Fenrir fixes for AES-GCM/GMAC and RSA-PSS JNI wrappers #990
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| # Cancel superseded in-progress runs for the same PR. In-progress | |
| # push runs are never cancelled, though a still-queued push run may | |
| # be superseded by a newer queued one. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| # Oracle JDK (Linux, Mac) | |
| # Oracle JDK requires JAR to be signed for some classes to load/run | |
| # properly, for example KeyAgreement. These tests are commented out | |
| # here until we get a solution in place for CI JAR signing | |
| #linux-oracle: | |
| # strategy: | |
| # matrix: | |
| # os: [ 'ubuntu-latest', 'macos-latest' ] | |
| # jdk_version: [ '17', '21', '24', '25' ] | |
| # wolfssl_configure: [ '--enable-jni' ] | |
| # name: ${{ matrix.os }} (Oracle JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| # uses: ./.github/workflows/linux-common.yml | |
| # with: | |
| # os: ${{ matrix.os }} | |
| # jdk_distro: "oracle" | |
| # jdk_version: ${{ matrix.jdk_version }} | |
| # wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # Zulu JDK (Linux, Mac) | |
| linux-zulu: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '8', '11', '17', '21', '24', '25' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # Corretto JDK (Linux, Mac) | |
| linux-corretto: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '8', '11', '17', '21', '24', '25' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: ${{ matrix.os }} (Corretto JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "corretto" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # Temurin JDK (Linux, Mac) | |
| # JDK 8 seems to have been removed from Temurin macos, with 8 we see the error | |
| # Could not find satisfied version for SemVer '8' | |
| linux-temurin: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11', '17', '21', '24', '25' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: ${{ matrix.os }} (Temurin JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "temurin" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # Microsoft JDK (Linux, Mac) | |
| linux-microsoft: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11.0.19', '17.0.7', '21.0.0', '25.0.0' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: ${{ matrix.os }} (Microsoft JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "microsoft" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # -------------------- enable-all sanity checks ----------------------- | |
| # Only check one Linux and Mac JDK version with --enable-jni --enable-all | |
| # as sanity. Using Zulu, but this can be expanded if needed. | |
| linux-zulu-all: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11' ] | |
| wolfssl_configure: [ '--enable-jni --enable-all' ] | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # ------------------ RSA 1024 min size sanity check ------------------- | |
| # Only check one Linux and Mac JDK version as a sanity check. Using Zulu, | |
| # but this can be expanded if needed. | |
| # wolfSSL ./configure: | |
| # --enable-jni CFLAGS="-DRSA_MIN_SIZE=1024 | |
| linux-zulu-rsa-min-size: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11' ] | |
| wolfssl_configure: [ '--enable-jni CFLAGS="-DRSA_MIN_SIZE=1024"' ] | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # -------------------- XMSS / XMSS^MT (RFC 8391) ---------------------- | |
| # XMSS is verify-only and requires wolfSSL 5.9.2 or later. XMSS is not pulled | |
| # in by --enable-all, so it must be enabled explicitly with --enable-xmss. | |
| # Permutations: the basic build, SHAKE parameter sets (--enable-sha3), and | |
| # --enable-all plus XMSS. | |
| linux-zulu-xmss: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11', '21', '24' ] | |
| wolfssl_configure: | |
| - '--enable-jni --enable-xmss' | |
| - '--enable-jni --enable-xmss --enable-sha3' | |
| - '--enable-jni --enable-all --enable-xmss' | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # ----------------------- LMS / HSS (RFC 8554) ------------------------ | |
| # LMS/HSS is verify-only in wolfJCE and requires wolfSSL to be built with | |
| # --enable-lms. It is not pulled in by --enable-all, so it is enabled | |
| # explicitly. The --enable-lms option is comma-separated and selects the | |
| # build variant and hash/parameter families: | |
| # (default) SHA-256/256 parameter sets, sign + verify | |
| # verify-only -> WOLFSSL_LMS_VERIFY_ONLY (wolfJCE production posture) | |
| # small -> WOLFSSL_WC_LMS_SMALL (low-memory, slower codepath) | |
| # sha256-192 -> WOLFSSL_LMS_SHA256_192 (RFC 9858 SHA-256/192 sets) | |
| # shake256 -> WOLFSSL_LMS_SHAKE256 (RFC 9858 SHAKE256 sets) | |
| # The LMS JUnit tests skip per hash family not compiled in (the JNI import | |
| # returns NOT_COMPILED_IN), so each permutation runs the KATs it can and | |
| # skips the rest. SHAKE parameter sets additionally require --enable-sha3. | |
