Improvements to patch testing
Paul Adelsbach
parent
96f1fdb95d
commit
dfba100bb8
|
|
@ -2,8 +2,8 @@ name: Patched JNI CI
|
|||
|
||||
# This workflow attempts to build and test the wolfSSL JNI library with all
|
||||
# available wolfSSL PR patches applied, eg WOLFSSL_PR*_PATCH_APPLIED defines.
|
||||
# It currently only supports a single PR patch at a time, using the highest PR
|
||||
# number found in the defines.
|
||||
# It currently only supports a single open PR patch at a time. If all patches
|
||||
# are merged, it builds against master with all patch defines enabled.
|
||||
|
||||
on:
|
||||
push:
|
||||
|
|
@ -15,20 +15,28 @@ jobs:
|
|||
resolve_wolfssl_ref:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
should_run: ${{ steps.resolve.outputs.should_run }}
|
||||
wolfssl_repo: ${{ steps.resolve.outputs.wolfssl_repo }}
|
||||
wolfssl_ref: ${{ steps.resolve.outputs.wolfssl_ref }}
|
||||
pr_number: ${{ steps.resolve.outputs.pr_number }}
|
||||
should_run: ${{ steps.eval_prs.outputs.should_run }}
|
||||
wolfssl_repo: ${{ steps.eval_prs.outputs.wolfssl_repo }}
|
||||
wolfssl_ref: ${{ steps.eval_prs.outputs.wolfssl_ref }}
|
||||
patch_defines: ${{ steps.eval_prs.outputs.patch_defines }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Resolve wolfSSL ref from patch defines
|
||||
id: resolve
|
||||
- name: Install prerequisites
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y jq curl
|
||||
|
||||
- name: Find patch defines
|
||||
id: find_defines
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
# Find WOLFSSL_PR*_PATCH_APPLIED defines in wolfssl source.
|
||||
defines="$(./scripts/find-wolfssl-pr-patch-defines.sh)"
|
||||
defines=""
|
||||
if ! defines="$(./scripts/find-wolfssl-pr-patch-defines.sh)"; then
|
||||
echo "::warning::find-wolfssl-pr-patch-defines.sh failed; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
if [ -z "$defines" ]; then
|
||||
echo "::warning::No WOLFSSL_PR*_PATCH_APPLIED defines found; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
|
|
@ -36,50 +44,103 @@ jobs:
|
|||
fi
|
||||
echo "Found patch defines:"
|
||||
printf "%s\n" "$defines"
|
||||
{
|
||||
echo "should_run=true"
|
||||
echo "defines<<EOF"
|
||||
printf "%s\n" "$defines"
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Find the highest PR number from the defines.
|
||||
pr_number="$(printf "%s\n" "$defines" | sed -E 's/^WOLFSSL_PR([0-9]+)_PATCH_APPLIED$/\1/' | sort -n | tail -1)"
|
||||
if [ -z "$pr_number" ]; then
|
||||
echo "::warning::Failed to derive PR number from patch defines; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
echo "Highest PR number from defines: $pr_number"
|
||||
- name: Evaluate PR statuses
|
||||
id: eval_prs
|
||||
if: steps.find_defines.outputs.should_run == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
# Check PR status via GitHub API.
|
||||
pr_json="$(curl -fsSL "https://api.github.com/repos/wolfSSL/wolfssl/pulls/$pr_number" || true)"
|
||||
if [ -z "$pr_json" ]; then
|
||||
echo "::warning::Unable to fetch PR #$pr_number from GitHub API; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
echo "Fetched PR #$pr_number info from GitHub API."
|
||||
defines="${{ steps.find_defines.outputs.defines }}"
|
||||
should_run=true
|
||||
wolfssl_repo="wolfSSL/wolfssl"
|
||||
wolfssl_ref="master"
|
||||
found_open=false
|
||||
patch_defines=""
|
||||
|
||||
state="$(printf "%s" "$pr_json" | jq -r '.state // empty')"
|
||||
merged_at="$(printf "%s" "$pr_json" | jq -r '.merged_at // empty')"
|
||||
head_repo="$(printf "%s" "$pr_json" | jq -r '.head.repo.full_name // empty')"
|
||||
head_ref="$(printf "%s" "$pr_json" | jq -r '.head.ref // empty')"
|
||||
echo "Evaluating patch defines:"
|
||||
printf "%s\n" "$defines"
|
||||
|
||||
if [ -n "$merged_at" ]; then
|
||||
echo "PR #$pr_number is merged; using wolfSSL master branch."
