diff --git a/fips-check.sh b/fips-check.sh index dd2029c83..bd4d516b8 100755 --- a/fips-check.sh +++ b/fips-check.sh @@ -9,27 +9,6 @@ # This should check out all the approved flavors. The command line # option selects the flavor. The keep option keeps the output # directory. -# -# Some variables may be overridden on the command line. - -Usage() { - cat </dev/null + then + $GIT branch --no-track "my$tag" "$tag" || exit $? + fi + $GIT checkout "my$tag" -- "$name" || exit $? + done +} + +# copy_fips_files takes an array of pairs of file paths and git tags to +# checkout. It will check to see if mytag exists and if now will make that +# tag a branch. It breaks the filepath apart into file name and path, then +# copies it from the file from the fips directory to the path. +function copy_fips_files() { + local name + local bname + local dname + local tag + for file_entry in "$@" + do + name=${file_entry%%:*} + tag=${file_entry#*:} + bname=$(basename "$name") + dname=$(dirname "$name") + if ! $GIT rev-parse -q --verify "my$tag" >/dev/null + then + $GIT branch --no-track "my$tag" "$tag" || exit $? + fi + $GIT checkout "my$tag" -- "$bname" || exit $? + cp "$bname" "../$dname" + done +} + if ! $GIT clone . "$TEST_DIR"; then echo "fips-check: Couldn't duplicate current working directory." exit 1 @@ -128,80 +262,16 @@ fi pushd "$TEST_DIR" || exit 2 -case "$FIPS_OPTION" in - -*dev) - echo "Don't need to copy in tagged wolfCrypt files for fips-dev." - ;; - -*ready) - echo "Don't need to copy in tagged wolfCrypt files for FIPS Ready." - ;; - -cavp-selftest*|v2|rand|v5*) - $GIT branch --no-track "my$CRYPT_VERSION" "$CRYPT_VERSION" || exit $? - # Checkout the fips versions of the wolfCrypt files from the repo. - for MOD in "${WC_MODS[@]}" - do - if [ -f "$CRYPT_SRC_PATH/$MOD.c" ]; then - $GIT checkout "my$CRYPT_VERSION" -- "$CRYPT_SRC_PATH/$MOD.c" || exit $? - fi - # aes_asm.S, sha256_asm.S sha512_asm.S - if [ -f "$CRYPT_SRC_PATH/$MOD.S" ]; then - echo "Checking out asm file: $MOD.S" - $GIT checkout "my$CRYPT_VERSION" -- "$CRYPT_SRC_PATH/$MOD.S" || exit $? - fi - # aes_asm.asm - if [ -f "$CRYPT_SRC_PATH/$MOD.asm" ]; then - echo "Checking out asm file: $MOD.asm" - $GIT checkout "my$CRYPT_VERSION" -- "$CRYPT_SRC_PATH/$MOD.asm" || exit $? - fi - if [ -f "$CRYPT_INC_PATH/$MOD.h" ]; then - $GIT checkout "my$CRYPT_VERSION" -- "$CRYPT_INC_PATH/$MOD.h" || exit $? - fi - done - - for MOD in "${COPY_DIRECT[@]}" - do - $GIT checkout "my$CRYPT_VERSION" -- "$MOD" || exit $? - done - - $GIT branch --no-track "myrng$RNG_VERSION" "$RNG_VERSION" || exit $? - # Checkout the fips versions of the wolfCrypt files from the repo. - $GIT checkout "myrng$RNG_VERSION" -- "$CRYPT_SRC_PATH/random.c" "$CRYPT_INC_PATH/random.h" || exit $? - ;; - -*) - echo "fips-check: Invalid FIPS option \"${FIPS_OPTION}\"." +if ! $GIT clone "$FIPS_REPO" fips +then + echo "fips-check: Couldn't check out FIPS repository." exit 1 - ;; -esac +fi -# clone the FIPS repository -case "$FIPS_OPTION" in -*dev) - if ! $GIT clone --depth 1 "$FIPS_REPO" fips; then - echo "fips-check: Couldn't check out the FIPS repository for fips-dev." - exit 1 - fi - ;; -*) - if ! $GIT clone --depth 1 -b "$FIPS_VERSION" "$FIPS_REPO" fips; then - echo "fips-check: Couldn't check out ${FIPS_VERSION} from repository ${FIPS_REPO}." - exit 1 - fi - ;; -esac - -for SRC in "${FIPS_SRCS[@]}" -do - cp "fips/$SRC" "$CRYPT_SRC_PATH" -done - -for INC in "${FIPS_INCS[@]}" -do - cp "fips/$INC" "$CRYPT_INC_PATH" -done +checkout_files "${WOLFCRYPT_FILES[@]}" || exit 3 +pushd fips || exit 2 +copy_fips_files "${FIPS_FILES[@]}" || exit 3 +popd || exit 2 # When checking out cert 3389 ready code, NIST will no longer perform # new certifications on 140-2 modules. If we were to use the latest files from @@ -209,11 +279,10 @@ done # Since OE additions can still be processed for cert3389 we will call 140-2 # ready "fipsv2-OE-ready" indicating it is ready to use for an OE addition but # would not be good for a new certification effort with the latest files. -if [ "$FLAVOR" = 'fipsv2-OE-ready' ]; then - OLD_VERSION=" return \"v4.0.0-alpha\";" - OE_READY_VERSION=" return \"fipsv2-OE-ready\";" - cp "${CRYPT_SRC_PATH}/fips.c" "${CRYPT_SRC_PATH}/fips.c.bak" - sed "s/^${OLD_VERSION}/${OE_READY_VERSION}/" "${CRYPT_SRC_PATH}/fips.c.bak" >"${CRYPT_SRC_PATH}/fips.c" +if [ "$FLAVOR" = 'fipsv2-OE-ready' ] && [ -s wolfcrypt/src/fips.c ] +then + cp wolfcrypt/src/fips.c wolfcrypt/src/fips.c.bak + sed "s/v4.0.0-alpha/fipsv2-OE-ready/" wolfcrypt/src/fips.c.bak >wolfcrypt/src/fips.c fi # run the make test @@ -233,29 +302,29 @@ esac if ! $MAKE then - echo "fips-check: Make failed. Debris left for analysis." + echo 'fips-check: Make failed. Debris left for analysis.' exit 3 fi -if [ -s "${CRYPT_SRC_PATH}/fips_test.c" ] +if [ -s wolfcrypt/src/fips_test.c ] then NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p') if [ -n "$NEWHASH" ]; then - cp "${CRYPT_SRC_PATH}/fips_test.c" "${CRYPT_SRC_PATH}/fips_test.c.bak" - sed "s/^\".*\";/\"${NEWHASH}\";/" "${CRYPT_SRC_PATH}/fips_test.c.bak" >"${CRYPT_SRC_PATH}/fips_test.c" + cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak + sed "s/^\".*\";/\"${NEWHASH}\";/" wolfcrypt/src/fips_test.c.bak >wolfcrypt/src/fips_test.c make clean fi fi if ! $MAKE check then - echo "fips-check: Test failed. Debris left for analysis." + echo 'fips-check: Test failed. Debris left for analysis.' exit 3 fi # Clean up popd || exit 2 -if [ "$KEEP" = "no" ]; +if [ "$KEEP" = 'no' ]; then rm -rf "$TEST_DIR" fi