mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-18 15:43:26 +02:00
Merge pull request #11098 from Frauschi/script_fix
Fix CI flakes from ccache saturation and stale schedule estimates
This commit is contained in:
David Garske
@@ -1,4 +1,9 @@
|
||||
[
|
||||
{"name": "user-settings-all-compat", "minutes": 9.5,
|
||||
"comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
|
||||
"user_settings": "examples/configs/user_settings_all.h",
|
||||
"cflags": "",
|
||||
"configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
|
||||
{"name": "all-no-client-auth", "minutes": 9.0,
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
|
||||
{"name": "all-dilithium-cryptocb", "minutes": 8.9,
|
||||
@@ -6,8 +11,6 @@
|
||||
"--enable-cryptocbutils", "--enable-pkcallbacks"]},
|
||||
{"name": "all-haproxy-quic", "minutes": 8.6,
|
||||
"configure": ["--enable-all", "--enable-haproxy", "--enable-quic"]},
|
||||
{"name": "all-asn-template", "minutes": 8.5,
|
||||
"configure": ["--enable-all", "--enable-asn=template"]},
|
||||
{"name": "all-asn-template-old-oid-sum", "minutes": 8.5,
|
||||
"configure": ["--enable-all", "--enable-asn=template", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
|
||||
{"name": "all-asn-original-old-oid-sum", "minutes": 8.4,
|
||||
@@ -30,11 +33,11 @@
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]},
|
||||
{"name": "all-hash-keep", "minutes": 7.8,
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]},
|
||||
{"name": "all-no-aes-192-256", "minutes": 7.5,
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]},
|
||||
{"name": "all-no-pkcs7-stream", "minutes": 7.0,
|
||||
"comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.",
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]},
|
||||
{"name": "all-no-aes-192-256", "minutes": 7.5,
|
||||
"configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]},
|
||||
{"name": "all-writedup", "minutes": 6.9,
|
||||
"configure": ["--enable-all", "--enable-writedup"]},
|
||||
{"name": "all-no-server", "minutes": 5.0,
|
||||
@@ -55,6 +58,8 @@
|
||||
"configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
|
||||
"--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
|
||||
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM"]},
|
||||
{"name": "all-asn-template", "minutes": 3.5,
|
||||
"configure": ["--enable-all", "--enable-asn=template"]},
|
||||
{"name": "tls13-dtls13-session-misc", "minutes": 3.3,
|
||||
"configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls",
|
||||
"--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts",
|
||||
@@ -66,11 +71,10 @@
|
||||
{"name": "dtls13-ocspstapling-cert-cb", "minutes": 3.1,
|
||||
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-ocspstapling",
|
||||
"--enable-ocspstapling2", "--enable-cert-setup-cb", "--enable-sessioncerts"]},
|
||||
{"name": "user-settings-all-compat", "minutes": 3.0,
|
||||
"comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
|
||||
"user_settings": "examples/configs/user_settings_all.h",
|
||||
"cflags": "",
|
||||
"configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
|
||||
{"name": "tsp-verifier", "minutes": 3,
|
||||
"comment": "Time-Stamp Protocol Verifier",
|
||||
"configure": ["--enable-tsp", "--enable-opensslall",
|
||||
"CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]},
|
||||
{"name": "dtls13-earlydata-psk-no-hrr", "minutes": 2.9,
|
||||
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-earlydata",
|
||||
"--enable-session-ticket", "--enable-psk", "CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME"]},
|
||||
@@ -80,6 +84,10 @@
|
||||
{"name": "dtls-records-span-datagrams", "minutes": 2.7,
|
||||
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch",
|
||||
"--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]},
|
||||
{"name": "tsp-min-hash-str", "minutes": 2.7,
|
||||
"comment": "Time-Stamp Protocol Minimum 128-bit hash strength",
|
||||
"configure": ["--enable-tsp",
|
||||
"CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]},
|
||||
{"name": "opensslextra-no-ca-names", "minutes": 2.6,
