mirror of https://github.com/wolfSSL/wolfssl.git
483 lines
38 KiB
JSON
483 lines
38 KiB
JSON
[
|
|
{"name": "user-settings-all-compat", "minutes": 9.5,
|
|
"comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
|
|
"user_settings": "examples/configs/user_settings_all.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
|
|
{"name": "all-no-client-auth", "minutes": 9.0,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-public-mp", "minutes": 8.0,
|
|
"comment": "--enable-all plus WOLFSSL_PUBLIC_MP. The shared-secret-at-infinity regression assertion needs direct mp access to plant an out-of-range scalar, because the import path itself now rejects one; without this the assertion is compiled out of every mainstream build.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_PUBLIC_MP"]},
|
|
{"name": "all-dilithium-cryptocb", "minutes": 8.9,
|
|
"configure": ["--enable-all", "--enable-dilithium", "--enable-cryptocb",
|
|
"--enable-cryptocbutils", "--enable-pkcallbacks"]},
|
|
{"name": "all-haproxy-quic", "minutes": 8.6,
|
|
"configure": ["--enable-all", "--enable-haproxy", "--enable-quic"]},
|
|
{"name": "all-asn-template-old-oid-sum", "minutes": 8.5,
|
|
"configure": ["--enable-all", "--enable-asn=template", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
|
|
{"name": "all-tls13-middlebox-compat", "minutes": 8.5,
|
|
"comment": "Only --enable-tls13-middlebox-compat and --enable-jni define WOLFSSL_TLS13_MIDDLEBOX_COMPAT, and configure.ac turns it back off when ECH is on, which --enable-all enables. So no other entry in this matrix compiles the client-side ChangeCipherSpec sends in wolfSSL_connect_TLSv13 or the tests/api/test_tls13.c middlebox tests guarded on that macro; without --disable-ech here they would all be skipped.",
|
|
"configure": ["--enable-all", "--disable-ech", "--enable-tls13-middlebox-compat"]},
|
|
{"name": "all-asn-original-old-oid-sum", "minutes": 8.4,
|
|
"configure": ["--enable-all", "--enable-asn=original", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
|
|
{"name": "all-asn-original", "minutes": 8.3,
|
|
"configure": ["--enable-all", "--enable-asn=original"]},
|
|
{"name": "all-certgencache", "minutes": 8.3,
|
|
"configure": ["--enable-all", "--enable-certgencache"]},
|
|
{"name": "all-certsigncb", "minutes": 8.3,
|
|
"comment": "Only --enable-certsigncb sets WOLFSSL_CERT_SIGN_CB, so without this entry wc_SignCert_cb() and its test are never compiled anywhere in CI. Minutes is seeded from the sibling --enable-all entries; refresh from a run's step summary.",
|
|
"configure": ["--enable-all", "--enable-certsigncb"]},
|
|
{"name": "all-dtls13-frag-ch-no-mlkem", "minutes": 8.2,
|
|
"configure": ["--enable-all", "--enable-dtls13", "--enable-dtls-frag-ch",
|
|
"--disable-mlkem"]},
|
|
{"name": "all-ecc-blind-k", "minutes": 8.0,
|
|
"comment": "Only entry that sets WOLFSSL_ECC_BLIND_K (the blind-private-key entry sets WOLFSSL_BLIND_PRIVATE_KEY, which does not imply it). Keeps the read-only wc_ecc_key_get_priv() contract exercised in CI. pkcs11 is on because wc_pkcs11.c is not compiled anywhere else in this matrix.",
|
|
"configure": ["--enable-all", "--enable-pkcs11",
|
|
"CPPFLAGS=-DWOLFSSL_ECC_BLIND_K"]},
|
|
{"name": "all-check-mem-zero", "minutes": 7.9,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO"]},
|
|
{"name": "all-faultharden-pk-privkey", "minutes": 7.8,
|
|
"comment": "Test holding private key in the PK callback with fault harden. Based on existing customer use case.",
|
|
"configure": ["--enable-all", "--enable-faultharden", "--enable-pkcallbacks", "CPPFLAGS=-DTEST_PK_PRIVKEY"]},
|
|
{"name": "all-secure-renegotiation", "minutes": 7.8,
|
|
"configure": ["--enable-all", "--enable-secure-renegotiation"]},
|
|
{"name": "all-debug-certs", "minutes": 7.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]},
|
|
{"name": "all-hash-keep", "minutes": 7.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]},
