Skip to content

Commit bb3a81a

Browse files
mattia-moffamattia-moffa
committed
Add NSS curl 8.0.0 test
1 parent 7c09e2b commit bb3a81a

File tree

1 file changed

+285
-0
lines changed

1 file changed

+285
-0
lines changed

‎.github/workflows/nss-curl-test.yml‎

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
name: wolfPKCS11 NSS curl test
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
env:
10+
NSPR_VERSION: NSPR_4_36_BRANCH
11+
NSS_VERSION: NSS_3_112_RTM
12+
WOLFSSL_VERSION: v5.8.0-stable
13+
CURL_VERSION: 8.0.0
14+
NSS_DEBUG_PKCS11_MODULE: "wolfPKCS11"
15+
NSPR_LOG_MODULES: all:5
16+
NSPR_LOG_FILE: /tmp/nss.log
17+
NSS_OUTPUT_FILE: /tmp/stats.log
18+
NSS_STRICT_NOFORK: 1
19+
NSS_DEBUG: all
20+
21+
jobs:
22+
test-nss-curl:
23+
runs-on: ubuntu-24.04
24+
steps:
25+
- name: Checkout wolfPKCS11 repository
26+
uses: actions/checkout@v4
27+
with:
28+
path: wolfpkcs11
29+
30+
- name: Install dependencies
31+
run: |
32+
sudo apt-get update
33+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
34+
build-essential \
35+
git \
36+
mercurial \
37+
gyp \
38+
ninja-build \
39+
pkg-config \
40+
zlib1g-dev \
41+
wget \
42+
python3 \
43+
python-is-python3 \
44+
python3-pip \
45+
autoconf \
46+
automake \
47+
libtool \
48+
make \
49+
gdb \
50+
vim \
51+
ca-certificates \
52+
libnss3-tools
53+
ln -sf /usr/bin/python3 /usr/bin/python
54+
rm -rf /var/lib/apt/lists/*
55+
56+
- name: Cache NSPR
57+
id: cache-nspr
58+
uses: actions/cache@v4
59+
with:
60+
path: /tmp/src/nspr
61+
key: nspr-${{ env.NSPR_VERSION }}
62+
63+
- name: Clone and build NSPR
64+
if: steps.cache-nspr.outputs.cache-hit != 'true'
65+
run: |
66+
mkdir -p /tmp/src
67+
cd /tmp/src
68+
hg clone https://hg.mozilla.org/projects/nspr -r ${{ env.NSPR_VERSION }}
69+
70+
- name: Cache NSS source and patches
71+
id: cache-nss-source
72+
uses: actions/cache@v4
73+
with:
74+
path: |
75+
/tmp/src/nss
76+
/tmp/src/osp
77+
key: nss-source-${{ env.NSS_VERSION }}-latest
78+
79+
- name: Cache NSS build artifacts
80+
id: cache-nss-build
81+
uses: actions/cache@v4
82+
with:
83+
path: /tmp/src/dist
84+
key: nss-build-${{ env.NSS_VERSION }}-latest
85+
86+
- name: Clone NSS and apply wolfSSL patches
87+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
88+
run: |
89+
mkdir -p /tmp/src
90+
cd /tmp/src
91+
92+
# Clone official Mozilla NSS with specific tag
93+
hg clone https://hg.mozilla.org/projects/nss -r ${{ env.NSS_VERSION }}
94+
95+
# Clone wolfSSL OSP repository for patches
96+
git clone https://github.com/wolfSSL/osp.git
97+
98+
cd nss
99+
100+
# Apply wolfSSL patches
101+
echo "Applying wolfSSL patches..."
102+
if [ -d "../osp/nss" ]; then
103+
for patch in ../osp/nss/*.patch; do
104+
if [ -f "$patch" ]; then
105+
echo "Applying patch: $(basename $patch)"
106+
patch -p1 < "$patch" || {
107+
echo "Warning: Patch $(basename $patch) failed to apply cleanly"
108+
echo "Attempting to apply with --reject-file option..."
109+
patch -p1 --reject-file=/tmp/$(basename $patch).rej < "$patch" || true
110+
}
111+
fi
112+
done
113+
else
114+
echo "No patches found in wolfSSL/osp/nss directory"
115+
fi
116+
117+
- name: Build NSS
118+
if: steps.cache-nss-build.outputs.cache-hit != 'true'
119+
run: |
120+
cd /tmp/src/nss
121+
122+
export USE_64=1
123+
export NSS_ENABLE_WERROR=0
124+
export BUILD_OPT=0
125+
126+
./build.sh -v
127+
128+
- name: Display patch application results
129+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
130+
run: |
131+
echo "=== NSS Patch Application Summary ==="
132+
if [ -d /tmp/src/osp/nss ]; then
133+
echo "Available patches in wolfSSL/osp/nss:"
134+
ls -la /tmp/src/osp/nss/*.patch 2>/dev/null || echo "No .patch files found"
135+
136+
# Check for any rejected patches
137+
if ls /tmp/*.rej 2>/dev/null; then
138+
echo ""
139+
echo "⚠ Warning: some patches were rejected:"
140+
ls -la /tmp/*.rej
141+
echo ""
142+
echo "Rejected patch contents:"
143+
for rej in /tmp/*.rej; do
144+
echo "--- $(basename $rej) ---"
145+
cat "$rej"
146+
echo ""
147+
done
148+
else
149+
echo "✓ All patches applied successfully (no .rej files found)"
150+
fi
151+
else
152+
echo "No patches directory found at wolfSSL/osp/nss"
153+
fi
154+
155+
156+
- name: Cache wolfSSL
