Skip to content

Commit 02bb35d

Browse files
LinuxJediLinuxJedi
committed
Add Debian testing GitHub Action
1 parent 17adaaa commit 02bb35d

File tree

2 files changed

+409
-0
lines changed

2 files changed

+409
-0
lines changed

‎.github/workflows/nss-cmsutil-debian-test.yml‎

Lines changed: 366 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,366 @@
1+
name: wolfPKCS11 NSS cmsutil Debian Package Test
2+
3+
on:
4+
push:
5+
branches: [ main, master, nss ]
6+
pull_request:
7+
branches: [ main, master, nss ]
8+
workflow_dispatch:
9+
10+
env:
11+
WOLFSSL_VERSION: v5.8.0-stable
12+
NSS_DEBUG_PKCS11_MODULE: wolfPKCS11
13+
NSPR_LOG_MODULES: all:5
14+
NSPR_LOG_FILE: /logs/nss.log
15+
NSS_OUTPUT_FILE: /logs/stats.log
16+
NSS_STRICT_NOFORK: 1
17+
NSS_DEBUG: all
18+
19+
jobs:
20+
nss-cmsutil-debian-test:
21+
runs-on: ubuntu-latest
22+
container:
23+
image: debian:bookworm
24+
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
29+
- name: Install system dependencies
30+
run: |
31+
apt-get update
32+
DEBIAN_FRONTEND=noninteractive apt-get install -y \
33+
build-essential \
34+
automake \
35+
libtool \
36+
git \
37+
pkg-config \
38+
wget \
39+
ca-certificates \
40+
devscripts \
41+
dpkg-dev \
42+
fakeroot \
43+
lintian \
44+
dh-make \
45+
debhelper \
46+
dh-autoreconf \
47+
openssl \
48+
patch \
49+
curl \
50+
gnupg2 \
51+
software-properties-common
52+
53+
- name: Setup Debian source repositories
54+
run: |
55+
# Add source repositories for apt-get source
56+
echo "deb-src http://deb.debian.org/debian bookworm main" >> /etc/apt/sources.list
57+
echo "deb-src http://deb.debian.org/debian-security bookworm-security main" >> /etc/apt/sources.list
58+
echo "deb-src http://deb.debian.org/debian bookworm-updates main" >> /etc/apt/sources.list
59+
apt-get update
60+
61+
- name: Build wolfSSL Debian package
62+
run: |
63+
cd /tmp
64+
git clone https://github.com/wolfSSL/wolfssl.git --branch ${{ env.WOLFSSL_VERSION }} --depth 1
65+
cd wolfssl
66+
67+
# Configure wolfSSL for PKCS#11 compatibility
68+
./autogen.sh
69+
./configure --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --enable-cmac --enable-aesctr --enable-aesccm --enable-md5 C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -D_GNU_SOURCE"
70+
71+
# Build Debian package
72+
make deb
73+
74+
# Install wolfSSL packages
75+
dpkg -i *.deb || true
76+
apt-get install -f -y
77+
ldconfig
78+
79+
- name: Build wolfPKCS11 Debian package
80+
run: |
81+
# Build wolfPKCS11
82+
./autogen.sh
83+
./configure --enable-debug --enable-nss --enable-aesecb --enable-aesctr --enable-aesccm --enable-aescmac CFLAGS="-D_GNU_SOURCE"
84+
make
85+
86+
# Build Debian package
87+
make deb
88+
89+
# Install wolfPKCS11 packages
90+
dpkg -i *.deb || true
91+
apt-get install -f -y
92+
ldconfig
93+
94+
- name: Clone NSS and apply wolfSSL patches
95+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
96+
run: |
97+
mkdir -p /tmp/src
98+
cd /tmp/src
99+
100+
# Clone wolfSSL OSP repository for patches
101+
git clone https://github.com/wolfSSL/osp.git
102+
103+
