mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
606 lines
49 KiB
JSON
606 lines
49 KiB
JSON
[
|
|
{"name": "user-settings-all-compat", "minutes": 9.5,
|
|
"comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
|
|
"user_settings": "examples/configs/user_settings_all.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
|
|
{"name": "session-cache-ref", "minutes": 3.2,
|
|
"comment": "NO_SESSION_CACHE_REF is now the configure default, so --enable-session-cache-ref is the only way back onto the client cache reference path and the generation check on it is covered nowhere else. savesession adds the persistence paths that restore those generations.",
|
|
"configure": ["--enable-opensslextra", "--enable-opensslall", "--enable-savesession",
|
|
"--enable-session-ticket", "--enable-session-cache-ref",
|
|
"CPPFLAGS=-DWOLFSSL_SESSION_CACHE_REF_WARNED"]},
|
|
{"name": "all-no-client-auth", "minutes": 9.0,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-public-mp", "minutes": 8.0,
|
|
"comment": "--enable-all plus WOLFSSL_PUBLIC_MP. The shared-secret-at-infinity regression assertion needs direct mp access to plant an out-of-range scalar, because the import path itself now rejects one; without this the assertion is compiled out of every mainstream build.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_PUBLIC_MP"]},
|
|
{"name": "all-dilithium-cryptocb", "minutes": 8.9,
|
|
"configure": ["--enable-all", "--enable-dilithium", "--enable-cryptocb",
|
|
"--enable-cryptocbutils", "--enable-pkcallbacks"]},
|
|
{"name": "all-haproxy-quic", "minutes": 8.6,
|
|
"configure": ["--enable-all", "--enable-haproxy", "--enable-quic"]},
|
|
{"name": "all-asn-template-old-oid-sum", "minutes": 8.5,
|
|
"configure": ["--enable-all", "--enable-asn=template", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
|
|
{"name": "all-tls13-middlebox-compat", "minutes": 8.5,
|
|
"comment": "Only --enable-tls13-middlebox-compat and --enable-jni define WOLFSSL_TLS13_MIDDLEBOX_COMPAT, and configure.ac turns it back off when ECH is on, which --enable-all enables. So no other entry in this matrix compiles the client-side ChangeCipherSpec sends in wolfSSL_connect_TLSv13 or the tests/api/test_tls13.c middlebox tests guarded on that macro; without --disable-ech here they would all be skipped.",
|
|
"configure": ["--enable-all", "--disable-ech", "--enable-tls13-middlebox-compat"]},
|
|
{"name": "all-asn-original-old-oid-sum", "minutes": 8.4,
|
|
"configure": ["--enable-all", "--enable-asn=original", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
|
|
{"name": "all-asn-original", "minutes": 8.3,
|
|
"configure": ["--enable-all", "--enable-asn=original"]},
|
|
{"name": "all-certgencache", "minutes": 8.3,
|
|
"configure": ["--enable-all", "--enable-certgencache"]},
|
|
{"name": "all-certsigncb", "minutes": 8.3,
|
|
"comment": "Only --enable-certsigncb sets WOLFSSL_CERT_SIGN_CB, so without this entry wc_SignCert_cb() and its test are never compiled anywhere in CI. Minutes is seeded from the sibling --enable-all entries; refresh from a run's step summary.",
|
|
"configure": ["--enable-all", "--enable-certsigncb"]},
|
|
{"name": "all-libz", "minutes": 8.3,
|
|
"comment": "Only --with-libz sets HAVE_LIBZ, so without this entry TLS record compression and the whole \"compress\" test group are never compiled anywhere in CI. Needs zlib1g-dev. Minutes is seeded from the sibling --enable-all entries; refresh from a run's step summary.",
|
|
"configure": ["--enable-all", "--with-libz"]},
|
|
{"name": "all-dtls13-frag-ch-no-mlkem", "minutes": 8.2,
|
|
"configure": ["--enable-all", "--enable-dtls13", "--enable-dtls-frag-ch",
|
|
"--disable-mlkem"]},
|
|
{"name": "all-ecc-blind-k", "minutes": 8.0,
|
|
"comment": "Only entry that sets WOLFSSL_ECC_BLIND_K (the blind-private-key entry sets WOLFSSL_BLIND_PRIVATE_KEY, which does not imply it). Keeps the read-only wc_ecc_key_get_priv() contract exercised in CI. pkcs11 is on because wc_pkcs11.c is not compiled anywhere else in this matrix.",
|
|
"configure": ["--enable-all", "--enable-pkcs11",
|
|
"CPPFLAGS=-DWOLFSSL_ECC_BLIND_K"]},
|
|
{"name": "all-check-mem-zero", "minutes": 7.9,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO"]},
|
|
{"name": "all-faultharden-pk-privkey", "minutes": 7.8,
|
|
"comment": "Test holding private key in the PK callback with fault harden. Based on existing customer use case.",
|
|
"configure": ["--enable-all", "--enable-faultharden", "--enable-pkcallbacks", "CPPFLAGS=-DTEST_PK_PRIVKEY"]},
|
|
{"name": "all-secret-callback", "minutes": 7.8,
|
|
"comment": "Only --enable-wpas sets HAVE_SECRET_CALLBACK and it is not in the matrix with the unit tests, so the session-secret callback resumption paths (EAP-FAST) never ran in CI. Minutes seeded from the sibling --enable-all entries.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DHAVE_SECRET_CALLBACK"]},
|
|
{"name": "all-no-ticket-expire", "minutes": 7.8,
|
|
"comment": "Nothing else in CI compiles WOLFSSL_NO_TICKET_EXPIRE; it removes the session expiry check that heads the resumption control flow in HandleTlsResumption.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_TICKET_EXPIRE"]},
|
|
{"name": "all-secure-renegotiation", "minutes": 7.8,
|
|
"configure": ["--enable-all", "--enable-secure-renegotiation"]},
|
|
{"name": "all-debug-certs", "minutes": 7.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]},
|
|
{"name": "all-hash-keep", "minutes": 7.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]},