|
|
{"name": "all-no-aes-192-256", "minutes": 7.5,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]},
|
|
{"name": "all-no-pkcs7-stream", "minutes": 7.0,
|
|
"comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]},
|
|
{"name": "all-writedup", "minutes": 6.9,
|
|
"configure": ["--enable-all", "--enable-writedup"]},
|
|
{"name": "all-no-server", "minutes": 5.0,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
|
{"name": "nonblock-sp-c32", "minutes": 5.0,
|
|
"comment": "Same but forcing SP_WORD_SIZE=32 to exercise sp_c32.c on a 64-bit host; the two builds together cover both generated variants of mod_exp_<words>_nb / RSA / DH wrappers.",
|
|
"configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
|
|
"--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM -DSP_WORD_SIZE=32"]},
|
|
{"name": "all-no-server-no-client-auth", "minutes": 4.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-no-client-no-client-auth", "minutes": 4.4,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-no-client", "minutes": 4.2,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
|
|
{"name": "nonblock-sp-c64", "minutes": 4.2,
|
|
"comment": "Non-blocking ECC/Curve25519/RSA/DH on the host default SP word size (sp_c64.c on x86_64); RSA/DH non-block require RSA_LOW_MEM (the CRT path is not supported in non-block mode).",
|
|
"configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
|
|
"--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM"]},
|
|
{"name": "all-asn-template", "minutes": 3.5,
|
|
"configure": ["--enable-all", "--enable-asn=template"]},
|
|
{"name": "tls13-dtls13-session-misc", "minutes": 3.3,
|
|
"configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls",
|
|
"--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts",
|
|
"CPPFLAGS=-DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE -DWOLFSSL_TICKET_HAVE_ID -DHAVE_EX_DATA -DSESSION_CACHE_DYNAMIC_MEM"]},
|
|
{"name": "dtls-cid-renego-psk", "minutes": 3.3,
|
|
"configure": ["--enable-dtls", "--enable-dtlscid", "--enable-dtls13",
|
|
"--enable-secure-renegotiation", "--enable-psk", "--enable-aesccm",
|
|
"--enable-nullcipher", "CPPFLAGS=-DWOLFSSL_STATIC_RSA"]},
|
|
{"name": "dtls13-ocspstapling-cert-cb", "minutes": 3.1,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-ocspstapling",
|
|
"--enable-ocspstapling2", "--enable-cert-setup-cb", "--enable-sessioncerts"]},
|
|
{"name": "tsp-verifier", "minutes": 3,
|
|
"comment": "Time-Stamp Protocol Verifier",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]},
|
|
{"name": "dtls13-earlydata-psk-no-hrr", "minutes": 2.9,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-earlydata",
|
|
"--enable-session-ticket", "--enable-psk", "CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME"]},
|
|
{"name": "ocsp-responder-nonblock-maxfrag", "minutes": 2.8,
|
|
"configure": ["--enable-ocsp", "--enable-ocsp-responder", "--enable-ocspstapling",
|
|
"CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP", "--enable-maxfragment"]},
|
|
{"name": "dtls-records-span-datagrams", "minutes": 2.7,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch",
|
|
"--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]},
|
|
{"name": "tsp-min-hash-str", "minutes": 2.7,
|
|
"comment": "Time-Stamp Protocol Minimum 128-bit hash strength",
|
|
"configure": ["--enable-tsp",
|
|
"CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]},
|
|
{"name": "opensslextra-no-ca-names", "minutes": 2.6,
|
|
"configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_CA_NAMES"]},
|
|
{"name": "sessionexport-dtls13", "minutes": 2.6,
|
|
"configure": ["--enable-sessionexport", "--enable-dtls", "--enable-dtls13"]},
|
|
{"name": "lms-xmss-verify-only", "minutes": 2.5,
|
|
"configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]},
|
|
{"name": "sp-4096-m32", "minutes": 1.2,
|
|
"comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
|
|
"configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"],
|
|
"cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
|
|
"ldflags": "-m32"},
|
|
{"name": "opensslall-rng-seed-cb", "minutes": 2.2,
|
|
"configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]},
|
|
{"name": "opensslall-ecc-zero-hash", "minutes": 2.2,
|
|
"configure": ["--enable-opensslall", "--enable-ecc", "CPPFLAGS=-DWC_ALLOW_ECC_ZERO_HASH"]},
|
|
{"name": "she-ext-cmac-no-she-misc", "minutes": 2.2,
|
|
"configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils",
|
|
"CPPFLAGS=-DNO_WC_SHE_GETUID -DNO_WC_SHE_GETCOUNTER -DNO_WC_SHE_EXPORTKEY"]},
|
|
{"name": "she-std-cmac-cryptocb-sw-default", "minutes": 2.2,
|
|
"configure": ["--enable-she=standard", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils", "CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
|
|
{"name": "sniffer-curves-enckeys", "minutes": 2.2,
|
|
"configure": ["--enable-sniffer", "--enable-curve25519", "--enable-curve448",
|
|
"--enable-enckeys", "CPPFLAGS=-DWOLFSSL_DH_EXTRA"]},
|
|
{"name": "sniffer-keylog-storedata", "minutes": 2.5,
|
|
"comment": "The sniffer keylog legs of scripts/sniffer-testsuite.test only run with WOLFSSL_SNIFFER_KEYLOGFILE, and the store data callback path is only compiled with WOLFSSL_SNIFFER_STORE_DATA_CB. Neither is set by any other entry.",
|
|
"configure": ["--enable-sniffer", "--enable-session-ticket",
|
|
"--enable-curve25519", "--enable-ed25519",
|
|
"CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DWOLFSSL_SNIFFER_STORE_DATA_CB"]},
|
|
{"name": "sniffer-no-enc-then-mac", "minutes": 2.2,
|
|
"comment": "The sniffer cannot read a capture that negotiated RFC 7366 without Encrypt-Then-MAC support, and says so through a dedicated error. That arm, and the assertion for it in scripts/sniffer-testsuite.test, are only compiled here.",
|
|
"configure": ["--enable-sniffer", "--enable-enc-then-mac=no"]},
|
|
{"name": "sniffer-threaded", "minutes": 2.5,
|
|
"comment": "snifftest with worker threads. Session tickets are deliberately left off: snifftest pins itself to a single worker when they are enabled, so this is the only way the concurrent path is exercised.",
|
|
"configure": ["--enable-sniffer", "--enable-curve25519", "--enable-ed25519",
|
|
"CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DTHREADED_SNIFFTEST"]},
|
|
{"name": "cryptocb-keygen-utils-aes-setkey", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-utils-setkey-free", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
|
|
"--enable-cryptocbutils=setkey,free", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-keygen-utils-export", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=export"]},
|
|
{"name": "cryptocb-keygen-export-key", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_EXPORT_KEY"]},
|
|
{"name": "cryptocb-utils-setkey-export-find", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen",
|
|
"--enable-cryptocbutils=setkey,export", "CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
|
|
{"name": "cryptocb-shake", "minutes": 2.2,
|
|
"comment": "Exercises the SHAKE128/SHAKE256 crypto callback wiring (wc_CryptoCb_Shake, the sha3.c Update/Final hooks, and the dedicated offload unit tests). cryptocbutils=copy,free adds the Copy/Free dispatch, which must see WC_HASH_TYPE_SHAKE* (not NONE) from SHAKE contexts. A normal (non-ONLY) cryptocb build keeps the host software SHA3/SHAKE present as the callbacks' offload fallback.",
|
|
"configure": ["--enable-cryptocb", "--enable-sha3",
|
|
"--enable-shake128", "--enable-shake256",
|
|
"--enable-cryptocbutils=copy,free"]},
|
|
{"name": "cryptocb-aes-cfb-ofb", "minutes": 2.2,
|
|
"comment": "Exercises the AES-CFB/OFB crypto callback wiring (wc_CryptoCb_AesCfb/Ofb Encrypt/Decrypt, the aes.c hooks, and the dedicated offload unit tests). A normal (non-ONLY) cryptocb build keeps the host software AES present as the callbacks' offload fallback; WOLF_CRYPTO_CB_ONLY_AES (no software fallback) is covered separately by cryptocb-only.yml via swdev.",
