Skip to content

Commit 56f12a5

Browse files
LinuxJediLinuxJedi
committed
Add NSS + pdfsig testing
1 parent 67a9ec8 commit 56f12a5

File tree

1 file changed

+289
-0
lines changed

1 file changed

+289
-0
lines changed

‎.github/workflows/nss-test.yml‎

Lines changed: 289 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,289 @@
1+
name: wolfPKCS11 NSS PDF Signing Test
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
workflow_dispatch:
9+
10+
jobs:
11+
test-nss-pdf-signing:
12+
runs-on: ubuntu-22.04
13+
14+
steps:
15+
- name: Checkout wolfPKCS11 repository
16+
uses: actions/checkout@v4
17+
with:
18+
path: wolfpkcs11
19+
20+
- name: Set up build environment
21+
- name: Install NSS and NSPR headers and libraries
22+
run: |
23+
sudo apt-get update
24+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
25+
mercurial \
26+
python3 \
27+
python-is-python3 \
28+
python3-pip \
29+
gyp \
30+
ninja-build \
31+
build-essential \
32+
automake \
33+
libtool \
34+
git \
35+
pkg-config \
36+
poppler-utils \
37+
wget \
38+
enscript \
39+
ghostscript \
40+
gdb \
41+
vim \
42+
hexedit
43+
44+
- name: Clone and build NSPR
45+
run: |
46+
mkdir -p /tmp/src
47+
cd /tmp/src
48+
hg clone https://hg.mozilla.org/projects/nspr
49+
50+
- name: Clone NSS and apply wolfSSL patches
51+
run: |
52+
cd /tmp/src
53+
54+
# Clone official Mozilla NSS
55+
hg clone https://hg.mozilla.org/projects/nss
56+
57+
# Clone wolfSSL OSP repository for patches
58+
git clone https://github.com/wolfSSL/osp.git
59+
60+
cd nss
61+
62+
# Apply patches from wolfSSL/osp/nss directory
63+
echo "Applying wolfSSL NSS patches..."
64+
if [ -d "../osp/nss" ]; then
65+
for patch in ../osp/nss/*.patch; do
66+
if [ -f "$patch" ]; then
67+
echo "Applying patch: $(basename $patch)"
68+
patch -p1 < "$patch" || {
69+
echo "Warning: Patch $(basename $patch) failed to apply cleanly"
70+
echo "Attempting to apply with --reject-file option..."
71+
patch -p1 --reject-file=/tmp/$(basename $patch).rej < "$patch" || true
72+
}
73+
fi
74+
done
75+
else
76+
echo "No patches found in wolfSSL/osp/nss directory"
77+
fi
78+
79+
# Set NSS build environment
80+
export USE_64=1
81+
export NSS_ENABLE_WERROR=0
82+
export BUILD_OPT=0
83+
84+
# Build NSS with debug mode enabled
85+
./build.sh -v
86+
87+
- name: Display patch application results
88+
run: |
89+
echo "=== NSS Patch Application Summary ==="
90+
if [ -d /tmp/src/osp/nss ]; then
91+
echo "Available patches in wolfSSL/osp/nss:"
92+
ls -la /tmp/src/osp/nss/*.patch 2>/dev/null || echo "No .patch files found"
93+
94+
# Check for any rejected patches
95+
if ls /tmp/*.rej 2>/dev/null; then
96+
echo ""
97+
echo "⚠ Warning: Some patches were rejected:"
98+
ls -la /tmp/*.rej
99+
echo ""
100+
echo "Rejected patch contents:"
101+
for rej in /tmp/*.rej; do
102+
echo "--- $(basename $rej) ---"
103+
cat "$rej"
104+
echo ""
105+
done
106+
else
107+
echo "✓ All patches applied successfully (no .rej files found)"