|
|
{"name": "all-no-aes-192-256", "minutes": 7.5,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]},
|
|
{"name": "all-no-pkcs7-stream", "minutes": 7.0,
|
|
"comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.",
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]},
|
|
{"name": "all-writedup", "minutes": 6.9,
|
|
"configure": ["--enable-all", "--enable-writedup"]},
|
|
{"name": "all-no-server", "minutes": 5.0,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
|
{"name": "nonblock-sp-c32", "minutes": 5.0,
|
|
"comment": "Same but forcing SP_WORD_SIZE=32 to exercise sp_c32.c on a 64-bit host; the two builds together cover both generated variants of mod_exp_<words>_nb / RSA / DH wrappers.",
|
|
"configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
|
|
"--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM -DSP_WORD_SIZE=32"]},
|
|
{"name": "all-no-server-no-client-auth", "minutes": 4.8,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-no-client-no-client-auth", "minutes": 4.4,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "all-no-client", "minutes": 4.2,
|
|
"configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
|
|
{"name": "nonblock-sp-c64", "minutes": 4.2,
|
|
"comment": "Non-blocking ECC/Curve25519/RSA/DH on the host default SP word size (sp_c64.c on x86_64); RSA/DH non-block require RSA_LOW_MEM (the CRT path is not supported in non-block mode).",
|
|
"configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
|
|
"--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM"]},
|
|
{"name": "nonblock-sp-asm", "minutes": 3.0,
|
|
"comment": "Non-blocking ECC on the SP x86_64 assembly implementation (RSA/DH non-block are C only).",
|
|
"configure": ["--enable-ecc=nonblock", "--enable-sp=yes,nonblock",
|
|
"--enable-sp-asm", "--enable-intelasm",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"]},
|
|
{"name": "nonblock-sp-asm-fast", "minutes": 3.0,
|
|
"comment": "Same but without the small math, so the non-blocking ECC state machines and the table-based blocking paths are built together.",
|
|
"configure": ["--enable-ecc=nonblock", "--enable-sp=yes,nonblocklarge",
|
|
"--enable-sp-asm", "--enable-intelasm",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"]},
|
|
{"name": "nonblock-sp-c64-fast", "minutes": 4.2,
|
|
"comment": "Non-blocking ECC on the portable C implementation without the small math; RSA/DH non-block are left off because their mod_exp only exists in the small variant.",
|
|
"configure": ["--enable-ecc=nonblock", "--enable-sp=yes,nonblocklarge", "--disable-sp-asm",
|
|
"CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"]},
|
|
{"name": "all-asn-template", "minutes": 3.5,
|
|
"configure": ["--enable-all", "--enable-asn=template"]},
|
|
{"name": "chain-verify-cb-async", "minutes": 3.5,
|
|
"comment": "chain verify callback with async crypt, the third handshake-suspend feature. Also the only leg with async crypt and CRL but without WOLFSSL_NONBLOCK_OCSP.",
|
|
"configure": ["--enable-chain-verify-cb", "--enable-asynccrypt",
|
|
"--enable-asynccrypt-sw", "--enable-ocsp", "--enable-crl",
|
|
"--enable-opensslextra", "--enable-sessioncerts"]},
|
|
{"name": "tls13-dtls13-session-misc", "minutes": 3.3,
|
|
"configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls",
|
|
"--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts",
|
|
"CPPFLAGS=-DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE -DWOLFSSL_TICKET_HAVE_ID -DHAVE_EX_DATA -DSESSION_CACHE_DYNAMIC_MEM"]},
|
|
{"name": "dtls-cid-renego-psk", "minutes": 3.3,
|
|
"configure": ["--enable-dtls", "--enable-dtlscid", "--enable-dtls13",
|
|
"--enable-secure-renegotiation", "--enable-psk", "--enable-aesccm",
|
|
"--enable-nullcipher", "CPPFLAGS=-DWOLFSSL_STATIC_RSA"]},
|
|
{"name": "dtls13-ocspstapling-cert-cb", "minutes": 3.1,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-ocspstapling",
|
|
"--enable-ocspstapling2", "--enable-cert-setup-cb", "--enable-sessioncerts"]},
|
|
{"name": "chain-verify-cb", "minutes": 3.1,
|
|
"comment": "postauth, stapling and rpk exercise the callback's resume-from-read and fail-hard paths.",
|
|
"configure": ["--enable-chain-verify-cb", "--enable-opensslextra",
|
|
"--enable-sessioncerts", "--enable-smallstack", "--enable-postauth",
|
|
"--enable-ocspstapling", "--enable-rpk"]},
|
|
{"name": "chain-verify-cb-nonblock-ocsp", "minutes": 3.1,
|
|
"comment": "chain verify callback alongside the other handshake-suspend feature, and DTLS.",
|
|
"configure": ["--enable-chain-verify-cb", "--enable-ocsp", "--enable-crl",
|
|
"--enable-dtls", "CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP"]},
|
|
{"name": "nullcipher-tls13-in-default", "minutes": 3.0,
|
|
"comment": "Legacy WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT mode: RFC 9150 integrity-only suites back in the default TLS 1.3/DTLS 1.3 cipher list. The only config that runs tests/test-tls13-null.conf and tests/test-dtls13-null.conf (they need the suites in the default list). The dtls-cid-renego-psk entry covers the default-exclusion mode of --enable-nullcipher.",
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-nullcipher",
|
|
"CPPFLAGS=-DWOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT -DWOLFSSL_STATIC_RSA"]},
|
|
{"name": "tsp-verifier", "minutes": 3,
|
|
"comment": "Time-Stamp Protocol Verifier",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]},
|
|
{"name": "dtls13-earlydata-psk-no-hrr", "minutes": 2.9,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-earlydata",
