Rebase changes for FIPS replace default in wolfprov

Author: Test User

.github/scripts/check-workflow-result.sh

@@ -275,11 +275,11 @@ if [ "$WOLFPROV_FORCE_FAIL" = "WOLFPROV_FORCE_FAIL=1" ]; then
     elif [ "$TEST_SUITE" = "tcpdump" ]; then
         if [ -f "tcpdump-test.log" ]; then
             # Check for expected 7 failed tests (ESP/crypto segfaults)
-            if grep -q "7 tests failed" tcpdump-test.log; then
-                echo "PASS: tcpdump tests failed as expected with force fail enabled (7 tests failed)"
+            if grep -q "2 tests failed" tcpdump-test.log; then
+                echo "PASS: tcpdump tests failed as expected with force fail enabled (2 tests failed)"
                 exit 0
             else
-                echo "FAIL: tcpdump tests did not fail as expected (should have 7 failed tests)"
+                echo "FAIL: tcpdump tests did not fail as expected (should have 2 failed tests)"
                 exit 1
             fi
         else

.github/scripts/docker/Dockerfile

@@ -0,0 +1,27 @@
+# Dockerfile used in `.github/workflows/build-wolfprovider.yml`
+FROM debian:bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    devscripts \
+    debhelper \
+    dh-autoreconf \
+    libtool \
+    pkg-config \
+    git \
+    wget \
+    curl \
+    ca-certificates \
+    openssl \
+    dpkg-dev \
+    lintian \
+    fakeroot \
+    dh-exec \
+    equivs \
+    expect \
+    xxd \
+    bc \
+    libdistro-info-perl \
+    && rm -rf /var/lib/apt/lists/*

.github/workflows/bind9.yml

@@ -18,21 +18,22 @@ jobs:
     with:
       wolfssl_ref: ${{ matrix.wolfssl_ref }}
       openssl_ref: ${{ matrix.openssl_ref }}
+      fips_ref: ${{ matrix.fips_ref }}
       replace_default: ${{ matrix.replace_default }}
     strategy:
       matrix:
         wolfssl_ref: [ 'v5.8.2-stable' ]
         openssl_ref: [ 'openssl-3.5.2' ]
+        fips_ref: [ 'FIPS', 'non-FIPS' ]
         replace_default: [ true ]
-        fips: [ false ]
 
   test_bind:
     runs-on: ubuntu-22.04
+    needs: build_wolfprovider
     container:
       image: debian:bookworm
       env:
         DEBIAN_FRONTEND: noninteractive
-    needs: build_wolfprovider
     # This should be a safe limit for the tests to run.
     timeout-minutes: 20
     strategy:
@@ -41,9 +42,9 @@ jobs:
         bind_ref: [ 'v9.18.28' ]
         wolfssl_ref: [ 'v5.8.2-stable' ]
         openssl_ref: [ 'openssl-3.5.2' ]
+        fips_ref: [ 'FIPS', 'non-FIPS' ]
         force_fail: ['WOLFPROV_FORCE_FAIL=1', '']
         replace_default: [ true ]
-        fips: [ false ]
     env:
       WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages
       OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
@@ -54,20 +55,21 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Checking OpenSSL/wolfProvider packages in cache
-        uses: actions/cache/restore@v4
-        id: wolfprov-cache
+      - name: Download packages from build job
+        uses: actions/download-artifact@v4
         with:
-          path: |
-            ${{ env.WOLFSSL_PACKAGES_PATH }}
-            ${{ env.OPENSSL_PACKAGES_PATH }}
-            ${{ env.WOLFPROV_PACKAGES_PATH }}
-          key: openssl-wolfprov-debian-packages-${{ github.sha }}${{ matrix.replace_default && '-replace-default' || '' }}
-          fail-on-cache-miss: true
+          name: debian-packages-${{ matrix.fips_ref }}${{ matrix.replace_default && '-replace-default' || '' }}-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }}
+          path: /tmp/packages
+
+      - name: Setup package directories
+        run: |
+          mv /tmp/packages/wolfssl-packages ${{ env.WOLFSSL_PACKAGES_PATH }}
+          mv /tmp/packages/openssl-packages ${{ env.OPENSSL_PACKAGES_PATH }}
+          mv /tmp/packages/wolfprov-packages ${{ env.WOLFPROV_PACKAGES_PATH }}
 
