Fix CK_ULONG length truncation in C_GenerateRandom and C_SeedRandom #662
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # wolfPKCS11 Clang-Tidy Static Analysis Workflow | |
| # | |
| # This workflow performs comprehensive static analysis on the wolfPKCS11 codebase | |
| # using clang-tidy to identify potential bugs, performance issues, and code quality | |
| # problems across different build configurations. | |
| # | |
| # Features: | |
| # - Matrix build testing both standard and TPM-enabled configurations | |
| # - Parallel analysis for improved performance | |
| # - Comprehensive check configuration covering security, performance, and readability | |
| # - Artifact upload for detailed review of analysis results | |
| # - Non-blocking analysis (warnings don't fail builds) | |
| # | |
| # Configurations tested: | |
| # 1. Standard Build - Default wolfPKCS11 configuration | |
| # 2. TPM Build - wolfPKCS11 with TPM support via wolfTPM and IBM TPM simulator | |
| # | |
| # The workflow generates detailed reports and summaries available as artifacts | |
| # for each configuration, enabling developers to review and address identified issues. | |
| name: wolfPKCS11 Clang-Tidy Analysis | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| jobs: | |
| clang-tidy: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: "Standard Build" | |
| configure_flags: "" | |
| - name: "NSS Build" | |
| configure_flags: "--enable-nss" | |
| - name: "TPM Build" | |
| configure_flags: "--enable-tpm" | |
| - name: "NSS+TPM Build" | |
| configure_flags: "--enable-nss --enable-tpm" | |
| - name: "PKCS#11 V3.2 PQC Build" | |
| configure_flags: "--enable-pkcs11v32 --enable-mldsa --enable-mlkem" | |
| steps: | |
| # Checkout wolfPKCS11 | |
| - uses: actions/checkout@v4 | |
| # Install build dependencies | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| build-essential \ | |
| autoconf \ | |
| automake \ | |
| libtool \ | |
| clang \ | |
| clang-tidy \ | |
| pkg-config \ | |
| git \ | |
| libnss3-dev \ | |
| libnspr4-dev | |
| # Build and install wolfSSL | |
| - name: Build and install wolfSSL | |
| run: | | |
| git clone https://github.com/wolfSSL/wolfssl.git | |
| cd wolfssl | |
| ./autogen.sh | |
| ./configure --enable-cryptocb --enable-aescfb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --enable-md5 \ | |
| --enable-mldsa C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -DHAVE_AES_KEYWRAP" | |
| make -j$(nproc) | |
| sudo make install | |
| sudo ldconfig | |
| cd .. | |
| # Setup IBM Software TPM (only if TPM enabled) | |
| - name: Setup IBM Software TPM | |
| if: contains(matrix.config.configure_flags, '--enable-tpm') | |
| run: | | |
| git clone https://github.com/kgoldman/ibmswtpm2.git | |
| cd ibmswtpm2/src | |
| make | |
| ./tpm_server & | |
| cd ../.. | |
| # Build and install wolfTPM (only if TPM enabled) | |
| - name: Build and install wolfTPM | |
| if: contains(matrix.config.configure_flags, '--enable-tpm') | |
| run: | | |
| git clone https://github.com/wolfSSL/wolftpm.git | |
| cd wolftpm | |
| ./autogen.sh | |
| ./configure --enable-swtpm | |
| make -j$(nproc) | |
| sudo make install | |
| sudo ldconfig | |
| cd .. | |
| # Install bear to generate compilation database | |
| - name: Install bear | |
| run: | | |
| sudo apt-get install -y bear | |
| # Configure and build wolfPKCS11 to generate compilation database | |
| - name: Configure and build wolfPKCS11 (${{ matrix.config.name }}) | |
| run: | | |
| ./autogen.sh | |
| if [ -n "${{ matrix.config.configure_flags }}" ]; then | |
