Allow SubjectInfoAccess extension without id-ad-caRepository entry #10972
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Ubuntu-Macos-Windows Tests | |
| # START OF COMMON SECTION | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # END OF COMMON SECTION | |
| jobs: | |
| # Ubuntu config matrix. macOS is covered separately by make_check_macos | |
| # below with a curated subset; configs here either have equivalent macOS | |
| # coverage there or exercise no Darwin-specific code. | |
| make_check_linux: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: [ | |
| # Add new configs here | |
| '', | |
| '--enable-all --enable-asn=template', | |
| '--enable-all --enable-asn=original', | |
| '--enable-all --enable-asn=template CPPFLAGS=-DWOLFSSL_OLD_OID_SUM', | |
| '--enable-all --enable-asn=original CPPFLAGS=-DWOLFSSL_OLD_OID_SUM', | |
| '--enable-harden-tls', | |
| '--enable-tls13 --enable-session-ticket --enable-dtls --enable-dtls13 | |
| --enable-opensslextra --enable-sessioncerts | |
| CPPFLAGS=''-DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE | |
| -DWOLFSSL_TICKET_HAVE_ID -DHAVE_EX_DATA -DSESSION_CACHE_DYNAMIC_MEM'' ', | |
| '--enable-all --enable-secure-renegotiation', | |
| '--enable-all --enable-haproxy --enable-quic', | |
| '--enable-dtls --enable-dtls13 --enable-earlydata | |
| --enable-session-ticket --enable-psk | |
| CPPFLAGS=''-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME'' ', | |
| '--enable-all --enable-dtls13 --enable-dtls-frag-ch --disable-mlkem', | |
| '--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation | |
| --enable-psk --enable-aesccm --enable-nullcipher | |
| CPPFLAGS=-DWOLFSSL_STATIC_RSA', | |
| '--enable-she=extended --enable-cryptocb --enable-cryptocbutils | |
| CPPFLAGS=''-DWC_SHE_SW_DEFAULT'' ', | |
| '--enable-she=standard --enable-cmac', | |
| '--enable-she=extended --enable-cmac --enable-cryptocb --enable-cryptocbutils', | |
| '--enable-she=standard --enable-cmac CPPFLAGS=''-DNO_WC_SHE_IMPORT_M123'' ', | |
| '--enable-she=extended --enable-cmac --enable-cryptocb --enable-cryptocbutils | |
| CPPFLAGS=''-DNO_WC_SHE_GETUID -DNO_WC_SHE_GETCOUNTER -DNO_WC_SHE_EXPORTKEY'' ', | |
| '--enable-she=standard --enable-cmac --enable-cryptocb --enable-cryptocbutils | |
| CPPFLAGS=''-DWC_SHE_SW_DEFAULT'' ', | |
| '--enable-all CPPFLAGS=''-DNO_AES_192 -DNO_AES_256'' ', | |
| '--enable-sniffer --enable-curve25519 --enable-curve448 --enable-enckeys | |
| CPPFLAGS=-DWOLFSSL_DH_EXTRA', | |
| '--enable-dtls --enable-dtls13 --enable-dtls-frag-ch | |
| --enable-dtls-mtu CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS', | |
| '--enable-opensslall --enable-opensslextra CPPFLAGS=-DWC_RNG_SEED_CB', | |
| '--enable-opensslall --enable-opensslextra | |
| CPPFLAGS=''-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID'' ', | |
| '--enable-opensslextra CPPFLAGS=''-DWOLFSSL_NO_CA_NAMES'' ', | |
| '--enable-opensslextra=x509small', | |
| '--disable-sys-ca-certs', | |
| '--enable-all CPPFLAGS=-DWOLFSSL_DEBUG_CERTS ', | |
| '--enable-all CPPFLAGS="-DWOLFSSL_CHECK_MEM_ZERO"', | |
| '--enable-dtls --enable-dtls13 --enable-ocspstapling --enable-ocspstapling2 | |
| --enable-cert-setup-cb --enable-sessioncerts', | |
| '--enable-dtls --enable-dtls13 --enable-tls13 | |
| CPPFLAGS=-DWOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC', | |
| '--enable-all --enable-certgencache', | |
| '--enable-all --enable-dilithium --enable-cryptocb --enable-cryptocbutils --enable-pkcallbacks', | |
| '--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"', | |
| '--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey', | |
| '--enable-cryptocb --enable-keygen --enable-cryptocbutils CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"', | |
| '--enable-cryptocb --enable-keygen --enable-aesgcm --enable-cryptocbutils=setkey,free CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"', | |
| '--enable-cryptocb --enable-keygen --enable-cryptocbutils=export', | |
| '--enable-cryptocb --enable-keygen CPPFLAGS="-DWOLF_CRYPTO_CB_EXPORT_KEY"', | |
| '--enable-cryptocb --enable-keygen --enable-aesgcm --enable-cryptocbutils=setkey,free,export CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"', | |
| '--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey,export CPPFLAGS="-DWOLF_CRYPTO_CB_FIND"', | |
| 'CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH', | |
| 'CPPFLAGS=''-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH''', | |
| 'CPPFLAGS=''-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH''', | |