       - name: Install wolfSSL/OpenSSL/wolfprov packages
         run: |
-          printf "Installing OpenSSL/wolfProvider packages:\n"
+          printf "Installing OpenSSL/wolfProvider packages (${{ matrix.fips_ref }}):\n"
           ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
           ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
           ls -la ${{ env.WOLFPROV_PACKAGES_PATH }}
@@ -85,7 +87,9 @@ jobs:
 
       - name: Verify wolfProvider is properly installed
         run: |
-          $GITHUB_WORKSPACE/scripts/verify-install.sh ${{ matrix.replace_default && '--replace-default' || '' }} ${{ matrix.fips && '--fips' || '' }}
+          $GITHUB_WORKSPACE/scripts/verify-install.sh \
+            ${{ matrix.replace_default && '--replace-default' || '' }} \
+            ${{ matrix.fips_ref == 'FIPS' && '--fips' || '' }}
 
       - name: Install bind9 test dependencies
         run: |

.github/workflows/build-wolfprovider.yml

@@ -9,6 +9,9 @@ on:
       openssl_ref:
         required: true
         type: string
+      fips_ref:
+        required: false
+        type: string
       replace_default:
         required: false
         type: boolean
@@ -20,7 +23,7 @@ jobs:
     runs-on: ubuntu-22.04
     # Run inside Debian Bookworm to match packaging environment
     container:
-      image: debian:bookworm
+      image: ghcr.io/aidangarske/wolfprovider-build:bookworm
       env:
         DEBIAN_FRONTEND: noninteractive
     timeout-minutes: 20
@@ -29,31 +32,86 @@ jobs:
       OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
       WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages
     steps:
-      # Install git prior to cloning to ensure we have the full repo
-      # TODO: create a docker with these pre-installed
-      - name: Install common dependencies
+      # Download pre-built packages from debs branch
+      - name: Checkout debs branch
+        uses: actions/checkout@v4
+        with:
+          repository: wolfSSL/wolfProvider
+          ref: debs
+          sparse-checkout: |
+            fips
+            nonfips
+            openssl
+          sparse-checkout-cone-mode: false
+          path: debs
+
+      - name: Setup packages from debs branch
         run: |
-          apt-get update && apt-get install -y --no-install-recommends \
-            build-essential \
-            devscripts \
-            debhelper \
-            dh-autoreconf \
-            libtool \
-            pkg-config \
-            git \
-            wget \
-            curl \
-            ca-certificates \
-            openssl \
-            dpkg-dev \
-            lintian \
-            fakeroot \
-            dh-exec \
-            equivs \
-            expect \
-            xxd \
-            bc \
-            libdistro-info-perl
+          mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }}
+          mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }}
+
+          echo "Available packages in debs branch:"
+          ls -la debs/
+
+          # Copy packages based on build type
+          if [ "${{ inputs.fips_ref }}" = "FIPS" ]; then
+            if [ -d "debs/fips" ] && [ "$(ls -A debs/fips/*.deb 2>/dev/null)" ]; then
+              echo "Copying FIPS wolfSSL packages..."
+              cp debs/fips/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/
+            else
+              echo "ERROR: No FIPS packages found in debs branch"
+              exit 1
+            fi
+          else
+            if [ -d "debs/nonfips" ] && [ "$(ls -A debs/nonfips/*.deb 2>/dev/null)" ]; then
+              echo "Copying non-FIPS wolfSSL packages..."
+              cp debs/nonfips/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/
+            else
+              echo "ERROR: No non-FIPS packages found in debs branch"
+              exit 1
+            fi
+          fi
+          # Copy OpenSSL packages
+          if [ -d "debs/openssl" ] && [ "$(ls -A debs/openssl/*.deb 2>/dev/null)" ]; then
+            echo "Copying OpenSSL packages..."
+            cp debs/openssl/*.deb ${{ env.OPENSSL_PACKAGES_PATH }}/
+          else
+            echo "WARNING: No OpenSSL packages found in debs branch"
+          fi
+
+          echo ""
+          echo "Packages ready for installation:"
+          echo "wolfSSL packages:"
+          ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
+          echo ""
+          echo "OpenSSL packages:"
+          ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
+
+      - name: Install OpenSSL and wolfSSL packages
+        run: |
+          echo "Installing OpenSSL and wolfSSL packages (${{ inputs.fips_ref }})..."
+
+          # Install OpenSSL packages first
+          if [ -n "$(ls -A ${{ env.OPENSSL_PACKAGES_PATH }}/*.deb 2>/dev/null)" ]; then
+            echo "Installing OpenSSL packages..."
+            dpkg -i ${{ env.OPENSSL_PACKAGES_PATH }}/*.deb || true
+          fi
+          # Install wolfSSL packages
+          if [ -n "$(ls -A ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb 2>/dev/null)" ]; then
+            echo "Installing wolfSSL packages..."
+            dpkg -i ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb || true
+          fi
+
+          # Fix any dependency issues
+          apt-get install -f -y
+
+          echo ""
+          echo "Packages installed successfully:"
+          echo "OpenSSL:"
+          dpkg -l | grep openssl || echo "  No OpenSSL packages found"
+          echo ""
+          echo "wolfSSL:"
+          dpkg -l | grep wolfssl || echo "  No wolfSSL packages found"
 