- name: Get NSS Debian sources and apply wolfPKCS11 patch
104+
run: |
105+
mkdir -p /tmp/nss-build
106+
cd /tmp/nss-build
107+
108+
# Get NSS Debian source package
109+
apt-get source libnss3
110+
111+
# Find the NSS source directory
112+
NSS_DIR=$(find . -maxdepth 1 -type d -name "nss-*" | head -1)
113+
echo "Found NSS directory: $NSS_DIR"
114+
115+
if [ -z "$NSS_DIR" ]; then
116+
echo "Error: NSS source directory not found"
117+
exit 1
118+
fi
119+
120+
cd "$NSS_DIR/nss"
121+
122+
# Apply the wolfPKCS11 NSS Debian patch
123+
echo "Applying wolfPKCS11 NSS Debian patch..."
124+
patch -p1 < ${{ github.workspace }}/.github/workflows/wolfpkcs11-nss-debian.patch
125+
126+
cd "$NSS_DIR"
127+
128+
# Apply the wolfPKCS11 NSS code patch
129+
echo "Applying wolfPKCS11 NSS code patch..."
130+
patch -p1 < /tmp/src/osp/nss/nss-fixes-3.87.patch
131+
132+
echo "Patches applied successfully"
133+
134+
- name: Build NSS Debian package with wolfPKCS11 support
135+
run: |
136+
cd /tmp/nss-build
137+
NSS_DIR=$(find . -maxdepth 1 -type d -name "nss-*" | head -1)
138+
cd "$NSS_DIR"
139+
140+
# Install build dependencies
141+
apt-get build-dep -y libnss3
142+
143+
# Build the NSS packages
144+
echo "Building NSS Debian packages..."
145+
dpkg-buildpackage -us -uc -b
146+
147+
# Install the built NSS packages
148+
cd ..
149+
echo "Installing NSS packages..."
150+
dpkg -i libnss3_*.deb libnss3-dev_*.deb libnss3-tools_*.deb || true
151+
apt-get install -f -y
152+
ldconfig
153+
154+
- name: Verify package installations
155+
run: |
156+
echo "=== Installed Package Versions ==="
157+
dpkg -l | grep -E "(wolfssl|wolfpkcs11|libnss3)"
158+
echo
159+
160+
echo "=== Library Dependencies ==="
161+
ldd /usr/lib/*/libwolfpkcs11.so* || echo "wolfPKCS11 library not found"
162+
ldd /usr/lib/*/libnss3.so* || echo "NSS library not found"
163+
echo
164+
165+
echo "=== Available NSS Tools ==="
166+
which certutil cmsutil || echo "NSS tools not found in PATH"
167+
certutil --version || echo "certutil not working"
168+
169+
- name: Configure NSS database and wolfPKCS11
170+
run: |
171+
mkdir -p /nss-test/nssdb
172+
chmod -R 777 /nss-test
173+
mkdir -p /logs
174+
175+
# Configure NSS to use wolfPKCS11 from installed package
176+
cat > /nss-test/pkcs11.txt << 'EOF'
177+
library=/usr/lib/libwolfpkcs11.so
178+
name=wolfPKCS11
179+
NSS=Flags=internal,critical,fips cipherOrder=100 slotParams={0x00000001=[slotFlags=ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] }
180+
EOF
181+
182+
# Initialize NSS database
183+
certutil -N -d /nss-test/nssdb/ --empty-password
184+
185+
echo "NSS database initialized successfully"
186+
187+
- name: Run NSS cmsutil tests with installed packages
188+
run: |
189+
cd /nss-test
190+
set -e
191+
192+
echo "=== NSS cmsutil Test Script (Using Installed Packages) ==="
193+
echo "NSS Database location: /nss-test/nssdb"
194+
echo "wolfPKCS11 library: /usr/lib/libwolfpkcs11.so"
195+
echo
196+
197+
# Create test data
198+
echo "1. Creating test data file:"
199+
echo "This is test data for CMS signing and encryption" > test-data.txt
