From f20a2616f75b4b5b1366ff123d691ed9700b1b36 Mon Sep 17 00:00:00 2001 From: Test User Date: Mon, 13 Oct 2025 11:50:34 -0700 Subject: [PATCH 1/3] Add debian pacakge creation nightly test --- .../build-wolfprovider-debian-nightly.yml | 57 ++++ .../workflows/build-wolfprovider-debian.yml | 259 ++++++++++++++++++ 2 files changed, 316 insertions(+) create mode 100644 .github/workflows/build-wolfprovider-debian-nightly.yml create mode 100644 .github/workflows/build-wolfprovider-debian.yml diff --git a/.github/workflows/build-wolfprovider-debian-nightly.yml b/.github/workflows/build-wolfprovider-debian-nightly.yml new file mode 100644 index 00000000..cddcd681 --- /dev/null +++ b/.github/workflows/build-wolfprovider-debian-nightly.yml @@ -0,0 +1,57 @@ +name: Build wolfProvider Nightly + +on: + push: + branches: [ 'master', 'main', 'build-debian-test', 'release/**' ] + pull_request: + branches: [ '*' ] + schedule: + # Jenkins: 2AM UTC nightly - Actual nightly build + # GitHub Actions: 3AM UTC nightly - Update build in github + - cron: "0 3 * * *" + workflow_dispatch: + inputs: + wolfssl_ref: + description: 'wolfSSL ref (tag/branch)' + required: false + default: 'v5.8.2-stable' + type: string + openssl_ref: + description: 'OpenSSL ref (tag/branch)' + required: false + default: 'openssl-3.5.2' + type: string + fips_ref: + description: 'Build type' + required: false + default: 'both' + type: choice + options: + - 'both' + - 'FIPS' + - 'non-FIPS' + replace_default: + description: 'Replace default provider' + required: false + default: true + type: boolean + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + build_wolfprovider: + name: Build wolfProvider + uses: ./.github/workflows/build-wolfprovider-debian.yml + strategy: + matrix: + # When manually triggered with 'both', or on schedule, build both FIPS and non-FIPS + # When manually triggered with specific type, only build that type + fips_ref: ${{ (github.event_name == 'schedule' || github.event.inputs.fips_ref == 'both' || github.event.inputs.fips_ref == '') && fromJSON('["FIPS", "non-FIPS"]') || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }} + with: + wolfssl_ref: ${{ github.event.inputs.wolfssl_ref || 'v5.8.2-stable' }} + openssl_ref: ${{ github.event.inputs.openssl_ref || 'openssl-3.5.2' }} + fips_ref: ${{ matrix.fips_ref }} + replace_default: ${{ github.event.inputs.replace_default != 'false' }} + secrets: inherit diff --git a/.github/workflows/build-wolfprovider-debian.yml b/.github/workflows/build-wolfprovider-debian.yml new file mode 100644 index 00000000..d6224067 --- /dev/null +++ b/.github/workflows/build-wolfprovider-debian.yml @@ -0,0 +1,259 @@ +name: Build wolfProvider + +on: + workflow_call: + inputs: + wolfssl_ref: + required: true + type: string + openssl_ref: + required: true + type: string + fips_ref: + required: true + type: string + replace_default: + required: false + type: boolean + default: false + +jobs: + build_wolfprovider: + name: Build wolfProvider (${{ inputs.fips_ref }}) + runs-on: ubuntu-22.04 + # Run inside Debian Bookworm to match packaging environment + container: + image: debian:bookworm + env: + DEBIAN_FRONTEND: noninteractive + timeout-minutes: 30 + env: + WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages + OPENSSL_PACKAGES_PATH: /tmp/openssl-packages + WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages + steps: + # Install minimal dependencies for Jenkins interaction + - name: Install minimal dependencies + run: | + apt-get update && apt-get install -y --no-install-recommends \ + curl \ + ca-certificates \ + libdistro-info-perl \ + jq + + # Trigger Jenkins to build all packages (wolfSSL, OpenSSL, wolfProvider) + # Skip for pull_request events as they don't have access to secrets + - name: Trigger Jenkins build + if: github.event_name != 'pull_request' + id: trigger + shell: bash + run: | + JOB_URL="https://cloud.wolfssl-test.com/jenkins/job/wolfProvider/job/debian-extraction" + JENKINS_BASE="https://cloud.wolfssl-test.com/jenkins" + + echo "Jenkins URL: $JENKINS_BASE" + echo "Job URL: $JOB_URL" + + # Test authentication first + echo "Testing Jenkins authentication..." + AUTH_TEST=$(curl -s -o /dev/null -w "%{http_code}" \ + "$JENKINS_BASE/api/json" \ + --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}") + echo "Auth test status: $AUTH_TEST" + + if [ "$AUTH_TEST" != "200" ]; then + echo "ERROR: Authentication failed (status: $AUTH_TEST)" + exit 1 + fi + + # Get CSRF token (crumb) first + echo "Getting CSRF token..." + CRUMB=$(curl -s \ + "$JENKINS_BASE/crumbIssuer/api/json" \ + --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" | jq -r '.crumb') + + if [ "$CRUMB" = "null" ] || [ -z "$CRUMB" ]; then + echo "ERROR: Failed to get CSRF token" + exit 1 + fi + + # Mask the crumb token to prevent leakage + echo "::add-mask::$CRUMB" + echo "CSRF token obtained" + + # Try simple build first (without parameters) + echo "Trying simple build trigger..." + SIMPLE_URL="${JOB_URL}/build" + echo "Simple URL: $SIMPLE_URL" + + RESPONSE=$(curl -s -X POST -i \ + "$SIMPLE_URL?token=${{ secrets.JENKINS_API_TOKEN }}" \ + --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" \ + -H "Jenkins-Crumb: $CRUMB") + + # Check if simple build worked + HTTP_STATUS=$(echo "$RESPONSE" | grep -i "^HTTP" | head -1) + echo "Simple build status: $HTTP_STATUS" + + # If simple build failed, try with parameters + if [[ "$HTTP_STATUS" == *"500"* ]] || [[ "$HTTP_STATUS" == *"400"* ]]; then + echo "Simple build failed, trying with parameters..." + FULL_JOB_URL="${JOB_URL}/buildWithParameters" + echo "Parameters URL: $FULL_JOB_URL" + + # Try with form data instead of query parameters + RESPONSE=$(curl -s -X POST -i \ + "$FULL_JOB_URL" \ + --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" \ + -H "Jenkins-Crumb: $CRUMB" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "token=${{ secrets.JENKINS_API_TOKEN }}") + fi + + # Show response for debugging + echo "Response headers:" + echo "$RESPONSE" | head -10 + + # Extract Location header (queue item URL) + QUEUE_URL=$(echo "$RESPONSE" | grep -i "^location:" | awk '{print $2}' | tr -d '\r') + + if [ -z "$QUEUE_URL" ]; then + echo "ERROR: Failed to get queue URL from Jenkins" + HTTP_STATUS=$(echo "$RESPONSE" | grep -i "^HTTP" | head -1) + echo "HTTP Status: $HTTP_STATUS" + echo "Response body (first 500 chars):" + echo "$RESPONSE" | tail -n +20 | head -c 500 + exit 1 + fi + + echo "Jenkins job queued successfully" + echo "Queue URL: $QUEUE_URL" + echo "Waiting for job to start..." + + # Wait for job to move from queue to actual build + BUILD_URL="" + for i in {1..30}; do + echo "Checking queue status (attempt $i/30)..." + QUEUE_STATUS=$(curl -s "$QUEUE_URL/api/json" --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" | jq -r '.executable.url // empty') + + if [ -n "$QUEUE_STATUS" ] && [ "$QUEUE_STATUS" != "null" ]; then + BUILD_URL="$QUEUE_STATUS" + echo "Build started: $BUILD_URL" + break + fi + + echo "Still in queue..." + sleep 10 + done + + if [ -z "$BUILD_URL" ]; then + echo "ERROR: Job did not start