diff --git a/.github/packages/debian-wolfssl.tar.gz b/.github/packages/debian-wolfssl.tar.gz deleted file mode 100644 index f7373b5f..00000000 Binary files a/.github/packages/debian-wolfssl.tar.gz and /dev/null differ diff --git a/.github/workflows/debian-package.yml b/.github/workflows/debian-package.yml index 5e5bb868..2e5a460d 100644 --- a/.github/workflows/debian-package.yml +++ b/.github/workflows/debian-package.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ '*' ] +env: + WOLFSSL_VERSION: master # Can be changed to specific tag like v5.6.4 + jobs: libwolfprov-standalone: runs-on: ubuntu-22.04 @@ -57,16 +60,50 @@ jobs: # List all tags git tag -l + # Cache wolfSSL to speed up builds: + # - Git repository cache: Avoids re-cloning wolfSSL repo + # - Complete build cache: Includes source, built packages, and artifacts + # Cache keys include script hash to invalidate when install script changes + - name: Cache wolfSSL git repository + uses: actions/cache@v4 + with: + path: /tmp/wolfssl-pkg/wolfssl/.git + key: wolfssl-git-${{ env.WOLFSSL_VERSION }}-${{ hashFiles('wolfProvider/debian/install-wolfssl.sh') }}-${{ github.sha }} + restore-keys: | + wolfssl-git-${{ env.WOLFSSL_VERSION }}-${{ hashFiles('wolfProvider/debian/install-wolfssl.sh') }}- + wolfssl-git-${{ env.WOLFSSL_VERSION }}- + + - name: Cache wolfSSL source and build + uses: actions/cache@v4 + with: + path: | + /tmp/wolfssl-pkg/wolfssl + /tmp/wolfssl-pkg/*.deb + /tmp/wolfssl-pkg/*.dsc + /tmp/wolfssl-pkg/*.tar.gz + key: wolfssl-complete-${{ env.WOLFSSL_VERSION }}-${{ hashFiles('wolfProvider/debian/install-wolfssl.sh') }}-${{ github.sha }} + restore-keys: | + wolfssl-complete-${{ env.WOLFSSL_VERSION }}-${{ hashFiles('wolfProvider/debian/install-wolfssl.sh') }}- + - name: Install wolfssl debian package run: | mkdir -p "/tmp/wolfssl-pkg" cd "/tmp/wolfssl-pkg" - # Install wolfssl packages - chmod +x $GITHUB_WORKSPACE/debian/install-wolfssl.sh - $GITHUB_WORKSPACE/debian/install-wolfssl.sh \ - $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz \ - "/tmp/wolfssl-pkg" + # Check if cached packages exist + if ls *.deb 1> /dev/null 2>&1; then + echo "Found cached wolfSSL packages, installing them..." + dpkg -i *.deb || apt-get install -f -y + else + echo "No cached packages found, building from source..." + # Install wolfssl packages with specified version + chmod +x $GITHUB_WORKSPACE/debian/install-wolfssl.sh + if [ "$WOLFSSL_VERSION" != "master" ]; then + $GITHUB_WORKSPACE/debian/install-wolfssl.sh --tag "$WOLFSSL_VERSION" "/tmp/wolfssl-pkg" + else + $GITHUB_WORKSPACE/debian/install-wolfssl.sh "/tmp/wolfssl-pkg" + fi + fi # Create wolfprov-packages directory and move wolfssl files there mkdir -p "/tmp/wolfprov-packages" diff --git a/.github/workflows/libwebsockets.yml b/.github/workflows/libwebsockets.yml index 624a1886..38192d59 100644 --- a/.github/workflows/libwebsockets.yml +++ b/.github/workflows/libwebsockets.yml @@ -73,7 +73,7 @@ jobs: run: | mkdir build cd build - cmake .. + cmake .. -DCMAKE_POLICY_VERSION_MINIMUM=3.5 make -j$(nproc) sudo make install diff --git a/README-packaging.md b/README-packaging.md index 41581fe0..9fb4919e 100644 --- a/README-packaging.md +++ b/README-packaging.md @@ -22,10 +22,32 @@ To use a build from CI for local install, download the artifacts from the Debian ## Install -If not already done, install the WolfSSL Debian package. The non-FIPS version is available in this repo and is installed by the script below. This step is only needed once, and can be done prior to the `build-wolfprovider.sh` step above. +If not already done, install the WolfSSL Debian package. The script below will clone the wolfSSL repository and build packages from source. This step is only needed once, and can be done prior to the `build-wolfprovider.sh` step above. + +Basic usage (builds master branch in temporary