Skip to content

Commit f089c95

Browse files
author
Test User
committed
Add support for FIPS github CI testing
1 parent f8f4324 commit f089c95

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1136
-918
lines changed

‎.github/scripts/check-workflow-result.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -275,11 +275,11 @@ if [ "$WOLFPROV_FORCE_FAIL" = "WOLFPROV_FORCE_FAIL=1" ]; then
275275
elif [ "$TEST_SUITE" = "tcpdump" ]; then
276276
if [ -f "tcpdump-test.log" ]; then
277277
# Check for expected 7 failed tests (ESP/crypto segfaults)
278-
if grep -q "7 tests failed" tcpdump-test.log; then
279-
echo "PASS: tcpdump tests failed as expected with force fail enabled (7 tests failed)"
278+
if grep -q "2 tests failed" tcpdump-test.log; then
279+
echo "PASS: tcpdump tests failed as expected with force fail enabled (2 tests failed)"
280280
exit 0
281281
else
282-
echo "FAIL: tcpdump tests did not fail as expected (should have 7 failed tests)"
282+
echo "FAIL: tcpdump tests did not fail as expected (should have 2 failed tests)"
283283
exit 1
284284
fi
285285
else

‎.github/scripts/docker/Dockerfile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dockerfile used in `.github/workflows/build-wolfprovider.yml`
2+
FROM debian:bookworm
3+
4+
ENV DEBIAN_FRONTEND=noninteractive
5+
6+
RUN apt-get update && apt-get install -y --no-install-recommends \
7+
build-essential \
8+
devscripts \
9+
debhelper \
10+
dh-autoreconf \
11+
libtool \
12+
pkg-config \
13+
git \
14+
wget \
15+
curl \
16+
ca-certificates \
17+
openssl \
18+
dpkg-dev \
19+
lintian \
20+
fakeroot \
21+
dh-exec \
22+
equivs \
23+
expect \
24+
xxd \
25+
bc \
26+
libdistro-info-perl \
27+
&& rm -rf /var/lib/apt/lists/*

‎.github/workflows/bind9.yml‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,22 @@ jobs:
1818
with:
1919
wolfssl_ref: ${{ matrix.wolfssl_ref }}
2020
openssl_ref: ${{ matrix.openssl_ref }}
21+
fips_ref: ${{ matrix.fips_ref }}
2122
replace_default: ${{ matrix.replace_default }}
2223
strategy:
2324
matrix:
2425
wolfssl_ref: [ 'v5.8.2-stable' ]
2526
openssl_ref: [ 'openssl-3.5.2' ]
27+
fips_ref: [ 'FIPS', 'non-FIPS' ]
2628
replace_default: [ true ]
27-
fips: [ false ]
2829

2930
test_bind:
3031
runs-on: ubuntu-22.04
32+
needs: build_wolfprovider
3133
container:
3234
image: debian:bookworm
3335
env:
3436
DEBIAN_FRONTEND: noninteractive
35-
needs: build_wolfprovider
3637
# This should be a safe limit for the tests to run.
3738
timeout-minutes: 20
3839
strategy:
@@ -41,9 +42,9 @@ jobs:
4142
bind_ref: [ 'v9.18.28' ]
4243
wolfssl_ref: [ 'v5.8.2-stable' ]
4344
openssl_ref: [ 'openssl-3.5.2' ]
45+
fips_ref: [ 'FIPS', 'non-FIPS' ]
4446
force_fail: ['WOLFPROV_FORCE_FAIL=1', '']
4547
replace_default: [ true ]
46-
fips: [ false ]
4748
env:
4849
WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages
4950
OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
@@ -54,20 +55,21 @@ jobs:
5455
with:
5556
fetch-depth: 1
5657

