Skip to content

Commit fdb24fa

Browse files
padelsbachpadelsbach
committed
Fix WPFF CI failures
1 parent 5d16735 commit fdb24fa

40 files changed

Lines changed: 210 additions & 2 deletions

‎.github/scripts/pam-pkcs11-test.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,22 @@ else
1010
exit 1
1111
fi
1212

13+
# Deterministic force-fail probe. The pam_pkcs11 test below exercises PAM via
14+
# 'su' as root, which never actually authenticates, so a force-fail-induced
15+
# crypto failure inside pam_pkcs11.so will not propagate to the script's exit
16+
# status. Probe wolfProvider directly here so the workflow fails closed if
17+
# WOLFPROV_FORCE_FAIL=1 is set but crypto still succeeds (e.g. apt replaced
18+
# the patched libssl3 and OpenSSL fell back to its built-in default provider).
19+
if [ "${WOLFPROV_FORCE_FAIL:-0}" = "1" ]; then
20+
if openssl rand -hex 16 >/dev/null 2>&1; then
21+
echo "FAIL: openssl rand succeeded with WOLFPROV_FORCE_FAIL=1;"
22+
echo " wolfProvider is not actually intercepting crypto."
23+
exit 1
24+
fi
25+
echo "[*] Force-fail probe confirmed wolfProvider is failing as expected"
26+
exit 1
27+
fi
28+
1329
echo "[*] Installing build dependencies..."
1430
apt-get update
1531
DEBIAN_FRONTEND=noninteractive apt-get install -y \

‎.github/workflows/bind9.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,11 @@ jobs:
7474
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7575
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7676
77+
# Prevent later 'apt-get install' of test dependencies from
78+
# replacing the wolfprov-patched libssl3, which breaks
79+
# replace-default mode.
80+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
81+
7782
- name: Verify wolfProvider is properly installed
7883
run: |
7984
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/cjose.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ jobs:
8181
apt install --reinstall -y \
8282
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
8383
84+
# Prevent later 'apt-get install' of test dependencies from
85+
# replacing the wolfprov-patched libssl3, which breaks
86+
# replace-default mode.
87+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
88+
8489
- name: Verify wolfProvider is properly installed
8590
run: |
8691
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/curl.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ jobs:
7373
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7474
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7575
76+
# Prevent later 'apt-get install' of test dependencies from
77+
# replacing the wolfprov-patched libssl3, which breaks
78+
# replace-default mode.
79+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
80+
7681
- name: Verify wolfProvider is properly installed
7782
run: |
7883
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/debian-package.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,11 @@ jobs:
8585
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
8686
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
8787
88+
# Prevent later 'apt-get install' of test dependencies from
89+
# replacing the wolfprov-patched libssl3, which breaks
90+
# replace-default mode.
91+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
92+
8893
# In standalone mode, use OPENSSL_CONF to enable wolfProvider.
8994
if [ "${{ matrix.replace_default }}" = "false" ]; then
9095
echo "Setting OPENSSL_CONF to /etc/ssl/openssl.cnf.d/wolfprovider.conf"

‎.github/workflows/git-ssh-dr.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ jobs:
7373
apt install --reinstall -y \
7474
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7575
76+
# Prevent later 'apt-get install' of test dependencies from
77+
# replacing the wolfprov-patched libssl3, which breaks
78+
# replace-default mode.
79+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
80+
7681
- name: Verify wolfProvider is properly installed
7782
run: |
7883
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/grpc.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ jobs:
8181
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
8282
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
8383
84+
# Prevent later 'apt-get install' of test dependencies from
85+
# replacing the wolfprov-patched libssl3, which breaks
86+
# replace-default mode.
87+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
88+
8489
- name: Verify wolfProvider is properly installed
8590
run: |
8691
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/hostap.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,11 @@ jobs:
7777
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7878
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7979
80+
# Prevent later 'apt-get install' of test dependencies from
81+
# replacing the wolfprov-patched libssl3, which breaks
82+
# replace-default mode.
83+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
84+
8085
- name: Show OpenSSL version
8186
run: |
8287
echo "OpenSSL version:"

‎.github/workflows/iperf.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ jobs:
7373
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7474
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7575
76+
# Prevent later 'apt-get install' of test dependencies from
77+
# replacing the wolfprov-patched libssl3, which breaks
78+
# replace-default mode.
79+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
80+
7681
- name: Verify wolfProvider is properly installed
7782
run: |
7883
$GITHUB_WORKSPACE/scripts/verify-install.sh \

‎.github/workflows/krb5.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ jobs:
7373
apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
7474
${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
7575
76+
# Prevent later 'apt-get install' of test dependencies from
77+
# replacing the wolfprov-patched libssl3, which breaks
78+
# replace-default mode.
79+
apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
80+
7681
- name: Verify wolfProvider is properly installed
7782
run: |
7883
$GITHUB_WORKSPACE/scripts/verify-install.sh \

0 commit comments

Comments
 (0)