From d7297671b57782ca29c48edcf3159be5e4db2285 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 22 Sep 2026 17:14:17 -0700 Subject: [PATCH 1/2] Run CI on the ubuntu-22.04 hosted runners --- .github/workflows/_resolve-wolfssl.yml | 2 +- .github/workflows/auto-pin-dependencies.yml | 2 +- .github/workflows/compiler-matrix.yml | 20 +++++++++++++++----- .github/workflows/core-port-split.yml | 2 +- .github/workflows/cross-compile.yml | 2 +- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/integration-tests.yml | 4 ++-- .github/workflows/m33mu.yml | 6 +++--- .github/workflows/sanitizers.yml | 2 +- .github/workflows/unit-tests.yml | 8 ++++---- .github/workflows/valgrind.yml | 7 ++----- .github/workflows/wiki-sync.yml | 2 +- 12 files changed, 34 insertions(+), 27 deletions(-) diff --git a/.github/workflows/_resolve-wolfssl.yml b/.github/workflows/_resolve-wolfssl.yml index 9e5e7e9b..4f9e4797 100644 --- a/.github/workflows/_resolve-wolfssl.yml +++ b/.github/workflows/_resolve-wolfssl.yml @@ -15,7 +15,7 @@ permissions: jobs: resolve: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 5 outputs: matrix: ${{ steps.refs.outputs.matrix }} diff --git a/.github/workflows/auto-pin-dependencies.yml b/.github/workflows/auto-pin-dependencies.yml index 35c5ed1c..9606b331 100644 --- a/.github/workflows/auto-pin-dependencies.yml +++ b/.github/workflows/auto-pin-dependencies.yml @@ -11,7 +11,7 @@ permissions: jobs: pin: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/compiler-matrix.yml b/.github/workflows/compiler-matrix.yml index b4928685..cb454e45 100644 --- a/.github/workflows/compiler-matrix.yml +++ b/.github/workflows/compiler-matrix.yml @@ -13,7 +13,7 @@ permissions: jobs: host-unit-tests: name: Host tests (${{ matrix.name }}) - runs-on: ubuntu-24.04 + runs-on: ubuntu-22.04 timeout-minutes: 30 strategy: fail-fast: false @@ -47,9 +47,19 @@ jobs: - name: Install compiler run: | sudo apt-get update - sudo apt-get install -y --no-install-recommends software-properties-common - sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test - sudo apt-get update - sudo apt-get install -y --no-install-recommends ${{ matrix.package }} + sudo apt-get install -y --no-install-recommends software-properties-common wget + case "${{ matrix.package }}" in + clang-*) + # 22.04 carries no clang-17/18; take them from the LLVM apt repository. + wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh + pkg='${{ matrix.package }}' + sudo bash /tmp/llvm.sh "${pkg#clang-}" + ;; + *) + sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test + sudo apt-get update + sudo apt-get install -y --no-install-recommends ${{ matrix.package }} + ;; + esac - name: Run aggregate host test suite run: make test CC=${{ matrix.cc }} diff --git a/.github/workflows/core-port-split.yml b/.github/workflows/core-port-split.yml index 52a23f87..5e730c8b 100644 --- a/.github/workflows/core-port-split.yml +++ b/.github/workflows/core-port-split.yml @@ -13,7 +13,7 @@ permissions: jobs: core-port-split: name: core/port split guard + vnet image - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 20 container: image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.15 diff --git a/.github/workflows/cross-compile.yml b/.github/workflows/cross-compile.yml index 9a073288..0d03c91e 100644 --- a/.github/workflows/cross-compile.yml +++ b/.github/workflows/cross-compile.yml @@ -13,7 +13,7 @@ permissions: jobs: cortex-m33: name: Cortex-M33 cross compilation - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 2e406333..f0f4c66d 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -17,7 +17,7 @@ jobs: # type here: schedule / manual dispatch get the full 600s soak; PR pushes and # merges get the 60s smoke that keeps the required checks fast. select: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 outputs: matrix: ${{ steps.pick.outputs.matrix }} steps: @@ -38,7 +38,7 @@ jobs: fuzz: needs: select - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 20 strategy: fail-fast: false diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 69989cf3..b3ace402 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -17,7 +17,7 @@ jobs: wolfcose: name: wolfCOSE integration (${{ matrix.name }}) needs: resolve - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 strategy: fail-fast: false @@ -53,7 +53,7 @@ jobs: wolfpsa: name: wolfPSA integration (${{ matrix.name }}) needs: resolve - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 strategy: fail-fast: false diff --git a/.github/workflows/m33mu.yml b/.github/workflows/m33mu.yml