108+
fi
109+
else
110+
echo "No patches directory found at wolfSSL/osp/nss"
111+
fi
112+
run: |
113+
# Create directories for headers
114+
sudo mkdir -p /usr/local/include/nss
115+
sudo mkdir -p /usr/local/include/nspr
116+
sudo mkdir -p /usr/local/lib
117+
118+
# Copy NSS headers from dist directory
119+
sudo cp -r /tmp/src/dist/public/nss/* /usr/local/include/nss/
120+
121+
# Copy NSPR headers from dist directory
122+
sudo cp -r /tmp/src/dist/Debug/include/nspr/* /usr/local/include/nspr/
123+
124+
# Copy NSS and NSPR libraries
125+
sudo find /tmp/src/dist/Debug -name "*.so" -exec cp {} /usr/local/lib/ \;
126+
sudo find /tmp/src/nspr/Debug -name "*.so" -exec cp {} /usr/local/lib/ \;
127+
128+
# Update library cache
129+
sudo ldconfig
130+
131+
- name: Clone and build wolfSSL
132+
run: |
133+
cd /tmp
134+
git clone https://github.com/wolfSSL/wolfssl.git
135+
cd wolfssl
136+
./autogen.sh
137+
./configure --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --enable-cmac --enable-aesctr --enable-aesccm C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -D_GNU_SOURCE"
138+
make -j$(nproc)
139+
sudo make install
140+
sudo ldconfig
141+
142+
- name: Build wolfPKCS11 with NSS support
143+
run: |
144+
cd wolfpkcs11
145+
./autogen.sh
146+
./configure --enable-debug --enable-nss --enable-aesecb --enable-aesctr --enable-aesccm --enable-aescmac CFLAGS="-D_GNU_SOURCE"
147+
make -j$(nproc)
148+
sudo make install
149+
sudo ldconfig
150+
151+
- name: Verify wolfPKCS11 installation
152+
run: |
153+
echo "Checking wolfPKCS11 library..."
154+
if [ -f /usr/local/lib/libwolfpkcs11.so ]; then
155+
echo "✓ wolfPKCS11 library found at /usr/local/lib/libwolfpkcs11.so"
156+
ls -la /usr/local/lib/libwolfpkcs11.so
157+
ldd /usr/local/lib/libwolfpkcs11.so || echo "Failed to run ldd on libwolfpkcs11.so"
158+
else
159+
echo "✗ ERROR: wolfPKCS11 library not found"
160+
find /usr -name "libwolfpkcs11.so" 2>/dev/null || true
161+
exit 1
162+
fi
163+
164+
echo "Checking wolfSSL library..."
165+
if [ -f /usr/local/lib/libwolfssl.so ]; then
166+
echo "✓ wolfSSL library found at /usr/local/lib/libwolfssl.so"
167+
ls -la /usr/local/lib/libwolfssl.so
168+
else
169+
echo "✗ ERROR: wolfSSL library not found"
170+
find /usr -name "libwolfssl.so" 2>/dev/null || true
171+
exit 1
172+
fi
173+
174+
- name: Configure NSS database
175+
run: |
176+
mkdir -p /tmp/nssdb
177+
chmod 755 /tmp/nssdb
178+
179+
# Configure NSS to use wolfPKCS11
180+
cat > /tmp/nssdb/pkcs11.txt << 'EOF'
181+
library=/usr/local/lib/libwolfpkcs11.so
182+
name=wolfPKCS11
183+
NSS=Flags=internal,critical,fips cipherOrder=100 slotParams={0x00000001=[slotFlags=ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] }
184+
EOF
185+
186+
# Initialize NSS database
187+
/tmp/src/dist/Debug/bin/certutil -N -d /tmp/nssdb/ --empty-password
188+
189+
- name: Generate test certificate
190+
run: |
191+
