ci: add wycheproof vector test job#10258
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a dedicated GitHub Actions workflow to run wolfSSL against the wolfSSL/wychcheck (Wycheproof + vector) suite on pushes and PRs, and to publish JUnit XML results as an artifact.
Changes:
- Introduces
.github/workflows/wycheproof.ymlwith a newwycheproofCI job. - Builds wolfSSL from the PR branch, builds
wolfcrypt-checkfromwolfSSL/wychcheck, and executesctestwith JUnit output. - Uploads the generated JUnit XML as a workflow artifact.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Build wolfSSL | ||
| run: | | ||
| autoreconf -i | ||
| ./configure \ |
There was a problem hiding this comment.
This workflow assumes build tooling (e.g., autoconf/automake/libtool, compiler toolchain, cmake/ctest) is present on ubuntu-latest. Since ubuntu-latest runner contents can change over time, this can cause sporadic CI failures. Add an explicit dependency-install step (apt-get) before autoreconf/cmake to make the job deterministic.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
| --enable-aeseax \ | ||
| --enable-aessiv \ | ||
| --enable-aesxts \ | ||
| --enable-keywrap \ |
There was a problem hiding this comment.
That isn't an option. Did you mean --enable-aeskeywrap?
Summary
.github/workflows/wycheproof.ymlwhich builds wolfSSL from the PR branch and runs it against the wolfSSL/wychcheck test suite (340+ Wycheproof JSON test files, NIST ACVP vectors, and RFC vectors covering AES-GCM, AES-EAX, AES-SIV, ChaCha20-Poly1305, RSA-PSS, RSA-OAEP, ECDH/ECDSA over all curves, X25519, ML-DSA, ML-KEM, SLH-DSA, EdDSA)if: github.repository_owner == 'wolfssl'per project conventionwycheproofsubmodule (notacvp-serverwhich is 900 MB)Relationship to wychcheck
wolfSSL/wychcheckalready runs nightly againstwolfssl/wolfsslmaster (Saturday 22:00 UTC). This job adds per-PR coverage so regressions are caught before merge rather than after.Test plan
wolfcrypt-checkbuilds and ctest passeswycheproof-results/test-results.xml