Repository navigation
Send each fwTPM mssim reply as one segment and disable Nagle #282
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: WolfTPM Rust Wrapper Tests | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '**' ] | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| repository_dispatch: | |
| types: [nightly-trigger] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Resolve the latest wolfSSL -stable tag so we also test the shipped release. | |
| discover: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| uses: ./.github/workflows/_resolve-wolfssl.yml | |
| rust: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| needs: discover | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/wolfssl/wolftpm-ci:v1.1 | |
| defaults: | |
| run: | |
| shell: bash | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: master | |
| wolfssl_ref: master | |
| - name: latest-stable | |
| wolfssl_ref: ${{ needs.discover.outputs.latest_stable }} | |
| steps: | |
| - name: Checkout wolfTPM | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: true | |
| # Build + install wolfSSL with the crypto-callback support the wrapper | |
| # (and the TPM-backed TLS bridge) needs; installs to /usr/local so | |
| # pkg-config finds it for both wolfTPM configure and the Rust build.rs. | |
| - name: Setup wolfSSL | |
| uses: ./.github/actions/setup-wolfssl | |
| with: | |
| ref: ${{ matrix.wolfssl_ref || 'master' }} | |
| # fwTPM RSA object creation needs WOLFSSL_KEY_GEN and the raw-RSA | |
| # padding path, or TPM2_Create returns TPM_RC_COMMAND_CODE for RSA | |
| # keys (see src/fwtpm/README.md). | |
| configure-flags: --enable-wolftpm --enable-pkcallbacks --enable-keygen | |
| cflags: -DWC_RSA_NO_PADDING | |
| - name: Generate TPM port | |
| run: | | |
| MATRIX_HASH=$(echo -n "rust-${{ matrix.name }}" | cksum | cut -d' ' -f1) | |
| TPM_PORT=$((40000 + (MATRIX_HASH % 1000) * 2)) | |
| { | |
| echo "TPM_PORT=$TPM_PORT" | |
| echo "TPM2_SWTPM_PORT=$TPM_PORT" | |
| echo "TPM2_SWTPM_HOST=localhost" | |
| } >> "$GITHUB_ENV" | |
| # Build wolfTPM with our in-tree firmware TPM (fwtpm_server) as the | |
| # software TPM the Rust tests run against — no external simulator. | |
| - name: Build wolfTPM (swtpm + fwtpm) | |
| run: | | |
| ./autogen.sh | |
| ./configure --enable-swtpm --enable-fwtpm --with-swtpm-port="$TPM_PORT" | |
| make -j"$(nproc)" | |
| - name: Build Rust wrapper | |
| working-directory: ./wrapper/rust/wolftpm | |
| run: cargo build --locked --all-targets --features swtpm-tests | |
| # Style gates are advisory on the first runs (annotate, don't fail the | |
| # pipeline); flip continue-on-error off once a `cargo fmt` pass is landed. | |
| - name: Clippy | |
| working-directory: ./wrapper/rust/wolftpm | |
| continue-on-error: true | |
| run: cargo clippy --locked --all-targets --features swtpm-tests -- -D warnings | |
| - name: Rustfmt check | |
| working-directory: ./wrapper/rust/wolftpm | |
| continue-on-error: true | |
| run: cargo fmt --check | |
| - name: Test against fwTPM | |
| working-directory: ./wrapper/rust/wolftpm | |
| run: | | |
| ../../../src/fwtpm/fwtpm_server --clear --port "$TPM_PORT" \ | |
| --platform-port "$((TPM_PORT + 1))" > /tmp/rust-fwtpm.log 2>&1 & | |
| server_pid=$! | |
| trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT | |
| for _ in $(seq 1 500); do | |
| ss -tln | grep -q ":$TPM_PORT " && break | |
| sleep 0.01 | |
| done | |
| kill -0 "$server_pid" | |
| ss -tln | grep -q ":$TPM_PORT " | |
| cargo test --locked --features swtpm-tests -- --test-threads=1 | |
| - name: Docs | |
| working-directory: ./wrapper/rust/wolftpm | |
| run: cargo doc --locked --no-deps | |
| # Compile-only against the Linux kernel-device transport, so the non-swtpm | |
| # cfg paths and the callback-free open() build are exercised too. | |
| rust-devtpm-compile: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/wolfssl/wolftpm-ci:v1.1 | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Checkout wolfTPM | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: true | |
| - name: Setup wolfSSL | |
| uses: ./.github/actions/setup-wolfssl | |
| with: | |
| ref: master | |
| configure-flags: --enable-wolftpm --enable-pkcallbacks | |
| - name: Build wolfTPM (devtpm) | |
| run: | | |
| ./autogen.sh | |
| ./configure --enable-devtpm | |
| make -j"$(nproc)" | |
| - name: Compile Rust wrapper (no swtpm) | |
| working-directory: ./wrapper/rust/wolftpm | |
| run: cargo build --locked --all-targets | |
| - name: Upload failure logs | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: wolftpm-rust-devtpm-logs | |
| path: | | |
| wrapper/rust/wolftpm/target/debug/build/*/output | |
| retention-days: 5 |