os-check-linux.json

[
{"name": "record-size-limit",
 "comment": "RFC 8449 on its own. --enable-all covers it alongside everything else; this is the minimal build, which is where the extension's own guards get exercised.",
 "configure": ["--enable-recordsizelimit"]},
{"name": "record-size-limit-tls12",
 "comment": "RFC 8449 defines the extension for TLS 1.2 too, where the server answers in the ServerHello. Guards the parse dispatch staying outside the WOLFSSL_TLS13 block.",
 "configure": ["--enable-recordsizelimit", "--disable-tls13"]},
{"name": "signed-cert-timestamp",
 "comment": "RFC 6962 on its own.",
 "configure": ["--enable-sct"]},
{"name": "signed-cert-timestamp-tls12",
 "comment": "RFC 6962 is a TLS 1.2 extension that TLS 1.3 relocated, so it must build with TLS 1.3 off. Guards the dispatch case staying outside the WOLFSSL_TLS13 block, and TLSX_SetResponse() staying behind NO_WOLFSSL_SERVER.",
 "configure": ["--enable-sct", "--disable-tls13"]},
{"name": "cert-compression",
 "comment": "RFC 8879 on its own, with the zlib it requires.",
 "configure": ["--enable-certcomp", "--with-libz"]},
{"name": "cert-compression-no-client-auth",
 "comment": "Server-only build without client auth: DoTls13CompressedCertificate() calls a static function guarded on exactly this combination, so it is the config that catches the guard drifting.",
 "configure": ["--enable-certcomp", "--with-libz",
  "CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "user-settings-all-compat", "minutes": 9.5,
 "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
 "user_settings": "examples/configs/user_settings_all.h",
 "cflags": "",
 "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
{"name": "all-no-client-auth", "minutes": 9.0,
 "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "all-public-mp", "minutes": 8.0,
 "comment": "--enable-all plus WOLFSSL_PUBLIC_MP. The shared-secret-at-infinity regression assertion needs direct mp access to plant an out-of-range scalar, because the import path itself now rejects one; without this the assertion is compiled out of every mainstream build.",
 "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_PUBLIC_MP"]},
{"name": "all-dilithium-cryptocb", "minutes": 8.9,
 "configure": ["--enable-all", "--enable-dilithium", "--enable-cryptocb",
  "--enable-cryptocbutils", "--enable-pkcallbacks"]},
{"name": "all-haproxy-quic", "minutes": 8.6,
 "configure": ["--enable-all", "--enable-haproxy", "--enable-quic"]},
{"name": "all-asn-template-old-oid-sum", "minutes": 8.5,
 "configure": ["--enable-all", "--enable-asn=template", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
{"name": "all-asn-original-old-oid-sum", "minutes": 8.4,
 "configure": ["--enable-all", "--enable-asn=original", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]},
{"name": "all-asn-original", "minutes": 8.3,
 "configure": ["--enable-all", "--enable-asn=original"]},
{"name": "all-certgencache", "minutes": 8.3,
 "configure": ["--enable-all", "--enable-certgencache"]},
{"name": "all-certsigncb", "minutes": 8.3,
 "comment": "Only --enable-certsigncb sets WOLFSSL_CERT_SIGN_CB, so without this entry wc_SignCert_cb() and its test are never compiled anywhere in CI. Minutes is seeded from the sibling --enable-all entries; refresh from a run's step summary.",
 "configure": ["--enable-all", "--enable-certsigncb"]},
{"name": "all-dtls13-frag-ch-no-mlkem", "minutes": 8.2,
 "configure": ["--enable-all", "--enable-dtls13", "--enable-dtls-frag-ch",
  "--disable-mlkem"]},
{"name": "all-ecc-blind-k", "minutes": 8.0,
 "comment": "Only entry that sets WOLFSSL_ECC_BLIND_K (the blind-private-key entry sets WOLFSSL_BLIND_PRIVATE_KEY, which does not imply it). Keeps the read-only wc_ecc_key_get_priv() contract exercised in CI. pkcs11 is on because wc_pkcs11.c is not compiled anywhere else in this matrix.",
 "configure": ["--enable-all", "--enable-pkcs11",
  "CPPFLAGS=-DWOLFSSL_ECC_BLIND_K"]},
{"name": "all-check-mem-zero", "minutes": 7.9,
 "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO"]},
{"name": "all-faultharden-pk-privkey", "minutes": 7.8,
 "comment": "Test holding private key in the PK callback with fault harden.  Based on existing customer use case.",