|
||||
echo "should_run=true" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_repo=wolfSSL/wolfssl" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_ref=master" >> "$GITHUB_OUTPUT"
|
||||
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
while read -r define; do
|
||||
define="$(printf "%s" "$define" | tr -d '\r' | xargs)"
|
||||
[ -z "$define" ] && continue
|
||||
pr_number="$(printf "%s" "$define" | sed -E 's/^WOLFSSL_PR([0-9]+)_PATCH_APPLIED$/\1/')"
|
||||
if [ -z "$pr_number" ] || [ "$pr_number" = "$define" ]; then
|
||||
echo "::warning::Failed to derive PR number from define $define; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$state" = "open" ] && [ -n "$head_repo" ] && [ -n "$head_ref" ]; then
|
||||
echo "should_run=true" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_repo=$head_repo" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_ref=$head_ref" >> "$GITHUB_OUTPUT"
|
||||
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
|
||||
echo "PR #$pr_number is open; using branch $head_ref from repo $head_repo."
|
||||
exit 0
|
||||
fi
|
||||
pr_info=""
|
||||
if ! pr_info="$(./scripts/find-pr-info.sh "$pr_number" --repo wolfSSL/wolfssl)"; then
|
||||
echo "::warning::find-pr-info.sh failed for PR #$pr_number; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
if [ -z "$pr_info" ]; then
|
||||
echo "::warning::Unable to resolve PR #$pr_number info; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
echo "PR #$pr_number raw info:"
|
||||
printf "%s\n" "$pr_info"
|
||||
|
||||
echo "::warning::PR #$pr_number is not merged or has no accessible branch; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
info_repo="$(printf "%s\n" "$pr_info" | sed -n 's/^repo://p')"
|
||||
info_branch="$(printf "%s\n" "$pr_info" | sed -n 's/^branch://p')"
|
||||
info_commit="$(printf "%s\n" "$pr_info" | sed -n 's/^commit://p')"
|
||||
info_status="$(printf "%s\n" "$pr_info" | sed -n 's/^status://p')"
|
||||
|
||||
if [ -z "$info_repo" ] || [ -z "$info_branch" ] || [ -z "$info_commit" ] || [ -z "$info_status" ]; then
|
||||
echo "::warning::Missing expected PR info fields for PR #$pr_number; skipping patched CI."
|
||||
echo "should_run=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
case "$info_status" in
|
||||
merged)
|
||||
continue
|
||||
;;
|
||||
open)
|
||||
if [ "$found_open" = "false" ]; then
|
||||
wolfssl_repo="$info_repo"
|
||||
wolfssl_ref="$info_commit"
|
||||
found_open=true
|
||||
patch_defines="WOLFSSL_PR${pr_number}_PATCH_APPLIED"
|
||||
echo "PR #$pr_number is open; using repo $wolfssl_repo"
|
||||
echo "PR #$pr_number is open; using branch $info_branch"
|
||||
echo "PR #$pr_number is open; using commit $wolfssl_ref"
|
||||
else
|
||||
echo "::warning::Found multiple PRs with patch defines; unable to determine which one to use; skipping patched CI."
|
||||
should_run=false
|
||||
break
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "::warning::PR #$pr_number is in unexpected state: $info_status; skipping patched CI."