57-
- name: Checking OpenSSL/wolfProvider packages in cache
58-
uses: actions/cache/restore@v4
59-
id: wolfprov-cache
58+
- name: Download packages from build job
59+
uses: actions/download-artifact@v4
6060
with:
61-
path: |
62-
${{ env.WOLFSSL_PACKAGES_PATH }}
63-
${{ env.OPENSSL_PACKAGES_PATH }}
64-
${{ env.WOLFPROV_PACKAGES_PATH }}
65-
key: openssl-wolfprov-debian-packages-${{ github.sha }}${{ matrix.replace_default && '-replace-default' || '' }}
66-
fail-on-cache-miss: true
61+
name: debian-packages-${{ matrix.fips_ref }}${{ matrix.replace_default && '-replace-default' || '' }}-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }}
62+
path: /tmp/packages
63+
64+
- name: Setup package directories
65+
run: |
66+
mv /tmp/packages/wolfssl-packages ${{ env.WOLFSSL_PACKAGES_PATH }}
67+
mv /tmp/packages/openssl-packages ${{ env.OPENSSL_PACKAGES_PATH }}
68+
mv /tmp/packages/wolfprov-packages ${{ env.WOLFPROV_PACKAGES_PATH }}
6769
6870
- name: Install wolfSSL/OpenSSL/wolfprov packages
6971
run: |
70-
printf "Installing OpenSSL/wolfProvider packages:\n"
72+
printf "Installing OpenSSL/wolfProvider packages (${{ matrix.fips_ref }}):\n"
7173
ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
7274
ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
7375
ls -la ${{ env.WOLFPROV_PACKAGES_PATH }}
@@ -85,7 +87,9 @@ jobs:
8587
8688
- name: Verify wolfProvider is properly installed
8789
run: |
88-
$GITHUB_WORKSPACE/scripts/verify-install.sh ${{ matrix.replace_default && '--replace-default' || '' }} ${{ matrix.fips && '--fips' || '' }}
90+
$GITHUB_WORKSPACE/scripts/verify-install.sh \
91+
${{ matrix.replace_default && '--replace-default' || '' }} \
92+
${{ matrix.fips_ref == 'FIPS' && '--fips' || '' }}
8993
9094
- name: Install bind9 test dependencies
9195
run: |
@@ -113,7 +117,11 @@ jobs:
113117
fetch-depth: 1
114118
- run: |
115119
cd bind9
116-
patch -p1 < $GITHUB_WORKSPACE/osp/wolfProvider/bind9/bind9-${{ matrix.bind_ref }}-wolfprov.patch
120+
if [ "${{ matrix.fips_ref }}" = "FIPS" ]; then
121+
patch -p1 < $GITHUB_WORKSPACE/osp/wolfProvider/bind9/bind9-${{ matrix.bind_ref }}-wolfprov-fips.patch
122+
else
123+
patch -p1 < $GITHUB_WORKSPACE/osp/wolfProvider/bind9/bind9-${{ matrix.bind_ref }}-wolfprov.patch
124+
fi
117125
118126
- name: Build and test bind9 with wolfProvider
119127
working-directory: bind9

