Skip to content

Fenrir fixes for AES-GCM/GMAC and RSA-PSS JNI wrappers #990

Fenrir fixes for AES-GCM/GMAC and RSA-PSS JNI wrappers

Fenrir fixes for AES-GCM/GMAC and RSA-PSS JNI wrappers #990

Workflow file for this run

name: CI
on:
push:
branches: [ 'master', 'main', 'release/**' ]
pull_request:
branches: [ '*' ]
# Cancel superseded in-progress runs for the same PR. In-progress
# push runs are never cancelled, though a still-queued push run may
# be superseded by a newer queued one.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
# Oracle JDK (Linux, Mac)
# Oracle JDK requires JAR to be signed for some classes to load/run
# properly, for example KeyAgreement. These tests are commented out
# here until we get a solution in place for CI JAR signing
#linux-oracle:
# strategy:
# matrix:
# os: [ 'ubuntu-latest', 'macos-latest' ]
# jdk_version: [ '17', '21', '24', '25' ]
# wolfssl_configure: [ '--enable-jni' ]
# name: ${{ matrix.os }} (Oracle JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
# uses: ./.github/workflows/linux-common.yml
# with:
# os: ${{ matrix.os }}
# jdk_distro: "oracle"
# jdk_version: ${{ matrix.jdk_version }}
# wolfssl_configure: ${{ matrix.wolfssl_configure }}
# Zulu JDK (Linux, Mac)
linux-zulu:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '8', '11', '17', '21', '24', '25' ]
wolfssl_configure: [ '--enable-jni' ]
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# Corretto JDK (Linux, Mac)
linux-corretto:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '8', '11', '17', '21', '24', '25' ]
wolfssl_configure: [ '--enable-jni' ]
name: ${{ matrix.os }} (Corretto JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "corretto"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# Temurin JDK (Linux, Mac)
# JDK 8 seems to have been removed from Temurin macos, with 8 we see the error
# Could not find satisfied version for SemVer '8'
linux-temurin:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11', '17', '21', '24', '25' ]
wolfssl_configure: [ '--enable-jni' ]
name: ${{ matrix.os }} (Temurin JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "temurin"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# Microsoft JDK (Linux, Mac)
linux-microsoft:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11.0.19', '17.0.7', '21.0.0', '25.0.0' ]
wolfssl_configure: [ '--enable-jni' ]
name: ${{ matrix.os }} (Microsoft JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "microsoft"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# -------------------- enable-all sanity checks -----------------------
# Only check one Linux and Mac JDK version with --enable-jni --enable-all
# as sanity. Using Zulu, but this can be expanded if needed.
linux-zulu-all:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11' ]
wolfssl_configure: [ '--enable-jni --enable-all' ]
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# ------------------ RSA 1024 min size sanity check -------------------
# Only check one Linux and Mac JDK version as a sanity check. Using Zulu,
# but this can be expanded if needed.
# wolfSSL ./configure:
# --enable-jni CFLAGS="-DRSA_MIN_SIZE=1024
linux-zulu-rsa-min-size:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11' ]
wolfssl_configure: [ '--enable-jni CFLAGS="-DRSA_MIN_SIZE=1024"' ]
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure}})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# -------------------- XMSS / XMSS^MT (RFC 8391) ----------------------
# XMSS is verify-only and requires wolfSSL 5.9.2 or later. XMSS is not pulled
# in by --enable-all, so it must be enabled explicitly with --enable-xmss.
# Permutations: the basic build, SHAKE parameter sets (--enable-sha3), and
# --enable-all plus XMSS.
linux-zulu-xmss:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11', '21', '24' ]
wolfssl_configure:
- '--enable-jni --enable-xmss'
- '--enable-jni --enable-xmss --enable-sha3'
- '--enable-jni --enable-all --enable-xmss'
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# ----------------------- LMS / HSS (RFC 8554) ------------------------
# LMS/HSS is verify-only in wolfJCE and requires wolfSSL to be built with
# --enable-lms. It is not pulled in by --enable-all, so it is enabled
# explicitly. The --enable-lms option is comma-separated and selects the
# build variant and hash/parameter families:
# (default) SHA-256/256 parameter sets, sign + verify
# verify-only -> WOLFSSL_LMS_VERIFY_ONLY (wolfJCE production posture)
# small -> WOLFSSL_WC_LMS_SMALL (low-memory, slower codepath)
# sha256-192 -> WOLFSSL_LMS_SHA256_192 (RFC 9858 SHA-256/192 sets)
# shake256 -> WOLFSSL_LMS_SHAKE256 (RFC 9858 SHAKE256 sets)
# The LMS JUnit tests skip per hash family not compiled in (the JNI import
# returns NOT_COMPILED_IN), so each permutation runs the KATs it can and
# skips the rest. SHAKE parameter sets additionally require --enable-sha3.
linux-zulu-lms:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11', '21', '24' ]