200+
cat test-data.txt
201+
echo
202+
203+
# Generate a test certificate and key
204+
echo "2. Generating CA and user certificates:"
205+
206+
# Step 1: Create a CA certificate using OpenSSL
207+
echo " Creating CA certificate..."
208+
cat > ca-openssl.conf << 'CAEOF'
209+
[req]
210+
distinguished_name = req_distinguished_name
211+
req_extensions = v3_ca
212+
prompt = no
213+
214+
[req_distinguished_name]
215+
CN = Test CA
216+
O = NSS Test CA
217+
C = US
218+
219+
[v3_ca]
220+
keyUsage = critical, keyCertSign, cRLSign
221+
basicConstraints = critical, CA:true
222+
subjectKeyIdentifier = hash
223+
authorityKeyIdentifier = keyid:always,issuer
224+
CAEOF
225+
226+
# Create CA certificate and key
227+
openssl req -x509 -newkey rsa:2048 -keyout ca-key.pem -out ca-cert.pem -days 365 -nodes \
228+
-config ca-openssl.conf -extensions v3_ca
229+
230+
# Import CA certificate into NSS database
231+
certutil -A -n "TestCA" -i ca-cert.pem -t "CT,C,C" -d /nss-test/nssdb
232+
233+
# Step 2: Generate user certificate and key pair directly in NSS
234+
echo " Generating user certificate and key pair in NSS database..."
235+
236+
# Create random seed for key generation
237+
dd if=/dev/urandom of=noise.bin bs=20 count=1 2>/dev/null
238+
239+
# Generate certificate request with key pair (creates DER format)
240+
printf '\n\n' | certutil -R -s "CN=Test User,O=NSS Test,C=US" \
241+
-o user-req.der -d /nss-test/nssdb -z noise.bin
242+
243+
# Convert DER format certificate request to PEM format for OpenSSL
244+
openssl req -in user-req.der -inform DER -out user-req.pem -outform PEM
245+
246+
# Sign the certificate request with CA
247+
echo " Signing user certificate with CA..."
248+
cat > signing.conf << 'SIGNEOF'
249+
[v3_user_sign]
250+
keyUsage = critical, digitalSignature, keyEncipherment
251+
extendedKeyUsage = critical, emailProtection
252+
basicConstraints = critical, CA:false
253+
subjectKeyIdentifier = hash
254+
authorityKeyIdentifier = keyid:always,issuer:always
255+
subjectAltName = email:test@example.com
256+
SIGNEOF
257+
258+
openssl x509 -req -in user-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial \
259+
-out user-cert.pem -days 365 -extensions v3_user_sign -extfile signing.conf
260+
261+
# Import the signed certificate back into NSS database
262+
echo " Importing signed user certificate..."
263+
certutil -A -n "testcert" -i user-cert.pem -t "u,u,u" -d /nss-test/nssdb
264+
265+
echo " ✓ CA and user certificates created successfully"
266+
267+
echo "3. Listing certificates in NSS database:"
268+
certutil -L -d /nss-test/nssdb
269+
echo
270+
echo "Private keys in NSS database:"
271+
certutil -K -d /nss-test/nssdb
272+
echo
273+
echo "Certificate details:"
274+
if certutil -L -n "testcert" -d /nss-test/nssdb >/dev/null 2>&1; then
275+
echo "User certificate 'testcert':"
276+
certutil -L -n "testcert" -d /nss-test/nssdb
277+
echo
278+
fi
279+
if certutil -L -n "TestCA" -d /nss-test/nssdb >/dev/null 2>&1; then
280+
echo "CA certificate 'TestCA':"
281+
certutil -L -n "TestCA" -d /nss-test/nssdb
282+
