Skip to content

Commit afb67e6

Browse files
dgarskedgarske
authored
Merge pull request #112 from mattia-moffa/20250715-nss-curl-test
Add NSS curl 8.0.0 test
2 parents da365cc + 47b0468 commit afb67e6

File tree

1 file changed

+282
-0
lines changed

1 file changed

+282
-0
lines changed

‎.github/workflows/nss-curl-test.yml‎

Lines changed: 282 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,282 @@
1+
name: wolfPKCS11 NSS curl test
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
env:
10+
NSPR_VERSION: NSPR_4_36_BRANCH
11+
NSS_VERSION: NSS_3_112_RTM
12+
WOLFSSL_VERSION: v5.8.0-stable
13+
CURL_VERSION: 8.0.0
14+
NSS_DEBUG_PKCS11_MODULE: "wolfPKCS11"
15+
NSPR_LOG_MODULES: all:5
16+
NSPR_LOG_FILE: /tmp/nss.log
17+
NSS_OUTPUT_FILE: /tmp/stats.log
18+
NSS_STRICT_NOFORK: 1
19+
NSS_DEBUG: all
20+
21+
jobs:
22+
test-nss-curl:
23+
runs-on: ubuntu-24.04
24+
steps:
25+
- name: Checkout wolfPKCS11 repository
26+
uses: actions/checkout@v4
27+
with:
28+
path: wolfpkcs11
29+
30+
- name: Install dependencies
31+
run: |
32+
sudo apt-get update
33+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
34+
build-essential \
35+
git \
36+
mercurial \
37+
gyp \
38+
ninja-build \
39+
pkg-config \
40+
zlib1g-dev \
41+
wget \
42+
python3 \
43+
python-is-python3 \
44+
python3-pip \
45+
autoconf \
46+
automake \
47+
libtool \
48+
make \
49+
gdb \
50+
vim \
51+
ca-certificates \
52+
libnss3-tools
53+
sudo rm -rf /var/lib/apt/lists/*
54+
55+
- name: Cache NSPR
56+
id: cache-nspr
57+
uses: actions/cache@v4
58+
with:
59+
path: /tmp/src/nspr
60+
key: nspr-${{ env.NSPR_VERSION }}
61+
62+
- name: Clone and build NSPR
63+
if: steps.cache-nspr.outputs.cache-hit != 'true'
64+
run: |
65+
mkdir -p /tmp/src
66+
cd /tmp/src
67+
hg clone https://hg.mozilla.org/projects/nspr -r ${{ env.NSPR_VERSION }}
68+
69+
- name: Cache NSS source and patches
70+
id: cache-nss-source
71+
uses: actions/cache@v4
72+
with:
73+
path: |
74+
/tmp/src/nss
75+
/tmp/src/osp
76+
key: nss-source-${{ env.NSS_VERSION }}-latest
77+
78+
- name: Cache NSS build artifacts
79+
id: cache-nss-build
80+
uses: actions/cache@v4
81+
with:
82+
path: /tmp/src/dist
83+
key: nss-build-${{ env.NSS_VERSION }}-latest
84+
85+
- name: Clone NSS and apply wolfSSL patches
86+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
87+
run: |
88+
mkdir -p /tmp/src
89+
cd /tmp/src
90+
91+
# Clone official Mozilla NSS with specific tag
92+
hg clone https://hg.mozilla.org/projects/nss -r ${{ env.NSS_VERSION }}
93+
94+
# Clone wolfSSL OSP repository for patches
95+
git clone https://github.com/wolfSSL/osp.git
96+
97+
cd nss
98+
99+
# Apply wolfSSL patches
100+
echo "Applying wolfSSL patches..."
101+
if [ -d "../osp/nss" ]; then
102+
for patch in ../osp/nss/*.patch; do
103+
if [ -f "$patch" ]; then
104+
echo "Applying patch: $(basename $patch)"
105+
patch -p1 < "$patch" || {
106+
echo "Warning: Patch $(basename $patch) failed to apply cleanly"
107+
echo "Attempting to apply with --reject-file option..."
108+
patch -p1 --reject-file=/tmp/$(basename $patch).rej < "$patch" || true
109+
}
110+
fi
111+
done
112+
else
113+
echo "No patches found in wolfSSL/osp/nss directory"
114+
fi
115+
116+
- name: Build NSS
117+
if: steps.cache-nss-build.outputs.cache-hit != 'true'
118+
run: |
119+
cd /tmp/src/nss
120+
121+
export USE_64=1
122+
export NSS_ENABLE_WERROR=0
123+
export BUILD_OPT=0
124+
125+
./build.sh -v
126+
127+
- name: Display patch application results
128+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
129+
run: |
130+
echo "=== NSS Patch Application Summary ==="
131+
if [ -d /tmp/src/osp/nss ]; then
132+
echo "Available patches in wolfSSL/osp/nss:"
133+
ls -la /tmp/src/osp/nss/*.patch 2>/dev/null || echo "No .patch files found"
134+
135+
# Check for any rejected patches
136+
if ls /tmp/*.rej 2>/dev/null; then
137+
echo ""
138+
echo "⚠ Warning: some patches were rejected:"
139+
ls -la /tmp/*.rej
140+
echo ""
141+
echo "Rejected patch contents:"
142+
for rej in /tmp/*.rej; do
143+
echo "--- $(basename $rej) ---"
144+
cat "$rej"
145+
echo ""
146+
done
147+
else
148+
echo "✓ All patches applied successfully (no .rej files found)"
149+
fi
150+
else
151+
echo "No patches directory found at wolfSSL/osp/nss"
152+
fi
153+
154+
155+
- name: Cache wolfSSL
156+
id: cache-wolfssl