 "configure": ["--enable-all", "--enable-faultharden", "--enable-pkcallbacks", "CPPFLAGS=-DTEST_PK_PRIVKEY"]},
{"name": "all-secure-renegotiation", "minutes": 7.8,
 "configure": ["--enable-all", "--enable-secure-renegotiation"]},
{"name": "all-debug-certs", "minutes": 7.8,
 "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]},
{"name": "all-hash-keep", "minutes": 7.8,
 "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]},
{"name": "all-no-aes-192-256", "minutes": 7.5,
 "configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]},
{"name": "all-no-pkcs7-stream", "minutes": 7.0,
 "comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.",
 "configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]},
{"name": "all-writedup", "minutes": 6.9,
 "configure": ["--enable-all", "--enable-writedup"]},
{"name": "all-no-server", "minutes": 5.0,
 "configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
{"name": "nonblock-sp-c32", "minutes": 5.0,
 "comment": "Same but forcing SP_WORD_SIZE=32 to exercise sp_c32.c on a 64-bit host; the two builds together cover both generated variants of mod_exp_<words>_nb / RSA / DH wrappers.",
 "configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
  "--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
  "CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM -DSP_WORD_SIZE=32"]},
{"name": "all-no-server-no-client-auth", "minutes": 4.8,
 "configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "all-no-client-no-client-auth", "minutes": 4.4,
 "configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "all-no-client", "minutes": 4.2,
 "configure": ["--enable-all", "CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
{"name": "nonblock-sp-c64", "minutes": 4.2,
 "comment": "Non-blocking ECC/Curve25519/RSA/DH on the host default SP word size (sp_c64.c on x86_64); RSA/DH non-block require RSA_LOW_MEM (the CRT path is not supported in non-block mode).",
 "configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock",
  "--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock",
  "CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM"]},
{"name": "all-asn-template", "minutes": 3.5,
 "configure": ["--enable-all", "--enable-asn=template"]},
{"name": "tls13-dtls13-session-misc", "minutes": 3.3,
 "configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls",
  "--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts",
  "CPPFLAGS=-DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE -DWOLFSSL_TICKET_HAVE_ID -DHAVE_EX_DATA -DSESSION_CACHE_DYNAMIC_MEM"]},
{"name": "dtls-cid-renego-psk", "minutes": 3.3,
 "configure": ["--enable-dtls", "--enable-dtlscid", "--enable-dtls13",
  "--enable-secure-renegotiation", "--enable-psk", "--enable-aesccm",
  "--enable-nullcipher", "CPPFLAGS=-DWOLFSSL_STATIC_RSA"]},
{"name": "dtls13-ocspstapling-cert-cb", "minutes": 3.1,
 "configure": ["--enable-dtls", "--enable-dtls13", "--enable-ocspstapling",
  "--enable-ocspstapling2", "--enable-cert-setup-cb", "--enable-sessioncerts"]},
{"name": "tsp-verifier", "minutes": 3,
 "comment": "Time-Stamp Protocol Verifier",
 "configure": ["--enable-tsp", "--enable-opensslall",
 "CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]},
{"name": "dtls13-earlydata-psk-no-hrr", "minutes": 2.9,
 "configure": ["--enable-dtls", "--enable-dtls13", "--enable-earlydata",
  "--enable-session-ticket", "--enable-psk", "CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME"]},
{"name": "ocsp-responder-nonblock-maxfrag", "minutes": 2.8,
 "configure": ["--enable-ocsp", "--enable-ocsp-responder", "--enable-ocspstapling",
  "CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP", "--enable-maxfragment"]},
{"name": "dtls-records-span-datagrams", "minutes": 2.7,
 "configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch",
  "--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]},
{"name": "tsp-min-hash-str", "minutes": 2.7,
 "comment": "Time-Stamp Protocol Minimum 128-bit hash strength",
 "configure": ["--enable-tsp",
 "CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]},
{"name": "opensslextra-no-ca-names", "minutes": 2.6,
 "configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_CA_NAMES"]},