|
|
"--enable-session-ticket", "--enable-psk", "CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME"]},
|
|
{"name": "ocsp-responder-nonblock-maxfrag", "minutes": 2.8,
|
|
"configure": ["--enable-ocsp", "--enable-ocsp-responder", "--enable-ocspstapling",
|
|
"CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP", "--enable-maxfragment"]},
|
|
{"name": "dtls-records-span-datagrams", "minutes": 2.7,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch",
|
|
"--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]},
|
|
{"name": "tsp-min-hash-str", "minutes": 2.7,
|
|
"comment": "Time-Stamp Protocol Minimum 128-bit hash strength",
|
|
"configure": ["--enable-tsp",
|
|
"CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]},
|
|
{"name": "opensslextra-no-ca-names", "minutes": 2.6,
|
|
"configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_CA_NAMES"]},
|
|
{"name": "sessionexport-dtls13", "minutes": 2.6,
|
|
"comment": "the only job pairing session export with CID; tickets, MTU and postauth compile the gated export tests",
|
|
"configure": ["--enable-sessionexport", "--enable-dtls", "--enable-dtls13",
|
|
"--enable-dtlscid", "--enable-session-ticket", "--enable-dtls-mtu",
|
|
"--enable-postauth", "--enable-writedup"]},
|
|
{"name": "lms-xmss-verify-only", "minutes": 2.5,
|
|
"configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]},
|
|
{"name": "sp-4096-m32", "minutes": 1.2,
|
|
"comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
|
|
"configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"],
|
|
"cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
|
|
"ldflags": "-m32"},
|
|
{"name": "opensslall-rng-seed-cb", "minutes": 2.2,
|
|
"configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]},
|
|
{"name": "opensslall-ecc-zero-hash", "minutes": 2.2,
|
|
"configure": ["--enable-opensslall", "--enable-ecc", "CPPFLAGS=-DWC_ALLOW_ECC_ZERO_HASH"]},
|
|
{"name": "she-ext-cmac-no-she-misc", "minutes": 2.2,
|
|
"configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils",
|
|
"CPPFLAGS=-DNO_WC_SHE_GETUID -DNO_WC_SHE_GETCOUNTER -DNO_WC_SHE_EXPORTKEY"]},
|
|
{"name": "she-std-cmac-cryptocb-sw-default", "minutes": 2.2,
|
|
"configure": ["--enable-she=standard", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils", "CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
|
|
{"name": "sniffer-curves-enckeys", "minutes": 2.2,
|
|
"configure": ["--enable-sniffer", "--enable-curve25519", "--enable-curve448",
|
|
"--enable-enckeys", "CPPFLAGS=-DWOLFSSL_DH_EXTRA"]},
|
|
{"name": "sniffer-keylog-storedata", "minutes": 2.5,
|
|
"comment": "The sniffer keylog legs of scripts/sniffer-testsuite.test only run with WOLFSSL_SNIFFER_KEYLOGFILE, and the store data callback path is only compiled with WOLFSSL_SNIFFER_STORE_DATA_CB. Neither is set by any other entry.",
|
|
"configure": ["--enable-sniffer", "--enable-session-ticket",
|
|
"--enable-curve25519", "--enable-ed25519",
|
|
"CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DWOLFSSL_SNIFFER_STORE_DATA_CB"]},
|
|
{"name": "sniffer-no-enc-then-mac", "minutes": 2.2,
|
|
"comment": "The sniffer cannot read a capture that negotiated RFC 7366 without Encrypt-Then-MAC support, and says so through a dedicated error. That arm, and the assertion for it in scripts/sniffer-testsuite.test, are only compiled here.",
|
|
"configure": ["--enable-sniffer", "--enable-enc-then-mac=no"]},
|
|
{"name": "sniffer-threaded", "minutes": 2.5,
|
|
"comment": "snifftest with worker threads. Session tickets are deliberately left off: snifftest pins itself to a single worker when they are enabled, so this is the only way the concurrent path is exercised.",
|
|
"configure": ["--enable-sniffer", "--enable-curve25519", "--enable-ed25519",
|
|
"CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DTHREADED_SNIFFTEST"]},
|
|
{"name": "cryptocb-keygen-utils-aes-setkey", "minutes": 2.2,
|
|
"comment": "aesofb turns on WOLFSSL_AES_DIRECT, so test_wc_CryptoCb_AesDirect's device-owned-key section runs through the WOLF_CRYPTO_CB_AES_SETKEY dispatch.",
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils",
|
|
"--enable-aesofb", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-utils-setkey-free", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
|
|
"--enable-cryptocbutils=setkey,free", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-keygen-utils-export", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=export"]},
|
|
{"name": "cryptocb-keygen-export-key", "minutes": 2.2,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_EXPORT_KEY"]},
|
|
{"name": "cryptocb-utils-setkey-export-find", "minutes": 2.2,
|
|
"comment": "aesofb turns on WOLFSSL_AES_DIRECT, so test_wc_CryptoCb_AesDirect's find-mode section runs with a finder that is not swdev's.",
|
|
"configure": ["--enable-cryptocb", "--enable-keygen",
|
|
"--enable-cryptocbutils=setkey,export", "--enable-aesofb",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
|
|
{"name": "cryptocb-cmd", "minutes": 2.2,
|
|
"comment": "Only WOLF_CRYPTO_CB_CMD builds the register/unregister command dispatch, so without this entry the nested-registration regression tests never compile in CI.",
|
|
"configure": ["--enable-cryptocb", "CPPFLAGS=-DWOLF_CRYPTO_CB_CMD"]},
|
|
{"name": "cryptocb-shake", "minutes": 2.2,
|
|