| '--enable-all CPPFLAGS=-DNO_WOLFSSL_CLIENT', | |
| '--enable-all CPPFLAGS=-DNO_WOLFSSL_SERVER', | |
| '--enable-all CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH', | |
| '--enable-all CPPFLAGS=''-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH''', | |
| '--enable-all CPPFLAGS=''-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH''', | |
| '--enable-ocsp --enable-ocsp-responder --enable-ocspstapling CPPFLAGS="-DWOLFSSL_NONBLOCK_OCSP" --enable-maxfragment', | |
| '--enable-all CPPFLAGS=-DWOLFSSL_HASH_KEEP', | |
| '--enable-all --enable-writedup', | |
| '--enable-ascon --enable-experimental', | |
| '--enable-ascon CPPFLAGS=-DWOLFSSL_ASCON_UNROLL --enable-experimental', | |
| # PKCS#7 with RSA-PSS (CMS RSASSA-PSS signers) | |
| '--enable-pkcs7 CPPFLAGS=-DWC_RSA_PSS', | |
| # PKCS#7 without RSA-PSS | |
| '--enable-pkcs7', | |
| 'CPPFLAGS=''-DWOLFSSL_EXTRA'' ', | |
| '--enable-coding=no', | |
| '--disable-sni --disable-ecc --disable-tls13 --disable-secure-renegotiation-info', | |
| 'CPPFLAGS=-DWOLFSSL_BLIND_PRIVATE_KEY', | |
| '--enable-sessionexport --enable-dtls --enable-dtls13', | |
| '--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"', | |
| '--disable-tls --enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"', | |
| '--enable-cryptocb --enable-keygen CPPFLAGS="-DWOLF_CRYPTO_CB_FIND"', | |
| '--disable-examples CPPFLAGS=-DWOLFSSL_NO_MALLOC', | |
| 'CPPFLAGS=-DNO_WOLFSSL_CLIENT', | |
| 'CPPFLAGS=-DNO_WOLFSSL_SERVER', | |
| '--enable-lms=small,verify-only --enable-xmss=small,verify-only', | |
| '--enable-curve25519=nonblock --enable-ecc=nonblock --enable-sp=yes,nonblock CPPFLAGS="-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"', | |
| '--enable-certreq --enable-certext --enable-certgen --disable-secure-renegotiation-info CPPFLAGS="-DNO_TLS"', | |
| ] | |
| name: make check linux | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: ubuntu-24.04 | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 14 | |
| steps: | |
| - name: Build and test wolfSSL | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| configure: CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE" ${{ matrix.config }} | |
| check: true | |
| # Curated macOS subset. Each config exists for a Darwin-specific reason; | |
| # do not add entries that only re-test platform-agnostic crypto already | |
| # covered by the corresponding Linux run. | |
| make_check_macos: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: [ | |
| # Default build: --enable-sys-ca-certs is auto-on on macOS, so | |
| # this exercises Apple keychain / system trust loading in | |
| # src/ssl_load.c that has no Linux equivalent. | |
| '', | |
| # Broad key-crypto + Security.framework + opensslextra in one run | |
| # (RSA, ECC, AES, SHA-2/3, ChaCha20-Poly1305, Curve25519/448, HMAC, | |
| # sniffer, DTLS, OCSP, ...). Note: --enable-all does NOT enable | |
| # cryptocb or SHE, so those have their own entries below. | |
| '--enable-all --enable-asn=template', | |
| # Validates the configure-time auto-enable override and that the | |
| # build compiles out the Security.framework code path cleanly -- | |
| # macOS is the only OS where sys-ca-certs is auto-on by default. | |
| '--disable-sys-ca-certs', | |
| # DTLS over BSD sockets on Darwin: connection-ID, fragmented | |
| # ClientHello, secure renegotiation, PSK, AES-CCM, null cipher -- | |
| # exercises recvmsg/MTU/datagram handling that differs from Linux. | |
| '--enable-dtls --enable-dtlscid --enable-dtls13 --enable-secure-renegotiation | |
| --enable-psk --enable-aesccm --enable-nullcipher | |
| CPPFLAGS=-DWOLFSSL_STATIC_RSA', | |
| # Crypto-callback dispatcher under Apple clang. Not covered by | |
| # --enable-all; verifies the cryptocb find/setkey/keygen path | |
| # compiles and runs on the macOS toolchain. | |
| '--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey', | |
| ] | |
| name: make check macos | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: macos-latest | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 14 | |
| steps: | |
| - name: Build and test wolfSSL | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| configure: CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE" ${{ matrix.config }} | |
| check: true | |
| # Run on both OSes: the user_settings.h header-driven build path is | |
| # distinct from the autotools-driven --enable-all path in | |
| # make_check_linux / make_check_macos, and macOS-specific guard ordering | |
| # (e.g. WOLFSSL_SYS_CA_CERTS pulling in Security.framework) needs to be | |