|
||||
"configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_CA_NAMES"]},
|
||||
{"name": "sessionexport-dtls13", "minutes": 2.6,
|
||||
@@ -215,10 +223,6 @@
|
||||
{"name": "tsp-smallstack", "minutes": 1.3,
|
||||
"comment": "Time-Stamp Protocol Small Stack",
|
||||
"configure": ["--enable-tsp", "CPPFLAGS=-DWOLFSSL_SMALL_STACK"]},
|
||||
{"name": "tsp-min-hash-str", "minutes": 2.7,
|
||||
"comment": "Time-Stamp Protocol Minimum 128-bit hash strength",
|
||||
"configure": ["--enable-tsp",
|
||||
"CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]},
|
||||
{"name": "tsp-requester", "minutes": 1.3,
|
||||
"comment": "Time-Stamp Protocol Requester",
|
||||
"configure": ["--enable-tsp", "--enable-opensslall",
|
||||
@@ -227,10 +231,6 @@
|
||||
"comment": "Time-Stamp Protocol Responder",
|
||||
"configure": ["--enable-tsp", "--enable-opensslall",
|
||||
"CPPFLAGS=-DWOLFSSL_TSP_RESPONDER"]},
|
||||
{"name": "tsp-verifier", "minutes": 1.3,
|
||||
"comment": "Time-Stamp Protocol Verifier",
|
||||
"configure": ["--enable-tsp", "--enable-opensslall",
|
||||
"CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]},
|
||||
{"name": "no-tls-cryptocb-aesgcm-setkey-free", "minutes": 1.3,
|
||||
"configure": ["--disable-tls", "--enable-cryptocb", "--enable-aesgcm",
|
||||
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
|
||||
@@ -304,22 +304,6 @@
|
||||
"user_settings": "examples/configs/user_settings_wolftpm.h",
|
||||
"cflags": "",
|
||||
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
||||
{"name": "no-wolfssl-server", "minutes": 0.9,
|
||||
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
||||
{"name": "dtls13-client-minimal", "minutes": 0.9,
|
||||
"comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.",
|
||||
"configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa",
|
||||
"--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5",
|
||||
"--disable-chacha", "--disable-poly1305", "--disable-errorstrings",
|
||||
"--disable-asn-print", "--disable-eccshamir", "--disable-base64encode",
|
||||
"--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384",
|
||||
"--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
|
||||
"--enable-sp=smallec256", "--disable-sp-asm",
|
||||
"CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
|
||||
{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
|
||||
"configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
|
||||
{"name": "no-examples-no-malloc", "minutes": 0.8,
|
||||
"configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]},
|
||||
{"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs",
|
||||
"name": "no-asn-strict-certs",
|
||||
"configure": ["--enable-testcert", "--enable-opensslextra", "--enable-certgen",
|
||||
@@ -336,5 +320,21 @@
|
||||
{"name": "x509-tiny-addbacks",
|
||||
"comment": "TINY profile with extension add-backs enabled directly.",
|
||||
"configure": ["--enable-ecc",
|
||||
"CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]}
|
||||
"CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]},
|
||||
{"name": "no-wolfssl-server", "minutes": 0.9,
|
||||
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
||||
{"name": "dtls13-client-minimal", "minutes": 0.9,
|
||||
"comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.",
|
||||
"configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa",
|
||||
"--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5",
|
||||
"--disable-chacha", "--disable-poly1305", "--disable-errorstrings",
|
||||
"--disable-asn-print", "--disable-eccshamir", "--disable-base64encode",
|
||||
"--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384",
|
||||
"--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
|
||||
"--enable-sp=smallec256", "--disable-sp-asm",
|
||||
"CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
|
||||
{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
|
||||
"configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
|
||||
{"name": "no-examples-no-malloc", "minutes": 0.8,
|
||||
"configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]}
|
||||
]
|
||||
|
||||
+86
-86
@@ -1,5 +1,5 @@
|
||||
[
|
||||
{"name": "all-pq-small-noasm", "minutes": 4,
|
||||
{"name": "all-pq-small-noasm", "minutes": 8,
|
||||
"configure": ["--disable-intelasm", "--enable-all",
|
||||
"--enable-testcert", "--enable-acert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
@@ -9,7 +9,7 @@
|
||||
"--enable-slhdsa=yes,small", "--enable-dilithium=yes,small",
|
||||
"--enable-dual-alg-certs", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_MLDSA_SIGN_SMALL_MEM -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_MAKE_KEY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]},
|
||||
{"name": "all-pq-small-smallstack-noasm", "minutes": 4,
|
||||
{"name": "all-pq-small-smallstack-noasm", "minutes": 7.5,
|
||||
"configure": ["--disable-intelasm", "--enable-smallstack",
|
||||
"--enable-smallstackcache", "--enable-all", "--enable-testcert",
|
||||
"--enable-acert", "--enable-dtls13", "--enable-dtls-mtu",
|
||||
@@ -61,21 +61,6 @@
|
||||
"--enable-lms", "--enable-xmss", "--enable-slhdsa",
|
||||
"--enable-dilithium", "--enable-dual-alg-certs", "--disable-qt",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-pq-verify-only-noasm", "minutes": 3,
|
||||
"configure": ["--disable-intelasm", "--enable-all",
|
||||
"--disable-mlkem", "--enable-lms=yes,small,verify-only",
|
||||
"--enable-xmss=yes,small,verify-only",
|
||||
"--enable-slhdsa=yes,small,verify-only",
|
||||
"--enable-dilithium=yes,small,verify-only", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]},
|
||||
{"name": "slhdsa-sha2-only", "minutes": 2,
|
||||
"comment": "SHA2-only SLH-DSA build (SHAKE family disabled) across all 128/192/256 SHA2 parameter sets. A SHAKE-off build must still size the FORS/XMSS buffers for the 192/256-bit SHA2 parameters via the combined SLHDSA_ALL_NO_* maxima guards rather than collapsing to the 128-bit level; running the SHA2-256 sign/verify tests exercises that sizing.",
|
||||
"configure": ["--enable-slhdsa=sha2", "--enable-testcert"]},
|
||||
{"name": "pq-asynccrypt-dual-alg", "minutes": 2,
|
||||
"comment": "Async crypto with dual-algorithm certs and PQC signatures. WOLFSSL_ASYNC_CRYPT turns off the streaming CertificateVerify path, so this is the only config that compiles the in-place fragmented send and the async args holder that Scv13Args must fit.",
|
||||
"configure": ["--enable-asynccrypt-sw", "--enable-dual-alg-certs",
|
||||
"--enable-slhdsa", "--enable-dilithium", "--enable-experimental",
|
||||
"--enable-testcert"]},
|
||||
{"name": "all-pq-mldsa-no-ctx", "minutes": 3,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-acert",
|
||||
@@ -86,93 +71,61 @@
|
||||
"--enable-dilithium=yes,no-ctx", "--enable-dual-alg-certs",
|
||||
"--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-frodokem", "minutes": 3.5,
|
||||
{"name": "pq-asynccrypt-dual-alg", "minutes": 2.5,
|
||||
"comment": "Async crypto with dual-algorithm certs and PQC signatures. WOLFSSL_ASYNC_CRYPT turns off the streaming CertificateVerify path, so this is the only config that compiles the in-place fragmented send and the async args holder that Scv13Args must fit.",
|
||||
"configure": ["--enable-asynccrypt-sw", "--enable-dual-alg-certs",
|
||||
"--enable-slhdsa", "--enable-dilithium", "--enable-experimental",
|
||||
"--enable-testcert"]},
|
||||
{"name": "all-pq-verify-only-noasm", "minutes": 2,
|
||||
"configure": ["--disable-intelasm", "--enable-all",
|
||||
"--disable-mlkem", "--enable-lms=yes,small,verify-only",
|
||||
"--enable-xmss=yes,small,verify-only",
|
||||
"--enable-slhdsa=yes,small,verify-only",
|
||||
"--enable-dilithium=yes,small,verify-only", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]},
|
||||
{"name": "slhdsa-sha2-only", "minutes": 2,
|
||||
"comment": "SHA2-only SLH-DSA build (SHAKE family disabled) across all 128/192/256 SHA2 parameter sets. A SHAKE-off build must still size the FORS/XMSS buffers for the 192/256-bit SHA2 parameters via the combined SLHDSA_ALL_NO_* maxima guards rather than collapsing to the 128-bit level; running the SHA2-256 sign/verify tests exercises that sizing.",