"comment": "Exercises the SHAKE128/SHAKE256 crypto callback wiring (wc_CryptoCb_Shake, the sha3.c Update/Final hooks, and the dedicated offload unit tests). cryptocbutils=copy,free adds the Copy/Free dispatch, which must see WC_HASH_TYPE_SHAKE* (not NONE) from SHAKE contexts. A normal (non-ONLY) cryptocb build keeps the host software SHA3/SHAKE present as the callbacks' offload fallback.",
|
|
"configure": ["--enable-cryptocb", "--enable-sha3",
|
|
"--enable-shake128", "--enable-shake256",
|
|
"--enable-cryptocbutils=copy,free"]},
|
|
{"name": "cryptocb-shake-xof", "minutes": 2.2,
|
|
"comment": "Only WOLF_CRYPTO_CB_SHAKE_XOF dispatches SHAKE absorb and squeeze to the callback, so without this entry the offload counter tests never compile in CI.",
|
|
"configure": ["--enable-cryptocb", "--enable-sha3",
|
|
"--enable-shake128", "--enable-shake256",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_SHAKE_XOF"]},
|
|
{"name": "cryptocb-aes-cfb-ofb", "minutes": 2.2,
|
|
"comment": "Exercises the AES-CFB/OFB crypto callback wiring (wc_CryptoCb_AesCfb/Ofb Encrypt/Decrypt, the aes.c hooks, and the dedicated offload unit tests). A normal (non-ONLY) cryptocb build keeps the host software AES present as the callbacks' offload fallback; WOLF_CRYPTO_CB_ONLY_AES (no software fallback) is covered separately by cryptocb-only.yml via swdev.",
|
|
"configure": ["--enable-cryptocb", "--enable-aescfb",
|
|
"--enable-aesofb", "--enable-aesctr"]},
|
|
{"name": "cryptocb-hooks-check-mem-zero", "minutes": 2.2,
|
|
"comment": "Ed448/CMAC/RSA-PSS crypto callback hooks under WOLFSSL_CHECK_MEM_ZERO. The Ed448 sign hook returns early past the secret-buffer registration, which a cryptocb build without this define does not catch.",
|
|
"configure": ["--enable-cryptocb", "--enable-ed448", "--enable-cmac",
|
|
"--enable-rsapss", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO -DWOLF_CRYPTO_CB_FREE -DWOLF_CRYPTO_CB_RSA_PAD"]},
|
|
{"name": "opensslall-rng-seed-cb-no-getpid", "minutes": 2.1,
|
|
"configure": ["--enable-opensslall", "--enable-opensslextra",
|
|
"CPPFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID"]},
|
|
{"name": "dtls13-ignore-pt-alert", "minutes": 2.1,
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-tls13",
|
|
"CPPFLAGS=-DWOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC"]},
|
|
{"name": "cryptocb-utils-setkey-free-export", "minutes": 2.1,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
|
|
"--enable-cryptocbutils=setkey,free,export", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-aesgcm-setkey-free", "minutes": 2.1,
|
|
"configure": ["--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
|
|
{"name": "ecies-sec1-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "ECIES with the AES-GCM DEM in the default SEC1 IV mode; WOLFSSL_ECIES_STATIC_GCM_NONCE opts into the fixed-nonce GCM path so the GCM KAT/round-trip and cryptocb tests run.",
|
|
"configure": ["--enable-eccencrypt", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen", "--enable-compkey",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "ecies-geniv-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "Same ECIES-GCM coverage in the WOLFSSL_ECIES_GEN_IV mode (random embedded nonce).",
|
|
"configure": ["--enable-eccencrypt=geniv", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen", "--enable-compkey",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "ecies-old-gcm-static-nonce", "minutes": 2.0,
|
|
"comment": "Same ECIES-GCM coverage in the legacy WOLFSSL_ECIES_OLD mode (KDF-derived nonce, no ephemeral pubkey prepended).",
|
|
"configure": ["--enable-eccencrypt=old", "--enable-aesgcm", "--enable-aesctr",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen", "--enable-compkey",
|
|
"CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
|
|
{"name": "ecies-gcm-only-geniv", "minutes": 2.0,
|
|
"comment": "ECIES with AES-GCM as the only cipher (AES-CBC off) in GEN_IV mode, so the ECIES tests take their GCM branches: no separate MAC step and a random embedded nonce.",
|
|
"configure": ["--enable-eccencrypt=geniv", "--enable-aesgcm", "--disable-aescbc",
|
|
"--enable-x963kdf", "--enable-cryptocb", "--enable-keygen", "--enable-compkey"]},
|
|
{"name": "opensslextra-x509small", "minutes": 2.0,
|
|
"configure": ["--enable-opensslextra=x509small"]},
|
|
{"name": "cryptocb-keygen-find", "minutes": 2.0,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
|
|
{"name": "ecies-cryptocb-find", "minutes": 2.0,
|
|
"comment": "ECIES with a WOLF_CRYPTO_CB_FIND finder: a context with no device id is routed by the finder, and the ECIES finder test checks that path.",
|
|
"configure": ["--enable-eccencrypt", "--enable-cryptocb", "--enable-keygen",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
|
|
{"name": "user-settings-all", "minutes": 2.0,
|
|
"comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.",
|
|
"user_settings": "examples/configs/user_settings_all.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings"]},
|
|
{"name": "she-ext-cryptocb-sw-default", "minutes": 1.9,
|
|
"configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils",
|
|
"CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
|
|
{"name": "cryptocb-aesgcm-aes-setkey", "minutes": 1.9,
|
|
"configure": ["--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
|
|
{"name": "cryptocb-keygen-utils-setkey", "minutes": 1.9,
|
|
"configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=setkey"]},
|
|
{"name": "pkcs7-rsa-pss", "minutes": 1.9,
|
|
"comment": "PKCS#7 with RSA-PSS (CMS RSASSA-PSS signers)",
|
|
"configure": ["--enable-pkcs7", "CPPFLAGS=-DWC_RSA_PSS"]},