| CC=clang CXX=clang++ ./configure --enable-all --enable-debug ${{ matrix.config.configure_flags }} | |
| else | |
| CC=clang CXX=clang++ ./configure --enable-all --enable-debug | |
| fi | |
| bear -- make -j$(nproc) | |
| # Run clang-tidy analysis | |
| - name: Run clang-tidy (${{ matrix.config.name }}) | |
| run: | | |
| # Find source files to analyze (prioritize main source files) | |
| echo "Finding source files to analyze..." | |
| find src wolfpkcs11 -name "*.c" -type f | sort > files_to_check.txt | |
| find src wolfpkcs11 -name "*.h" -type f | sort >> files_to_check.txt | |
| # Run clang-tidy analysis | |
| echo "Running clang-tidy analysis..." | |
| clang-tidy -p . --config-file=.clang-tidy $(cat files_to_check.txt) \ | |
| > clang-tidy-report.txt 2>&1 | |
| # Display the report (limit output to avoid log overflow) | |
| echo "=== Clang-Tidy Analysis Results (First 100 lines) ===" | |
| if [ -s clang-tidy-report.txt ]; then | |
| head -100 clang-tidy-report.txt | |
| TOTAL_LINES=$(wc -l < clang-tidy-report.txt) | |
| if [ "$TOTAL_LINES" -gt 100 ]; then | |
| echo "... (truncated, full report available in artifacts - $TOTAL_LINES total lines)" | |
| fi | |
| else | |
| echo "No issues found or clang-tidy produced no output" | |
| fi | |
| # Count issues with proper error handling to avoid string concatenation | |
| WARNINGS=0 | |
| ERRORS=0 | |
| NOTES=0 | |
| FILES_ANALYZED=0 | |
| if [ -s clang-tidy-report.txt ]; then | |
| WARNINGS=$(grep -c ": warning:" clang-tidy-report.txt 2>/dev/null) || WARNINGS=0 | |
| ERRORS=$(grep -c ": error:" clang-tidy-report.txt 2>/dev/null) || ERRORS=0 | |
| NOTES=$(grep -c ": note:" clang-tidy-report.txt 2>/dev/null) || NOTES=0 | |
| # Also try to parse "X warnings generated" format | |
| GENERATED_WARNINGS=$(grep -o "[0-9]\+ warnings generated" clang-tidy-report.txt 2>/dev/null | sed 's/ warnings generated//' | paste -sd+ | bc 2>/dev/null) || GENERATED_WARNINGS=0 | |
| # Use the higher warning count | |
| if [ "$GENERATED_WARNINGS" -gt "$WARNINGS" ]; then | |
| WARNINGS=$GENERATED_WARNINGS | |
| fi | |
| fi | |
| if [ -s files_to_check.txt ]; then | |
| FILES_ANALYZED=$(wc -l < files_to_check.txt 2>/dev/null) || FILES_ANALYZED=0 | |
| fi | |
| echo "" | |
| echo "=== Analysis Summary ===" | |
| echo "Files analyzed: $FILES_ANALYZED" | |
| echo "Warnings: $WARNINGS" | |
| echo "Errors: $ERRORS" | |
| echo "Notes: $NOTES" | |
| # Create a summary for the build | |
| echo "Configuration: ${{ matrix.config.name }}" >> clang-tidy-summary.txt | |
| echo "Files analyzed: $FILES_ANALYZED" >> clang-tidy-summary.txt | |
| echo "Warnings: $WARNINGS" >> clang-tidy-summary.txt | |
| echo "Errors: $ERRORS" >> clang-tidy-summary.txt | |
| echo "Notes: $NOTES" >> clang-tidy-summary.txt | |
| echo "Timestamp: $(date)" >> clang-tidy-summary.txt | |
| echo "---" >> clang-tidy-summary.txt | |
| # Set exit code based on error count (fail the build on errors) | |
| # Note: Only fail on actual errors, not warnings | |
| if [ "$ERRORS" -gt 0 ]; then | |
| echo "Found $ERRORS clang-tidy errors - failing build" | |
| exit 1 | |
| else | |
| echo "No clang-tidy errors found - build passing (warnings are informational)" | |
| fi | |
| # Cleanup temporary files | |
| rm -f files_to_check.txt | |
| echo "Clang-tidy analysis completed" | |
| # Upload test logs on failure | |
| - name: Upload failure logs | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-logs-${{ matrix.config.name }} | |
| path: | | |
| clang-tidy-summary.txt | |
| clang-tidy-report.txt | |
| test-suite.log | |
| config.log | |
| retention-days: 5 |