|
||||
"configure": ["--enable-slhdsa=sha2", "--enable-testcert"]},
|
||||
{"name": "all-frodokem", "minutes": 2,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-experimental",
|
||||
"--enable-mlkem=yes,kyber,ml-kem",
|
||||
"--enable-frodokem=aes,ephemeral", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "frodokem-small-smallstack-noasm", "minutes": 2.5,
|
||||
"configure": ["--disable-intelasm", "--enable-smallstack",
|
||||
"--enable-smallstackcache", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,small",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "frodokem-976-only-noasm", "minutes": 1.5,
|
||||
"comment": "976-only builds D=16 (q=2^16) alone; no-asm the C path",
|
||||
"configure": ["--disable-intelasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,no-640,no-1344",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "frodokem-640-shake-only", "minutes": 1.5,
|
||||
"comment": "640-only builds D=15 (q=2^15); shake-only, with asm",
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-experimental",
|
||||
"--enable-frodokem=no-976,no-1344,no-aes",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "frodokem-aarch64-armasm", "minutes": 4, "check": false,
|
||||
"cc": "ccache aarch64-linux-gnu-gcc",
|
||||
"comment": "Cross-build only (no ARM runner): catches ARM asm link/compile breaks. sve+sme+aes A-gen all live in the .S.",
|
||||
"configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
|
||||
"--enable-armasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
|
||||
{"name": "frodokem-aarch64-armasm-inline", "minutes": 4,
|
||||
"check": false, "cc": "ccache aarch64-linux-gnu-gcc",
|
||||
"comment": "Inline armasm: sve/sme/aes are .S-only, so they must fall back to NEON/C; guards the inline-asm link break.",
|
||||
"configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
|
||||
"--enable-armasm=inline", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
|
||||
{"name": "frodokem-arm32-armasm", "minutes": 4, "check": false,
|
||||
"cc": "ccache arm-linux-gnueabihf-gcc",
|
||||
"comment": "Cross-build only: AArch32 NEON matrix ops + AES-crypto A-gen.",
|
||||
"configure": ["--host=arm-linux-gnueabihf", "--enable-cryptonly",
|
||||
"--enable-armasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral", "--disable-examples"]},
|
||||
{"name": "ubsan-mldsa-mlkem", "minutes": 2.5,
|
||||
"configure": ["--disable-shared", "--enable-dilithium",
|
||||
"--enable-mlkem",
|
||||
"CFLAGS=-fsanitize=undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer",
|
||||
"LDFLAGS=-fsanitize=undefined",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_ALIGNMENT=4"]},
|
||||
{"name": "all-mlkem-512-standalone", "minutes": 2.5,
|
||||
{"name": "all-mlkem-512-standalone", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,512", "--enable-tls-mlkem-standalone",
|
||||
"--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-768", "minutes": 2.5,
|
||||
{"name": "all-mlkem-768", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,768", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-768-standalone", "minutes": 2.5,
|
||||
{"name": "all-mlkem-768-standalone", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone",
|
||||
"--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-768-standalone-no-hybrids", "minutes": 2.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone",
|
||||
"--disable-pqc-hybrids", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-1024", "minutes": 2.5,
|
||||
{"name": "all-mlkem-1024", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,1024", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-1024-standalone", "minutes": 2.5,
|
||||
{"name": "all-mlkem-1024-standalone", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,1024",
|
||||
"--enable-tls-mlkem-standalone", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "all-mlkem-1024-standalone-no-hybrids", "minutes": 2.5,
|
||||