| linux-zulu-lms: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11', '21', '24' ] | |
| wolfssl_configure: | |
| - '--enable-jni --enable-lms' | |
| - '--enable-jni --enable-lms=verify-only' | |
| - '--enable-jni --enable-lms=verify-only,small' | |
| - '--enable-jni --enable-lms=sha256-192,shake256 --enable-sha3' | |
| - '--enable-jni --enable-all --enable-lms' | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # ----------------------- SLH-DSA (FIPS 205) -------------------------- | |
| # SLH-DSA provides full keygen/sign/verify in wolfJCE and requires wolfSSL | |
| # to be built with --enable-slhdsa. It is not pulled in by --enable-all. | |
| # The --enable-slhdsa option is comma-separated: | |
| # (default/yes) the six SHAKE parameter sets (128s/128f/192s/192f/ | |
| # 256s/256f), full keygen + sign + verify | |
| # sha2 -> adds the six SHA2 parameter sets (SLH-DSA-SHA2-*) | |
| # 128f, sha2-128f, ... -> select individual parameter sets | |
| # small -> WOLFSSL_WC_SLHDSA_SMALL (low-memory codepath) | |
| # small-mem -> WOLFSSL_WC_SLHDSA_SMALL_MEM (lower-memory codepath) | |
| # verify-only -> WOLFSSL_SLHDSA_VERIFY_ONLY (no keygen/sign) | |
| # Extra options do not imply 'yes': parameter sets must be selected via | |
| # 'yes', 'sha2', or per-set tokens, otherwise no set is compiled in and | |
| # native wolfSSL fails to build ("No parameters defined"). SHAKE256/SHA-3 | |
| # dependencies are auto-enabled by wolfSSL configure, so no --enable-sha3 | |
| # is needed. JUnit tests probe per parameter set and per capability, so | |
| # each permutation runs what it can and skips the rest. Permutations: | |
| # default SHAKE-only, all 12 sets, all 12 + small codepath, a reduced | |
| # per-set selection + small-mem codepath, verify-only degradation, and | |
| # --enable-all interop. | |
| linux-zulu-slhdsa: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '11', '21', '24' ] | |
| wolfssl_configure: | |
| - '--enable-jni --enable-slhdsa' | |
| - '--enable-jni --enable-slhdsa=yes,sha2' | |
| - '--enable-jni --enable-slhdsa=yes,sha2,small' | |
| - '--enable-jni --enable-slhdsa=128f,sha2-128f,small-mem' | |
| - '--enable-jni --enable-slhdsa=yes,sha2,verify-only' | |
| - '--enable-jni --enable-all --enable-slhdsa=yes,sha2' | |
| name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }}) | |
| uses: ./.github/workflows/linux-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # ------------------ Facebook Infer static analysis ------------------- | |
| # Run Facebook Infer over the Java sources, only running on Linux with | |
| # one JDK/version for now. Infer only compiles the .java files with | |
| # javac, so no native wolfSSL build or test run is needed here. Tests | |
| # for the equivalent configuration run in linux-zulu-all above. | |
| fb-infer: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest' ] | |
| jdk_version: [ '11' ] | |
| name: Facebook Infer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }}) | |
| uses: ./.github/workflows/infer.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| # --------------------- Maven build - test pom.xml -------------------- | |
| # Run Maven build over PR code, running on Linux and Mac with only one | |
| # JDK/version for now. | |
| maven-build: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest', 'macos-latest' ] | |
| jdk_version: [ '21' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: Maven Build (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }}) | |
| uses: ./.github/workflows/maven.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # --------------- AddressSanitizer build and test ------------------ | |
| # Run AddressSanitizer build and test on Linux only for memory error detection | |
| address-sanitizer: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest' ] | |
| jdk_version: [ '21' ] | |
| wolfssl_configure: [ '--enable-jni' ] | |
| name: AddressSanitizer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }}) | |
| uses: ./.github/workflows/sanitizer-common.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| wolfssl_configure: ${{ matrix.wolfssl_configure }} | |
| # --------------- Filtered providers (native-free) ----------------- | |
| # Build/test the filtered-providers ant targets and Maven profile. | |
| # JDK 8 added to verify it skips building filtered providers. | |
| filtered-providers: | |
| strategy: | |
| matrix: | |
| os: [ 'ubuntu-latest' ] | |
| jdk_version: [ '8', '11', '17', '21', '24', '25' ] | |
| name: Filtered Providers (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }}) | |
| uses: ./.github/workflows/filtered-providers.yml | |
| with: | |
| os: ${{ matrix.os }} | |
| jdk_distro: "zulu" | |
| jdk_version: ${{ matrix.jdk_version }} | |
| # ----------------- Windows Visual Studio build -------------------- | |
| windows-build: | |
| uses: ./.github/workflows/windows-vs.yml | |