mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-18 09:31:38 +02:00
Tobias Frauenschläger
9a788724d7
pq-all and trackmemory restore a seed ccache that already sits at its cap, so every object a run compiles evicts a seeded one that is still needed. Both reported a cache 100% full with over 200 cleanups and a 43-44% hit rate, and their configs took 3-5x their warm time. That left pq-all shards finishing at 23-26 min against a 30 min limit: a healthy shard passed with 5.6 min to spare, so any hiccup ahead of the build took the job down. One did, twice, when the prebuilt deb image came up short and the dependency step fell back to apt for 9.7 min - the only two jobs out of 47 whose install ran past 2 min are the only two that timed out. Size both caches to hold the seeded objects and a run's own alongside them, and widen the limits so a slow install is survivable. Raise the trackmemory limit as well, for a different reason: its wolfEntropy configs have overrun it outright, once with six configs done inside 8 min while all-wolfentropy ran on for another 32. That is a stall rather than a slow run - 91 jobs have a 17.2 min median and a 17.9 min p90, with nothing between 18 min and the cap - so the higher limit is headroom, not a fix. It costs nothing on a healthy run. Recalibrate "minutes", which drives longest-first scheduling and shard balancing. pq-all and fips-dev-no-post had drifted several-fold in both directions: two frodokem cross-builds were declared at 4 min but take 0.3, so the pool kept scheduling them first as its longest work. pq-all is calibrated from runs whose ccache actually hit, which the resized cache makes the normal case; a value read off a cold run makes every warm run warn instead. os-check-linux was already calibrated cold and correct, so only its three genuine outliers change. Both config lists are re-sorted to restore the documented descending order, so most of their diff is a mechanical move rather than a value change. Shard totals come out at 29.4/29.6 for pq-all and 76.9-77.7 across the four os-check shards.
165 lines
8.1 KiB
YAML
165 lines
8.1 KiB
YAML
name: FIPS dev-no-POST tests
|
|
|
|
# --enable-fips=dev-no-post builds with FIPS-like settings but none of the fips
|
|
# repo content: no POST, no CASTs, no optest, and no fips.c wrappers (hence
|
|
# FIPS_NO_WRAPPERS). That makes the FIPS-conditional code in the regular
|
|
# sources buildable and testable on ordinary master, where the fips repo is
|
|
# absent. It also tests for consistency in behavior/error codes between the
|
|
# wrappers and the underlying implementations, because all callers (particularly
|
|
# unit.test) expect FIPS behavior.
|
|
|
|
# START OF COMMON SECTION
|
|
on:
|
|
push:
|
|
branches: [ 'release/**' ]
|
|
# Docs-only changes cannot affect the build/test matrix - skip the
|
|
# run for them. Keep this list narrow (markdown + doc/ only);
|
|
# do not add cert/test data extensions here.
|
|
paths-ignore:
|
|
- '**/*.md'
|
|
- 'doc/**'
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
branches: [ '*' ]
|
|
paths-ignore:
|
|
- '**/*.md'
|
|
- 'doc/**'
|
|
# Weekday-morning cron (10:00 UTC) seeds the master-scoped ccache that PR runs
|
|
# restore: re-runs --build-only (compile only, no tests) on the
|
|
# default branch. PR runs are read-only (see ccache-setup).
|
|
schedule:
|
|
- cron: '38 10 * * 1-5'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
# END OF COMMON SECTION
|
|
|
|
jobs:
|
|
# All former runner-per-config matrix entries build on one runner via
|
|
# .github/scripts/parallel-make-check.py (see os-check.yml for the full
|
|
# pattern): each config builds in its own out-of-tree ("VPATH") build
|
|
# directory off one checkout/autogen, on a pool of one-per-CPU worker
|
|
# threads, longest first.
|
|
build_library:
|
|
name: build library/module
|
|
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
|
|
runs-on: ubuntu-24.04
|
|
# Generous for a cold ccache; warm reruns finish in a fraction. The
|
|
# wall is set by kernel-settings-all-pqc-asm, the one config no other
|
|
# thread can overlap once the rest are done: it alone has been measured
|
|
# at 23 min on a cold cache, against a 23 min job total.
|
|
timeout-minutes: 40
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
name: Checkout wolfSSL
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/install-apt-deps
|
|
with:
|
|
packages: autoconf automake libtool build-essential linux-headers-$(uname -r)
|
|
ghcr-debs-tag: ubuntu-24.04-linuxkm
|
|
|
|
- name: Set up ccache
|
|
uses: ./.github/actions/ccache-setup
|
|
with:
|
|
workflow-id: fips-dev-no-post
|
|
read-only: ${{ github.event_name == 'pull_request' }}
|
|
max-size: 500M
|
|
|
|
- name: Prepare target kernel for module builds
|
|
run: |
|
|
echo "preparing target kernel $(uname -r)"
|
|
pushd "/lib/modules/$(uname -r)/build" || $(exit 4)
|
|
if [ -f /proc/config.gz ]; then gzip -dc /proc/config.gz > /tmp/.config && sudo mv /tmp/.config . || $(exit 5); elif [ -f "/boot/config-$(uname -r)" ]; then sudo cp -p "/boot/config-$(uname -r)" .config || $(exit 6); fi
|
|
sudo make -j 4 olddefconfig || $(exit 7)
|
|
sudo make M="$(pwd)" modules_prepare || $(exit 8)
|
|
popd >/dev/null
|
|
|
|
- name: autogen.sh
|
|
run: |
|
|
./autogen.sh || $(exit 9)