{"name": "all-mlkem-1024-standalone-no-hybrids", "minutes": 1.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
@@ -180,33 +133,80 @@
|
||||
"--enable-tls-mlkem-standalone", "--disable-pqc-hybrids",
|
||||
"--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "mlkem-old-ids", "minutes": 1.2,
|
||||
{"name": "all-mlkem-768-standalone-no-hybrids", "minutes": 1.3,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-mlkem=yes,kyber,ml-kem",
|
||||
"CPPFLAGS=-DWOLFSSL_ML_KEM_USE_OLD_IDS"]},
|
||||
{"name": "mlkem-dynamic-keys", "minutes": 1.2,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-mlkem=yes,kyber,ml-kem,cache-a",
|
||||
"CPPFLAGS=-DWOLFSSL_MLKEM_DYNAMIC_KEYS"]},
|
||||
{"name": "mldsa-dynamic-keys", "minutes": 1.2,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-dilithium=yes", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]},
|
||||
{"name": "mldsa-small-dynamic-keys", "minutes": 1.2,
|
||||
"--enable-all", "--enable-testcert", "--enable-dtls13",
|
||||
"--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid",
|
||||
"--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone",
|
||||
"--disable-pqc-hybrids", "--disable-qt",
|
||||
"CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
|
||||
{"name": "frodokem-small-smallstack-noasm", "minutes": 1,
|
||||
"configure": ["--disable-intelasm", "--enable-smallstack",
|
||||
"--enable-smallstackcache", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,small",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "ubsan-mldsa-mlkem", "minutes": 1,
|
||||
"configure": ["--disable-shared", "--enable-dilithium",
|
||||
"--enable-mlkem",
|
||||
"CFLAGS=-fsanitize=undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer",
|
||||
"LDFLAGS=-fsanitize=undefined",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_ALIGNMENT=4"]},
|
||||
{"name": "frodokem-976-only-noasm", "minutes": 0.5,
|
||||
"comment": "976-only builds D=16 (q=2^16) alone; no-asm the C path",
|
||||
"configure": ["--disable-intelasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,no-640,no-1344",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "mldsa-small-dynamic-keys", "minutes": 0.5,
|
||||
"configure": ["--disable-intelasm", "--enable-dilithium=yes,small",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]},
|
||||
{"name": "mldsa-verify-only-dynamic-keys", "minutes": 1.2,
|
||||
{"name": "mldsa-verify-only-dynamic-keys", "minutes": 0.5,
|
||||
"configure": ["--disable-intelasm",
|
||||
"--enable-dilithium=44,65,87,verify-only",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]},
|
||||
{"name": "mldsa-no-asn1-opensslextra", "minutes": 1.2,
|
||||
{"name": "mldsa-no-asn1-opensslextra", "minutes": 0.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-dilithium=yes", "--enable-opensslextra",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]},
|
||||
{"name": "mldsa-no-asn1-fips204-draft-opensslextra", "minutes": 1.2,
|
||||
{"name": "mldsa-no-asn1-fips204-draft-opensslextra", "minutes": 0.5,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-dilithium=yes,draft", "--enable-opensslextra",
|
||||
"CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]},
|
||||
{"name": "pkcs7-mldsa-only", "minutes": 1.2,
|
||||
{"name": "frodokem-aarch64-armasm", "minutes": 0.4, "check": false,
|
||||
"cc": "ccache aarch64-linux-gnu-gcc",
|
||||
"comment": "Cross-build only (no ARM runner): catches ARM asm link/compile breaks. sve+sme+aes A-gen all live in the .S.",
|
||||
"configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
|
||||
"--enable-armasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
|
||||
{"name": "frodokem-arm32-armasm", "minutes": 0.4, "check": false,
|
||||
"cc": "ccache arm-linux-gnueabihf-gcc",
|
||||
"comment": "Cross-build only: AArch32 NEON matrix ops + AES-crypto A-gen.",
|
||||
"configure": ["--host=arm-linux-gnueabihf", "--enable-cryptonly",
|
||||
"--enable-armasm", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral", "--disable-examples"]},
|
||||
{"name": "frodokem-aarch64-armasm-inline", "minutes": 0.4,
|
||||