|
|
{"name": "blind-private-key", "minutes": 1.9,
|
|
"configure": ["CPPFLAGS=-DWOLFSSL_BLIND_PRIVATE_KEY"]},
|
|
{"name": "certgen-no-tls", "minutes": 1.9,
|
|
"configure": ["--enable-certreq", "--enable-certext", "--enable-certgen",
|
|
"--disable-secure-renegotiation-info", "CPPFLAGS=-DNO_TLS"]},
|
|
{"name": "no-sys-ca-certs", "minutes": 1.8, "configure": ["--disable-sys-ca-certs"]},
|
|
{"name": "no-client-auth", "minutes": 1.8,
|
|
"configure": ["CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "harden-tls", "minutes": 1.7, "configure": ["--enable-harden-tls"]},
|
|
{"name": "no-sni-ecc-tls13-scr-info", "minutes": 1.7,
|
|
"configure": ["--disable-sni", "--disable-ecc", "--disable-tls13",
|
|
"--disable-secure-renegotiation-info"]},
|
|
{"name": "default", "minutes": 1.6},
|
|
{"name": "aeskeywrap-padding", "minutes": 1.6,
|
|
"comment": "RFC 5649 AES key wrap with padding; exercises the =padding sub-option (not pulled in by --enable-all).",
|
|
"configure": ["--enable-aeskeywrap=padding"]},
|
|
{"name": "aeskeywrap-padding-cryptocb", "minutes": 1.6,
|
|
"comment": "Key wrap (RFC 3394 + RFC 5649) over WOLF_CRYPTO_CB device offload; runs test_wc_CryptoCb_AesKeyWrap.",
|
|
"configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding"]},
|
|
{"name": "aeskeywrap-padding-cryptocb-ecb", "minutes": 1.6,
|
|
"comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).",
|
|
"configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]},
|
|
{"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6,
|
|
"comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
|
|
"configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding",
|
|
"--disable-sha512", "--disable-sha384",
|
|
"--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"],
|
|
"cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
|
|
"ldflags": "-m32"},
|
|
{"name": "no-client-no-client-auth", "minutes": 1.6,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "ascon-experimental", "minutes": 1.6,
|
|
"configure": ["--enable-ascon", "--enable-experimental"]},
|
|
{"name": "ascon-unroll-experimental", "minutes": 1.6,
|
|
"configure": ["--enable-ascon", "CPPFLAGS=-DWOLFSSL_ASCON_UNROLL",
|
|
"--enable-experimental"]},
|
|
{"name": "wolfssl-extra", "minutes": 1.6, "configure": ["CPPFLAGS=-DWOLFSSL_EXTRA"]},
|
|
{"name": "coding-no", "minutes": 1.5, "configure": ["--enable-coding=no"]},
|
|
{"name": "rng-no-getpid", "minutes": 1.5,
|
|
"comment": "Default RNG fork handlers without the pid check, so the child handler alone must make the forked child reseed in the compat RAND fork test.",
|
|
"configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_GETPID"]},
|
|
{"name": "rng-autofork-off-no-getpid", "minutes": 1.5,
|
|
"comment": "Neither the fork handlers nor the pid check: the compat RAND fork test must see the child repeat the parent.",
|
|
"configure": ["--disable-rng-autofork", "--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_GETPID"]},
|
|
{"name": "she-ext-cmac-cryptocb", "minutes": 1.3,
|
|
"configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
|
|
"--enable-cryptocbutils"]},
|
|
{"name": "she-std-cmac-no-import-m123", "minutes": 1.3,
|
|
"configure": ["--enable-she=standard", "--enable-cmac",
|
|
"CPPFLAGS=-DNO_WC_SHE_IMPORT_M123"]},
|
|
{"name": "pkcs7", "minutes": 1.3,
|
|
"comment": "PKCS#7 without RSA-PSS",
|
|
"configure": ["--enable-pkcs7"]},
|
|
{"name": "tsp", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol",
|
|
"configure": ["--enable-tsp"]},
|
|
{"name": "tsp-openssl", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol with OpenSSL compat",
|
|
"configure": ["--enable-tsp", "--enable-opensslall"]},
|
|
{"name": "tsp-no-ecc", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol without ECC",
|
|
"configure": ["--enable-tsp", "--disable-ecc"]},
|
|
{"name": "tsp-no-rsa", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol without RSA",
|
|
"configure": ["--enable-tsp", "--disable-rsa"]},
|
|
{"name": "tsp-smallstack", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Small Stack",
|
|
"configure": ["--enable-tsp", "CPPFLAGS=-DWOLFSSL_SMALL_STACK"]},
|
|
{"name": "tsp-requester", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Requester",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_REQUESTER"]},
|
|
{"name": "tsp-responder", "minutes": 1.3,
|
|
"comment": "Time-Stamp Protocol Responder",
|
|
"configure": ["--enable-tsp", "--enable-opensslall",
|
|
"CPPFLAGS=-DWOLFSSL_TSP_RESPONDER"]},
|
|
{"name": "no-tls-cryptocb-aesgcm-setkey-free", "minutes": 1.3,
|
|
"configure": ["--disable-tls", "--enable-cryptocb", "--enable-aesgcm",
|
|
"CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
|
|
{"name": "rng-bank-lock", "minutes": 1.3,
|
|
"comment": "The RNG bank with the per-instance lock: bank builds still hand out plain instances.",
|
|
"configure": ["--enable-rng-bank", "--enable-opensslextra"]},
|
|
{"name": "she-std-cmac", "minutes": 1.2,
|
|
"configure": ["--enable-she=standard", "--enable-cmac"]},
|
|
{"name": "no-verify-oid-fpki", "minutes": 1.2,
|
|
"configure": ["CPPFLAGS=-DNO_VERIFY_OID -DWOLFSSL_FPKI"]},
|
|
{"name": "rng-single-threaded", "minutes": 1.2,
|
|
"comment": "SINGLE_THREADED: no RNG lock and no fork handlers may be built, and the compat RAND test still passes.",
|
|
"configure": ["--enable-singlethreaded", "--enable-opensslextra"]},
|
|
{"name": "rng-autofork-off", "minutes": 1.2,
|
|