echo "Generating self-signed certificate for PDF signing..."
192+
/tmp/src/dist/Debug/bin/certutil -d /tmp/nssdb -S -n "PDF Signing Certificate" -s "CN=PDF Signer,O=wolfSSL,C=US" -x -t "CT,C,C" -v 120 -g 2048 -z wolfpkcs11/configure.ac
193+
194+
- name: Generate test PDF
195+
run: |
196+
cd /tmp
197+
198+
# Create test content
199+
cat > test.txt << EOF
200+
This is a test document for PDF signing with wolfPKCS11 and NSS.
201+
Generated on $(date)
202+
Branch: ${GITHUB_REF#refs/heads/}
203+
Commit: ${GITHUB_SHA:0:8}
204+
EOF
205+
206+
echo "Converting text to PDF..."
207+
cat test.txt | enscript -B -o - | ps2pdf - test.pdf
208+
209+
if [ -f test.pdf ]; then
210+
echo "✓ PDF generation successful!"
211+
ls -la test.pdf
212+
else
213+
echo "✗ PDF generation failed!"
214+
exit 1
215+
fi
216+
217+
- name: Test PDF signing with wolfPKCS11
218+
env:
219+
NSS_DEBUG_PKCS11_MODULE: "wolfPKCS11"
220+
NSPR_LOG_MODULES: "all:5"
221+
NSPR_LOG_FILE: /tmp/nss.log
222+
NSS_OUTPUT_FILE: /tmp/stats.log
223+
NSS_STRICT_NOFORK: "1"
224+
NSS_DEBUG: "all"
225+
run: |
226+
cd /tmp
227+
228+
echo "Signing the PDF file with wolfPKCS11..."
229+
echo "Note: NSS shutdown warnings are normal and expected"
230+
231+
# Attempt to sign the PDF
232+
if pdfsig test.pdf signed.pdf -add-signature -nick "PDF Signing Certificate" -nssdir /tmp/nssdb; then
233+
echo "✓ PDF signing completed successfully!"
234+
else
235+
echo "⚠ PDF signing completed with warnings (this may be normal)"
236+
fi
237+
238+
# Check if signed PDF was created
239+
if [ -f signed.pdf ]; then
240+
echo "✓ Signed PDF file created successfully"
241+
ls -la signed.pdf
242+
else
243+
echo "✗ Signed PDF file was not created"
244+
exit 1
245+
fi
246+
247+
- name: Verify PDF signature
248+
run: |
249+
cd /tmp
250+
251+
echo "Verifying the PDF signature..."
252+
if pdfsig signed.pdf -nssdir /tmp/nssdb; then
253+
echo "✓ PDF signature verification completed"
254+
else
255+
echo "⚠ PDF signature verification completed with warnings"
256+
fi
257+
258+
- name: Upload test artifacts
259+
uses: actions/upload-artifact@v4
260+
if: always()
261+
with:
262+
name: pdf-test-artifacts
263+
path: |
264+
/tmp/test.pdf
265+
/tmp/signed.pdf
266+
/tmp/*.log
267+
retention-days: 7
268+
269+
- name: Display test summary
270+
if: always()
271+
run: |
272+
echo "=== wolfPKCS11 NSS PDF Signing Test Summary ==="
273+
echo "Branch: ${GITHUB_REF#refs/heads/}"
274+
echo "Commit: ${GITHUB_SHA:0:8}"
275+
echo ""
276+
if [ -f /tmp/signed.pdf ]; then
277+
echo "✓ Test PASSED: PDF was successfully signed using wolfPKCS11 with NSS"
278+
else
279+
echo "✗ Test FAILED: PDF signing was not successful"
280+
fi
281+
echo ""
282+
echo "Files created during test:"
283+
ls -la /tmp/*.pdf 2>/dev/null || echo "No PDF files found"
284+
echo ""
285+
if [ -f /tmp/nss.log ]; then
286+
echo "NSS debug log (last 20 lines):"
287+
tail -20 /tmp/nss.log
288+
fi
289+

0 commit comments

Comments
 (0)