Merge pull request #130 from mjdemilliano/add-hashdrbg-reseed #275
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow will install Python dependencies, run tests and lint with a single version of Python | |
| # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions | |
| name: Python application | |
| on: | |
| push: | |
| branches: [ '*' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python 3.10 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.10" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| # Install a specific version of uv. | |
| version: "0.11.26" | |
| - name: Build the wheel | |
| run: uv build --wheel | |
| - name: Install the project | |
| run: uv sync --dev | |
| - name: Perform static checks | |
| run: uv run ruff check | |
| - name: Run tests using the locally built wheel | |
| run: | | |
| uv pip install --reinstall dist/*.whl | |
| uv run --no-sync pytest tests | |
| build-no-pqc: | |
| # Regression coverage for issue #2659: INVALID_DEVID is only declared | |
| # in the CFFI cdef when ML_KEM or ML_DSA is enabled, so a wolfSSL build | |
| # without those features must still import wolfcrypt.random successfully. | |
| runs-on: ubuntu-latest | |
| env: | |
| USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python 3.10 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.10" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| # Install a specific version of uv. | |
| version: "0.11.26" | |
| - name: Install build deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y autoconf automake libtool | |
| - name: Build wolfSSL without ML-KEM/ML-DSA | |
| run: | | |
| cd lib/wolfssl | |
| ./autogen.sh | |
| ./configure --enable-cryptonly --disable-shared \ | |
| --disable-mlkem --disable-mldsa \ | |
| --enable-aes --enable-aesgcm --enable-aessiv \ | |
| --enable-aesctr --enable-aesgcm-stream \ | |
| --enable-des3 --enable-chacha --enable-poly1305 \ | |
| --enable-sha --enable-sha384 --enable-sha512 --enable-sha3 \ | |
| --enable-hkdf --enable-rsa --enable-rsapss --enable-ecc \ | |
| --enable-ed25519 --enable-ed448 --enable-curve25519 \ | |
| --enable-keygen --enable-pwdbased --enable-pkcs7 \ | |
| --disable-md5 --disable-sha224 --disable-dh \ | |
| --disable-oldtls --disable-oldnames --disable-extended-master \ | |
| CFLAGS=-fPIC \ | |
| --prefix=$GITHUB_WORKSPACE/wolfssl-install | |
| make | |
| make install | |
| - name: Install wolfcrypt-py against the local wolfSSL | |
| run: | | |
| uv venv | |
| uv pip install pytest | |
| uv pip install -e . | |
| - name: Check absence of ML-KEM and ML-DSA support | |
| run: | | |
| uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'" | |
| uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'" | |
| - name: Import smoke (regression for INVALID_DEVID) | |
| run: uv run --no-sync python -c "from wolfcrypt.random import Random; Random()" | |
| - name: Run tests | |
| run: uv run --no-sync pytest tests |