157+
uses: actions/cache@v4
158+
with:
159+
path: /tmp/wolfssl
160+
key: wolfssl-${{ env.WOLFSSL_VERSION }}
161+
162+
- name: Clone and build wolfSSL
163+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
164+
run: |
165+
cd /tmp
166+
git clone https://github.com/wolfSSL/wolfssl.git --branch ${{ env.WOLFSSL_VERSION }} --depth 1
167+
cd wolfssl
168+
./autogen.sh
169+
./configure --enable-all --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --with-eccminsz=192 --with-max-rsa-bits=8192 CFLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DRSA_MIN_SIZE=1024 -DWOLFSSL_PSS_LONG_SALT"
170+
make
171+
172+
- name: Install wolfSSL
173+
run: |
174+
cd /tmp/wolfssl
175+
sudo make install
176+
sudo ldconfig
177+
178+
- name: Build wolfPKCS11 with NSS support
179+
run: |
180+
cd wolfpkcs11
181+
./autogen.sh
182+
./configure --enable-debug --enable-nss --enable-aesecb --enable-aesctr --enable-aesccm --enable-aescmac --enable-aeskeywrap CFLAGS="-D_GNU_SOURCE"
183+
make
184+
sudo make install
185+
sudo ldconfig
186+
187+
- name: Verify wolfPKCS11 installation
188+
run: |
189+
echo "Checking wolfPKCS11 library..."
190+
if [ -f /usr/local/lib/libwolfpkcs11.so ]; then
191+
echo "✓ wolfPKCS11 library found at /usr/local/lib/libwolfpkcs11.so"
192+
ls -la /usr/local/lib/libwolfpkcs11.so
193+
ldd /usr/local/lib/libwolfpkcs11.so || echo "Failed to run ldd on libwolfpkcs11.so"
194+
else
195+
echo "✗ ERROR: wolfPKCS11 library not found"
196+
find /usr -name "libwolfpkcs11.so" 2>/dev/null || true
197+
exit 1
198+
fi
199+
200+
echo "Checking wolfSSL library..."
201+
if [ -f /usr/local/lib/libwolfssl.so ]; then
202+
echo "✓ wolfSSL library found at /usr/local/lib/libwolfssl.so"
203+
ls -la /usr/local/lib/libwolfssl.so
204+
else
205+
echo "✗ ERROR: wolfSSL library not found"
206+
find /usr -name "libwolfssl.so" 2>/dev/null || true
207+
exit 1
208+
fi
209+
210+
- name: Configure NSS database
211+
run: |
212+
sudo mkdir -p /etc/pki/nssdb
213+
cd /etc/pki
214+
215+
# Initialize NSS database
216+
sudo certutil -N -d sql:/etc/pki/nssdb --empty-password
217+
218+
# Configure NSS to use wolfPKCS11
219+
sudo bash -c 'echo "library=/usr/local/lib/libwolfpkcs11.so" > /etc/pki/nssdb/pkcs11.txt'
220+
sudo bash -c 'echo "name=wolfPKCS11" >> /etc/pki/nssdb/pkcs11.txt'
221+
sudo bash -c 'echo "NSS=Flags=internal,critical,fips cipherOrder=100 slotParams={0x00000001=[slotFlags=ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]}" >> /etc/pki/nssdb/pkcs11.txt'
222+
223+
- name: Copy NSS headers and libraries
224+
run: |
225+
sudo mkdir -p /usr/local/include/nss
226+
sudo mkdir -p /usr/local/include/nspr
227+
sudo mkdir -p /usr/local/lib
228+
229+
sudo cp -r /tmp/src/dist/public/nss/* /usr/local/include/nss/
230+
sudo cp -r /tmp/src/dist/Debug/* /usr/local/
231+
sudo find /tmp/src/dist/Debug -name "*.so" -exec cp {} /usr/local/lib \;
232+
sudo find /tmp/src/nspr/Debug -name "*.so" -exec cp {} /usr/local/lib \;
233+
234+
sudo ldconfig
235+
236+
- name: Cache curl
237+
id: cache-curl
238+
uses: actions/cache@v4
239+
with:
240+
path: /tmp/curl
241+
key: curl-${{ env.CURL_VERSION }}
242+
243+
- name: Download and build curl
244+
if: steps.cache-curl.outputs.cache-hit != 'true'
245+
run: |
246+
cd /tmp
247+
wget https://curl.se/download/curl-${{ env.CURL_VERSION }}.tar.gz
248+
tar -xzf curl-*.tar.gz
249+
rm curl-*.tar.gz
250+
cd curl-*
251+
252+
export LD_LIBRARY_PATH=/usr/local/lib
253+
export CPPFLAGS="-I/usr/local/include/nss -I/usr/local/include/nspr -I/usr/local/include"
254+
export LDFLAGS="-L/usr/local/lib"
255+
256+
./configure --with-nss=/usr/local --with-nss-deprecated
257+
make -j"$(nproc)"
258+
sudo make install
259+
sudo ldconfig
260+
261+
- name: Verify curl installation
262+
run: curl -V | grep NSS
263+
264+
- name: Test curl
265+
run: |
266+
echo "Running curl against https://github.com/"
267+
touch /tmp/nss.log
268+
chmod 666 /tmp/nss.log
269+
if curl -v https://github.com/; then
270+
echo "✓ curl exited successfully"
271+
else
272+
echo "✗ curl exited with error code $?"
273+
exit 1
274+
fi
275+
276+
- name: Upload test artifacts
277+
uses: actions/upload-artifact@v4
278+
if: failure()
279+
with:
280+
name: curl-test-artifacts
281+
path: /tmp/*.log
282+
retention-days: 5

0 commit comments

Comments
 (0)