directory): +``` +./debian/install-wolfssl.sh +``` + +Build master branch in specific directory: +``` +./debian/install-wolfssl.sh /path/to/working/directory ``` -./debian/install-wolfssl.sh ./.github/packages/debian-wolfssl.tar.gz + +Build specific tag or branch: ``` +./debian/install-wolfssl.sh --tag v5.6.4 +./debian/install-wolfssl.sh --tag v5.6.4 /path/to/working/directory +``` + +Build with debug mode enabled: +``` +./debian/install-wolfssl.sh --debug +./debian/install-wolfssl.sh --debug --tag v5.6.4 +./debian/install-wolfssl.sh --debug --tag v5.6.4 /path/to/working/directory +``` + +The script will automatically detect if wolfSSL is already cloned in the working directory and reuse it. For older tags that don't include debian packaging files, the script will automatically backport the packaging from master. For the script above, some systems may require additional packages: ``` diff --git a/debian/install-wolfssl.sh b/debian/install-wolfssl.sh index 440a9c79..8ed2f859 100755 --- a/debian/install-wolfssl.sh +++ b/debian/install-wolfssl.sh @@ -1,11 +1,11 @@ #!/bin/bash # Script to install wolfSSL packages for Debian -# Checks if packages are already installed and installs appropriate architecture-specific packages +# Clones from git repository and builds from source set -e -# Function to check if packages are installed +# Function to check if packages are already installed check_packages_installed() { if dpkg -l | grep -q "^ii.*libwolfssl " && dpkg -l | grep -q "^ii.*libwolfssl-dev "; then echo "libwolfssl and libwolfssl-dev packages are already installed" @@ -16,109 +16,211 @@ check_packages_installed() { fi } -# Function to install wolfSSL packages -install_wolfssl_packages() { - local wolfssl_tar_path="$1" - local dest_dir="$2" - - if [ ! -f "$wolfssl_tar_path" ]; then - echo "Error: wolfSSL package archive not found at $wolfssl_tar_path" - exit 1 - fi - - # If no destination directory specified, create one using mktemp - if [ -z "$dest_dir" ]; then - dest_dir=$(mktemp -d) - echo "No destination directory specified, created temporary directory: $dest_dir" +# Function to install wolfSSL packages from git +install_wolfssl_from_git() { + local work_dir="$1" + local git_tag="$2" + local debug_mode="$3" + + # If no working directory specified, create one using mktemp + if [ -z "$work_dir" ]; then + work_dir=$(mktemp -d) + echo "No working directory specified, created temporary directory: $work_dir" else - echo "Using specified destination directory: $dest_dir" + echo "Using specified working directory: $work_dir" # Create the directory if it doesn't exist - mkdir -p "$dest_dir" + mkdir -p "$work_dir" fi - - echo "Extracting wolfSSL package to: $dest_dir" - tar -xvf "$wolfssl_tar_path" -C "$dest_dir" - - # Get current architecture - CURRENT_ARCH=$(dpkg --print-architecture) - echo "Current architecture: $CURRENT_ARCH" - - # Look for existing .deb files that match the current architecture - cd "$dest_dir/debian-packages" - MATCHING_DEB_FILES=$(find . -name "*_${CURRENT_ARCH}.deb" -o -name "*_${CURRENT_ARCH}_*.deb" 2>/dev/null || true) - - if [ -n "$MATCHING_DEB_FILES" ]; then - echo "Found matching .deb files for architecture $CURRENT_ARCH:" - echo "$MATCHING_DEB_FILES" - echo "Installing existing .deb files..." - - # Install both libwolfssl and libwolfssl-dev packages for the current architecture - LIBWOLFSSL_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl_[^-]" | head -n1) - LIBWOLFSSL_DEV_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl-dev_" | head -n1) - - if [ -n "$LIBWOLFSSL_DEB" ]; then - echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" - dpkg -i "$LIBWOLFSSL_DEB" - else - echo "No libwolfssl package found for architecture $CURRENT_ARCH" - exit 1 - fi - - if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then - echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" - dpkg -i "$LIBWOLFSSL_DEV_DEB" + + echo "Working directory: $work_dir" + cd "$work_dir" + + # Check if wolfSSL directory already exists + if [ -d "wolfssl" ]; then + echo "Found existing wolfSSL directory, using it..." + cd wolfssl + + # If a specific tag is requested, checkout that tag + if [ -n "$git_tag" ]; then + echo "Checking out tag/branch: $git_tag" + git fetch --tags + git checkout "$git_tag" else - echo "No libwolfssl-dev package found for architecture $CURRENT_ARCH" - exit 1 + echo "Using existing wolfSSL version" fi else - echo "No matching .deb files found for architecture $CURRENT_ARCH, rebuilding from source..." - dpkg-source -x wolfssl*.dsc - cd wolfssl*/ - dpkg-buildpackage -b -us -uc - - # Install both libwolfssl and libwolfssl-dev packages - LIBWOLFSSL_DEB=$(find .. -name "libwolfssl_*${CURRENT_ARCH}.deb" | grep -v "dev" | head -n1) - LIBWOLFSSL_DEV_DEB=$(find .. -name "libwolfssl-dev*_${CURRENT_ARCH}.deb" | head -n1) - - if [ -n "$LIBWOLFSSL_DEB" ]; then - echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" - dpkg -i "$LIBWOLFSSL_DEB" + # Clone wolfSSL repository + echo "Cloning wolfSSL repository..." + if [ -n "$git_tag" ]; then + echo "Cloning specific tag/branch: $git_tag" + git clone https://github.com/wolfSSL/wolfssl + cd wolfssl + git checkout "$git_tag" else - echo "No libwolfssl package found after building for architecture $CURRENT_ARCH" - exit 1 + echo "Cloning master branch with depth 1" + git clone https://github.com/wolfSSL/wolfssl --depth 1 + cd wolfssl fi - - if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then - echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" - dpkg -i "$LIBWOLFSSL_DEV_DEB" + fi + + # Check if debian/rules.in exists, if not, we need to backport debian packaging + if [ ! -f "debian/rules.in" ]; then + echo "debian/rules.in not found, backporting debian packaging from master..." + + # Save current branch/tag + current_ref=$(git rev-parse HEAD) + + # Create a temporary directory for master checkout + temp_master_dir=$(mktemp -d) + cd "$temp_master_dir" + + echo "Cloning master branch to get debian directory..." + git clone https://github.com/wolfSSL/wolfssl master-checkout + cd master-checkout + + # Copy debian directory to our working wolfssl + echo "Copying debian directory from master..." + cp -r debian "$work_dir/wolfssl/" + + # Go back to our working wolfssl directory + cd "$work_dir/wolfssl" + + # Clean up temporary directory + rm -rf "$temp_master_dir" + + # Patch configure.ac to add required substitutions for debian packaging + echo "Patching configure.ac for debian packaging compatibility..." + + # Check if the patch is already applied + if ! grep -q "CONFIGURE_OPTIONS=" configure.ac; then + # Find the location to insert the new lines (before AC_OUTPUT or at the end) + if grep -q "AC_OUTPUT" configure.ac; then + # Insert before AC_OUTPUT + sed -i '/^AC_OUTPUT/i \ +CONFIGURE_OPTIONS="$ac_configure_args"\ +CONFIGURE_CFLAGS="$CFLAGS"\ +AC_SUBST([CONFIGURE_OPTIONS])\ +AC_SUBST([CONFIGURE_CFLAGS])\ +AC_CONFIG_FILES([debian/rules],[chmod +x debian/rules])' configure.ac + else + # Append at the end + echo 'CONFIGURE_OPTIONS="$ac_configure_args"' >> configure.ac + echo 'CONFIGURE_CFLAGS="$CFLAGS"' >> configure.ac + echo 'AC_SUBST([CONFIGURE_OPTIONS])' >> configure.ac + echo 'AC_SUBST([CONFIGURE_CFLAGS])' >> configure.ac + echo 'AC_CONFIG_FILES([debian/rules],[chmod +x debian/rules])' >> configure.ac + fi + echo "configure.ac patched successfully" else - echo "No libwolfssl-dev package found after building for architecture $CURRENT_ARCH" - exit 1 + echo "configure.ac already contains required patches" fi + else + echo "debian/rules.in found, using existing debian packaging" fi + + # Run autogen.sh + echo "Running autogen.sh..." + ./autogen.sh + + # Comment out part of test that fails with option -DACVP_VECTOR_TESTING + # This is because