‎.github/workflows/build-wolfprovider.yml‎

Lines changed: 132 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
openssl_ref:
1010
required: true
1111
type: string
12+
fips_ref:
13+
required: false
14+
type: string
1215
replace_default:
1316
required: false
1417
type: boolean
@@ -18,103 +21,174 @@ jobs:
1821
build_wolfprovider_common:
1922
name: Build wolfProvider
2023
runs-on: ubuntu-22.04
21-
# Run inside Debian Bookworm to match packaging environment
24+
# Run inside Debian Bookworm using container from ghcr.io/aidangarske/wolfprovider-build:bookworm
25+
# We are using this container to avoid having to install all the dependencies on the host machine
26+
# and speed up the build process.
27+
# TODO: Switch from aidangarske fork to main WP repo for the build container.
2228
container:
23-
image: debian:bookworm
29+
image: ghcr.io/aidangarske/wolfprovider-build:bookworm
2430
env:
2531
DEBIAN_FRONTEND: noninteractive
32+
# Add network capabilities so ifconfig/RTNETLINK operations are permitted
33+
# These are passed to `docker run` as runtime options
34+
options: --cap-add=NET_ADMIN --cap-add=NET_RAW
2635
timeout-minutes: 20
2736
env:
2837
WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages
2938
OPENSSL_PACKAGES_PATH: /tmp/openssl-packages
3039
WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages
40+
DEBS_PATH: debs
3141
steps:
32-
# Install git prior to cloning to ensure we have the full repo
33-
# TODO: create a docker with these pre-installed
34-
- name: Install common dependencies
42+
# Check if artifact already exists from another job in the same workflow run
43+
# When multiple matrix jobs run in parallel, the first one to finish uploads the artifact
44+
# Other jobs can then find it and skip rebuilding (no need to download it, just check it exists)
45+
- name: Check for existing artifact from same run
46+
id: check_artifact
47+
continue-on-error: true
48+
uses: actions/download-artifact@v4
49+
with:
50+
name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }}
51+
52+
# Download pre-built packages from debs branch
53+
- name: Checkout debs branch
54+
if: steps.check_artifact.outcome != 'success'
55+
uses: actions/checkout@v4
56+
with:
57+
repository: wolfSSL/wolfProvider
58+
ref: debs
59+
sparse-checkout: |
60+
fips
61+
nonfips
62+
openssl
63+
sparse-checkout-cone-mode: false
64+
path: ${{ env.DEBS_PATH }}
65+
66+
- name: Setup packages from debs branch
67+
if: steps.check_artifact.outcome != 'success'
68+
run: |
69+
mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }}
70+
mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }}
71+
72+
echo "Available packages in debs branch:"
73+
ls -la ${{ env.DEBS_PATH }}/
74+
75+
# Copy packages based on build type
76+
if [ "${{ inputs.fips_ref }}" = "FIPS" ]; then
77+
if [ -d "${{ env.DEBS_PATH }}/fips" ] && [ "$(ls -A ${{ env.DEBS_PATH }}/fips/*.deb 2>/dev/null)" ]; then
78+
echo "Copying FIPS wolfSSL packages..."
79+
cp ${{ env.DEBS_PATH }}/fips/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/
80+
else
81+
echo "ERROR: No FIPS packages found in debs branch"
82+
exit 1
83+
fi
84+
else
85+
if [ -d "${{ env.DEBS_PATH }}/nonfips" ] && [ "$(ls -A ${{ env.DEBS_PATH }}/nonfips/*.deb 2>/dev/null)" ]; then
86+
echo "Copying non-FIPS wolfSSL packages..."
87+
cp ${{ env.DEBS_PATH }}/nonfips/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/
88+
else
89+
echo "ERROR: No non-FIPS packages found in debs branch"
90+
exit 1
91+
fi
92+
fi
93+
# Copy OpenSSL packages
94+
if [ -d "${{ env.DEBS_PATH }}/openssl" ] && [ "$(ls -A ${{ env.DEBS_PATH }}/openssl/*.deb 2>/dev/null)" ]; then
95+
echo "Copying OpenSSL packages..."
96+
cp ${{ env.DEBS_PATH }}/openssl/*.deb ${{ env.OPENSSL_PACKAGES_PATH }}/
97+
else
98+
echo "WARNING: No OpenSSL packages found in debs branch"
99+
fi
100+
101+
echo ""
102+
echo "Packages ready for installation:"
103+
echo "wolfSSL packages:"
104+
ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
105+
echo ""
106+
echo "OpenSSL packages:"
107+
ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
108+
109+
- name: Install OpenSSL and wolfSSL packages
110+
if: steps.check_artifact.outcome != 'success'
35111
run: |
36-
apt-get update && apt-get install -y --no-install-recommends \
37-
build-essential \
38-
devscripts \
39-
debhelper \
40-
dh-autoreconf \
41-
libtool \
42-
pkg-config \
43-
git \
44-
wget \
45-
curl \
46-
ca-certificates \
47-
openssl \
48-
dpkg-dev \
49-
lintian \
50-
fakeroot \
51-
dh-exec \
52-
equivs \
53-
expect \
54-
xxd \
55-
bc \
56-
libdistro-info-perl
112+
echo "Installing OpenSSL and wolfSSL packages (${{ inputs.fips_ref }})..."
113+
114+
# Install OpenSSL packages first
115+
if [ -n "$(ls -A ${{ env.OPENSSL_PACKAGES_PATH }}/*.deb 2>/dev/null)" ]; then
116+
echo "Installing OpenSSL packages..."
117+
dpkg -i ${{ env.OPENSSL_PACKAGES_PATH }}/*.deb || true
118+
fi
119+
# Install wolfSSL packages
120+
if [ -n "$(ls -A ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb 2>/dev/null)" ]; then
121+
echo "Installing wolfSSL packages..."
122+
dpkg -i ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb || true
123+
fi
124+
125+
# Fix any dependency issues
126+
apt-get install -f -y
127+
128+
echo ""
129+
echo "Packages installed successfully:"
130+
echo "OpenSSL:"
131+
dpkg -l | grep openssl || echo " No OpenSSL packages found"
132+
echo ""
133+
echo "wolfSSL:"
134+
dpkg -l | grep wolfssl || echo " No wolfSSL packages found"
57135
58136
- name: Checkout wolfProvider
137+
if: steps.check_artifact.outcome != 'success'
59138
uses: actions/checkout@v4
60139
with:
61140
fetch-depth: 1
62141
fetch-tags: true
63142