within 5 minutes" + exit 1 + fi + + # Check status until build finishes + echo "Checking build status..." + while true; do + STATUS=$(curl -s "$BUILD_URL/api/json" --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" | jq -r '.result') + if [[ "$STATUS" == "SUCCESS" ]]; then + echo "Jenkins build succeeded." + echo "build_url=$BUILD_URL" >> $GITHUB_OUTPUT + break + elif [[ "$STATUS" == "FAILURE" ]]; then + echo "Jenkins build failed!" + exit 1 + elif [[ "$STATUS" == "null" ]]; then + echo "Build still running..." + sleep 20 + else + echo "Unknown status: $STATUS" + sleep 10 + fi + done + + - name: Download all packages from Jenkins + if: github.event_name != 'pull_request' + shell: bash + run: | + echo "Downloading packages from Jenkins build..." + echo "Build URL: ${{ steps.trigger.outputs.build_url }}" + + # Get list of all artifacts + echo "Getting artifact list..." + ARTIFACTS_JSON=$(curl -s "${{ steps.trigger.outputs.build_url }}/api/json" --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" | jq '.artifacts') + + # Show all available artifacts + echo "All available artifacts:" + echo "$ARTIFACTS_JSON" | jq -r '.[] | .fileName' | sort + + # Download based on build type (FIPS or non-FIPS) + BUILD_TYPE="${{ inputs.fips_ref }}" + echo "" + echo "Downloading packages for: $BUILD_TYPE" + + # Determine the pattern to match based on build type + if [ "$BUILD_TYPE" = "FIPS" ]; then + # For FIPS: match files with "-fips" or ".fips." but NOT "nonfips" + FILTER_PATTERN="contains(\"fips\") and (contains(\"nonfips\") | not)" + else + # For non-FIPS: match files with "nonfips" OR files without "fips" at all + FILTER_PATTERN="contains(\"nonfips\") or (contains(\"fips\") | not)" + fi + + # Get all package files for this build type + ALL_PACKAGES=$(echo "$ARTIFACTS_JSON" | jq -r ".[] | select(.fileName | $FILTER_PATTERN) | .fileName") + + # Create directory for downloaded packages + mkdir -p ./downloaded-packages + + # Download all packages + echo "$ALL_PACKAGES" | while read -r file; do + if [ -n "$file" ] && [ "$file" != "null" ]; then + echo " Downloading: $file" + curl -u "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" -L -o "./downloaded-packages/$file" \ + "${{ steps.trigger.outputs.build_url }}/artifact/artifacts/$file" + fi + done + + echo "" + echo "Downloaded files:" + ls -lh ./downloaded-packages/ + + - name: Organize packages into directories + if: github.event_name != 'pull_request' + run: | + # Create package directories + mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }} + mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }} + mkdir -p ${{ env.WOLFPROV_PACKAGES_PATH }} + + echo "Organizing packages..." + # Copy wolfSSL packages (libwolfssl*) + cp ./downloaded-packages/libwolfssl* ${{ env.WOLFSSL_PACKAGES_PATH }}/ 2>/dev/null || echo "No wolfSSL packages found" + + # Copy OpenSSL packages (openssl*, libssl*) + cp ./downloaded-packages/openssl* ${{ env.OPENSSL_PACKAGES_PATH }}/ 2>/dev/null || true + cp ./downloaded-packages/libssl* ${{ env.OPENSSL_PACKAGES_PATH }}/ 2>/dev/null || true + + # Copy wolfProvider packages (libwolfprov*) + cp ./downloaded-packages/libwolfprov* ${{ env.WOLFPROV_PACKAGES_PATH }}/ 2>/dev/null || true + + echo "Package organization complete!" + echo "wolfSSL packages:" + ls -lh ${{ env.WOLFSSL_PACKAGES_PATH }} 2>/dev/null || echo " (none)" + echo "OpenSSL packages:" + ls -lh ${{ env.OPENSSL_PACKAGES_PATH }} 2>/dev/null || echo " (none)" + echo "wolfProvider packages:" + ls -lh ${{ env.WOLFPROV_PACKAGES_PATH }} 2>/dev/null || echo " (none)" + + # Save all packages as artifacts for consumers + - name: Upload all packages (wolfSSL, OpenSSL, wolfProvider) + if: github.event_name != 'pull_request' + uses: actions/upload-artifact@v4 + with: + name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }} + path: | + ${{ env.WOLFSSL_PACKAGES_PATH }} + ${{ env.OPENSSL_PACKAGES_PATH }} + ${{ env.WOLFPROV_PACKAGES_PATH }} + retention-days: 1 From 1e8f2f7e63ca5aefe073b295e195ef87723dd0de Mon Sep 17 00:00:00 2001 From: Test User Date: Mon, 13 Oct 2025 13:29:15 -0700 Subject: [PATCH 2/3] Add better config and dont fail if other fail --- .../build-wolfprovider-debian-nightly.yml | 22 +++++++++++-------- .../workflows/build-wolfprovider-debian.yml | 2 +- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-wolfprovider-debian-nightly.yml b/.github/workflows/build-wolfprovider-debian-nightly.yml index cddcd681..8bfbb852 100644 --- a/.github/workflows/build-wolfprovider-debian-nightly.yml +++ b/.github/workflows/build-wolfprovider-debian-nightly.yml @@ -1,10 +1,6 @@ name: Build wolfProvider Nightly on: - push: - branches: [ 'master', 'main', 'build-debian-test', 'release/**' ] - pull_request: - branches: [ '*' ] schedule: # Jenkins: 2AM UTC nightly - Actual nightly build # GitHub Actions: 3AM UTC nightly - Update build in github @@ -22,7 +18,7 @@ on: default: 'openssl-3.5.2' type: string fips_ref: - description: 'Build type' + description: 'FIPS Type' required: false default: 'both' type: choice @@ -31,10 +27,14 @@ on: - 'FIPS' - 'non-FIPS' replace_default: - description: 'Replace default provider' + description: 'Replace Default Type' required: false - default: true - type: boolean + default: 'true' + type: choice + options: + - 'both' + - 'true' + - 'false' # Currently we dont support debian builds without replace-default concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -45,13 +45,17 @@ jobs: name: Build wolfProvider uses: ./.github/workflows/build-wolfprovider-debian.yml strategy: + fail-fast: false # Continue other builds even if some fail matrix: # When manually triggered with 'both', or on schedule, build both FIPS and non-FIPS # When manually triggered with specific type, only build that type fips_ref: ${{ (github.event_name == 'schedule' || github.event.inputs.fips_ref == 'both' || github.event.inputs.fips_ref == '') && fromJSON('["FIPS", "non-FIPS"]') || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }} + # When manually triggered with 'both', or on schedule, build both replace-default variants + # When manually triggered with specific value, only build that variant + replace_default: ${{ (github.event_name == 'schedule' || github.event.inputs.replace_default == 'both' || github.event.inputs.replace_default == '') && fromJSON('["true", "false"]') || fromJSON(format('["{0}"]', github.event.inputs.replace_default)) }} with: wolfssl_ref: ${{ github.event.inputs.wolfssl_ref || 'v5.8.2-stable' }} openssl_ref: ${{ github.event.inputs.openssl_ref || 'openssl-3.5.2' }} fips_ref: ${{ matrix.fips_ref }} - replace_default: ${{ github.event.inputs.replace_default != 'false' }} + replace_default: ${{ matrix.replace_default == 'true' }} secrets: inherit diff --git a/.github/workflows/build-wolfprovider-debian.yml b/.github/workflows/build-wolfprovider-debian.yml index d6224067..9a6f3b9e 100644 --- a/.github/workflows/build-wolfprovider-debian.yml +++ b/.github/workflows/build-wolfprovider-debian.yml @@ -19,7 +19,7 @@ on: jobs: build_wolfprovider: - name: Build wolfProvider (${{ inputs.fips_ref }}) + name: Build wolfProvider (${{ inputs.fips_ref }}${{ inputs.replace_default && ', replace-default' || '' }}) runs-on: ubuntu-22.04 # Run inside Debian Bookworm to match packaging environment container: From b5e73e7cb48eee9b5b97987c2a1c0b9a1bafe3b9 Mon Sep 17 00:00:00 2001 From: Test User Date: Wed, 15 Oct 2025 14:12:53 -0700 Subject: [PATCH 3/3] Add updated debian nightly --- .../build-wolfprovider-debian-nightly.yml | 39 +-- .../workflows/build-wolfprovider-debian.yml | 235 +++++++++++++----- 2 files changed, 200 insertions(+), 74 deletions(-) diff --git a/.github/workflows/build-wolfprovider-debian-nightly.yml b/.github/workflows/build-wolfprovider-debian-nightly.yml index 8bfbb852..194bde35 100644 --- a/.github/workflows/build-wolfprovider-debian-nightly.yml +++ b/.github/workflows/build-wolfprovider-debian-nightly.yml @@ -1,4 +1,4 @@ -name: Build wolfProvider Nightly +name: Nightly Build wolfProvider on: schedule: @@ -18,7 +18,7 @@ on: default: 'openssl-3.5.2' type: string fips_ref: - description: 'FIPS Type' + description: 'Build type' required: false default: 'both' type: choice @@ -27,35 +27,40 @@ on: - 'FIPS' - 'non-FIPS' replace_default: - description: 'Replace Default Type' + description: 'Replace default provider' required: false - default: 'true' - type: choice - options: - - 'both' - - 'true' - - 'false' # Currently we dont support debian builds without replace-default + default: true + type: boolean + build_packages: + description: 'build fresh via Jenkins (true) or use downloaded packages (false)' + required: false + type: boolean + default: true concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: - build_wolfprovider: - name: Build wolfProvider + build_wolfprovider_debian: + name: Build wolfProvider Debian + # Only run Jenkins builds on schedule/dispatch from protected branches + if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target' }} uses: ./.github/workflows/build-wolfprovider-debian.yml strategy: - fail-fast: false # Continue other builds even if some fail matrix: # When manually triggered with 'both', or on schedule, build both FIPS and non-FIPS # When manually triggered with specific type, only build that type - fips_ref: ${{ (github.event_name == 'schedule' || github.event.inputs.fips_ref == 'both' || github.event.inputs.fips_ref == '') && fromJSON('["FIPS", "non-FIPS"]') || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }} - # When manually triggered with 'both', or on schedule, build both replace-default variants - # When manually triggered with specific value, only build that variant - replace_default: ${{ (github.event_name == 'schedule' || github.event.inputs.replace_default == 'both' || github.event.inputs.replace_default == '') && fromJSON('["true", "false"]') || fromJSON(format('["{0}"]', github.event.inputs.replace_default)) }} + fips_ref: >- + ${{ (github.event_name == 'schedule' + || github.event.inputs.fips_ref == 'both' + || github.event.inputs.fips_ref == '') + && fromJSON('["FIPS", "non-FIPS"]') + || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }} with: wolfssl_ref: ${{ github.event.inputs.wolfssl_ref || 'v5.8.2-stable' }} openssl_ref: ${{ github.event.inputs.openssl_ref || 'openssl-3.5.2' }} fips_ref: ${{ matrix.fips_ref }} - replace_default: ${{ matrix.replace_default == 'true' }} + replace_default: ${{ github.event.inputs.replace_default != 'false' }} + build_packages: ${{ github.event.inputs.build_packages == 'true' }} secrets: inherit diff --git a/.github/workflows/build-wolfprovider-debian.yml