"check": false, "cc": "ccache aarch64-linux-gnu-gcc",
|
||||
"comment": "Inline armasm: sve/sme/aes are .S-only, so they must fall back to NEON/C; guards the inline-asm link break.",
|
||||
"configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
|
||||
"--enable-armasm=inline", "--enable-experimental",
|
||||
"--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
|
||||
{"name": "mlkem-old-ids", "minutes": 0.4,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-mlkem=yes,kyber,ml-kem",
|
||||
"CPPFLAGS=-DWOLFSSL_ML_KEM_USE_OLD_IDS"]},
|
||||
{"name": "mlkem-dynamic-keys", "minutes": 0.4,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-mlkem=yes,kyber,ml-kem,cache-a",
|
||||
"CPPFLAGS=-DWOLFSSL_MLKEM_DYNAMIC_KEYS"]},
|
||||
{"name": "mldsa-dynamic-keys", "minutes": 0.4,
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-dilithium=yes", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]},
|
||||
{"name": "frodokem-640-shake-only", "minutes": 0.3,
|
||||
"comment": "640-only builds D=15 (q=2^15); shake-only, with asm",
|
||||
"configure": ["--enable-intelasm", "--enable-sp-asm",
|
||||
"--enable-experimental",
|
||||
"--enable-frodokem=no-976,no-1344,no-aes",
|
||||
"CPPFLAGS=-Wdeclaration-after-statement"]},
|
||||
{"name": "pkcs7-mldsa-only", "minutes": 0.3,
|
||||
"comment": "PKCS#7 SignedData with ML-DSA as the only signature algorithm (no RSA, no ECC); guards the ML-DSA-only PKCS7 build path",
|
||||
"configure": ["--enable-cryptonly", "--enable-mldsa",
|
||||
"--enable-pkcs7", "--disable-rsa", "--disable-ecc"]}
|
||||
|
||||
@@ -48,8 +48,11 @@ jobs:
|
||||
name: build library/module
|
||||
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
|
||||
runs-on: ubuntu-24.04
|
||||
# Generous for a cold ccache; warm reruns finish in a fraction.
|
||||
timeout-minutes: 30
|
||||
# Generous for a cold ccache; warm reruns finish in a fraction. The
|
||||
# wall is set by kernel-settings-all-pqc-asm, the one config no other
|
||||
# thread can overlap once the rest are done: it alone has been measured
|
||||
# at 23 min on a cold cache, against a 23 min job total.
|
||||
timeout-minutes: 40
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
name: Checkout wolfSSL
|
||||
@@ -101,23 +104,23 @@ jobs:
|
||||
"--with-linux-source=/lib/modules/$(uname -r)/build",
|
||||
"EXTRA_CPPFLAGS=-Werror"]},
|
||||
"configs": [
|
||||
{"name": "default", "minutes": 7,
|
||||
{"name": "default", "minutes": 6,
|
||||
"configure": ["CPPFLAGS=-pedantic"]},
|
||||
{"name": "all-asm-sp", "minutes": 7,
|
||||
{"name": "all-asm-sp", "minutes": 2.5,
|
||||
"configure": ["CPPFLAGS=-pedantic", "--enable-all-asm", "--enable-sp"]},
|
||||
{"name": "all", "minutes": 16,
|
||||
{"name": "all", "minutes": 6,
|
||||
"configure": ["CPPFLAGS=-pedantic", "--enable-all"]},
|
||||
{"name": "all-nodh-extiv", "minutes": 16,
|
||||
{"name": "all-nodh-extiv", "minutes": 6,
|
||||
"comment": "DH out of the boundary in v7; one-shot AES-GCM ext IV allowed",
|
||||
"configure": ["--enable-all", "--disable-dh",
|
||||
"CPPFLAGS=-pedantic -DWC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED -DWC_FIPS_AESGCM_NO_SHORT_NONCES"]},
|
||||
{"name": "all-pqc-asm-fallback-fuzzer", "minutes": 22,
|
||||
{"name": "all-pqc-asm-fallback-fuzzer", "minutes": 8,
|
||||
"configure": ["--enable-all", "--enable-sp", "--enable-experimental", "--enable-all-quantum-crypto",
|
||||
"CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]},
|
||||
{"name": "kernel-settings", "minutes": 8,
|
||||
{"name": "kernel-settings", "minutes": 9.5,
|
||||
"configure": ["--enable-kernel-settings", "--enable-dh",
|
||||
"CPPFLAGS=-pedantic"]},
|
||||
{"name": "kernel-settings-all-pqc-asm", "minutes": 22,
|
||||
{"name": "kernel-settings-all-pqc-asm", "minutes": 17,
|
||||
"configure": ["--enable-kernel-settings", "--enable-all", "--enable-experimental", "--enable-all-quantum-crypto",
|
||||
"--enable-all-asm", "--enable-sp",
|
||||
"CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]}
|
||||
|
||||
@@ -37,8 +37,11 @@ jobs:
|
||||
shard: [1, 2]