{"name": "sessionexport-dtls13", "minutes": 2.6,
 "configure": ["--enable-sessionexport", "--enable-dtls", "--enable-dtls13"]},
{"name": "lms-xmss-verify-only", "minutes": 2.5,
 "configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]},
{"name": "sp-4096-m32", "minutes": 1.2,
 "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
 "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"],
 "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
 "ldflags": "-m32"},
{"name": "opensslall-rng-seed-cb", "minutes": 2.2,
 "configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]},
{"name": "opensslall-ecc-zero-hash", "minutes": 2.2,
 "configure": ["--enable-opensslall", "--enable-ecc", "CPPFLAGS=-DWC_ALLOW_ECC_ZERO_HASH"]},
{"name": "she-ext-cmac-no-she-misc", "minutes": 2.2,
 "configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
  "--enable-cryptocbutils",
  "CPPFLAGS=-DNO_WC_SHE_GETUID -DNO_WC_SHE_GETCOUNTER -DNO_WC_SHE_EXPORTKEY"]},
{"name": "she-std-cmac-cryptocb-sw-default", "minutes": 2.2,
 "configure": ["--enable-she=standard", "--enable-cmac", "--enable-cryptocb",
  "--enable-cryptocbutils", "CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
{"name": "sniffer-curves-enckeys", "minutes": 2.2,
 "configure": ["--enable-sniffer", "--enable-curve25519", "--enable-curve448",
  "--enable-enckeys", "CPPFLAGS=-DWOLFSSL_DH_EXTRA"]},
{"name": "sniffer-keylog-storedata", "minutes": 2.5,
 "comment": "The sniffer keylog legs of scripts/sniffer-testsuite.test only run with WOLFSSL_SNIFFER_KEYLOGFILE, and the store data callback path is only compiled with WOLFSSL_SNIFFER_STORE_DATA_CB. Neither is set by any other entry.",
 "configure": ["--enable-sniffer", "--enable-session-ticket",
  "--enable-curve25519", "--enable-ed25519",
  "CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DWOLFSSL_SNIFFER_STORE_DATA_CB"]},
{"name": "sniffer-no-enc-then-mac", "minutes": 2.2,
 "comment": "The sniffer cannot read a capture that negotiated RFC 7366 without Encrypt-Then-MAC support, and says so through a dedicated error. That arm, and the assertion for it in scripts/sniffer-testsuite.test, are only compiled here.",
 "configure": ["--enable-sniffer", "--enable-enc-then-mac=no"]},
{"name": "sniffer-threaded", "minutes": 2.5,
 "comment": "snifftest with worker threads. Session tickets are deliberately left off: snifftest pins itself to a single worker when they are enabled, so this is the only way the concurrent path is exercised.",
 "configure": ["--enable-sniffer", "--enable-curve25519", "--enable-ed25519",
  "CPPFLAGS=-DWOLFSSL_SNIFFER_KEYLOGFILE -DTHREADED_SNIFFTEST"]},
{"name": "cryptocb-keygen-utils-aes-setkey", "minutes": 2.2,
 "configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils",
  "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
{"name": "cryptocb-utils-setkey-free", "minutes": 2.2,
 "configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
  "--enable-cryptocbutils=setkey,free", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
{"name": "cryptocb-keygen-utils-export", "minutes": 2.2,
 "configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=export"]},
{"name": "cryptocb-keygen-export-key", "minutes": 2.2,
 "configure": ["--enable-cryptocb", "--enable-keygen",
  "CPPFLAGS=-DWOLF_CRYPTO_CB_EXPORT_KEY"]},
{"name": "cryptocb-utils-setkey-export-find", "minutes": 2.2,
 "configure": ["--enable-cryptocb", "--enable-keygen",
  "--enable-cryptocbutils=setkey,export", "CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
{"name": "cryptocb-shake", "minutes": 2.2,
 "comment": "Exercises the SHAKE128/SHAKE256 crypto callback wiring (wc_CryptoCb_Shake, the sha3.c Update/Final hooks, and the dedicated offload unit tests). cryptocbutils=copy,free adds the Copy/Free dispatch, which must see WC_HASH_TYPE_SHAKE* (not NONE) from SHAKE contexts. A normal (non-ONLY) cryptocb build keeps the host software SHA3/SHAKE present as the callbacks' offload fallback.",
 "configure": ["--enable-cryptocb", "--enable-sha3",
  "--enable-shake128", "--enable-shake256",
  "--enable-cryptocbutils=copy,free"]},
{"name": "cryptocb-aes-cfb-ofb", "minutes": 2.2,