ACVP_VECTOR_TESTING disables the erasing of output if + # authTag check fails. But the test is checking for the erasure. + echo "Fixing test.c for DACVP_VECTOR_TESTING compatibility..." + sed -i "/^[[:space:]]*if (XMEMCMP(p2, c2, sizeof(p2)))/{ s/^[[:space:]]*/&\/\/ /; n; s/^[[:space:]]*/&\/\/ /; }" wolfcrypt/test/test.c + + # Configure with the specified options + echo "Configuring wolfSSL with specified options..." + configure_opts="--enable-opensslcoexist --enable-cmac --with-eccminsz=192 --enable-ed25519 --enable-ed448 --enable-md5 --enable-curve25519 --enable-curve448 --enable-aesccm --enable-aesxts --enable-aescfb --enable-keygen --enable-shake128 --enable-shake256 --enable-wolfprovider --enable-rsapss --enable-scrypt" + + if [ "$debug_mode" = "true" ]; then + configure_opts="$configure_opts --enable-debug" + echo "Debug mode enabled" + fi + + ./configure $configure_opts CFLAGS="-DWOLFSSL_OLD_OID_SUM -DWOLFSSL_PUBLIC_ASN -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DWOLFSSL_DH_EXTRA -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DWOLFSSL_PUBLIC_MP -DWOLFSSL_RSA_KEY_CHECK -DHAVE_FFDHE_Q -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DWOLFSSL_ECDSA_DETERMINISTIC_K -DWOLFSSL_VALIDATE_ECC_IMPORT -DRSA_MIN_SIZE=1024 -DHAVE_AES_ECB -DWC_RSA_DIRECT -DWC_RSA_NO_PADDING -DACVP_VECTOR_TESTING -DWOLFSSL_ECDSA_SET_K" + + # Build Debian packages + echo "Building Debian packages..." + make deb + + # Install the generated packages + echo "Installing generated .deb packages..." + dpkg -i ../*.deb + + echo "WolfSSL installation from git completed successfully" } # Main execution main() { - local wolfssl_tar_path="$1" - local dest_dir="$2" - - if [ -z "$wolfssl_tar_path" ]; then - echo "Usage: $0 [destination-directory]" - echo " If destination-directory is not specified, a temporary directory will be created using mktemp" - exit 1 - fi - + local work_dir="" + local git_tag="" + local debug_mode="false" + + # Parse command line arguments + while [[ $# -gt 0 ]]; do + case $1 in + -h|--help) + echo "Usage: $0 [options] [working-directory]" + echo " Installs wolfSSL from git repository by cloning, configuring, and building .deb packages" + echo "" + echo "Options:" + echo " -t, --tag TAG Clone and build specific tag or branch (default: master)" + echo " -d, --debug Enable debug build mode (adds --enable-debug)" + echo " -h, --help Show this help message" + echo "" + echo "Arguments:" + echo " working-directory Directory to use for build (default: temporary directory)" + echo "" + echo "Examples:" + echo " $0 # Build master in temp directory" + echo " $0 /tmp/build # Build master in /tmp/build" + echo " $0 --tag v5.6.4 # Build tag v5.6.4 in temp directory" + echo " $0 --tag v5.6.4 /tmp/build # Build tag v5.6.4 in /tmp/build" + echo " $0 --debug # Build master with debug enabled" + echo " $0 --debug --tag v5.6.4 # Build tag v5.6.4 with debug enabled" + exit 0 + ;; + -t|--tag) + git_tag="$2" + shift 2 + ;; + -d|--debug) + debug_mode="true" + shift + ;; + -*) + echo "Unknown option: $1" >&2 + echo "Use --help for usage information" >&2 + exit 1 + ;; + *) + if [ -z "$work_dir" ]; then + work_dir="$1" + else + echo "Too many arguments" >&2 + echo "Use --help for usage information" >&2 + exit 1 + fi + shift + ;; + esac + done + echo "Checking if wolfSSL packages are already installed..." if check_packages_installed; then echo "Packages already installed, exiting successfully" exit 0 fi - - echo "Installing wolfSSL packages..." - install_wolfssl_packages "$wolfssl_tar_path" "$dest_dir" - + + echo "Installing wolfSSL packages from git repository..." + if [ -n "$git_tag" ]; then + echo "Building wolfSSL tag/branch: $git_tag" + else + echo "Building wolfSSL master branch" + fi + + install_wolfssl_from_git "$work_dir" "$git_tag" "$debug_mode" + echo "WolfSSL installation completed successfully" }