|
|
"configure": ["--enable-cryptocb", "--enable-aescfb",
|
|
"--enable-aesofb", "--enable-aesctr"]},
|
|
{"name": "cryptocb-hooks-check-mem-zero", "minutes": 2.2,
|
|
"comment": "Ed448/CMAC/RSA-PSS crypto callback hooks under WOLFSSL_CHECK_MEM_ZERO. The Ed448 sign hook returns early past the secret-buffer registration, which a cryptocb build without this define does not catch.",
|
|
"configure": ["--enable-cryptocb", "--enable-ed448", "--enable-cmac",
|
|
"--enable-rsapss", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO -DWOLF_CRYPTO_CB_FREE -DWOLF_CRYPTO_CB_RSA_PAD"]},
|
|
{"name": "opensslall-rng-seed-cb-no-getpid", "minutes": 2.1,
|
|
"configure": ["--enable-opensslall", "--enable-opensslextra",
|
|
"CPPFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID"]},
|
|
{"name": "dtls13-ignore-pt-alert", "minutes": 2.1,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-tls13",
|
|
"CPPFLAGS=-DWOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC"]},
|
|
{"name": "cryptocb-utils-setkey-free-export", "minutes": 2.1,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
|
|
"--enable-cryptocbutils=setkey,free,export", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-aesgcm-setkey-free", "minutes": 2.1,
|
|
"configure": ["--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
|
|
{"name": "ecies-sec1-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "ECIES with the AES-GCM DEM in the default SEC1 IV mode; WOLFSSL_ECIES_STATIC_GCM_NONCE opts into the fixed-nonce GCM path so the GCM KAT/round-trip and cryptocb tests run.",
|
|
"configure": ["--enable-eccencrypt", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "ecies-geniv-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "Same ECIES-GCM coverage in the WOLFSSL_ECIES_GEN_IV mode (random embedded nonce).",
|
|
"configure": ["--enable-eccencrypt=geniv", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "ecies-old-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "Same ECIES-GCM coverage in the legacy WOLFSSL_ECIES_OLD mode (KDF-derived nonce, no ephemeral pubkey prepended).",
|
|
"configure": ["--enable-eccencrypt=old", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "opensslextra-x509small", "minutes": 2.0,
|
|
"configure": ["--enable-opensslextra=x509small"]},
|
|
{"name": "cryptocb-keygen-find", "minutes": 2.0,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
|
|
{"name": "user-settings-all", "minutes": 2.0,
|
|
"comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.",
|
|
"user_settings": "examples/configs/user_settings_all.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings"]},
|
|
{"name": "she-ext-cryptocb-sw-default", "minutes": 1.9,
|
|
"configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils",
|
|
"CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
|
|
{"name": "cryptocb-aesgcm-aes-setkey", "minutes": 1.9,
|
|
"configure": ["--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-keygen-utils-setkey", "minutes": 1.9,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=setkey"]},
|
|
{"name": "pkcs7-rsa-pss", "minutes": 1.9,
|
|
"comment": "PKCS#7 with RSA-PSS (CMS RSASSA-PSS signers)",
|
|
"configure": ["--enable-pkcs7", "CPPFLAGS=-DWC_RSA_PSS"]},
|
|
{"name": "blind-private-key", "minutes": 1.9,
|
|
"configure": ["CPPFLAGS=-DWOLFSSL_BLIND_PRIVATE_KEY"]},
|
|
{"name": "certgen-no-tls", "minutes": 1.9,
|
|
"configure": ["--enable-certreq", "--enable-certext", "--enable-certgen",
|
|
"--disable-secure-renegotiation-info", "CPPFLAGS=-DNO_TLS"]},
|
|
{"name": "no-sys-ca-certs", "minutes": 1.8, "configure": ["--disable-sys-ca-certs"]},
|
|
{"name": "no-client-auth", "minutes": 1.8,
|
|
"configure": ["CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "harden-tls", "minutes": 1.7, "configure": ["--enable-harden-tls"]},