"comment": "Opt out of the RNG fork handlers that are on by default, so the lock without them is built and tested.",
|
|
"configure": ["--disable-rng-autofork"]},
|
|
{"name": "no-verify-oid", "minutes": 1.1, "configure": ["CPPFLAGS=-DNO_VERIFY_OID"]},
|
|
{"name": "rng-autolock-off", "minutes": 1.1,
|
|
"comment": "Opt out of the per-instance RNG lock, so the WC_RNG layout and generate path without it are built and tested.",
|
|
"configure": ["--disable-rng-autolock"]},
|
|
{"name": "rng-seed-device", "minutes": 1.1,
|
|
"comment": "Seed the RNG from a nominated device. /dev/urandom stands in for a hardware RNG so the WC_RNG_SEED_DEVICE read path is actually exercised on a runner.",
|
|
"configure": ["--with-rng-seed-device=/dev/urandom"]},
|
|
{"name": "rng-seed-device-fallback", "minutes": 1.1,
|
|
"comment": "Nominated seed device that cannot be opened, so every test runs through the fallback to the default seed sources.",
|
|
"configure": ["--with-rng-seed-device=/nonexistent/hwrng"]},
|
|
{"name": "rng-custom-block-hashdrbg", "minutes": 1.0,
|
|
"comment": "fwTPM defines CUSTOM_RAND_GENERATE_BLOCK while HAVE_HASHDRBG remains enabled. Keep the custom RNG bypass buildable when both macros are present.",
|
|
"user_settings": "IDE/m33mu-falcon-verify/user_settings.h",
|
|
"configure": ["--enable-usersettings", "--disable-examples",
|
|
"--disable-crypttests", "--disable-shared",
|
|
"CPPFLAGS=-DWOLFCRYPT_ONLY -DHAVE_HASHDRBG -DWC_RESEED_INTERVAL=1000000 -DWOLFSSL_NO_GETPID"],
|
|
"check": false},
|
|
{"name": "no-server-no-client-auth", "minutes": 1.0,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
|
|
{"name": "no-wolfssl-client", "minutes": 1.0,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
|
|
{"name": "testwolfcrypt-ca", "minutes": 1.0,
|
|
"comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
|
|
"user_settings": "examples/configs/user_settings_ca.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-dtls13", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_dtls13.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-ebsnet", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_EBSnet.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-eccnonblock", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_eccnonblock.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_curve25519nonblock.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded", "minutes": 1.0,
|
|
"comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0,
|
|
"comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0,
|
|
"comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0,
|
|
"comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0,
|
|
"comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.",
|
|
"user_settings": "examples/configs/user_settings_embedded.h",
|
|
"cflags": "",
|
|
"prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]],
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-min-ecc", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_min_ecc.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-openssl-compat", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_openssl_compat.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-pkcs7", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_pkcs7.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-pq", "minutes": 1.0,
|
|
"comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.",
|
|
"user_settings": "examples/configs/user_settings_pq.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-rsa-only", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_rsa_only.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-template", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_template.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-tls12", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_tls12.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-tls13", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_tls13.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolfboot_keytools.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolfssh", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolfssh.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "testwolfcrypt-wolftpm", "minutes": 1.0,
|
|
"user_settings": "examples/configs/user_settings_wolftpm.h",
|
|
"cflags": "",
|
|
"configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
|
|
{"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs",
|
|
"name": "no-asn-strict-certs",
|
|
"configure": ["--enable-testcert", "--enable-opensslextra", "--enable-certgen",
|
|
"--enable-certreq", "--enable-certext", "--enable-ecc",
|
|
"CPPFLAGS=-DWOLFSSL_NO_ASN_STRICT -DWOLFSSL_CUSTOM_OID -DHAVE_OID_ENCODING -DWOLFSSL_ALT_NAMES"]},
|
|
{"comment": "wolfSSL <= 5.9.0 DTLS 1.3 legacy_session_id echo compatibility shim",
|
|
"name": "dtls13-echo-legacy-session-id",
|
|
"configure": ["--enable-dtls", "--enable-dtls13", "--enable-session-ticket",
|
|
"--enable-ecc", "CPPFLAGS=-DWOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID"]},
|
|
{"name": "x509-tiny",
|
|
"comment": "Minimal-extension X.509 profile.",
|
|
"configure": ["--enable-ecc", "--enable-rsapss",
|
|
"CPPFLAGS=-DWOLFSSL_X509_TINY"]},
|
|
{"name": "x509-tiny-addbacks",
|
|
"comment": "TINY profile with extension add-backs enabled directly.",
|
|
"configure": ["--enable-ecc",
|
|
"CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]},
|
|
{"name": "tls13-psk-no-certs",
|
|