| # exercised under Apple clang here. | |
| make_user_settings: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ ubuntu-24.04, macos-latest ] | |
| user-settings: [ | |
| # Add new user_settings.h here | |
| 'examples/configs/user_settings_all.h', | |
| ] | |
| name: make user_setting.h | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: ${{ matrix.os }} | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 14 | |
| steps: | |
| - name: Build and test wolfSSL | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| configure: --enable-usersettings | |
| check: true | |
| user-settings: ${{ matrix.user-settings }} | |
| make_user_settings_testwolfcrypt: | |
| # testwolfcrypt runs pure crypto tests with no platform-specific | |
| # features, so Linux-only is sufficient for these user_settings. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| user-settings: [ | |
| # Add new user_settings.h here (alphabetical order) | |
| 'examples/configs/user_settings_ca.h', | |
| 'examples/configs/user_settings_dtls13.h', | |
| 'examples/configs/user_settings_EBSnet.h', | |
| 'examples/configs/user_settings_eccnonblock.h', | |
| 'examples/configs/user_settings_curve25519nonblock.h', | |
| 'examples/configs/user_settings_min_ecc.h', | |
| 'examples/configs/user_settings_openssl_compat.h', | |
| 'examples/configs/user_settings_pkcs7.h', | |
| 'examples/configs/user_settings_rsa_only.h', | |
| 'examples/configs/user_settings_template.h', | |
| 'examples/configs/user_settings_tls12.h', | |
| 'examples/configs/user_settings_tls13.h', | |
| 'examples/configs/user_settings_wolfboot_keytools.h', | |
| 'examples/configs/user_settings_wolfssh.h', | |
| 'examples/configs/user_settings_wolftpm.h', | |
| # Not included (require special setup): | |
| # - user_settings_pq.h: Requires --enable-experimental | |
| # - user_settings_baremetal.h: Requires static memory, custom platform | |
| ] | |
| name: make user_setting.h (testwolfcrypt only) | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: ubuntu-24.04 | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 14 | |
| steps: | |
| - name: Build and test wolfSSL | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| configure: --enable-usersettings --disable-examples | |
| check: false | |
| user-settings: ${{ matrix.user-settings }} | |
| - name: Run wolfcrypt/test/testwolfcrypt | |
| run: ./wolfcrypt/test/testwolfcrypt | |
| # Has to be dedicated function due to the sed call. | |
| # Platform-agnostic; --enable-all macOS coverage in make_check_macos and | |
| # the macOS user_settings_all.h run in make_user_settings already cover | |
| # the equivalent code paths on Darwin. | |
| make_user_all: | |
| name: make user_setting.h (with sed) | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: ubuntu-24.04 | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: ./autogen.sh | |
| - name: user_settings_all.h with compatibility layer | |
| run: | | |
| cp ./examples/configs/user_settings_all.h user_settings.h | |
| sed -i -e "s/if 0/if 1/" user_settings.h | |
| ./configure --enable-usersettings | |
| make -j | |
| make check | |
| windows_build: | |
| name: Windows Build Test | |
| if: github.repository_owner == 'wolfssl' | |
| runs-on: windows-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [ x64, Win32, ARM64 ] | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 6 | |
| env: | |
| # Path to the solution file relative to the root of the project. | |
| SOLUTION_FILE_PATH: wolfssl64.sln | |
| # Configuration type to build. | |
| # You can convert this to a build matrix if you need coverage of multiple configuration types. | |
| # https://docs.github.com/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix | |
| BUILD_CONFIGURATION: Release | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Add MSBuild to PATH | |
| uses: microsoft/setup-msbuild@v2 | |
| - name: Restore NuGet packages | |
| working-directory: ${{env.GITHUB_WORKSPACE}} | |
| run: nuget restore ${{env.SOLUTION_FILE_PATH}} | |
| - name: Build | |
| working-directory: ${{env.GITHUB_WORKSPACE}} | |
| # Add additional options to the MSBuild command line here (like platform or verbosity level). | |
| # See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference | |
| run: msbuild /m /p:PlatformToolset=v142 /p:Platform=${{matrix.arch}} /p:Configuration=${{env.BUILD_CONFIGURATION}} ${{env.SOLUTION_FILE_PATH}} | |
| - if: ${{ matrix.arch != 'ARM64' }} | |
| name: Run Test | |
| working-directory: ${{env.GITHUB_WORKSPACE}} | |
| run: Release/${{matrix.arch}}/testsuite.exe |