index b7c2b182..8f14b18c 100644 --- a/.github/workflows/m33mu.yml +++ b/.github/workflows/m33mu.yml @@ -20,7 +20,7 @@ concurrency: jobs: wolfboot-m33mu: name: wolfBoot signed boot and rollback - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 strategy: fail-fast: false matrix: @@ -81,7 +81,7 @@ jobs: wolfboot-wolftrust-m33mu: name: wolfTrust ${{ matrix.guest }} lifecycle (${{ matrix.engine }}) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 strategy: fail-fast: false matrix: @@ -276,7 +276,7 @@ jobs: wolfboot-wolftrust-m33mu-scenarios: name: ${{ matrix.scenario.name }} (${{ matrix.engine }}) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 strategy: fail-fast: false matrix: diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml index 8221fdb8..74a5db99 100644 --- a/.github/workflows/sanitizers.yml +++ b/.github/workflows/sanitizers.yml @@ -13,7 +13,7 @@ permissions: jobs: host-sanitizers: name: Host tests (ASan and UBSan) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index f70c0a15..e475cf0d 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -13,7 +13,7 @@ permissions: jobs: discover: name: Discover host suites - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 outputs: matrix: ${{ steps.s.outputs.matrix }} steps: @@ -29,7 +29,7 @@ jobs: host-unit-tests: name: ${{ matrix.suite }} needs: discover - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 20 strategy: fail-fast: false @@ -46,7 +46,7 @@ jobs: psa-ff-conformance: name: Arm PSA FF conformance - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 20 steps: - uses: actions/checkout@v4 @@ -55,7 +55,7 @@ jobs: qcbor-interop: name: CBOR interop (wolfCOSE and QCBOR) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 15 steps: - uses: actions/checkout@v4 diff --git a/.github/workflows/valgrind.yml b/.github/workflows/valgrind.yml index 060324b3..5512a8dc 100644 --- a/.github/workflows/valgrind.yml +++ b/.github/workflows/valgrind.yml @@ -13,7 +13,7 @@ permissions: jobs: host-valgrind: name: Host tests (Valgrind) - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 timeout-minutes: 30 steps: - uses: actions/checkout@v4 @@ -24,10 +24,7 @@ jobs: git submodule update --init --recursive - name: Install Valgrind run: | - sudo apt-get update \ - -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" \ - -o Dir::Etc::sourceparts="-" \ - -o APT::Get::List-Cleanup="0" + sudo apt-get update sudo apt-get install -y --no-install-recommends valgrind - name: Run aggregate host suite under Valgrind run: make test-valgrind diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 9938adbc..3da0b42d 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -17,7 +17,7 @@ concurrency: jobs: sync: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 - name: Publish docs/ to wiki From 5d91c35cc7f6763237d19c6723459037025ac178 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 22 Sep 2026 17:35:51 -0700 Subject: [PATCH 2/2] Install clang from the signed LLVM apt repository --- .github/workflows/compiler-matrix.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/compiler-matrix.yml b/.github/workflows/compiler-matrix.yml index cb454e45..85f6c9ef 100644 --- a/.github/workflows/compiler-matrix.yml +++ b/.github/workflows/compiler-matrix.yml @@ -47,13 +47,21 @@ jobs: - name: Install compiler run: | sudo apt-get update - sudo apt-get install -y --no-install-recommends software-properties-common wget + sudo apt-get install -y --no-install-recommends software-properties-common curl gnupg case "${{ matrix.package }}" in clang-*) - # 22.04 carries no clang-17/18; take them from the LLVM apt repository. - wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh + # 22.04 carries no clang-17/18: add the signed LLVM apt repository, + # pinned to its signing key's fingerprint, and install only clang. pkg='${{ matrix.package }}' - sudo bash /tmp/llvm.sh "${pkg#clang-}" + curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key -o /tmp/llvm.asc + fpr=$(gpg --show-keys --with-colons /tmp/llvm.asc | awk -F: '/^fpr/{print $10; exit}') + test "$fpr" = "6084F3CF814B57C1CF12EFD515CF4D18AF4F7421" + sudo install -d -m 0755 /etc/apt/keyrings + sudo gpg --dearmor -o /etc/apt/keyrings/llvm.gpg /tmp/llvm.asc + echo "deb [signed-by=/etc/apt/keyrings/llvm.gpg] https://apt.llvm.org/jammy/ llvm-toolchain-jammy-${pkg#clang-} main" | \ + sudo tee /etc/apt/sources.list.d/llvm.list + sudo apt-get update + sudo apt-get install -y --no-install-recommends "$pkg" ;; *) sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test