|
|
|
|
# "base" carries flags appropriate for every config; its "configure" list
|
|
# is prepended to each config's own. KERNEL_EXTRA_CFLAGS_REMOVE and
|
|
# FORCE_NO_MODULE_SIG go in the environment rather than the JSON because
|
|
# the pool builds with a bare "make" (no way to add variables to that
|
|
# command line); make picks them up from the environment, and they are
|
|
# inert for the non-linuxkm configs. Note the heredoc is unquoted so
|
|
# $(uname -r) and $FUZZING_SEED expand -- there are no other $ or
|
|
# backticks in the JSON.
|
|
- name: Build all configs (parallel, out-of-tree)
|
|
env:
|
|
KERNEL_EXTRA_CFLAGS_REMOVE: -pg
|
|
FORCE_NO_MODULE_SIG: 1
|
|
run: |
|
|
FUZZING_SEED=$(( (RANDOM << 15) ^ RANDOM ))
|
|
echo "FUZZING_SEED=$FUZZING_SEED"
|
|
if [ -n "$GITHUB_STEP_SUMMARY" ]; then echo "FUZZING_SEED=$FUZZING_SEED" >> "$GITHUB_STEP_SUMMARY"; fi
|
|
cat > "$RUNNER_TEMP/fips-dev-no-post-configs.json" <<EOF
|
|
{"base": {"configure": ["--enable-fips=dev-no-post",
|
|
"--with-linux-source=/lib/modules/$(uname -r)/build",
|
|
"EXTRA_CPPFLAGS=-Werror"]},
|
|
"configs": [
|
|
{"name": "default", "minutes": 6,
|
|
"configure": ["CPPFLAGS=-pedantic"]},
|
|
{"name": "all-asm-sp", "minutes": 2.5,
|
|
"configure": ["CPPFLAGS=-pedantic", "--enable-all-asm", "--enable-sp"]},
|
|
{"name": "all", "minutes": 6,
|
|
"configure": ["CPPFLAGS=-pedantic", "--enable-all"]},
|
|
{"name": "all-nodh-extiv", "minutes": 6,
|
|
"comment": "DH out of the boundary in v7; one-shot AES-GCM ext IV allowed",
|
|
"configure": ["--enable-all", "--disable-dh",
|
|
"CPPFLAGS=-pedantic -DWC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED -DWC_FIPS_AESGCM_NO_SHORT_NONCES"]},
|
|
{"name": "all-pqc-asm-fallback-fuzzer", "minutes": 8,
|
|
"configure": ["--enable-all", "--enable-sp", "--enable-experimental", "--enable-all-quantum-crypto",
|
|
"CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]},
|
|
{"name": "kernel-settings", "minutes": 9.5,
|
|
"configure": ["--enable-kernel-settings", "--enable-dh",
|
|
"CPPFLAGS=-pedantic"]},
|
|
{"name": "kernel-settings-all-pqc-asm", "minutes": 17,
|
|
"configure": ["--enable-kernel-settings", "--enable-all", "--enable-experimental", "--enable-all-quantum-crypto",
|
|
"--enable-all-asm", "--enable-sp",
|
|
"CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]}
|
|
]}
|
|
EOF
|
|
# out-of-tree kernel module builds not working yet:
|
|
# {"name": "linuxkm", "minutes": 4,
|
|
# "comment": "module build; check=false (no host-side test suite), and the ls proves the .ko landed in the VPATH build dir",
|
|
# "check": false,
|
|
# "run": [["ls", "-l", "linuxkm/libwolfssl.ko"]],
|
|
# "configure": ["--enable-linuxkm",
|
|
# "--enable-linuxkm-lkcapi-register=all", "--enable-crypttests",
|
|
# "--enable-linuxkm-benchmarks", "--with-max-rsa-bits=16384",
|
|
# "CFLAGS=-Wframe-larger-than=2048 -Wstack-usage=4096 -DBENCH_EMBEDDED -DBENCH_MIN_RUNTIME_SEC=0.01 -DBENCH_NTIMES=1 -DBENCH_AGREETIMES=1"]},
|
|
# {"name": "linuxkm-all-asm", "minutes": 6,
|
|
# "check": false,
|
|
# "run": [["ls", "-l", "linuxkm/libwolfssl.ko"]],
|
|
# "configure": ["--enable-linuxkm",
|
|
# "--enable-linuxkm-lkcapi-register=all", "--enable-all",
|
|
# "--enable-all-asm", "--enable-crypttests",
|
|
# "--enable-linuxkm-benchmarks", "--with-max-rsa-bits=16384",
|
|
# "CFLAGS=-Wframe-larger-than=2048 -Wstack-usage=4096 -DBENCH_EMBEDDED -DBENCH_MIN_RUNTIME_SEC=0.01 -DBENCH_NTIMES=1 -DBENCH_AGREETIMES=1"]}
|
|
.github/scripts/parallel-make-check.py \
|
|
${{ github.event_name == 'schedule' && '--build-only' || '' }} \
|
|
"$RUNNER_TEMP/fips-dev-no-post-configs.json"
|
|
|
|
- name: ccache stats
|
|
if: always()
|
|
run: ccache -s || true
|
|
|
|
- name: Upload logs on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
retention-days: 7
|
|
name: dev-no-POST-logs
|
|
path: |
|
|
build-*/make-check.log
|
|
build-*/test-suite.log
|
|
build-*/config.log
|
|
if-no-files-found: ignore
|