wolfssl_configure:
- '--enable-jni --enable-lms'
- '--enable-jni --enable-lms=verify-only'
- '--enable-jni --enable-lms=verify-only,small'
- '--enable-jni --enable-lms=sha256-192,shake256 --enable-sha3'
- '--enable-jni --enable-all --enable-lms'
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# ----------------------- SLH-DSA (FIPS 205) --------------------------
# SLH-DSA provides full keygen/sign/verify in wolfJCE and requires wolfSSL
# to be built with --enable-slhdsa. It is not pulled in by --enable-all.
# The --enable-slhdsa option is comma-separated:
# (default/yes) the six SHAKE parameter sets (128s/128f/192s/192f/
# 256s/256f), full keygen + sign + verify
# sha2 -> adds the six SHA2 parameter sets (SLH-DSA-SHA2-*)
# 128f, sha2-128f, ... -> select individual parameter sets
# small -> WOLFSSL_WC_SLHDSA_SMALL (low-memory codepath)
# small-mem -> WOLFSSL_WC_SLHDSA_SMALL_MEM (lower-memory codepath)
# verify-only -> WOLFSSL_SLHDSA_VERIFY_ONLY (no keygen/sign)
# Extra options do not imply 'yes': parameter sets must be selected via
# 'yes', 'sha2', or per-set tokens, otherwise no set is compiled in and
# native wolfSSL fails to build ("No parameters defined"). SHAKE256/SHA-3
# dependencies are auto-enabled by wolfSSL configure, so no --enable-sha3
# is needed. JUnit tests probe per parameter set and per capability, so
# each permutation runs what it can and skips the rest. Permutations:
# default SHAKE-only, all 12 sets, all 12 + small codepath, a reduced
# per-set selection + small-mem codepath, verify-only degradation, and
# --enable-all interop.
linux-zulu-slhdsa:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '11', '21', '24' ]
wolfssl_configure:
- '--enable-jni --enable-slhdsa'
- '--enable-jni --enable-slhdsa=yes,sha2'
- '--enable-jni --enable-slhdsa=yes,sha2,small'
- '--enable-jni --enable-slhdsa=128f,sha2-128f,small-mem'
- '--enable-jni --enable-slhdsa=yes,sha2,verify-only'
- '--enable-jni --enable-all --enable-slhdsa=yes,sha2'
name: ${{ matrix.os }} (Zulu JDK ${{ matrix.jdk_version }}, ${{ matrix.wolfssl_configure }})
uses: ./.github/workflows/linux-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# ------------------ Facebook Infer static analysis -------------------
# Run Facebook Infer over the Java sources, only running on Linux with
# one JDK/version for now. Infer only compiles the .java files with
# javac, so no native wolfSSL build or test run is needed here. Tests
# for the equivalent configuration run in linux-zulu-all above.
fb-infer:
strategy:
matrix:
os: [ 'ubuntu-latest' ]
jdk_version: [ '11' ]
name: Facebook Infer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
uses: ./.github/workflows/infer.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
# --------------------- Maven build - test pom.xml --------------------
# Run Maven build over PR code, running on Linux and Mac with only one
# JDK/version for now.
maven-build:
strategy:
matrix:
os: [ 'ubuntu-latest', 'macos-latest' ]
jdk_version: [ '21' ]
wolfssl_configure: [ '--enable-jni' ]
name: Maven Build (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
uses: ./.github/workflows/maven.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# --------------- AddressSanitizer build and test ------------------
# Run AddressSanitizer build and test on Linux only for memory error detection
address-sanitizer:
strategy:
matrix:
os: [ 'ubuntu-latest' ]
jdk_version: [ '21' ]
wolfssl_configure: [ '--enable-jni' ]
name: AddressSanitizer (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
uses: ./.github/workflows/sanitizer-common.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
wolfssl_configure: ${{ matrix.wolfssl_configure }}
# --------------- Filtered providers (native-free) -----------------
# Build/test the filtered-providers ant targets and Maven profile.
# JDK 8 added to verify it skips building filtered providers.
filtered-providers:
strategy:
matrix:
os: [ 'ubuntu-latest' ]
jdk_version: [ '8', '11', '17', '21', '24', '25' ]
name: Filtered Providers (${{ matrix.os }} Zulu JDK ${{ matrix.jdk_version }})
uses: ./.github/workflows/filtered-providers.yml
with:
os: ${{ matrix.os }}
jdk_distro: "zulu"
jdk_version: ${{ matrix.jdk_version }}
# ----------------- Windows Visual Studio build --------------------
windows-build:
uses: ./.github/workflows/windows-vs.yml