       - name: Checkout wolfProvider
         uses: actions/checkout@v4
@@ -72,49 +130,38 @@ jobs:
           git remote add upstream https://github.com/wolfSSL/wolfProvider.git || true
           git fetch upstream --tags --no-recurse-submodules
 
-      - name: Install wolfSSL
-        run: |
-          $GITHUB_WORKSPACE/debian/install-wolfssl.sh --tag ${{ inputs.wolfssl_ref }} ${{ env.WOLFSSL_PACKAGES_PATH }}
-
-      - name: Install OpenSSL
-        run: |
-          $GITHUB_WORKSPACE/debian/install-openssl.sh ${{ inputs.replace_default && '--replace-default' || '' }} ${{ env.OPENSSL_PACKAGES_PATH }} 
-
       - name: Install wolfProvider
         run: |
-          $GITHUB_WORKSPACE/debian/install-wolfprov.sh ${{ env.WOLFPROV_PACKAGES_PATH }}
+          $GITHUB_WORKSPACE/debian/install-wolfprov.sh ${{ inputs.fips_ref == 'FIPS' && '--fips' || '' }} ${{ env.WOLFPROV_PACKAGES_PATH }}
 
-      - name: List packages directories
+      - name: Setup packages directory
         run: |
+          mkdir -p ${{ env.WOLFPROV_PACKAGES_PATH }}
+          
+          # Copy wolfProvider packages (built in previous step)
+          cp $GITHUB_WORKSPACE/../libwolfprov*.deb    ${{ env.WOLFPROV_PACKAGES_PATH }}
+          cp $GITHUB_WORKSPACE/../libwolfprov*.dsc    ${{ env.WOLFPROV_PACKAGES_PATH }}
+          cp $GITHUB_WORKSPACE/../libwolfprov*.tar.gz ${{ env.WOLFPROV_PACKAGES_PATH }}
+
+          # Note: OpenSSL and wolfSSL packages already copied from debs branch earlier
+          
+          printf "Listing packages directory:\n"
+          echo "wolfProvider packages:"
           ls -la ${{ env.WOLFPROV_PACKAGES_PATH }}
+          echo ""
+          echo "wolfSSL packages:"
           ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
+          echo ""
+          echo "OpenSSL packages:"
           ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
 
-      - name: Save all packages to cache for use by other workflows
-        uses: actions/cache/save@v4
-        continue-on-error: true
+      # Save all packages as artifacts for consumers
+      - name: Upload wolfProvider packages
+        uses: actions/upload-artifact@v4
         with:
+          name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }}
           path: |
             ${{ env.WOLFSSL_PACKAGES_PATH }}
             ${{ env.OPENSSL_PACKAGES_PATH }}
             ${{ env.WOLFPROV_PACKAGES_PATH }}
-          key: openssl-wolfprov-debian-packages-${{ github.sha }}${{ inputs.replace_default && '-replace-default' || '' }}
-
-      # Save all packages in a single artifact for consumers
-      # TODO: support debug builds
-      - name: Upload wolfProvider artifacts
-        uses: actions/upload-artifact@v4
-        continue-on-error: true
-        with:
-          name: openssl-wolfprov-debian-packages-${{ github.sha }}${{ inputs.replace_default && '-replace-default' || '' }}
-          path: |
-            ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb
-            ${{ env.WOLFSSL_PACKAGES_PATH }}/*.dsc
-            ${{ env.WOLFSSL_PACKAGES_PATH }}/*.tar.gz
-            ${{ env.OPENSSL_PACKAGES_PATH }}/*.deb
-            ${{ env.OPENSSL_PACKAGES_PATH }}/*.dsc
-            ${{ env.OPENSSL_PACKAGES_PATH }}/*.tar.gz
-            ${{ env.WOLFPROV_PACKAGES_PATH }}/*.deb
-            ${{ env.WOLFPROV_PACKAGES_PATH }}/*.dsc
-            ${{ env.WOLFPROV_PACKAGES_PATH }}/*.tar.gz
           retention-days: 1