b/.github/workflows/build-wolfprovider-debian.yml index 9a6f3b9e..336162a8 100644 --- a/.github/workflows/build-wolfprovider-debian.yml +++ b/.github/workflows/build-wolfprovider-debian.yml @@ -1,4 +1,4 @@ -name: Build wolfProvider +name: Build wolfProvider Debian on: workflow_call: @@ -16,10 +16,14 @@ on: required: false type: boolean default: false + build_packages: + required: false + type: boolean + default: false jobs: - build_wolfprovider: - name: Build wolfProvider (${{ inputs.fips_ref }}${{ inputs.replace_default && ', replace-default' || '' }}) + build_wolfprovider_debian: + name: Build wolfProvider Debian (${{ inputs.fips_ref }}) runs-on: ubuntu-22.04 # Run inside Debian Bookworm to match packaging environment container: @@ -32,19 +36,42 @@ jobs: OPENSSL_PACKAGES_PATH: /tmp/openssl-packages WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages steps: - # Install minimal dependencies for Jenkins interaction - - name: Install minimal dependencies + # Install git prior to cloning to ensure we have the full repo + # TODO: create a docker with these pre-installed + - name: Install common dependencies run: | apt-get update && apt-get install -y --no-install-recommends \ + build-essential \ + devscripts \ + debhelper \ + dh-autoreconf \ + libtool \ + pkg-config \ + git \ + wget \ curl \ ca-certificates \ + openssl \ + dpkg-dev \ + lintian \ + fakeroot \ + dh-exec \ + equivs \ + expect \ + xxd \ libdistro-info-perl \ + autoconf \ + automake \ + quilt \ + patch \ + python3 \ + file \ + gdebi-core \ jq - # Trigger Jenkins to build all packages (wolfSSL, OpenSSL, wolfProvider) - # Skip for pull_request events as they don't have access to secrets + # Step 1: Trigger Jenkins and download wolfSSL packages - name: Trigger Jenkins build - if: github.event_name != 'pull_request' + if: ${{ inputs.build_packages }} id: trigger shell: bash run: | @@ -171,84 +198,178 @@ jobs: fi done - - name: Download all packages from Jenkins - if: github.event_name != 'pull_request' + - name: Download .deb files from Jenkins + if: ${{ inputs.build_packages }} shell: bash run: | - echo "Downloading packages from Jenkins build..." + echo "Downloading .deb files from Jenkins build..." echo "Build URL: ${{ steps.trigger.outputs.build_url }}" - # Get list of all artifacts + mkdir -p ./artifacts + cd ./artifacts + + # Get list of artifacts to find real filenames echo "Getting artifact list..." - ARTIFACTS_JSON=$(curl -s "${{ steps.trigger.outputs.build_url }}/api/json" --user "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" | jq '.artifacts') + ARTIFACTS_JSON=$(curl -s "${{ steps.trigger.outputs.build_url }}/api/json" --user "aidan:${{ secrets.JENKINS_TOKEN }}" | jq '.artifacts') - # Show all available artifacts + # Find all .deb files and their real names echo "All available artifacts:" - echo "$ARTIFACTS_JSON" | jq -r '.[] | .fileName' | sort + echo "$ARTIFACTS_JSON" | jq -r '.[] | .fileName' | grep '\.deb$' | sort + + # Find FIPS packages + FIPS_PACKAGES=$(echo "$ARTIFACTS_JSON" | jq -r '.[] | select(.fileName | contains("fips") and endswith(".deb")) | .fileName') + NONFIPS_PACKAGES=$(echo "$ARTIFACTS_JSON" | jq -r '.