|
||||
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
|
||||
runs-on: ubuntu-24.04
|
||||
# Generous for a cold ccache; warm reruns finish in a fraction.
|
||||
timeout-minutes: 30
|
||||
# Generous for a cold ccache; warm reruns finish in a fraction. The
|
||||
# margin is deliberately wide: the "Install dependencies" step has been
|
||||
# seen to spend 30 min pulling the cross-compilers from a slow archive
|
||||
# mirror, which used up the whole budget before a single config built.
|
||||
timeout-minutes: 45
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
name: Checkout wolfSSL
|
||||
@@ -56,7 +59,12 @@ jobs:
|
||||
with:
|
||||
workflow-id: pq-all
|
||||
config-hash: shard-${{ matrix.shard }}
|
||||
max-size: 350M
|
||||
# A shard restores a seed cache that already sits at the cap, so
|
||||
# every object this run compiles evicts one that is still needed:
|
||||
# at 350M a shard reported 223 cleanups and a 43% hit rate, and
|
||||
# configs took 3-5x their warm time. Size it to hold the seeded
|
||||
# objects and this run's alongside them.
|
||||
max-size: 700M
|
||||
# PRs read the cache the weekday seed writes; they never
|
||||
# save, so PR runs add nothing to the Actions cache.
|
||||
read-only: ${{ github.event_name == 'pull_request' }}
|
||||
@@ -78,6 +86,9 @@ jobs:
|
||||
# omit it for a new config (defaults to 1) and refresh later. The list
|
||||
# is kept sorted by minutes for readability, but the schedule sorts by
|
||||
# the values, not list order.
|
||||
# Take the figure from a run whose ccache actually hit: the same config
|
||||
# takes 3-5x longer when the cache is cold, so a value read off a cold
|
||||
# run makes every warm run warn that the estimate is stale.
|
||||
- name: Build and make check this shard's configs (parallel, out-of-tree)
|
||||
run: |
|
||||
.github/scripts/parallel-make-check.py \
|
||||
|
||||
@@ -35,8 +35,11 @@ jobs:
|
||||
runs-on: ubuntu-24.04
|
||||
# Typical runs finish in 13-16 min, but the wolfEntropy configs gather
|
||||
# entropy from CPU timing jitter, whose runtime varies severalfold with
|
||||
# runner contention (a 20-min limit was hit with one config left).
|
||||
timeout-minutes: 40
|
||||
# runner contention (a 20-min limit was hit with one config left, and
|
||||
# later a 40-min one: six configs were done inside 8 min while
|
||||
# all-wolfentropy ran on for another 32). Cheap to leave high - a
|
||||
# healthy run never approaches it.
|
||||
timeout-minutes: 60
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
name: Checkout wolfSSL
|
||||
@@ -54,7 +57,10 @@ jobs:
|
||||
with:
|
||||
workflow-id: trackmemory
|
||||
read-only: ${{ github.event_name == 'pull_request' }}
|
||||
max-size: 250M
|
||||
# 250M left the cache 100% full with 232 cleanups and a 44% hit
|
||||
# rate, i.e. evicting objects this same run still needed; the
|
||||
# configs then ran 2-3x their warm time.
|
||||
max-size: 450M
|
||||
|
||||
# Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor,
|
||||
# which would stop the test scripts from re-execing under
|
||||
|
||||
Reference in New Issue
Block a user