"comment": "NO_CERTS reached through --disable-asn, with TLS 1.3 PSK still available. psk.yml's static-psk-lowresource-tls13 already covers NO_CERTS with PSK but disables DH, so it only reaches psk_ke; this one leaves DH on and covers psk_dhe_ke. First NO_CERTS entry in this list.",
|
|
"configure": ["--enable-psk", "--disable-rsa", "--disable-ecc", "--disable-asn"]},
|
|
{"name": "no-wolfssl-server", "minutes": 0.9,
|
|
"configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
|
|
{"name": "dtls13-client-minimal", "minutes": 0.9,
|
|
"comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.",
|
|
"configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa",
|
|
"--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5",
|
|
"--disable-chacha", "--disable-poly1305", "--disable-errorstrings",
|
|
"--disable-asn-print", "--disable-eccshamir", "--disable-base64encode",
|
|
"--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384",
|
|
"--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
|
|
"--enable-sp=smallec256", "--disable-sp-asm",
|
|
"CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
|
|
{"name": "no-tlsv12-ocspstapling",
|
|
"comment": "--disable-tlsv12 with the two feature axes that reach TLS 1.2-only code from a TLS 1.3 build: OCSP stapling, whose chain-status path calls ProcessCSR_ex, and the OpenSSL compatibility layer, which is where most of the tests that hard-code a TLS 1.2 method live. Nothing else covers the plain option - dtls13-client-minimal above reaches the define through CPPFLAGS and strips most of the crypto with it, and psk.yml's static-psk-lowresource-tls13 pairs it with --disable-asn.",
|
|
"configure": ["--disable-tlsv12", "--enable-ocspstapling", "--enable-opensslextra"]},
|
|
{"name": "no-tlsv12-ocspstapling2",
|
|
"comment": "status_request_v2 without status_request, which is the one stapling shape where the TLS 1.3 chain-status path is not compiled: ProcessCSR_ex then has only its TLS 1.2 caller, so compiling TLS 1.2 out left it with none and -Wunused-function broke the build. no-tlsv12-ocspstapling above enables v1 and cannot reach it.",
|
|
"configure": ["--disable-tlsv12", "--enable-ocspstapling2"]},
|
|
{"name": "no-tlsv12-dtls13",
|
|
"comment": "DTLS 1.3 with the TLS 1.2 handshake compiled out, both sides. dtls13-client-minimal above covers the same version pair but is client-only through NO_WOLFSSL_SERVER, so the DTLS 1.3 server path under WOLFSSL_NO_TLS12 has no other coverage. This is also the one combination configure still accepts once TLS 1.2 is gone: DTLS without --enable-dtls13 is rejected, because DTLS 1.2 is the TLS 1.2 handshake. Connection ID and session tickets are on because both pull in DTLS 1.2-only test and record-layer code that the version gating has to reach.",
|
|
"configure": ["--disable-tlsv12", "--enable-dtls", "--enable-dtls13",
|
|
"--enable-dtlscid", "--enable-session-ticket"]},
|
|
{"name": "no-tlsv12-sniffer",
|
|
"comment": "The sniffer picks its master-secret derivation, resumption key derivation, Finished parsing and record decryption by version, and with WOLFSSL_NO_TLS12 only the TLS 1.3 halves of those are compiled in. sniffer-curves-enckeys keeps TLS 1.2 enabled, so it never builds them that way; scripts/sniffer-testsuite.test probes snifftest for the versions it was built with and runs the TLS 1.3 legs here.",
|
|
"configure": ["--enable-sniffer", "--disable-tlsv12"]},
|
|
{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
|
|
"configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
|
|
{"name": "no-examples-no-malloc", "minutes": 0.8,
|
|
"configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]},
|
|
{"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3,
|
|
"comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.",
|
|
"configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519",
|
|
"--enable-keygen", "--disable-examples",
|
|
"CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"],
|
|
"cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"},
|
|
{"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false,
|
|
"comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.",
|
|
"configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource",
|
|
"--disable-crypttests", "--disable-examples"]},
|
|
{"name": "pkcs12-pbkdf-mp-api", "minutes": 1.0,
|
|
"comment": "WC_PKCS12_PBKDF_USING_MP_API selects a second wc_PKCS12_PBKDF_ex implementation that no configure option reaches.",
|
|
"configure": ["--enable-pkcs12", "--enable-des3", "--enable-opensslextra",
|
|
"CPPFLAGS=-DWC_PKCS12_PBKDF_USING_MP_API"]},
|
|
{"name": "no-session-cache-session-ticket", "minutes": 0.8,
|
|
"comment": "Session tickets with the internal session cache compiled out, over TLS 1.3 and DTLS 1.3. This is what a Zephyr build produces from CONFIG_WOLFSSL_SESSION_CACHE=n with tickets left on, and it used to fail to link. HAVE_EXT_CACHE is set because NO_SESSION_CACHE with an external cache is the one combination where the ticket-session free path keeps its external-cache branch, and --enable-wpas with --enable-lowresource reaches it. Examples are off because tests/unit.test calls the session APIs that NO_SESSION_CACHE removes, so this entry is compile coverage for the library.",
|
|
"configure": ["--enable-session-ticket", "--enable-dtls", "--enable-dtls13",
|
|
"--disable-examples",
|
|
"CPPFLAGS=-DNO_SESSION_CACHE -DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE"]},
|
|
{"name": "lowresource-tls13-session-ticket", "minutes": 0.8,
|
|