 "comment": "Exercises the AES-CFB/OFB crypto callback wiring (wc_CryptoCb_AesCfb/Ofb Encrypt/Decrypt, the aes.c hooks, and the dedicated offload unit tests). A normal (non-ONLY) cryptocb build keeps the host software AES present as the callbacks' offload fallback; WOLF_CRYPTO_CB_ONLY_AES (no software fallback) is covered separately by cryptocb-only.yml via swdev.",
 "configure": ["--enable-cryptocb", "--enable-aescfb",
  "--enable-aesofb", "--enable-aesctr"]},
{"name": "cryptocb-hooks-check-mem-zero", "minutes": 2.2,
 "comment": "Ed448/CMAC/RSA-PSS crypto callback hooks under WOLFSSL_CHECK_MEM_ZERO. The Ed448 sign hook returns early past the secret-buffer registration, which a cryptocb build without this define does not catch.",
 "configure": ["--enable-cryptocb", "--enable-ed448", "--enable-cmac",
  "--enable-rsapss", "--enable-keygen",
  "CPPFLAGS=-DWOLFSSL_CHECK_MEM_ZERO -DWOLF_CRYPTO_CB_FREE -DWOLF_CRYPTO_CB_RSA_PAD"]},
{"name": "opensslall-rng-seed-cb-no-getpid", "minutes": 2.1,
 "configure": ["--enable-opensslall", "--enable-opensslextra",
  "CPPFLAGS=-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID"]},
{"name": "dtls13-ignore-pt-alert", "minutes": 2.1,
 "configure": ["--enable-dtls", "--enable-dtls13", "--enable-tls13",
  "CPPFLAGS=-DWOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC"]},
{"name": "cryptocb-utils-setkey-free-export", "minutes": 2.1,
 "configure": ["--enable-cryptocb", "--enable-keygen", "--enable-aesgcm",
  "--enable-cryptocbutils=setkey,free,export", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
{"name": "cryptocb-aesgcm-setkey-free", "minutes": 2.1,
 "configure": ["--enable-cryptocb", "--enable-aesgcm",
  "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
{"name": "ecies-sec1-gcm-static-nonce", "minutes": 2.0,
 "comment": "ECIES with the AES-GCM DEM in the default SEC1 IV mode; WOLFSSL_ECIES_STATIC_GCM_NONCE opts into the fixed-nonce GCM path so the GCM KAT/round-trip and cryptocb tests run.",
 "configure": ["--enable-eccencrypt", "--enable-aesgcm", "--enable-aesctr",
  "--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
  "CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
{"name": "ecies-geniv-gcm-static-nonce", "minutes": 2.0,
 "comment": "Same ECIES-GCM coverage in the WOLFSSL_ECIES_GEN_IV mode (random embedded nonce).",
 "configure": ["--enable-eccencrypt=geniv", "--enable-aesgcm", "--enable-aesctr",
  "--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
  "CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
{"name": "ecies-old-gcm-static-nonce", "minutes": 2.0,
 "comment": "Same ECIES-GCM coverage in the legacy WOLFSSL_ECIES_OLD mode (KDF-derived nonce, no ephemeral pubkey prepended).",
 "configure": ["--enable-eccencrypt=old", "--enable-aesgcm", "--enable-aesctr",
  "--enable-x963kdf", "--enable-cryptocb", "--enable-keygen",
  "CPPFLAGS=-DWOLFSSL_ECIES_STATIC_GCM_NONCE"]},
{"name": "opensslextra-x509small", "minutes": 2.0,
 "configure": ["--enable-opensslextra=x509small"]},
{"name": "cryptocb-keygen-find", "minutes": 2.0,
 "configure": ["--enable-cryptocb", "--enable-keygen", "CPPFLAGS=-DWOLF_CRYPTO_CB_FIND"]},
{"name": "user-settings-all", "minutes": 2.0,
 "comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.",
 "user_settings": "examples/configs/user_settings_all.h",
 "cflags": "",
 "configure": ["--enable-usersettings"]},
{"name": "she-ext-cryptocb-sw-default", "minutes": 1.9,
 "configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils",
  "CPPFLAGS=-DWC_SHE_SW_DEFAULT"]},
{"name": "cryptocb-aesgcm-aes-setkey", "minutes": 1.9,
 "configure": ["--enable-cryptocb", "--enable-aesgcm",
  "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY"]},
{"name": "cryptocb-keygen-utils-setkey", "minutes": 1.9,
 "configure": ["--enable-cryptocb", "--enable-keygen", "--enable-cryptocbutils=setkey"]},
{"name": "pkcs7-rsa-pss", "minutes": 1.9,
 "comment": "PKCS#7 with RSA-PSS (CMS RSASSA-PSS signers)",
 "configure": ["--enable-pkcs7", "CPPFLAGS=-DWC_RSA_PSS"]},
{"name": "blind-private-key", "minutes": 1.9,
 "configure": ["CPPFLAGS=-DWOLFSSL_BLIND_PRIVATE_KEY"]},
{"name": "certgen-no-tls", "minutes": 1.9,
 "configure": ["--enable-certreq", "--enable-certext", "--enable-certgen",
  "--disable-secure-renegotiation-info", "CPPFLAGS=-DNO_TLS"]},
