crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

fips-check: use fips-hash.sh for the in core hash update

Browse Source 
Replace the inline hash scrape with a call to fips-hash.sh so the
digest detection and length check apply here too. A rejected hash now
stops the run instead of running make check against a bad verifyCore,
and make clean only runs when verifyCore actually changed.
This commit is contained in:
jackctj117
2026-10-15 14:20:59 -06:00
parent 2cdf44b253
commit 36754d7613
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
fips-check.sh
View File

@@ -672,14 +672,15 @@ if [ "$DOCONFIGURE" = "yes" ]; then
fi
if [ -s wolfcrypt/src/fips_test.c ]; then
# Take the hash exactly as long as reported: the in core digest is
# SHA-256 (64 hex) up to FIPS v6.0.0 and SHA-512 (128 hex) from v7.0.0.
NEWHASH=$(./wolfcrypt/test/testwolfcrypt | \
sed -n 's/^hash = \([0-9A-Fa-f][0-9A-Fa-f]*\).*$/\1/p' | head -1)
if [ -n "$NEWHASH" ]; then
cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak
sed "s/^\".*\";/\"${NEWHASH}\";/" wolfcrypt/src/fips_test.c.bak > \
wolfcrypt/src/fips_test.c
# fips-hash.sh matches the reported hash to the in core digest that
# fips_test.c expects (SHA-256 up to FIPS v6.0.0, SHA-512 from v7.0.0)
# and refuses to write one of the wrong length.
OLDHASH=$(grep '^".*";' wolfcrypt/src/fips_test.c)
if ! ./fips-hash.sh; then
echo 'fips-check: Hash update failed. Debris left for analysis.'
exit 3
fi
if [ "$OLDHASH" != "$(grep '^".*";' wolfcrypt/src/fips_test.c)" ]; then
make clean
fi
fi