64143
# Avoid "detected dubious ownership" warning
65144
- name: Ensure the working directory safe
145+
if: steps.check_artifact.outcome != 'success'
66146
run: |
67147
git config --global --add safe.directory "$GITHUB_WORKSPACE"
68148
69149
# When running on a fork the upstream tags are not present, so fetch them explicitly
70150
- name: Fetch tags from upstream(for Debian versioning)
151+
if: steps.check_artifact.outcome != 'success'
71152
run: |
72153
git remote add upstream https://github.com/wolfSSL/wolfProvider.git || true
73154
git fetch upstream --tags --no-recurse-submodules
74155
75-
- name: Install wolfSSL
76-
run: |
77-
$GITHUB_WORKSPACE/debian/install-wolfssl.sh --tag ${{ inputs.wolfssl_ref }} ${{ env.WOLFSSL_PACKAGES_PATH }}
78-
79-
- name: Install OpenSSL
80-
run: |
81-
$GITHUB_WORKSPACE/debian/install-openssl.sh ${{ inputs.replace_default && '--replace-default' || '' }} ${{ env.OPENSSL_PACKAGES_PATH }}
82-
83156
- name: Install wolfProvider
157+
if: steps.check_artifact.outcome != 'success'
84158
run: |
85-
$GITHUB_WORKSPACE/debian/install-wolfprov.sh ${{ env.WOLFPROV_PACKAGES_PATH }}
159+
$GITHUB_WORKSPACE/debian/install-wolfprov.sh ${{ inputs.fips_ref == 'FIPS' && '--fips' || '' }} ${{ env.WOLFPROV_PACKAGES_PATH }}
86160
87-
- name: List packages directories
161+
- name: Setup packages directory
162+
if: steps.check_artifact.outcome != 'success'
88163
run: |
164+
mkdir -p ${{ env.WOLFPROV_PACKAGES_PATH }}
165+
166+
# Copy wolfProvider packages (built in previous step)
167+
cp $GITHUB_WORKSPACE/../libwolfprov*.deb ${{ env.WOLFPROV_PACKAGES_PATH }}
168+
cp $GITHUB_WORKSPACE/../libwolfprov*.dsc ${{ env.WOLFPROV_PACKAGES_PATH }}
169+
cp $GITHUB_WORKSPACE/../libwolfprov*.tar.gz ${{ env.WOLFPROV_PACKAGES_PATH }}
170+
171+
# Note: OpenSSL and wolfSSL packages already copied from debs branch earlier
172+
173+
printf "Listing packages directory:\n"
174+
echo "wolfProvider packages:"
89175
ls -la ${{ env.WOLFPROV_PACKAGES_PATH }}
176+
echo ""
177+
echo "wolfSSL packages:"
90178
ls -la ${{ env.WOLFSSL_PACKAGES_PATH }}
179+
echo ""
180+
echo "OpenSSL packages:"
91181
ls -la ${{ env.OPENSSL_PACKAGES_PATH }}
92182
93-
- name: Save all packages to cache for use by other workflows
94-
uses: actions/cache/save@v4
95-
continue-on-error: true
183+
# Save all packages as artifacts for consumers
184+
# Skip upload if artifact already exists (from a parallel run)
185+
- name: Upload wolfProvider packages
186+
if: steps.check_artifact.outcome != 'success'
187+
uses: actions/upload-artifact@v4
96188
with:
189+
name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }}
97190
path: |
98191
${{ env.WOLFSSL_PACKAGES_PATH }}
99192
${{ env.OPENSSL_PACKAGES_PATH }}
100193
${{ env.WOLFPROV_PACKAGES_PATH }}
101-
key: openssl-wolfprov-debian-packages-${{ github.sha }}${{ inputs.replace_default && '-replace-default' || '' }}
102-
103-
# Save all packages in a single artifact for consumers
104-
# TODO: support debug builds
105-
- name: Upload wolfProvider artifacts
106-
uses: actions/upload-artifact@v4
107-
continue-on-error: true
108-
with:
109-
name: openssl-wolfprov-debian-packages-${{ github.sha }}${{ inputs.replace_default && '-replace-default' || '' }}
110-
path: |
111-
${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb
112-
${{ env.WOLFSSL_PACKAGES_PATH }}/*.dsc
113-
${{ env.WOLFSSL_PACKAGES_PATH }}/*.tar.gz
114-
${{ env.OPENSSL_PACKAGES_PATH }}/*.deb
115-
${{ env.OPENSSL_PACKAGES_PATH }}/*.dsc
116-
${{ env.OPENSSL_PACKAGES_PATH }}/*.tar.gz
117-
${{ env.WOLFPROV_PACKAGES_PATH }}/*.deb
118-
${{ env.WOLFPROV_PACKAGES_PATH }}/*.dsc
119-
${{ env.WOLFPROV_PACKAGES_PATH }}/*.tar.gz
120194
retention-days: 1

0 commit comments

Comments
 (0)