{"name": "no-sys-ca-certs", "minutes": 1.8, "configure": ["--disable-sys-ca-certs"]},
{"name": "no-client-auth", "minutes": 1.8,
 "configure": ["CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "harden-tls", "minutes": 1.7, "configure": ["--enable-harden-tls"]},
{"name": "no-sni-ecc-tls13-scr-info", "minutes": 1.7,
 "configure": ["--disable-sni", "--disable-ecc", "--disable-tls13",
  "--disable-secure-renegotiation-info"]},
{"name": "default", "minutes": 1.6},
{"name": "aeskeywrap-padding", "minutes": 1.6,
 "comment": "RFC 5649 AES key wrap with padding; exercises the =padding sub-option (not pulled in by --enable-all).",
 "configure": ["--enable-aeskeywrap=padding"]},
{"name": "aeskeywrap-padding-cryptocb", "minutes": 1.6,
 "comment": "Key wrap (RFC 3394 + RFC 5649) over WOLF_CRYPTO_CB device offload; runs test_wc_CryptoCb_AesKeyWrap.",
 "configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding"]},
{"name": "aeskeywrap-padding-cryptocb-ecb", "minutes": 1.6,
 "comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).",
 "configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]},
{"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6,
 "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
 "configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding",
  "--disable-sha512", "--disable-sha384",
  "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"],
 "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
 "ldflags": "-m32"},
{"name": "no-client-no-client-auth", "minutes": 1.6,
 "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "ascon-experimental", "minutes": 1.6,
 "configure": ["--enable-ascon", "--enable-experimental"]},
{"name": "ascon-unroll-experimental", "minutes": 1.6,
 "configure": ["--enable-ascon", "CPPFLAGS=-DWOLFSSL_ASCON_UNROLL",
  "--enable-experimental"]},
{"name": "wolfssl-extra", "minutes": 1.6, "configure": ["CPPFLAGS=-DWOLFSSL_EXTRA"]},
{"name": "coding-no", "minutes": 1.5, "configure": ["--enable-coding=no"]},
{"name": "she-ext-cmac-cryptocb", "minutes": 1.3,
 "configure": ["--enable-she=extended", "--enable-cmac", "--enable-cryptocb",
  "--enable-cryptocbutils"]},
{"name": "she-std-cmac-no-import-m123", "minutes": 1.3,
 "configure": ["--enable-she=standard", "--enable-cmac",
  "CPPFLAGS=-DNO_WC_SHE_IMPORT_M123"]},
{"name": "pkcs7", "minutes": 1.3,
 "comment": "PKCS#7 without RSA-PSS",
 "configure": ["--enable-pkcs7"]},
{"name": "tsp", "minutes": 1.3,
 "comment": "Time-Stamp Protocol",
 "configure": ["--enable-tsp"]},
{"name": "tsp-openssl", "minutes": 1.3,
 "comment": "Time-Stamp Protocol with OpenSSL compat",
 "configure": ["--enable-tsp", "--enable-opensslall"]},
{"name": "tsp-no-ecc", "minutes": 1.3,
 "comment": "Time-Stamp Protocol without ECC",
 "configure": ["--enable-tsp", "--disable-ecc"]},
{"name": "tsp-no-rsa", "minutes": 1.3,
 "comment": "Time-Stamp Protocol without RSA",
 "configure": ["--enable-tsp", "--disable-rsa"]},
{"name": "tsp-smallstack", "minutes": 1.3,
 "comment": "Time-Stamp Protocol Small Stack",
 "configure": ["--enable-tsp", "CPPFLAGS=-DWOLFSSL_SMALL_STACK"]},
{"name": "tsp-requester", "minutes": 1.3,
 "comment": "Time-Stamp Protocol Requester",
 "configure": ["--enable-tsp", "--enable-opensslall",
 "CPPFLAGS=-DWOLFSSL_TSP_REQUESTER"]},
{"name": "tsp-responder", "minutes": 1.3,
 "comment": "Time-Stamp Protocol Responder",
 "configure": ["--enable-tsp", "--enable-opensslall",
 "CPPFLAGS=-DWOLFSSL_TSP_RESPONDER"]},
{"name": "no-tls-cryptocb-aesgcm-setkey-free", "minutes": 1.3,
 "configure": ["--disable-tls", "--enable-cryptocb", "--enable-aesgcm",
  "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]},
{"name": "she-std-cmac", "minutes": 1.2,
 "configure": ["--enable-she=standard", "--enable-cmac"]},
{"name": "no-verify-oid-fpki", "minutes": 1.2,
 "configure": ["CPPFLAGS=-DNO_VERIFY_OID -DWOLFSSL_FPKI"]},
{"name": "no-verify-oid", "minutes": 1.1, "configure": ["CPPFLAGS=-DNO_VERIFY_OID"]},
{"name": "rng-seed-device", "minutes": 1.1,
 "comment": "Seed the RNG from a nominated device. /dev/urandom stands in for a hardware RNG so the WC_RNG_SEED_DEVICE read path is actually exercised on a runner.",
 "configure": ["--with-rng-seed-device=/dev/urandom"]},
{"name": "rng-seed-device-fallback", "minutes": 1.1,
 "comment": "Nominated seed device that cannot be opened, so every test runs through the fallback to the default seed sources.",
 "configure": ["--with-rng-seed-device=/nonexistent/hwrng"]},
{"name": "no-server-no-client-auth", "minutes": 1.0,
 "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
{"name": "no-wolfssl-client", "minutes": 1.0,
 "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
{"name": "testwolfcrypt-ca", "minutes": 1.0,
 "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
 "user_settings": "examples/configs/user_settings_ca.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-dtls13", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_dtls13.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-ebsnet", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_EBSnet.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-eccnonblock", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_eccnonblock.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_curve25519nonblock.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-embedded", "minutes": 1.0,
 "comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.",
 "user_settings": "examples/configs/user_settings_embedded.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0,
 "comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.",
 "user_settings": "examples/configs/user_settings_embedded.h",
 "cflags": "",
 "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]],
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0,
 "comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.",
 "user_settings": "examples/configs/user_settings_embedded.h",
 "cflags": "",
 "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]],
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0,
 "comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.",
 "user_settings": "examples/configs/user_settings_embedded.h",
 "cflags": "",
 "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]],
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0,
 "comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.",
 "user_settings": "examples/configs/user_settings_embedded.h",
 "cflags": "",
 "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]],
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-min-ecc", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_min_ecc.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-openssl-compat", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_openssl_compat.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-pkcs7", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_pkcs7.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-pq", "minutes": 1.0,
 "comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.",
 "user_settings": "examples/configs/user_settings_pq.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-rsa-only", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_rsa_only.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-template", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_template.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-tls12", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_tls12.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-tls13", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_tls13.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_wolfboot_keytools.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-wolfssh", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_wolfssh.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"name": "testwolfcrypt-wolftpm", "minutes": 1.0,
 "user_settings": "examples/configs/user_settings_wolftpm.h",
 "cflags": "",
 "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
{"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs",
 "name": "no-asn-strict-certs",
 "configure": ["--enable-testcert", "--enable-opensslextra", "--enable-certgen",
  "--enable-certreq", "--enable-certext", "--enable-ecc",
  "CPPFLAGS=-DWOLFSSL_NO_ASN_STRICT -DWOLFSSL_CUSTOM_OID -DHAVE_OID_ENCODING -DWOLFSSL_ALT_NAMES"]},
{"comment": "wolfSSL <= 5.9.0 DTLS 1.3 legacy_session_id echo compatibility shim",