157+
id: cache-wolfssl
158+
uses: actions/cache@v4
159+
with:
160+
path: /tmp/wolfssl
161+
key: wolfssl-${{ env.WOLFSSL_VERSION }}
162+
163+
- name: Clone and build wolfSSL
164+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
165+
run: |
166+
cd /tmp
167+
git clone https://github.com/wolfSSL/wolfssl.git --branch ${{ env.WOLFSSL_VERSION }} --depth 1
168+
cd wolfssl
169+
./autogen.sh
170+
./configure --enable-all --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --with-eccminsz=192 --with-max-rsa-bits=8192 CFLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DRSA_MIN_SIZE=1024 -DWOLFSSL_PSS_LONG_SALT"
171+
make
172+
173+
- name: Install wolfSSL
174+
run: |
175+
cd /tmp/wolfssl
176+
sudo make install
177+
sudo ldconfig
178+
179+
- name: Build wolfPKCS11 with NSS support
180+
run: |
181+
cd wolfpkcs11
182+
./autogen.sh
183+
./configure --enable-debug --enable-nss --enable-aesecb --enable-aesctr --enable-aesccm --enable-aescmac --enable-aeskeywrap CFLAGS="-D_GNU_SOURCE"
184+
make
185+
sudo make install
186+
sudo ldconfig
187+
188+
- name: Verify wolfPKCS11 installation
189+
run: |
190+
echo "Checking wolfPKCS11 library..."
191+
if [ -f /usr/local/lib/libwolfpkcs11.so ]; then
192+
echo "✓ wolfPKCS11 library found at /usr/local/lib/libwolfpkcs11.so"
193+
ls -la /usr/local/lib/libwolfpkcs11.so
194+
ldd /usr/local/lib/libwolfpkcs11.so || echo "Failed to run ldd on libwolfpkcs11.so"
195+
else
196+
echo "✗ ERROR: wolfPKCS11 library not found"
197+
find /usr -name "libwolfpkcs11.so" 2>/dev/null || true
198+
exit 1
199+
fi
200+
201+
echo "Checking wolfSSL library..."
202+
if [ -f /usr/local/lib/libwolfssl.so ]; then
203+
echo "✓ wolfSSL library found at /usr/local/lib/libwolfssl.so"
204+
ls -la /usr/local/lib/libwolfssl.so
205+
else
206+
echo "✗ ERROR: wolfSSL library not found"
207+
find /usr -name "libwolfssl.so" 2>/dev/null || true
208+
exit 1
209+
fi
210+
211+
- name: Configure NSS database
212+
run: |
213+
mkdir -p /etc/pki/nssdb
214+
cd /etc/pki
215+
216+
# Initialize NSS database
217+
sudo certutil -N -d sql:/etc/pki/nssdb --empty-password
218+
219+
# Configure NSS to use wolfPKCS11
220+
sudo cat > /etc/pki/nssdb/pkcs11.txt << EOF
221+
library=/usr/local/lib/libwolfpkcs11.so
222+
name=wolfPKCS11
223+
NSS=Flags=internal,critical,fips cipherOrder=100 slotParams={0x00000001=[slotFlags=ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]}
224+
EOF
225+
226+
- name: Copy NSS headers and libraries
227+
run: |
228+
sudo mkdir -p /usr/local/include/nss
229+
sudo mkdir -p /usr/local/include/nspr
230+
sudo mkdir -p /usr/local/lib
231+
232+
sudo cp -r /tmp/src/dist/public/nss/* /usr/local/include/nss/
233+
sudo cp -r /tmp/src/dist/Debug/* /usr/local/
234+
sudo find /tmp/src/dist/Debug -name "*.so" -exec cp {} /usr/local/lib \;
235+
sudo find /tmp/src/nspr/Debug -name "*.so" -exec cp {} /usr/local/lib \;
236+
237+
sudo ldconfig
238+
239+
- name: Cache curl
240+
id: cache-curl
241+
uses: actions/cache@v4
242+
with:
243+
path: /tmp/curl
244+
key: curl-${{ env.CURL_VERSION }}
245+
246+
- name: Download and build curl
247+
if: steps.cache-curl.outputs.cache-hit != 'true'
248+
run: |
249+
cd /tmp
250+
wget https://curl.se/download/curl-${{ env.CURL_VERSION }}.tar.gz
251+
tar -xzf curl-*.tar.gz
252+
rm curl-*.tar.gz
253+
cd curl-*
254+
255+
export LD_LIBRARY_PATH=/usr/local/lib
256+
export CPPFLAGS="-I/usr/local/include/nss -I/usr/local/include/nspr -I/usr/local/include"
257+
export LDFLAGS="-L/usr/local/lib"
258+
259+
./configure --with-nss=/usr/local --with-nss-deprecated
260+
make -j"$(nproc)"
261+
sudo make install
262+
sudo ldconfig
263+
264+
- name: Verify curl installation
265+
run: curl -V | grep NSS
266+
267+
- name: Test curl
268+
run: |
269+
echo "Running curl against https://example.com/"
270+
touch /tmp/nss.log
271+
chmod 666 /tmp/nss.log
272+
if curl -v https://example.com/; then
273+
echo "✓ curl exited successfully"
274+
else
275+
echo "✗ curl exited with error code $?"
276+
exit 1
277+
fi
278+
279+
- name: Upload test artifacts
280+
uses: actions/upload-artifact@v4
281+
if: failure()
282+
with:
283+
name: curl-test-artifacts
284+
path: /tmp/*.log
285+
retention-days: 5

0 commit comments

Comments
 (0)