fi
283+
284+
echo "4. Testing CMS operations with installed cmsutil:"
285+
286+
# Verify cmsutil is from installed NSS package
287+
echo " Using cmsutil from: $(which cmsutil)"
288+
cmsutil -V || echo "cmsutil version command not supported"
289+
290+
# Test CMS signing with additional options to handle trust
291+
echo " a) Signing data with CMS:"
292+
cmsutil -S -N "testcert" -i test-data.txt -o signed-data.p7s -d /nss-test/nssdb -p "" -G
293+
294+
if [ -f signed-data.p7s ]; then
295+
echo " ✓ CMS signing successful - created signed-data.p7s"
296+
ls -la signed-data.p7s
297+
else
298+
echo " ✗ CMS signing failed"
299+
fi
300+
301+
# Test CMS verification
302+
echo " b) Verifying CMS signature:"
303+
openssl smime -verify -in signed-data.p7s -CAfile ca-cert.pem -inform DER -noverify 2>/dev/null && echo " ✓ OpenSSL verification successful"
304+
305+
# Test CMS encryption (envelope)
306+
echo " c) Creating CMS encrypted envelope:"
307+
cmsutil -E -r "testcert" -i test-data.txt -o encrypted-data.p7e -d /nss-test/nssdb
308+
if [ -f encrypted-data.p7e ]; then
309+
echo " ✓ CMS encryption successful - created encrypted-data.p7e"
310+
ls -la encrypted-data.p7e
311+
else
312+
echo " ✗ CMS encryption failed"
313+
fi
314+
315+
# Test CMS decryption
316+
echo " d) Decrypting CMS envelope:"
317+
cmsutil -D -i encrypted-data.p7e -o decrypted-data.txt -d /nss-test/nssdb -p ""
318+
if [ -f decrypted-data.txt ]; then
319+
echo " ✓ CMS decryption successful"
320+
echo " Original data:"
321+
cat test-data.txt
322+
echo " Decrypted data:"
323+
cat decrypted-data.txt
324+
echo " Data match:" $(cmp -s test-data.txt decrypted-data.txt && echo "YES" || echo "NO")
325+
else
326+
echo " ✗ CMS decryption failed"
327+
fi
328+
329+
echo
330+
echo "=== Package-based cmsutil Test Complete ==="
331+
echo "Files created:"
332+
ls -la *.p7s *.p7e *.txt *.pem 2>/dev/null || echo "No files found"
333+
334+
echo
335+
echo "=== Package Information ==="
336+
echo "Installed wolfSSL packages:"
337+
dpkg -l | grep wolfssl || echo "No wolfSSL packages found"
338+
echo "Installed wolfPKCS11 packages:"
339+
dpkg -l | grep wolfpkcs11 || echo "No wolfPKCS11 packages found"
340+
echo "Installed NSS packages:"
341+
dpkg -l | grep libnss3 || echo "No NSS packages found"
342+
343+
# Create tar archive with all test artifacts
344+
mkdir -p /tmp/artifacts
345+
cp -r /logs /tmp/artifacts/ 2>/dev/null || true
346+
cp -r /nss-test /tmp/artifacts/ 2>/dev/null || true
347+
tar -czf /tmp/nss-cmsutil-debian-test-artifacts.tar.gz -C /tmp/artifacts . 2>/dev/null || true
348+
349+
- name: Upload test artifacts
350+
if: always()
351+
uses: actions/upload-artifact@v4
352+
with:
353+
name: nss-cmsutil-debian-test-artifacts
354+
path: /tmp/nss-cmsutil-debian-test-artifacts.tar.gz
355+
retention-days: 5
356+
357+
- name: Upload built packages
358+
if: always()
359+
uses: actions/upload-artifact@v4
360+
with:
361+
name: debian-packages
362+
path: |
363+
/tmp/wolfssl/*.deb
364+
*.deb
365+
/tmp/nss-build/*.deb
366+
retention-days: 5

0 commit comments

Comments
 (0)