 "name": "dtls13-echo-legacy-session-id",
 "configure": ["--enable-dtls", "--enable-dtls13", "--enable-session-ticket",
  "--enable-ecc", "CPPFLAGS=-DWOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID"]},
{"name": "x509-tiny",
 "comment": "Minimal-extension X.509 profile.",
 "configure": ["--enable-ecc", "--enable-rsapss",
  "CPPFLAGS=-DWOLFSSL_X509_TINY"]},
{"name": "x509-tiny-addbacks",
 "comment": "TINY profile with extension add-backs enabled directly.",
 "configure": ["--enable-ecc",
  "CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]},
{"name": "tls13-psk-no-certs",
 "comment": "NO_CERTS reached through --disable-asn, with TLS 1.3 PSK still available. psk.yml's static-psk-lowresource-tls13 already covers NO_CERTS with PSK but disables DH, so it only reaches psk_ke; this one leaves DH on and covers psk_dhe_ke. First NO_CERTS entry in this list.",
 "configure": ["--enable-psk", "--disable-rsa", "--disable-ecc", "--disable-asn"]},
{"name": "no-wolfssl-server", "minutes": 0.9,
 "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]},
{"name": "dtls13-client-minimal", "minutes": 0.9,
 "comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.",
 "configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa",
  "--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5",
  "--disable-chacha", "--disable-poly1305", "--disable-errorstrings",
  "--disable-asn-print", "--disable-eccshamir", "--disable-base64encode",
  "--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384",
  "--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
  "--enable-sp=smallec256", "--disable-sp-asm",
  "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
 "configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
{"name": "no-examples-no-malloc", "minutes": 0.8,
 "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]},
{"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3,
 "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.",
 "configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519",
  "--enable-keygen", "--disable-examples",
  "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"],
 "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"},
{"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false,
 "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.",
 "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource",
  "--disable-crypttests", "--disable-examples"]},
{"name": "pkcs12-pbkdf-mp-api", "minutes": 1.0,
 "comment": "WC_PKCS12_PBKDF_USING_MP_API selects a second wc_PKCS12_PBKDF_ex implementation that no configure option reaches.",
 "configure": ["--enable-pkcs12", "--enable-des3", "--enable-opensslextra",
  "CPPFLAGS=-DWC_PKCS12_PBKDF_USING_MP_API"]},
{"name": "no-session-cache-session-ticket", "minutes": 0.8,
 "comment": "Session tickets with the internal session cache compiled out, over TLS 1.3 and DTLS 1.3. This is what a Zephyr build produces from CONFIG_WOLFSSL_SESSION_CACHE=n with tickets left on, and it used to fail to link. HAVE_EXT_CACHE is set because NO_SESSION_CACHE with an external cache is the one combination where the ticket-session free path keeps its external-cache branch, and --enable-wpas with --enable-lowresource reaches it. Examples are off because tests/unit.test calls the session APIs that NO_SESSION_CACHE removes, so this entry is compile coverage for the library.",
 "configure": ["--enable-session-ticket", "--enable-dtls", "--enable-dtls13",
  "--disable-examples",
  "CPPFLAGS=-DNO_SESSION_CACHE -DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE"]},
{"name": "lowresource-tls13-session-ticket", "minutes": 0.8,
 "comment": "--enable-lowresource defines NO_SESSION_CACHE, so this reaches the src/internal.c no-cache ticket paths purely through configure options, with no CPPFLAGS to get wrong. It does not cover src/dtls.c, whose TlsSessionIdIsValid needs WOLFSSL_DTLS_NO_HVR_ON_RESUME, so no-session-cache-session-ticket is the entry for that and the two are not interchangeable. Examples are off for the same reason as that entry.",
 "configure": ["--enable-lowresource", "--enable-tls13", "--enable-session-ticket",
  "--disable-examples"]}
]