|
||||
should_run=false
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done <<EOF
|
||||
$defines
|
||||
EOF
|
||||
|
||||
echo "should_run=$should_run" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_repo=$wolfssl_repo" >> "$GITHUB_OUTPUT"
|
||||
echo "wolfssl_ref=$wolfssl_ref" >> "$GITHUB_OUTPUT"
|
||||
echo "patch_defines=$patch_defines" >> "$GITHUB_OUTPUT"
|
||||
|
||||
echo "Using: "
|
||||
echo "repo : $wolfssl_repo"
|
||||
echo "ref : $wolfssl_ref"
|
||||
echo "branch : $info_branch"
|
||||
echo "defines: $patch_defines"
|
||||
|
||||
patched_jni_build:
|
||||
needs: resolve_wolfssl_ref
|
||||
|
|
@ -126,10 +187,9 @@ jobs:
|
|||
run: |
|
||||
echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Build and test JNI library with all patches
|
||||
- name: Build and test JNI library with all patches enabled
|
||||
run: |
|
||||
make all-patched PREFIX=$GITHUB_WORKSPACE/build-dir
|
||||
make check
|
||||
make build check PREFIX=$GITHUB_WORKSPACE/build-dir ENABLE_PATCHES=1 PATCH_DEFINES="${{ needs.resolve_wolfssl_ref.outputs.patch_defines }}"
|
||||
|
||||
- name: Show logs on failure
|
||||
if: failure() || cancelled()
|
||||
|
|
|
|||
|
|
@ -252,8 +252,14 @@ aux_source_directory(${wolfssl_DIR}/src TLS_SOURCES)
|
|||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/bio.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/conf.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/pk.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/pk_ec.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/pk_rsa.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_bn.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_api_cert.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_api_crl_ocsp.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_api_pk.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_asn1.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_ech.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_certman.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_crypto.c)
|
||||
list(REMOVE_ITEM TLS_SOURCES ${wolfssl_DIR}/src/ssl_load.c)
|
||||
|
|
@ -268,6 +274,7 @@ if ("${WOLFSSL_PKG_TYPE}" MATCHES "normal")
|
|||
# Add crypto sources to CRYPTO_SOURCES, remove files that are included inline by other files
|
||||
aux_source_directory(${wolfssl_DIR}/wolfcrypt/src CRYPTO_SOURCES)
|
||||
list(REMOVE_ITEM CRYPTO_SOURCES ${wolfssl_DIR}/wolfcrypt/src/evp.c)
|
||||
list(REMOVE_ITEM CRYPTO_SOURCES ${wolfssl_DIR}/wolfcrypt/src/evp_pk.c)
|
||||
list(REMOVE_ITEM CRYPTO_SOURCES ${wolfssl_DIR}/wolfcrypt/src/misc.c)
|
||||
|
||||
elseif("${WOLFSSL_PKG_TYPE}" MATCHES "fipsready")
|
||||
|
|
|
|||
32
Makefile
32
Makefile
|
|
@ -21,7 +21,22 @@ endif
|
|||
all: build
|
||||
|
||||
build: java.sh build.xml
|
||||
./java.sh $(INSTALL_DIR)
|
||||
@cflags=""; \
|
||||
if [ "$(ENABLE_PATCHES)" = "1" ]; then \
|
||||
if [ -n "$(PATCH_DEFINES)" ]; then \
|
||||
defines="$(PATCH_DEFINES)"; \
|
||||
else \
|
||||
defines="$$(./scripts/find-wolfssl-pr-patch-defines.sh)"; \
|
||||
fi; \
|
||||
if [ -z "$$defines" ]; then \
|
||||
echo "warning: no WOLFSSL_PR*_PATCH_APPLIED defines found; building without patches"; \
|
||||
else \
|
||||
for define in $$defines; do \
|
||||
cflags="$$cflags -D$$define"; \
|
||||
done; \
|
||||
fi; \
|
||||
fi; \
|
||||
CFLAGS="$$cflags" ./java.sh $(INSTALL_DIR); \
|
||||
ant
|
||||
|
||||
check: build
|
||||
|
|
@ -30,21 +45,6 @@ check: build
|
|||
clean:
|
||||
ant clean cleanjni
|
||||
|
||||
# Enable all WOLFSSL_PR*_PATCH_APPLIED defines when building JNI.
|
||||
# Requires latest/recent wolfssl source with patches applied. This is not
|
||||
# detected automatically.
|
||||
all-patched:
|
||||
@defines="$$(./scripts/find-wolfssl-pr-patch-defines.sh)"; \
|
||||
if [ -z "$$defines" ]; then \
|
||||
echo "warning: no WOLFSSL_PR*_PATCH_APPLIED defines found; skipping all-patched"; \
|
||||
exit 0; \
|
||||
fi; \
|
||||
cflags=""; \
|
||||
for define in $$defines; do \
|
||||
cflags="$$cflags -D$$define"; \
|
||||
done; \
|
||||
CFLAGS="$$cflags" ./java.sh $(INSTALL_DIR); \
|
||||
ant
|
||||
|
||||
install:
|
||||
$(INSTALL) -d $(INSTALL_DIR)/$(LIBDIR)
|
||||
|
|
|
|||
6
java.sh
6
java.sh
|
|
@ -65,6 +65,12 @@ else
|
|||
javaHome="$JAVA_HOME"
|
||||
fi
|
||||
|
||||
if [ -z "${CFLAGS:-}" ]; then
|
||||
echo " CFLAGS = <none>"
|
||||
else
|
||||
echo " CFLAGS = $CFLAGS"
|
||||
fi
|
||||
|
||||
fpic=""
|
||||
CFLAGS="${CFLAGS:-}"
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,105 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# Given a PR number, print the originating fork (repo full_name) and branch.
