Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions .github/actions/cache-build-deps/action.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
name: Cache build dependencies
description: Restore cached OpenSSL/wolfSSL installs keyed by resolved commit SHA so build-wolfprovider.sh skips configure+make on a hit.

inputs:
variant:
description: Token capturing every build-config dimension that changes the produced binaries (compiler, debug, replace-default, seed-src, fips). Distinct configs must use distinct variants.
required: true
openssl_ref:
description: OpenSSL tag/branch/sha, resolved to a SHA for the cache key.
required: true
wolfssl_ref:
description: wolfSSL tag/branch/sha, resolved to a SHA for the cache key. Ignored when wolfssl_fixed_key is set.
required: false
default: ''
wolfssl_fixed_key:
description: Verbatim wolfSSL cache key, used instead of resolving wolfssl_ref (FIPS bundle case - fixed stable version with no git ref).
required: false
default: ''
cache_openssl_source:
description: Also cache openssl-source. Required for --replace-default / --fips-baseline builds whose mismatch checks read the patched source.
required: false
default: 'false'
github_token:
description: Token passed to resolve-ref.sh to avoid GitHub API rate limits.
required: true

runs:
using: composite
steps:
- name: Resolve OpenSSL ref
id: openssl-ref
shell: bash
env:
GITHUB_TOKEN: ${{ inputs.github_token }}
run: echo "sha=$("${GITHUB_WORKSPACE}/scripts/resolve-ref.sh" "${{ inputs.openssl_ref }}" openssl/openssl)" >> "$GITHUB_OUTPUT"

- name: Resolve wolfSSL ref
id: wolfssl-ref
if: inputs.wolfssl_fixed_key == ''
shell: bash
env:
GITHUB_TOKEN: ${{ inputs.github_token }}
run: echo "sha=$("${GITHUB_WORKSPACE}/scripts/resolve-ref.sh" "${{ inputs.wolfssl_ref }}" wolfssl/wolfssl)" >> "$GITHUB_OUTPUT"

- name: Cache OpenSSL install
uses: actions/cache@v4
with:
path: openssl-install
key: openssl-install-${{ inputs.variant }}-${{ steps.openssl-ref.outputs.sha }}-${{ hashFiles('scripts/utils-openssl.sh', 'scripts/utils-wolfssl.sh', 'scripts/build-wolfprovider.sh') }}

- name: Cache OpenSSL source
if: inputs.cache_openssl_source == 'true'
uses: actions/cache@v4
with:
path: openssl-source
key: openssl-source-${{ inputs.variant }}-${{ steps.openssl-ref.outputs.sha }}-${{ hashFiles('scripts/utils-openssl.sh', 'scripts/utils-wolfssl.sh', 'scripts/build-wolfprovider.sh') }}

- name: Cache wolfSSL install
uses: actions/cache@v4
with:
path: wolfssl-install
key: wolfssl-install-${{ inputs.variant }}-${{ inputs.wolfssl_fixed_key || steps.wolfssl-ref.outputs.sha }}-${{ hashFiles('scripts/utils-openssl.sh', 'scripts/utils-wolfssl.sh', 'scripts/build-wolfprovider.sh') }}
8 changes: 8 additions & 0 deletions .github/workflows/cmdline.yml
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,14 @@ jobs:
with:
fetch-depth: 1

- name: Cache build dependencies
uses: ./.github/actions/cache-build-deps
with:
variant: cmdline${{ matrix.debug != '' && '-debug' || '' }}
openssl_ref: ${{ matrix.openssl_ref }}
wolfssl_ref: ${{ matrix.wolfssl_ref }}
github_token: ${{ secrets.GITHUB_TOKEN }}

- name: Build wolfProvider
run: |
${{ matrix.debug }} OPENSSL_TAG=${{ matrix.openssl_ref }} WOLFSSL_TAG=${{ matrix.wolfssl_ref }} ./scripts/build-wolfprovider.sh
Expand Down
27 changes: 22 additions & 5 deletions .github/workflows/fips-ready.yml
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,30 @@ jobs:
with:
fetch-depth: 1

- name: Cache build dependencies
uses: ./.github/actions/cache-build-deps
with:
variant: fips-ready
openssl_ref: ${{ matrix.openssl_ref }}
wolfssl_fixed_key: wolfssl-fips-${{ matrix.wolfssl_bundle_ref }}-${{ matrix.openssl_ref }}
github_token: ${{ secrets.GITHUB_TOKEN }}

- name: Cache FIPS Ready Bundle zip
uses: actions/cache@v4
with:
path: wolfssl-fips-ready.zip
key: wolfssl-fips-bundle-${{ matrix.wolfssl_bundle_ref }}

- name: Download FIPS Ready Bundle
run: |
# Download FIPS ready bundle from wolfSSL website
BUNDLE_URL="https://www.wolfssl.com/wolfssl-${{matrix.wolfssl_bundle_ref}}-gplv3-fips-ready.zip"

wget -O wolfssl-fips-ready.zip "$BUNDLE_URL"
unzip wolfssl-fips-ready.zip
# Bundle is a fixed stable release; only fetch on a cache miss. The
# build script's bundle copy still needs the extracted tree present,
# so unzip runs every time.
if [ ! -f wolfssl-fips-ready.zip ]; then
BUNDLE_URL="https://www.wolfssl.com/wolfssl-${{matrix.wolfssl_bundle_ref}}-gplv3-fips-ready.zip"
wget -O wolfssl-fips-ready.zip "$BUNDLE_URL"
fi
unzip -o wolfssl-fips-ready.zip

# Find the extracted directory (build script requires directory, not zip)
BUNDLE_DIR=$(find . -maxdepth 1 -type d -name "*fips-ready*" | head -n 1)
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/seed-src.yml
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,14 @@ jobs:
with:
fetch-depth: 1

- name: Cache build dependencies
uses: ./.github/actions/cache-build-deps
with:
variant: seed-src
openssl_ref: ${{ matrix.openssl_ref }}
wolfssl_ref: ${{ matrix.wolfssl_ref }}
github_token: ${{ secrets.GITHUB_TOKEN }}

- name: Build and test wolfProvider with SEED-SRC
run: |
# Force wolfSSL to not use getrandom syscall via ac_cv_func_getrandom=no.
Expand Down
9 changes: 9 additions & 0 deletions .github/workflows/simple.yml
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,15 @@ jobs:
with:
fetch-depth: 1

- name: Cache build dependencies
uses: ./.github/actions/cache-build-deps
with:
variant: simple${{ matrix.replace_default != '' && '-rd' || '' }}
openssl_ref: ${{ matrix.openssl_ref }}
wolfssl_ref: ${{ matrix.wolfssl_ref }}
cache_openssl_source: ${{ matrix.replace_default != '' }}
github_token: ${{ secrets.GITHUB_TOKEN }}

- name: Build and test wolfProvider
run: |
OPENSSL_TAG=${{ matrix.openssl_ref }} \
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/smoke-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,14 @@ jobs:
with:
fetch-depth: 1

- name: Cache build dependencies
uses: ./.github/actions/cache-build-deps
with:
variant: smoke
openssl_ref: ${{ needs.discover_versions.outputs.openssl_latest_ref }}
wolfssl_ref: ${{ matrix.wolfssl_ref || needs.discover_versions.outputs.wolfssl_latest_ref }}
github_token: ${{ secrets.GITHUB_TOKEN }}

- name: Build and test wolfProvider
run: |
# Resolve "stable" matrix row to the discovered latest tag.
Expand Down
Loading