Add CI that builds and runs every example #104

Workflow file for this run

.github/workflows/emulated.yml at 88c0fb4

	name: Emulated Examples

	# Examples that need hardware -- run against a simulator instead. No boards,
	# no licences, all on a stock runner.

	on:
	push:
	branches: [ '**' ]
	paths:
	- 'tpm/**'
	- 'SGX_Linux/**'
	- 'can-bus/**'
	- '.github/workflows/emulated.yml'
	- '.github/examples-manifest.yml'
	pull_request:
	types: [opened, synchronize, reopened, ready_for_review]
	# No cron: nightly.yml calls this, so the whole nightly is ONE run
	# and therefore one triage writer. See nightly.yml's header.
	workflow_call:
	inputs:
	caller_run_id:
	description: 'run id of the calling workflow; keeps a called run in its own concurrency group'
	type: string
	default: ''
	workflow_dispatch:

	# Hardcode this workflow's OWN name: github.workflow is the CALLER's in a called
	# workflow, so keying on it put all 12 targets in one group -- and GitHub cancels
	# the previously-pending run in a group, so only the last target survived.
	concurrency:
	group: ${{ inputs.caller_run_id && format('emulated-call-{0}', inputs.caller_run_id) \|\| format('emulated-{0}', github.ref) }}
	cancel-in-progress: ${{ !inputs.caller_run_id }}

	permissions:
	contents: read

	jobs:
	tpm:
	name: Run / tpm (${{ matrix.simulator }})
	runs-on: ubuntu-24.04
	timeout-minutes: 30
	strategy:
	fail-fast: false
	matrix:
	# the same example against the third-party reference TPM and against
	# wolfTPM's own wolfCrypt-backed one; a disagreement between them is a
	# finding either way
	simulator: [ibmswtpm2, fwtpm]
	steps:
	- uses: actions/checkout@v5
	- run: \|
	sudo apt-get update
	sudo apt-get install -y --no-install-recommends autoconf automake libtool
	pip install --quiet pyyaml

	- uses: ./.github/actions/setup-wolfssl
	id: wolfssl
	with:
	ref: master
	flags: --enable-all --enable-wolftpm --enable-cryptocb --enable-static --enable-shared
	# fwTPM's RSA_Encrypt/Decrypt return TPM_RC_SCHEME without it, and
	# --enable-all does not imply it (only the FIPS and provider paths do)
	cflags: -DWC_RSA_NO_PADDING

	# --enable-fwtpm also builds wolfTPM's own wolfCrypt-backed TPM 2.0
	# simulator; --enable-swtpm gives both legs the socket transport the
	# client already speaks.
	- name: Build wolfTPM
	run: \|
	set -euo pipefail
	git clone --depth 1 https://github.com/wolfSSL/wolfTPM /tmp/wolftpm
	cd /tmp/wolftpm
	./autogen.sh
	./configure --enable-fwtpm --enable-swtpm
	make -j"$(nproc)"
	sudo make install
	sudo ldconfig

	- name: Start ibmswtpm2
	if: matrix.simulator == 'ibmswtpm2'
	run: \|
	set -euo pipefail
	git clone --depth 1 https://github.com/kgoldman/ibmswtpm2 /tmp/ibmswtpm2
	make -C /tmp/ibmswtpm2/src -j"$(nproc)"
	(cd /tmp/ibmswtpm2/src && ./tpm_server &)

	- name: Start fwtpm_server
	if: matrix.simulator == 'fwtpm'
	run: \|
	set -euo pipefail
	# --clear wipes NV state so a rerun cannot inherit the last run's keys
	(cd /tmp/wolftpm && ./src/fwtpm/fwtpm_server --clear &)

	# both simulators speak the swtpm command interface on TCP 2321, which is
	# what makes them interchangeable under the same example
	- name: Wait for the TPM on :2321
	run: \|
	for _ in $(seq 1 200); do
	ss -tln \| grep -q ':2321 ' && break
	sleep 0.05
	done
	ss -tln \| grep ':2321 ' \
	\|\| { echo "${{ matrix.simulator }} never listened on 2321"; exit 1; }

	- name: Build and run tpm example
	run: \|
	python3 .github/scripts/run_example.py --only tpm --no-netns \
	--expect-sha '${{ steps.wolfssl.outputs.sha256 }}' \
	--results results-tpm-${{ matrix.simulator }}.json

	- uses: actions/upload-artifact@v4
	if: always()
	with:
	name: results-tpm-${{ matrix.simulator }}-attempt${{ github.run_attempt }}
	path: results-*.json
	retention-days: 5
	if-no-files-found: ignore

	sgx:
	name: Run / SGX_Linux (SGX_MODE=SIM)
	runs-on: ubuntu-24.04
	timeout-minutes: 40
	steps:
	- uses: actions/checkout@v5