"comment": "--enable-lowresource defines NO_SESSION_CACHE, so this reaches the src/internal.c no-cache ticket paths purely through configure options, with no CPPFLAGS to get wrong. It does not cover src/dtls.c, whose TlsSessionIdIsValid needs WOLFSSL_DTLS_NO_HVR_ON_RESUME, so no-session-cache-session-ticket is the entry for that and the two are not interchangeable. Examples are off for the same reason as that entry.",
|
|
"configure": ["--enable-lowresource", "--enable-tls13", "--enable-session-ticket",
|
|
"--disable-examples"]},
|
|
{"name": "small-cert-verify", "minutes": 3.0,
|
|
"comment": "WOLFSSL_SMALL_CERT_VERIFY verifies the peer certificate signature separately from the parse, and no other profile that builds the unit tests defines it: --enable-lowresource sets the macro but not WOLFSSL_CERT_GEN, WOLFSSL_CERT_EXT or USE_CERT_BUFFERS_2048, so the signature-vs-parse precedence test is skipped there too.",
|
|
"configure": ["--enable-opensslextra", "--enable-certgen", "--enable-certext", "CPPFLAGS=-DWOLFSSL_SMALL_CERT_VERIFY -DUSE_CERT_BUFFERS_2048"]},
|
|
{"name": "tls13-only-sha512-transcript", "minutes": 0.8,
|
|
"comment": "WOLFSSL_NO_TLS12 with SHA-512 still enabled. That is the only shape where WOLFSSL_HS_HASH_SHA512 is false while WOLFSSL_SHA512 is true. dtls13-client-minimal compiles the same HS_Hashes layout without hashSha512, verifyHashes and certHashes, but it gets there with --disable-sha512, so it does not cover this combination. --disable-tlsv12 alone does not define the macro. Examples are off because tests/api/test_tls13.c calls wolfTLSv1_2_server_method() unguarded, so this entry is compile coverage for the library.",
|
|
"configure": ["--enable-tls13", "--disable-tlsv12", "--disable-oldtls",
|
|
"--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_TLS12"]},
|
|
{"name": "tls13-sha512-transcript-only", "minutes": 0.8,
|
|
"comment": "The other side of WOLFSSL_HS_HASH_SHA512: --enable-tls13-sha512 without TLS 1.2, so the SHA-512 transcript is kept for TLS 1.3 alone. Examples are off for the same reason as tls13-only-sha512-transcript.",
|
|
"configure": ["--enable-tls13", "--enable-tls13-sha512", "--disable-tlsv12",
|
|
"--disable-oldtls", "--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_TLS12"]},
|
|
{"name": "tls13-sha512-runtime", "minutes": 1.6,
|
|
"comment": "--enable-tls13-sha512 with TLS 1.2 left in, so the examples and unit tests build and run with WOLFSSL_HS_HASH_SHA512 set. No cipher suite sets mac_algorithm to sha512_mac, so the sha512_mac arms in src/tls13.c stay unreached; what this entry proves is that the option does not break an otherwise ordinary build, which the two compile-only entries above cannot show.",
|
|
"configure": ["--enable-tls13", "--enable-tls13-sha512", "--enable-sha512"]},
|
|
{"name": "cryptonly-sha3-keyid", "minutes": 0.8,
|
|
"comment": "SHA3 as the only hash family that can derive key identifiers: no SHA-1 and no SHA-256, so HashIdAlg()/CalcHashId_ex() must pick SHA3-256 and KEYID_SIZE must follow it. SHA-512 is kept only because the Hash DRBG needs it. The CERT KEYID subtest checks the SKID/AKID sizes the generator writes against CTC_MAX_SKID_SIZE.",
|
|
"configure": ["--enable-cryptonly", "--enable-ecc", "--enable-certgen",
|
|
"--enable-certreq", "--enable-certext", "--enable-sha3", "--enable-sha512",
|
|
"--disable-sha", "--disable-sha256", "--disable-sha224", "--disable-rsa",
|
|
"--disable-dh",
|
|
"CPPFLAGS=-DWOLFSSL_DRBG_SHA512 -DUSE_CERT_BUFFERS_256"]},
|
|
{"name": "sha3-keyid-ocsp-crl", "minutes": 1.2,
|
|
"comment": "The SHA3-only key identifier hash of cryptonly-sha3-keyid, but with the TLS layer left in so src/ocsp.c and the Signer table compile. OCSP_DIGEST and OCSP_RESPONDER_ID_HASH_TYPE must name SHA3-256 and SIGNER_DIGEST_SIZE must match KEYID_SIZE, none of which a cryptonly build reaches. NO_SESSION_CACHE because HashObject() needs MD5, SHA-1 or SHA-256 and this build has none; no cipher suite survives either, so there is no handshake left to check.",
|
|
"configure": ["--enable-ocsp", "--enable-crl", "--enable-sha3",
|
|
"--enable-certgen", "--enable-certreq", "--enable-certext",
|
|
"--disable-sha", "--disable-sha256", "--disable-sha224",
|
|
"--disable-examples", "CPPFLAGS=-DNO_SESSION_CACHE"],
|
|
"check": false,
|
|
"run": [["./wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "sha3-384-keyid", "minutes": 0.8,
|
|
"comment": "WOLFSSL_NOSHA3_256 on top of the SHA3-only key identifier hash, so the selection falls through to SHA3-384 and WC_ASN_KEYID_SZ becomes 48. This is the only entry where the key identifier is larger than the 32-byte floor, so it is what proves CTC_MAX_SKID_SIZE widens and the Cert SKID/AKID buffers still hold what CalcHashId_ex() writes. ML-KEM is off because wc_mlkem_poly.c calls wc_InitSha3_256() unconditionally.",
|
|
"configure": ["--enable-cryptonly", "--enable-ecc", "--enable-certgen",
|
|
"--enable-certreq", "--enable-certext", "--enable-sha3", "--enable-sha512",
|
|
"--disable-sha", "--disable-sha256", "--disable-sha224", "--disable-rsa",
|
|
"--disable-dh", "--disable-mlkem",
|
|
"CPPFLAGS=-DWOLFSSL_DRBG_SHA512 -DUSE_CERT_BUFFERS_256 -DWOLFSSL_NOSHA3_256"],
|
|
"check": false,
|
|
"run": [["./wolfcrypt/test/testwolfcrypt"]]},
|
|
{"name": "postauth-no-compat",
|
|
"comment": "Post-handshake auth without OPENSSL_EXTRA, which otherwise compiles out the handshake-end unload of SSL-owned certs and keys.",
|
|
"configure": ["--enable-postauth", "--enable-sessioncerts"]}
|
|
]
|