[] | select(.fileName | (contains("fips") | not) and endswith(".deb")) | .fileName') - # Download based on build type (FIPS or non-FIPS) - BUILD_TYPE="${{ inputs.fips_ref }}" echo "" - echo "Downloading packages for: $BUILD_TYPE" + echo "FIPS packages found:" + echo "$FIPS_PACKAGES" | while read -r file; do + if [ -n "$file" ] && [ "$file" != "null" ]; then + echo " - $file" + fi + done - # Determine the pattern to match based on build type - if [ "$BUILD_TYPE" = "FIPS" ]; then - # For FIPS: match files with "-fips" or ".fips." but NOT "nonfips" - FILTER_PATTERN="contains(\"fips\") and (contains(\"nonfips\") | not)" - else - # For non-FIPS: match files with "nonfips" OR files without "fips" at all - FILTER_PATTERN="contains(\"nonfips\") or (contains(\"fips\") | not)" - fi + echo "" + echo "Non-FIPS packages found:" + echo "$NONFIPS_PACKAGES" | while read -r file; do + if [ -n "$file" ] && [ "$file" != "null" ]; then + echo " - $file" + fi + done - # Get all package files for this build type - ALL_PACKAGES=$(echo "$ARTIFACTS_JSON" | jq -r ".[] | select(.fileName | $FILTER_PATTERN) | .fileName") + # Create subdirectories + mkdir -p fips-packages nonfips-packages - # Create directory for downloaded packages - mkdir -p ./downloaded-packages + # Download FIPS packages + echo "" + echo "Downloading FIPS packages..." + echo "$FIPS_PACKAGES" | while read -r file; do + if [ -n "$file" ] && [ "$file" != "null" ]; then + echo " Downloading: $file" + curl -u "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" -L -o "fips-packages/$file" "${{ steps.trigger.outputs.build_url }}/artifact/artifacts/$file" + fi + done - # Download all packages - echo "$ALL_PACKAGES" | while read -r file; do + # Download Non-FIPS packages + echo "" + echo "Downloading Non-FIPS packages..." + echo "$NONFIPS_PACKAGES" | while read -r file; do if [ -n "$file" ] && [ "$file" != "null" ]; then echo " Downloading: $file" - curl -u "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" -L -o "./downloaded-packages/$file" \ - "${{ steps.trigger.outputs.build_url }}/artifact/artifacts/$file" + curl -u "${{ secrets.USERNAME }}:${{ secrets.JENKINS_TOKEN }}" -L -o "nonfips-packages/$file" "${{ steps.trigger.outputs.build_url }}/artifact/artifacts/$file" fi done echo "" echo "Downloaded files:" - ls -lh ./downloaded-packages/ + echo "FIPS packages:" + ls -lh fips-packages/ 2>/dev/null || echo " No FIPS packages found" + echo "" + echo "Non-FIPS packages:" + ls -lh nonfips-packages/ 2>/dev/null || echo " No Non-FIPS packages found" - - name: Organize packages into directories - if: github.event_name != 'pull_request' + - name: Setup wolfSSL packages from Jenkins + if: ${{ inputs.build_packages }} run: | - # Create package directories mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }} - mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }} - mkdir -p ${{ env.WOLFPROV_PACKAGES_PATH }} - echo "Organizing packages..." - # Copy wolfSSL packages (libwolfssl*) - cp ./downloaded-packages/libwolfssl* ${{ env.WOLFSSL_PACKAGES_PATH }}/ 2>/dev/null || echo "No wolfSSL packages found" + # Copy packages based on build type + if [ "${{ inputs.fips_ref }}" = "FIPS" ]; then + if [ -d "./artifacts/fips-packages" ] && [ "$(ls -A ./artifacts/fips-packages/*.deb 2>/dev/null)" ]; then + echo "Copying FIPS packages..." + cp ./artifacts/fips-packages/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/ + else + echo "ERROR: No FIPS packages found" + exit 1 + fi + else + if [ -d "./artifacts/nonfips-packages" ] && [ "$(ls -A ./artifacts/nonfips-packages/*.deb 2>/dev/null)" ]; then + echo "Copying non-FIPS packages..." + cp ./artifacts/nonfips-packages/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/ + else + echo "ERROR: No non-FIPS packages found" + exit 1 + fi + fi + + echo "Jenkins wolfSSL packages available:" + ls -la ${{ env.WOLFSSL_PACKAGES_PATH }} + + - name: Download previously built wolfSSL