	- name: Install Intel SGX SDK
	run: \|
	set -euo pipefail
	# Simulation mode needs only the SDK -- no PSW, no aesmd, no /dev/sgx_enclave.
	url=https://download.01.org/intel-sgx/sgx-linux/2.29/distro/ubuntu24.04-server
	wget -q "$url/sgx_linux_x64_sdk_2.29.100.1.bin"
	chmod +x sgx_linux_x64_sdk_2.29.100.1.bin
	# The installer is interactive.
	echo yes \| ./sgx_linux_x64_sdk_2.29.100.1.bin

	- name: Build wolfSSL for SGX
	run: \|
	set -euo pipefail
	git clone --depth 1 https://github.com/wolfSSL/wolfssl /tmp/wolfssl
	source sgxsdk/environment
	# wolfcrypt/test/test.c includes <wolfssl/options.h>, which ./configure
	# generates -- and the SGX build never configures, it uses
	# user_settings.h. An empty options.h satisfies the include.
	: > /tmp/wolfssl/wolfssl/options.h
	# HAVE_WOLFSSL_TEST must match the App build below: the enclave
	# references wolfcrypt_test, so the static lib has to contain it.
	make -C /tmp/wolfssl/IDE/LINUX-SGX -f sgx_t_static.mk HAVE_WOLFSSL_TEST=1

	- name: Build enclave and run in simulation
	run: \|
	set -euo pipefail
	source sgxsdk/environment
	# SKIP_INTELCPU_CHECK: runners are frequently AMD, and the check aborts
	# even though SIM mode uses no SGX instructions. build.sh hardcodes
	# SGX_MODE=HW, so drive make directly.
	make -C SGX_Linux \
	SGX_MODE=SIM SGX_PRERELEASE=0 SGX_DEBUG=0 \
	SGX_WOLFSSL_LIB=/tmp/wolfssl/IDE/LINUX-SGX/ \
	WOLFSSL_ROOT=/tmp/wolfssl \
	HAVE_WOLFSSL_TEST=1
	cd SGX_Linux && SKIP_INTELCPU_CHECK=TRUE ./App

	can-bus:
	name: Run / can-bus (vcan)
	runs-on: ubuntu-24.04
	timeout-minutes: 25
	steps:
	- uses: actions/checkout@v5
	- run: \|
	sudo apt-get update
	sudo apt-get install -y --no-install-recommends autoconf automake libtool openssl
	pip install --quiet pyyaml

	- name: Set up vcan0
	run: \|
	set -euo pipefail
	# vcan ships in linux-modules-extra, which must match the running Azure
	# kernel exactly -- apt-get update immediately before, and treat a 404
	# here as infrastructure flake rather than an example failure.
	sudo apt-get install -y "linux-modules-extra-$(uname -r)"
	sudo modprobe can
	sudo modprobe can-raw
	sudo modprobe vcan
	sudo ip link add dev vcan0 type vcan
	sudo ip link set vcan0 mtu 16 # 16 = classic CAN (72 for CAN FD)
	sudo ip link set up vcan0
	ip -details link show vcan0

	- uses: ./.github/actions/setup-wolfssl
	id: wolfssl
	with:
	ref: master
	flags: --enable-all --enable-static --enable-shared
	cflags: "-DWOLFSSL_ISOTP"

	- name: Generate certs and build
	working-directory: can-bus
	run: \|
	./generate_ssl.sh
	make

	- name: Run over vcan0
	working-directory: can-bus
	run: \|
	set -euo pipefail
	sudo apt-get install -y --no-install-recommends can-utils
	candump -L vcan0 >/tmp/candump.log 2>&1 &
	dump=$!
	./server vcan0 >/tmp/can-server.log 2>&1 &
	srv=$!
	sleep 1
	# The client is an interactive echo client: it getline()s stdin and
	# sends. With </dev/null it reads EOF, sends nothing, and the server
	# sits waiting -- which is what produced the -308 and the 124.
	printf 'hello over can\n' \| timeout 30 ./client vcan0 \|\| rc=$?
	kill "$srv" 2>/dev/null \|\| true
	sleep 1; kill "$dump" 2>/dev/null \|\| true
	echo "--- server output:"
	cat /tmp/can-server.log \|\| true
	echo "--- frames on vcan0 ($(wc -l </tmp/candump.log) total), last 16:"
	tail -16 /tmp/candump.log \|\| true
	exit "${rc:-0}"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add CI that builds and runs every example #104

Workflow file

Add CI that builds and runs every example #104

Uh oh!

Workflow file for this run