|
|
{"name": "no-sni-ecc-tls13-scr-info", "minutes": 1.7,
|
|
"configure": ["--disable-sni", "--disable-ecc", "--disable-tls13",
|
|
"--disable-secure-renegotiation-info"]},
|
|
{"name": "default", "minutes": 1.6},
|
|
{"name": "aeskeywrap-padding", "minutes": 1.6,
|
|
"comment": "RFC 5649 AES key wrap with padding; exercises the =padding sub-option (not pulled in by --enable-all).",
|
|
"configure": ["--enable-aeskeywrap=padding"]},
|
|
{"name": "aeskeywrap-padding-cryptocb", "minutes": 1.6,
|
|
"comment": "Key wrap (RFC 3394 + RFC 5649) over WOLF_CRYPTO_CB device offload; runs test_wc_CryptoCb_AesKeyWrap.",
|
|
"configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding"]},
|
|
{"name": "aeskeywrap-padding-cryptocb-ecb", "minutes": 1.6,
|
|
"comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).",
|
|
"configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]},
|
|
{"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6,
|
|
"comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
|
|
"configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding",
|
|
"--disable-sha512", "--disable-sha384",
|
|
"--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"],
|
|
"cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
|
|
"ldflags": "-m32"},
|
|
{"name": "no-client-no-client-auth", "minutes": 1.6,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "ascon-experimental", "minutes": 1.6,
|
|
"configure": ["--enable-ascon", "--enable-experimental"]},
|
|
{"name": "ascon-unroll-experimental", "minutes": 1.6,
|
|
"configure": ["--enable-ascon", "CPPFLAGS=-DWOLFSSL_ASCON_UNROLL",
|
|
"--enable-experimental"]},
|
|
{"name": "wolfssl-extra", "minutes": 1.6, "configure": ["CPPFLAGS=-DWOLFSSL_EXTRA"]},
|
|
{"name": "coding-no", "minutes": 1.5, "configure": ["--enable-coding=no"]},
|
|
{"name": "she-ext-cmac-cryptocb", "minutes": 1.3,
|
|
"configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils"]},
|
|
{"name": "she-std-cmac-no-import-m123", "minutes": 1.3,
|
|
"configure": ["--enable-she=standard", "--enable-cmac",
|
|
"CPPFLAGS=-DNO_WC_SHE_IMPORT_M123"]},
|
|
{"name": "pkcs7", "minutes": 1.3,
|
|
"comment": "PKCS#7 without RSA-PSS",
|
|
"configure": ["--enable-pkcs7"]},
|
|
{"name": "tsp", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol",
|
|
"configure": ["--enable-tsp"]},
|
|
{"name": "tsp-openssl", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol with OpenSSL compat",
|
|
"configure": ["--enable-tsp", "--enable-opensslall"]},
|
|
{"name": "tsp-no-ecc", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol without ECC",
|
|
"configure": ["--enable-tsp", "--disable-ecc"]},
|
|
{"name": "tsp-no-rsa", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol without RSA",
|
|
"configure": ["--enable-tsp", "--disable-rsa"]},
|
|
{"name": "tsp-smallstack", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Small Stack",
|
|
"configure": ["--enable-tsp", "CPPFLAGS=-DWOLFSSL_SMALL_STACK"]},
|
|
{"name": "tsp-requester", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Requester",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_REQUESTER"]},
|
|
{"name": "tsp-responder", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Responder",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_RESPONDER"]},
|
|
{"name": "no-tls-cryptocb-aesgcm-setkey-free", "minutes": 1.3,
|
|
"configure": ["--disable-tls", "--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
|
|
{"name": "she-std-cmac", "minutes": 1.2,
|
|
"configure": ["--enable-she=standard", "--enable-cmac"]},
|
|
{"name": "no-verify-oid-fpki", "minutes": 1.2,
|
|
"configure": ["CPPFLAGS=-DNO_VERIFY_OID -DWOLFSSL_FPKI"]},
|
|
{"name": "no-verify-oid", "minutes": 1.1, "configure": ["CPPFLAGS=-DNO_VERIFY_OID"]},
|
|
{"name": "rng-seed-device", "minutes": 1.1,
|
|
"comment": "Seed the RNG from a nominated device. /dev/urandom stands in for a hardware RNG so the WC_RNG_SEED_DEVICE read path is actually exercised on a runner.",
|
|
"configure": ["--with-rng-seed-device=/dev/urandom"]},
|
|
{"name": "rng-seed-device-fallback", "minutes": 1.1,
|
|
"comment": "Nominated seed device that cannot be opened, so every test runs through the fallback to the default seed sources.",
|
|
"configure": ["--with-rng-seed-device=/nonexistent/hwrng"]},
|
|
{"name": "no-server-no-client-auth", "minutes": 1.0,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "no-wolfssl-client", "minutes": 1.0,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
|
|
{"name": "testwolfcrypt-ca", "minutes": 1.0,
|
|
"comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
|
|
"user_settings": "examples/configs/user_settings_ca.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-dtls13", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_dtls13.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-ebsnet", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_EBSnet.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-eccnonblock", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_eccnonblock.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_curve25519nonblock.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded", "minutes": 1.0,
|
|
"comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0,
|
|
"comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0,
|
|
"comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0,
|
|
"comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0,
|
|
"comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-min-ecc", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_min_ecc.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-openssl-compat", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_openssl_compat.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-pkcs7", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_pkcs7.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-pq", "minutes": 1.0,
|
|
"comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.",
|
|
"user_settings": "examples/configs/user_settings_pq.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-rsa-only", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_rsa_only.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-template", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_template.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-tls12", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_tls12.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-tls13", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_tls13.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolfboot_keytools.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolfssh", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolfssh.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolftpm", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolftpm.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs",
|
|
"name": "no-asn-strict-certs",
|
|
"configure": ["--enable-testcert", "--enable-opensslextra", "--enable-certgen",
|
|
"--enable-certreq", "--enable-certext", "--enable-ecc",
|
|
"CPPFLAGS=-DWOLFSSL_NO_ASN_STRICT -DWOLFSSL_CUSTOM_OID -DHAVE_OID_ENCODING -DWOLFSSL_ALT_NAMES"]},
|
|
{"comment": "wolfSSL <= 5.9.0 DTLS 1.3 legacy_session_id echo compatibility shim",
|
|
"name": "dtls13-echo-legacy-session-id",
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-session-ticket",
|
|
"--enable-ecc", "CPPFLAGS=-DWOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID"]},
|
|
{"name": "x509-tiny",
|
|
"comment": "Minimal-extension X.509 profile.",
|
|
"configure": ["--enable-ecc", "--enable-rsapss",
|
|
"CPPFLAGS=-DWOLFSSL_X509_TINY"]},
|
|
{"name": "x509-tiny-addbacks",
|
|
"comment": "TINY profile with extension add-backs enabled directly.",
|
|
"configure": ["--enable-ecc",
|
|
"CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]},
|
|
{"name": "tls13-psk-no-certs",
|
|
"comment": "NO_CERTS reached through --disable-asn, with TLS 1.3 PSK still available. psk.yml's static-psk-lowresource-tls13 already covers NO_CERTS with PSK but disables DH, so it only reaches psk_ke; this one leaves DH on and covers psk_dhe_ke. First NO_CERTS entry in this list.",
|
|
"configure": ["--enable-psk", "--disable-rsa", "--disable-ecc", "--disable-asn"]},
|
|
{"name": "no-wolfssl-server", "minutes": 0.9,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
|
{"name": "dtls13-client-minimal", "minutes": 0.9,
|
|
"comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.",
|
|
"configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa",
|
|
"--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5",
|
|
"--disable-chacha", "--disable-poly1305", "--disable-errorstrings",
|
|
"--disable-asn-print", "--disable-eccshamir", "--disable-base64encode",
|
|
"--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384",
|
|
"--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
|
|
"--enable-sp=smallec256", "--disable-sp-asm",
|
|
"CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
|
|
{"name": "no-tlsv12-ocspstapling",
|
|
"comment": "--disable-tlsv12 with the two feature axes that reach TLS 1.2-only code from a TLS 1.3 build: OCSP stapling, whose chain-status path calls ProcessCSR_ex, and the OpenSSL compatibility layer, which is where most of the tests that hard-code a TLS 1.2 method live. Nothing else covers the plain option - dtls13-client-minimal above reaches the define through CPPFLAGS and strips most of the crypto with it, and psk.yml's static-psk-lowresource-tls13 pairs it with --disable-asn.",
|
|
"configure": ["--disable-tlsv12", "--enable-ocspstapling", "--enable-opensslextra"]},
|
|
{"name": "no-tlsv12-ocspstapling2",
|
|
"comment": "status_request_v2 without status_request, which is the one stapling shape where the TLS 1.3 chain-status path is not compiled: ProcessCSR_ex then has only its TLS 1.2 caller, so compiling TLS 1.2 out left it with none and -Wunused-function broke the build. no-tlsv12-ocspstapling above enables v1 and cannot reach it.",
|
|
"configure": ["--disable-tlsv12", "--enable-ocspstapling2"]},
|
|
{"name": "no-tlsv12-dtls13",
|
|
"comment": "DTLS 1.3 with the TLS 1.2 handshake compiled out, both sides. dtls13-client-minimal above covers the same version pair but is client-only through NO_WOLFSSL_SERVER, so the DTLS 1.3 server path under WOLFSSL_NO_TLS12 has no other coverage. This is also the one combination configure still accepts once TLS 1.2 is gone: DTLS without --enable-dtls13 is rejected, because DTLS 1.2 is the TLS 1.2 handshake. Connection ID and session tickets are on because both pull in DTLS 1.2-only test and record-layer code that the version gating has to reach.",
|
|
"configure": ["--disable-tlsv12", "--enable-dtls", "--enable-dtls13",
|
|
"--enable-dtlscid", "--enable-session-ticket"]},
|
|
{"name": "no-tlsv12-sniffer",
|
|
"comment": "The sniffer picks its master-secret derivation, resumption key derivation, Finished parsing and record decryption by version, and with WOLFSSL_NO_TLS12 only the TLS 1.3 halves of those are compiled in. sniffer-curves-enckeys keeps TLS 1.2 enabled, so it never builds them that way; scripts/sniffer-testsuite.test probes snifftest for the versions it was built with and runs the TLS 1.3 legs here.",
|
|
"configure": ["--enable-sniffer", "--disable-tlsv12"]},
|
|
{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
|
|
"configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
|
|
{"name": "no-examples-no-malloc", "minutes": 0.8,
|
|
"configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]},
|
|
{"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3,
|
|
"comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.",
|
|
"configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519",
|
|
"--enable-keygen", "--disable-examples",
|
|
"CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"],
|
|
"cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"},
|
|
{"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false,
|
|
"comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.",
|
|
"configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource",
|
|
"--disable-crypttests", "--disable-examples"]},
|
|
{"name": "pkcs12-pbkdf-mp-api", "minutes": 1.0,
|
|
"comment": "WC_PKCS12_PBKDF_USING_MP_API selects a second wc_PKCS12_PBKDF_ex implementation that no configure option reaches.",
|
|
"configure": ["--enable-pkcs12", "--enable-des3", "--enable-opensslextra",
|
|
"CPPFLAGS=-DWC_PKCS12_PBKDF_USING_MP_API"]},
|
|
{"name": "no-session-cache-session-ticket", "minutes": 0.8,
|
|
"comment": "Session tickets with the internal session cache compiled out, over TLS 1.3 and DTLS 1.3. This is what a Zephyr build produces from CONFIG_WOLFSSL_SESSION_CACHE=n with tickets left on, and it used to fail to link. HAVE_EXT_CACHE is set because NO_SESSION_CACHE with an external cache is the one combination where the ticket-session free path keeps its external-cache branch, and --enable-wpas with --enable-lowresource reaches it. Examples are off because tests/unit.test calls the session APIs that NO_SESSION_CACHE removes, so this entry is compile coverage for the library.",
|
|
"configure": ["--enable-session-ticket", "--enable-dtls", "--enable-dtls13",
|
|
"--disable-examples",
|
|
"CPPFLAGS=-DNO_SESSION_CACHE -DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE"]},
|
|
{"name": "lowresource-tls13-session-ticket", "minutes": 0.8,
|
|
"comment": "--enable-lowresource defines NO_SESSION_CACHE, so this reaches the src/internal.c no-cache ticket paths purely through configure options, with no CPPFLAGS to get wrong. It does not cover src/dtls.c, whose TlsSessionIdIsValid needs WOLFSSL_DTLS_NO_HVR_ON_RESUME, so no-session-cache-session-ticket is the entry for that and the two are not interchangeable. Examples are off for the same reason as that entry.",
|
|
"configure": ["--enable-lowresource", "--enable-tls13", "--enable-session-ticket",
|
|
"--disable-examples"]},
|
|
{"name": "tls13-only-sha512-transcript", "minutes": 0.8,
|
|
"comment": "WOLFSSL_NO_TLS12 with SHA-512 still enabled. That is the only shape where WOLFSSL_HS_HASH_SHA512 is false while WOLFSSL_SHA512 is true. dtls13-client-minimal compiles the same HS_Hashes layout without hashSha512, verifyHashes and certHashes, but it gets there with --disable-sha512, so it does not cover this combination. --disable-tlsv12 alone does not define the macro. Examples are off because tests/api/test_tls13.c calls wolfTLSv1_2_server_method() unguarded, so this entry is compile coverage for the library.",
|
|
"configure": ["--enable-tls13", "--disable-tlsv12", "--disable-oldtls",
|
|
"--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_TLS12"]},
|
|
{"name": "tls13-sha512-transcript-only", "minutes": 0.8,
|
|
"comment": "The other side of WOLFSSL_HS_HASH_SHA512: --enable-tls13-sha512 without TLS 1.2, so the SHA-512 transcript is kept for TLS 1.3 alone. Examples are off for the same reason as tls13-only-sha512-transcript.",
|
|
"configure": ["--enable-tls13", "--enable-tls13-sha512", "--disable-tlsv12",
|
|
"--disable-oldtls", "--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_TLS12"]},
|
|
{"name": "tls13-sha512-runtime", "minutes": 1.6,
|
|
"comment": "--enable-tls13-sha512 with TLS 1.2 left in, so the examples and unit tests build and run with WOLFSSL_HS_HASH_SHA512 set. No cipher suite sets mac_algorithm to sha512_mac, so the sha512_mac arms in src/tls13.c stay unreached; what this entry proves is that the option does not break an otherwise ordinary build, which the two compile-only entries above cannot show.",
|
|
"configure": ["--enable-tls13", "--enable-tls13-sha512", "--enable-sha512"]}
|
|
]
|