.0" - expect_fail: "36,64,146,155,156,216,307,309,310,321,386,399,402,403,459,460,467,468,475,478,491,492,528,529" + expect_fail: "36,64,146,155,156,205,216,227,307,309,310,321,386,399,402,403,459,460,467,468,475,478,491,492,528,529" - socat_version: "1.8.0.3" - expect_fail: "146,155,156,307,321,386,399,402,459,460,467,468,475,478,491,492,495,528,529" + expect_fail: "23,146,155,156,307,321,386,399,402,459,460,467,468,475,478,491,492,495,528,529" steps: - name: Checkout wolfSSL CI actions uses: actions/checkout@v5