|
||||
# Default repo is wolfSSL/wolfssl. Override with --repo owner/name.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: scripts/find-pr-info.sh <pr_number> [--repo owner/name]
|
||||
|
||||
Outputs:
|
||||
pr:<pr_number>
|
||||
repo:<fork_full_name>
|
||||
branch:<branch_name>
|
||||
commit:<head_sha>
|
||||
status:<open|closed|merged|unknown>
|
||||
|
||||
Example:
|
||||
scripts/find-pr-info.sh 9631
|
||||
scripts/find-pr-info.sh 9631 --repo wolfSSL/wolfssl
|
||||
EOF
|
||||
}
|
||||
|
||||
if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
|
||||
usage
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -z "${1:-}" ]; then
|
||||
usage
|
||||
exit 2
|
||||
fi
|
||||
|
||||
pr_number="$1"
|
||||
if ! [[ "$pr_number" =~ ^[0-9]+$ ]]; then
|
||||
echo "error: PR number must be numeric" >&2
|
||||
exit 2
|
||||
fi
|
||||
shift
|
||||
|
||||
repo="wolfSSL/wolfssl"
|
||||
if [ "${1:-}" = "--repo" ]; then
|
||||
if [ -z "${2:-}" ]; then
|
||||
echo "error: --repo requires owner/name" >&2
|
||||
exit 2
|
||||
fi
|
||||
repo="$2"
|
||||
shift 2
|
||||
fi
|
||||
|
||||
if [ -n "${1:-}" ]; then
|
||||
echo "error: unexpected argument: $1" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if ! command -v jq >/dev/null 2>&1; then
|
||||
echo "error: jq is required but not installed" >&2
|
||||
exit 127
|
||||
fi
|
||||
|
||||
# Use GITHUB_TOKEN if set to avoid rate-limiting (60 requests/hour per IP)
|
||||
auth_header=()
|
||||
if [ -n "${GITHUB_TOKEN:-}" ]; then
|
||||
auth_header=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
|
||||
fi
|
||||
|
||||
if ! pr_json="$(curl -fsSL "${auth_header[@]}" "https://api.github.com/repos/${repo}/pulls/${pr_number}")"; then
|
||||
curl_rc=$?
|
||||
echo "error: curl failed ($curl_rc) fetching PR #${pr_number} from ${repo}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
head_repo="$(printf "%s" "$pr_json" | jq -r '.head.repo.full_name // empty')"
|
||||
head_ref="$(printf "%s" "$pr_json" | jq -r '.head.ref // empty')"
|
||||
head_sha="$(printf "%s" "$pr_json" | jq -r '.head.sha // empty')"
|
||||
state="$(printf "%s" "$pr_json" | jq -r '.state // empty')"
|
||||
merged_at="$(printf "%s" "$pr_json" | jq -r '.merged_at // empty')"
|
||||
|
||||
if [ -z "$head_ref" ] || [ -z "$head_sha" ]; then
|
||||
echo "error: PR #${pr_number} missing head ref data" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# head_repo may be empty if the fork was deleted
|
||||
if [ -z "$head_repo" ]; then
|
||||
head_repo="unknown"
|
||||
fi
|
||||
|
||||
status="$state"
|
||||
if [ -n "$merged_at" ]; then
|
||||
status="merged"
|
||||
fi
|
||||
|
||||
if [ -z "$status" ]; then
|
||||
status="unknown"
|
||||
fi
|
||||
|
||||
cat <<EOF
|
||||
pr:${pr_number}
|
||||
repo:${head_repo}
|
||||
branch:${head_ref}
|
||||
commit:${head_sha}
|
||||
status:${status}
|
||||
EOF
|
||||
Loading…
Reference in New Issue