artifacts + if: ${{ !inputs.build_packages }} + uses: dawidd6/action-download-artifact@v6 + with: + name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }} + path: ./cached-artifacts + workflow: build-wolfprovider-nightly.yml + workflow_conclusion: success + + - name: Setup cached wolfSSL artifacts + if: ${{ !inputs.build_packages }} + run: | + mkdir -p ${{ env.WOLFSSL_PACKAGES_PATH }} + + # Copy files from downloaded artifact subdirectories + cp ./cached-artifacts/wolfssl-packages/*.deb ${{ env.WOLFSSL_PACKAGES_PATH }}/ + + echo "Cached packages restored:" + ls -la ${{ env.WOLFSSL_PACKAGES_PATH }} + + - name: Install wolfSSL packages + run: | + echo "Installing wolfSSL packages (${{ inputs.fips_ref }})..." + + # Install packages + dpkg -i ${{ env.WOLFSSL_PACKAGES_PATH }}/*.deb || true + + # Fix any dependency issues + apt-get install -f -y + + echo "wolfSSL packages installed successfully:" + dpkg -l | grep wolfssl + + - name: Checkout wolfProvider + uses: actions/checkout@v4 + with: + fetch-depth: 1 + fetch-tags: true + + # Avoid "detected dubious ownership" warning + - name: Ensure the working directory safe + run: | + git config --global --add safe.directory "$GITHUB_WORKSPACE" + + # When running on a fork the upstream tags are not present, so fetch them explicitly + - name: Fetch tags from upstream(for Debian versioning) + run: | + git remote add upstream https://github.com/wolfSSL/wolfProvider.git || true + git fetch upstream --tags --no-recurse-submodules - # Copy OpenSSL packages (openssl*, libssl*) - cp ./downloaded-packages/openssl* ${{ env.OPENSSL_PACKAGES_PATH }}/ 2>/dev/null || true - cp ./downloaded-packages/libssl* ${{ env.OPENSSL_PACKAGES_PATH }}/ 2>/dev/null || true + - name: Build wolfProvider + run: | + echo "Building ${{ inputs.fips_ref }} wolfProvider..." + WOLFSSL_TAG=${{ inputs.wolfssl_ref }} OPENSSL_TAG=${{ inputs.openssl_ref }} \ + yes "Y" | $GITHUB_WORKSPACE/scripts/build-wolfprovider.sh --debian \ + ${{ inputs.fips_ref == 'FIPS' && '--enable-fips' || '' }} \ + ${{ inputs.replace_default && '--replace-default' || '' }} - # Copy wolfProvider packages (libwolfprov*) - cp ./downloaded-packages/libwolfprov* ${{ env.WOLFPROV_PACKAGES_PATH }}/ 2>/dev/null || true + - name: Setup packages directory + run: | + mkdir -p ${{ env.OPENSSL_PACKAGES_PATH }} + cp $GITHUB_WORKSPACE/../openssl*.deb ${{ env.OPENSSL_PACKAGES_PATH }} + cp $GITHUB_WORKSPACE/../libssl*.deb ${{ env.OPENSSL_PACKAGES_PATH }} + + mkdir -p ${{ env.WOLFPROV_PACKAGES_PATH }} + cp $GITHUB_WORKSPACE/../libwolfprov*.deb ${{ env.WOLFPROV_PACKAGES_PATH }} + cp $GITHUB_WORKSPACE/../libwolfprov*.dsc ${{ env.WOLFPROV_PACKAGES_PATH }} + cp $GITHUB_WORKSPACE/../libwolfprov*.tar.gz ${{ env.WOLFPROV_PACKAGES_PATH }} - echo "Package organization complete!" - echo "wolfSSL packages:" - ls -lh ${{ env.WOLFSSL_PACKAGES_PATH }} 2>/dev/null || echo " (none)" - echo "OpenSSL packages:" - ls -lh ${{ env.OPENSSL_PACKAGES_PATH }} 2>/dev/null || echo " (none)" - echo "wolfProvider packages:" - ls -lh ${{ env.WOLFPROV_PACKAGES_PATH }} 2>/dev/null || echo " (none)" + printf "Listing packages directory:\n" + ls -la ${{ env.WOLFPROV_PACKAGES_PATH }} + ls -la ${{ env.WOLFSSL_PACKAGES_PATH }} + ls -la ${{ env.OPENSSL_PACKAGES_PATH }} # Save all packages as artifacts for consumers - - name: Upload all packages (wolfSSL, OpenSSL, wolfProvider) - if: github.event_name != 'pull_request' + - name: Upload wolfProvider packages uses: actions/upload-artifact@v4 with: name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }}