From 9a788724d7cbe9723b641d673610141797eccd3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 6 Aug 2026 18:54:36 +0200 Subject: [PATCH] Fix CI flakes from ccache saturation and stale schedule estimates pq-all and trackmemory restore a seed ccache that already sits at its cap, so every object a run compiles evicts a seeded one that is still needed. Both reported a cache 100% full with over 200 cleanups and a 43-44% hit rate, and their configs took 3-5x their warm time. That left pq-all shards finishing at 23-26 min against a 30 min limit: a healthy shard passed with 5.6 min to spare, so any hiccup ahead of the build took the job down. One did, twice, when the prebuilt deb image came up short and the dependency step fell back to apt for 9.7 min - the only two jobs out of 47 whose install ran past 2 min are the only two that timed out. Size both caches to hold the seeded objects and a run's own alongside them, and widen the limits so a slow install is survivable. Raise the trackmemory limit as well, for a different reason: its wolfEntropy configs have overrun it outright, once with six configs done inside 8 min while all-wolfentropy ran on for another 32. That is a stall rather than a slow run - 91 jobs have a 17.2 min median and a 17.9 min p90, with nothing between 18 min and the cap - so the higher limit is headroom, not a fix. It costs nothing on a healthy run. Recalibrate "minutes", which drives longest-first scheduling and shard balancing. pq-all and fips-dev-no-post had drifted several-fold in both directions: two frodokem cross-builds were declared at 4 min but take 0.3, so the pool kept scheduling them first as its longest work. pq-all is calibrated from runs whose ccache actually hit, which the resized cache makes the normal case; a value read off a cold run makes every warm run warn instead. os-check-linux was already calibrated cold and correct, so only its three genuine outliers change. Both config lists are re-sorted to restore the documented descending order, so most of their diff is a mechanical move rather than a value change. Shard totals come out at 29.4/29.6 for pq-all and 76.9-77.7 across the four os-check shards. --- .github/configs/os-check-linux.json | 68 +++++----- .github/configs/pq-all.json | 172 ++++++++++++------------- .github/workflows/fips-dev-no-post.yml | 21 +-- .github/workflows/pq-all.yml | 17 ++- .github/workflows/trackmemory.yml | 12 +- 5 files changed, 155 insertions(+), 135 deletions(-) diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json index 23dfc3a4e24..87573a86887 100644 --- a/.github/configs/os-check-linux.json +++ b/.github/configs/os-check-linux.json @@ -1,4 +1,9 @@ [ +{"name": "user-settings-all-compat", "minutes": 9.5, + "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.", + "user_settings": "examples/configs/user_settings_all.h", + "cflags": "", + "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]}, {"name": "all-no-client-auth", "minutes": 9.0, "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_NO_CLIENT_AUTH"]}, {"name": "all-dilithium-cryptocb", "minutes": 8.9, @@ -6,8 +11,6 @@ "--enable-cryptocbutils", "--enable-pkcallbacks"]}, {"name": "all-haproxy-quic", "minutes": 8.6, "configure": ["--enable-all", "--enable-haproxy", "--enable-quic"]}, -{"name": "all-asn-template", "minutes": 8.5, - "configure": ["--enable-all", "--enable-asn=template"]}, {"name": "all-asn-template-old-oid-sum", "minutes": 8.5, "configure": ["--enable-all", "--enable-asn=template", "CPPFLAGS=-DWOLFSSL_OLD_OID_SUM"]}, {"name": "all-asn-original-old-oid-sum", "minutes": 8.4, @@ -27,11 +30,11 @@ "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]}, {"name": "all-hash-keep", "minutes": 7.8, "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]}, +{"name": "all-no-aes-192-256", "minutes": 7.5, + "configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]}, {"name": "all-no-pkcs7-stream", "minutes": 7.0, "comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.", "configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]}, -{"name": "all-no-aes-192-256", "minutes": 7.5, - "configure": ["--enable-all", "CPPFLAGS=-DNO_AES_192 -DNO_AES_256"]}, {"name": "all-writedup", "minutes": 6.9, "configure": ["--enable-all", "--enable-writedup"]}, {"name": "all-no-server", "minutes": 5.0, @@ -52,6 +55,8 @@ "configure": ["--enable-curve25519=nonblock", "--enable-ecc=nonblock", "--enable-rsa=nonblock", "--enable-dh=nonblock", "--enable-sp=yes,nonblock", "CPPFLAGS=-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK -DRSA_LOW_MEM"]}, +{"name": "all-asn-template", "minutes": 3.5, + "configure": ["--enable-all", "--enable-asn=template"]}, {"name": "tls13-dtls13-session-misc", "minutes": 3.3, "configure": ["--enable-tls13", "--enable-session-ticket", "--enable-dtls", "--enable-dtls13", "--enable-opensslextra", "--enable-sessioncerts", @@ -63,11 +68,10 @@ {"name": "dtls13-ocspstapling-cert-cb", "minutes": 3.1, "configure": ["--enable-dtls", "--enable-dtls13", "--enable-ocspstapling", "--enable-ocspstapling2", "--enable-cert-setup-cb", "--enable-sessioncerts"]}, -{"name": "user-settings-all-compat", "minutes": 3.0, - "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.", - "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", - "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]}, +{"name": "tsp-verifier", "minutes": 3, + "comment": "Time-Stamp Protocol Verifier", + "configure": ["--enable-tsp", "--enable-opensslall", + "CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]}, {"name": "dtls13-earlydata-psk-no-hrr", "minutes": 2.9, "configure": ["--enable-dtls", "--enable-dtls13", "--enable-earlydata", "--enable-session-ticket", "--enable-psk", "CPPFLAGS=-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME"]}, @@ -77,6 +81,10 @@ {"name": "dtls-records-span-datagrams", "minutes": 2.7, "configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch", "--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]}, +{"name": "tsp-min-hash-str", "minutes": 2.7, + "comment": "Time-Stamp Protocol Minimum 128-bit hash strength", + "configure": ["--enable-tsp", + "CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]}, {"name": "opensslextra-no-ca-names", "minutes": 2.6, "configure": ["--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_NO_CA_NAMES"]}, {"name": "sessionexport-dtls13", "minutes": 2.6, @@ -212,10 +220,6 @@ {"name": "tsp-smallstack", "minutes": 1.3, "comment": "Time-Stamp Protocol Small Stack", "configure": ["--enable-tsp", "CPPFLAGS=-DWOLFSSL_SMALL_STACK"]}, -{"name": "tsp-min-hash-str", "minutes": 2.7, - "comment": "Time-Stamp Protocol Minimum 128-bit hash strength", - "configure": ["--enable-tsp", - "CPPFLAGS=-DWC_TSP_MIN_HASH_STRENGTH_BITS=128"]}, {"name": "tsp-requester", "minutes": 1.3, "comment": "Time-Stamp Protocol Requester", "configure": ["--enable-tsp", "--enable-opensslall", @@ -224,10 +228,6 @@ "comment": "Time-Stamp Protocol Responder", "configure": ["--enable-tsp", "--enable-opensslall", "CPPFLAGS=-DWOLFSSL_TSP_RESPONDER"]}, -{"name": "tsp-verifier", "minutes": 1.3, - "comment": "Time-Stamp Protocol Verifier", - "configure": ["--enable-tsp", "--enable-opensslall", - "CPPFLAGS=-DWOLFSSL_TSP_VERIFIER"]}, {"name": "no-tls-cryptocb-aesgcm-setkey-free", "minutes": 1.3, "configure": ["--disable-tls", "--enable-cryptocb", "--enable-aesgcm", "CPPFLAGS=-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"]}, @@ -301,22 +301,6 @@ "user_settings": "examples/configs/user_settings_wolftpm.h", "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, -{"name": "no-wolfssl-server", "minutes": 0.9, - "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]}, -{"name": "dtls13-client-minimal", "minutes": 0.9, - "comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.", - "configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa", - "--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5", - "--disable-chacha", "--disable-poly1305", "--disable-errorstrings", - "--disable-asn-print", "--disable-eccshamir", "--disable-base64encode", - "--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384", - "--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math", - "--enable-sp=smallec256", "--disable-sp-asm", - "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]}, -{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9, - "configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]}, -{"name": "no-examples-no-malloc", "minutes": 0.8, - "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]}, {"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs", "name": "no-asn-strict-certs", "configure": ["--enable-testcert", "--enable-opensslextra", "--enable-certgen", @@ -333,5 +317,21 @@ {"name": "x509-tiny-addbacks", "comment": "TINY profile with extension add-backs enabled directly.", "configure": ["--enable-ecc", - "CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]} + "CPPFLAGS=-DWOLFSSL_X509_TINY -DWOLFSSL_X509_TINY_NAME_CONSTRAINTS -DWOLFSSL_X509_TINY_AKI -DWOLFSSL_X509_TINY_SKI -DWOLFSSL_X509_TINY_AIA -DWOLFSSL_X509_TINY_CRL_DP -DWOLFSSL_X509_TINY_POLICIES -DWOLFSSL_CERT_EXT"]}, +{"name": "no-wolfssl-server", "minutes": 0.9, + "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER"]}, +{"name": "dtls13-client-minimal", "minutes": 0.9, + "comment": "Minimal DTLS 1.3 client-only build with the SHA-224/384/512/3 hash families disabled. SHA-256 (used by TLS_AES_128_GCM_SHA256) and SHA-1 remain enabled.", + "configure": ["--enable-dtls13", "--disable-tlsv12", "--disable-oldtls", "--disable-rsa", + "--disable-dh", "--disable-aescbc", "--disable-aesecb", "--disable-md5", + "--disable-chacha", "--disable-poly1305", "--disable-errorstrings", + "--disable-asn-print", "--disable-eccshamir", "--disable-base64encode", + "--disable-coding", "--disable-sni", "--disable-sha224", "--disable-sha384", + "--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math", + "--enable-sp=smallec256", "--disable-sp-asm", + "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]}, +{"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9, + "configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]}, +{"name": "no-examples-no-malloc", "minutes": 0.8, + "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]} ] diff --git a/.github/configs/pq-all.json b/.github/configs/pq-all.json index f081b3c75ae..08f1533e261 100644 --- a/.github/configs/pq-all.json +++ b/.github/configs/pq-all.json @@ -1,5 +1,5 @@ [ -{"name": "all-pq-small-noasm", "minutes": 4, +{"name": "all-pq-small-noasm", "minutes": 8, "configure": ["--disable-intelasm", "--enable-all", "--enable-testcert", "--enable-acert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", @@ -9,7 +9,7 @@ "--enable-slhdsa=yes,small", "--enable-dilithium=yes,small", "--enable-dual-alg-certs", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_NO_LARGE_CODE -DWOLFSSL_MLDSA_SIGN_SMALL_MEM -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_MAKE_KEY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]}, -{"name": "all-pq-small-smallstack-noasm", "minutes": 4, +{"name": "all-pq-small-smallstack-noasm", "minutes": 7.5, "configure": ["--disable-intelasm", "--enable-smallstack", "--enable-smallstackcache", "--enable-all", "--enable-testcert", "--enable-acert", "--enable-dtls13", "--enable-dtls-mtu", @@ -61,21 +61,6 @@ "--enable-lms", "--enable-xmss", "--enable-slhdsa", "--enable-dilithium", "--enable-dual-alg-certs", "--disable-qt", "CPPFLAGS=-Wdeclaration-after-statement -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-pq-verify-only-noasm", "minutes": 3, - "configure": ["--disable-intelasm", "--enable-all", - "--disable-mlkem", "--enable-lms=yes,small,verify-only", - "--enable-xmss=yes,small,verify-only", - "--enable-slhdsa=yes,small,verify-only", - "--enable-dilithium=yes,small,verify-only", "--disable-qt", - "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]}, -{"name": "slhdsa-sha2-only", "minutes": 2, - "comment": "SHA2-only SLH-DSA build (SHAKE family disabled) across all 128/192/256 SHA2 parameter sets. A SHAKE-off build must still size the FORS/XMSS buffers for the 192/256-bit SHA2 parameters via the combined SLHDSA_ALL_NO_* maxima guards rather than collapsing to the 128-bit level; running the SHA2-256 sign/verify tests exercises that sizing.", - "configure": ["--enable-slhdsa=sha2", "--enable-testcert"]}, -{"name": "pq-asynccrypt-dual-alg", "minutes": 2, - "comment": "Async crypto with dual-algorithm certs and PQC signatures. WOLFSSL_ASYNC_CRYPT turns off the streaming CertificateVerify path, so this is the only config that compiles the in-place fragmented send and the async args holder that Scv13Args must fit.", - "configure": ["--enable-asynccrypt-sw", "--enable-dual-alg-certs", - "--enable-slhdsa", "--enable-dilithium", "--enable-experimental", - "--enable-testcert"]}, {"name": "all-pq-mldsa-no-ctx", "minutes": 3, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-acert", @@ -86,93 +71,61 @@ "--enable-dilithium=yes,no-ctx", "--enable-dual-alg-certs", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-frodokem", "minutes": 3.5, +{"name": "pq-asynccrypt-dual-alg", "minutes": 2.5, + "comment": "Async crypto with dual-algorithm certs and PQC signatures. WOLFSSL_ASYNC_CRYPT turns off the streaming CertificateVerify path, so this is the only config that compiles the in-place fragmented send and the async args holder that Scv13Args must fit.", + "configure": ["--enable-asynccrypt-sw", "--enable-dual-alg-certs", + "--enable-slhdsa", "--enable-dilithium", "--enable-experimental", + "--enable-testcert"]}, +{"name": "all-pq-verify-only-noasm", "minutes": 2, + "configure": ["--disable-intelasm", "--enable-all", + "--disable-mlkem", "--enable-lms=yes,small,verify-only", + "--enable-xmss=yes,small,verify-only", + "--enable-slhdsa=yes,small,verify-only", + "--enable-dilithium=yes,small,verify-only", "--disable-qt", + "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_NO_LARGE_CODE"]}, +{"name": "slhdsa-sha2-only", "minutes": 2, + "comment": "SHA2-only SLH-DSA build (SHAKE family disabled) across all 128/192/256 SHA2 parameter sets. A SHAKE-off build must still size the FORS/XMSS buffers for the 192/256-bit SHA2 parameters via the combined SLHDSA_ALL_NO_* maxima guards rather than collapsing to the 128-bit level; running the SHA2-256 sign/verify tests exercises that sizing.", + "configure": ["--enable-slhdsa=sha2", "--enable-testcert"]}, +{"name": "all-frodokem", "minutes": 2, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-experimental", "--enable-mlkem=yes,kyber,ml-kem", "--enable-frodokem=aes,ephemeral", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "frodokem-small-smallstack-noasm", "minutes": 2.5, - "configure": ["--disable-intelasm", "--enable-smallstack", - "--enable-smallstackcache", "--enable-experimental", - "--enable-frodokem=aes,ephemeral,small", - "CPPFLAGS=-Wdeclaration-after-statement"]}, -{"name": "frodokem-976-only-noasm", "minutes": 1.5, - "comment": "976-only builds D=16 (q=2^16) alone; no-asm the C path", - "configure": ["--disable-intelasm", "--enable-experimental", - "--enable-frodokem=aes,ephemeral,no-640,no-1344", - "CPPFLAGS=-Wdeclaration-after-statement"]}, -{"name": "frodokem-640-shake-only", "minutes": 1.5, - "comment": "640-only builds D=15 (q=2^15); shake-only, with asm", - "configure": ["--enable-intelasm", "--enable-sp-asm", - "--enable-experimental", - "--enable-frodokem=no-976,no-1344,no-aes", - "CPPFLAGS=-Wdeclaration-after-statement"]}, -{"name": "frodokem-aarch64-armasm", "minutes": 4, "check": false, - "cc": "ccache aarch64-linux-gnu-gcc", - "comment": "Cross-build only (no ARM runner): catches ARM asm link/compile breaks. sve+sme+aes A-gen all live in the .S.", - "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly", - "--enable-armasm", "--enable-experimental", - "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]}, -{"name": "frodokem-aarch64-armasm-inline", "minutes": 4, - "check": false, "cc": "ccache aarch64-linux-gnu-gcc", - "comment": "Inline armasm: sve/sme/aes are .S-only, so they must fall back to NEON/C; guards the inline-asm link break.", - "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly", - "--enable-armasm=inline", "--enable-experimental", - "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]}, -{"name": "frodokem-arm32-armasm", "minutes": 4, "check": false, - "cc": "ccache arm-linux-gnueabihf-gcc", - "comment": "Cross-build only: AArch32 NEON matrix ops + AES-crypto A-gen.", - "configure": ["--host=arm-linux-gnueabihf", "--enable-cryptonly", - "--enable-armasm", "--enable-experimental", - "--enable-frodokem=aes,ephemeral", "--disable-examples"]}, -{"name": "ubsan-mldsa-mlkem", "minutes": 2.5, - "configure": ["--disable-shared", "--enable-dilithium", - "--enable-mlkem", - "CFLAGS=-fsanitize=undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer", - "LDFLAGS=-fsanitize=undefined", - "CPPFLAGS=-DWOLFSSL_MLDSA_ALIGNMENT=4"]}, -{"name": "all-mlkem-512-standalone", "minutes": 2.5, +{"name": "all-mlkem-512-standalone", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-mlkem=make,enc,dec,512", "--enable-tls-mlkem-standalone", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-768", "minutes": 2.5, +{"name": "all-mlkem-768", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-mlkem=make,enc,dec,768", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-768-standalone", "minutes": 2.5, +{"name": "all-mlkem-768-standalone", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-768-standalone-no-hybrids", "minutes": 2.5, - "configure": ["--enable-intelasm", "--enable-sp-asm", - "--enable-all", "--enable-testcert", "--enable-dtls13", - "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", - "--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone", - "--disable-pqc-hybrids", "--disable-qt", - "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-1024", "minutes": 2.5, +{"name": "all-mlkem-1024", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-mlkem=make,enc,dec,1024", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-1024-standalone", "minutes": 2.5, +{"name": "all-mlkem-1024-standalone", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-mlkem=make,enc,dec,1024", "--enable-tls-mlkem-standalone", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "all-mlkem-1024-standalone-no-hybrids", "minutes": 2.5, +{"name": "all-mlkem-1024-standalone-no-hybrids", "minutes": 1.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-all", "--enable-testcert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", @@ -180,33 +133,80 @@ "--enable-tls-mlkem-standalone", "--disable-pqc-hybrids", "--disable-qt", "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, -{"name": "mlkem-old-ids", "minutes": 1.2, +{"name": "all-mlkem-768-standalone-no-hybrids", "minutes": 1.3, "configure": ["--enable-intelasm", "--enable-sp-asm", - "--enable-mlkem=yes,kyber,ml-kem", - "CPPFLAGS=-DWOLFSSL_ML_KEM_USE_OLD_IDS"]}, -{"name": "mlkem-dynamic-keys", "minutes": 1.2, - "configure": ["--enable-intelasm", "--enable-sp-asm", - "--enable-mlkem=yes,kyber,ml-kem,cache-a", - "CPPFLAGS=-DWOLFSSL_MLKEM_DYNAMIC_KEYS"]}, -{"name": "mldsa-dynamic-keys", "minutes": 1.2, - "configure": ["--enable-intelasm", "--enable-sp-asm", - "--enable-dilithium=yes", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]}, -{"name": "mldsa-small-dynamic-keys", "minutes": 1.2, + "--enable-all", "--enable-testcert", "--enable-dtls13", + "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", + "--enable-mlkem=make,enc,dec,768", "--enable-tls-mlkem-standalone", + "--disable-pqc-hybrids", "--disable-qt", + "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]}, +{"name": "frodokem-small-smallstack-noasm", "minutes": 1, + "configure": ["--disable-intelasm", "--enable-smallstack", + "--enable-smallstackcache", "--enable-experimental", + "--enable-frodokem=aes,ephemeral,small", + "CPPFLAGS=-Wdeclaration-after-statement"]}, +{"name": "ubsan-mldsa-mlkem", "minutes": 1, + "configure": ["--disable-shared", "--enable-dilithium", + "--enable-mlkem", + "CFLAGS=-fsanitize=undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer", + "LDFLAGS=-fsanitize=undefined", + "CPPFLAGS=-DWOLFSSL_MLDSA_ALIGNMENT=4"]}, +{"name": "frodokem-976-only-noasm", "minutes": 0.5, + "comment": "976-only builds D=16 (q=2^16) alone; no-asm the C path", + "configure": ["--disable-intelasm", "--enable-experimental", + "--enable-frodokem=aes,ephemeral,no-640,no-1344", + "CPPFLAGS=-Wdeclaration-after-statement"]}, +{"name": "mldsa-small-dynamic-keys", "minutes": 0.5, "configure": ["--disable-intelasm", "--enable-dilithium=yes,small", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]}, -{"name": "mldsa-verify-only-dynamic-keys", "minutes": 1.2, +{"name": "mldsa-verify-only-dynamic-keys", "minutes": 0.5, "configure": ["--disable-intelasm", "--enable-dilithium=44,65,87,verify-only", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]}, -{"name": "mldsa-no-asn1-opensslextra", "minutes": 1.2, +{"name": "mldsa-no-asn1-opensslextra", "minutes": 0.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-dilithium=yes", "--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]}, -{"name": "mldsa-no-asn1-fips204-draft-opensslextra", "minutes": 1.2, +{"name": "mldsa-no-asn1-fips204-draft-opensslextra", "minutes": 0.5, "configure": ["--enable-intelasm", "--enable-sp-asm", "--enable-dilithium=yes,draft", "--enable-opensslextra", "CPPFLAGS=-DWOLFSSL_MLDSA_NO_ASN1"]}, -{"name": "pkcs7-mldsa-only", "minutes": 1.2, +{"name": "frodokem-aarch64-armasm", "minutes": 0.4, "check": false, + "cc": "ccache aarch64-linux-gnu-gcc", + "comment": "Cross-build only (no ARM runner): catches ARM asm link/compile breaks. sve+sme+aes A-gen all live in the .S.", + "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly", + "--enable-armasm", "--enable-experimental", + "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]}, +{"name": "frodokem-arm32-armasm", "minutes": 0.4, "check": false, + "cc": "ccache arm-linux-gnueabihf-gcc", + "comment": "Cross-build only: AArch32 NEON matrix ops + AES-crypto A-gen.", + "configure": ["--host=arm-linux-gnueabihf", "--enable-cryptonly", + "--enable-armasm", "--enable-experimental", + "--enable-frodokem=aes,ephemeral", "--disable-examples"]}, +{"name": "frodokem-aarch64-armasm-inline", "minutes": 0.4, + "check": false, "cc": "ccache aarch64-linux-gnu-gcc", + "comment": "Inline armasm: sve/sme/aes are .S-only, so they must fall back to NEON/C; guards the inline-asm link break.", + "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly", + "--enable-armasm=inline", "--enable-experimental", + "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]}, +{"name": "mlkem-old-ids", "minutes": 0.4, + "configure": ["--enable-intelasm", "--enable-sp-asm", + "--enable-mlkem=yes,kyber,ml-kem", + "CPPFLAGS=-DWOLFSSL_ML_KEM_USE_OLD_IDS"]}, +{"name": "mlkem-dynamic-keys", "minutes": 0.4, + "configure": ["--enable-intelasm", "--enable-sp-asm", + "--enable-mlkem=yes,kyber,ml-kem,cache-a", + "CPPFLAGS=-DWOLFSSL_MLKEM_DYNAMIC_KEYS"]}, +{"name": "mldsa-dynamic-keys", "minutes": 0.4, + "configure": ["--enable-intelasm", "--enable-sp-asm", + "--enable-dilithium=yes", "CPPFLAGS=-DWOLFSSL_MLDSA_DYNAMIC_KEYS"]}, +{"name": "frodokem-640-shake-only", "minutes": 0.3, + "comment": "640-only builds D=15 (q=2^15); shake-only, with asm", + "configure": ["--enable-intelasm", "--enable-sp-asm", + "--enable-experimental", + "--enable-frodokem=no-976,no-1344,no-aes", + "CPPFLAGS=-Wdeclaration-after-statement"]}, +{"name": "pkcs7-mldsa-only", "minutes": 0.3, "comment": "PKCS#7 SignedData with ML-DSA as the only signature algorithm (no RSA, no ECC); guards the ML-DSA-only PKCS7 build path", "configure": ["--enable-cryptonly", "--enable-mldsa", "--enable-pkcs7", "--disable-rsa", "--disable-ecc"]} diff --git a/.github/workflows/fips-dev-no-post.yml b/.github/workflows/fips-dev-no-post.yml index 5330b8e74cc..b526ec19969 100644 --- a/.github/workflows/fips-dev-no-post.yml +++ b/.github/workflows/fips-dev-no-post.yml @@ -48,8 +48,11 @@ jobs: name: build library/module if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} runs-on: ubuntu-24.04 - # Generous for a cold ccache; warm reruns finish in a fraction. - timeout-minutes: 30 + # Generous for a cold ccache; warm reruns finish in a fraction. The + # wall is set by kernel-settings-all-pqc-asm, the one config no other + # thread can overlap once the rest are done: it alone has been measured + # at 23 min on a cold cache, against a 23 min job total. + timeout-minutes: 40 steps: - uses: actions/checkout@v5 name: Checkout wolfSSL @@ -101,23 +104,23 @@ jobs: "--with-linux-source=/lib/modules/$(uname -r)/build", "EXTRA_CPPFLAGS=-Werror"]}, "configs": [ - {"name": "default", "minutes": 7, + {"name": "default", "minutes": 6, "configure": ["CPPFLAGS=-pedantic"]}, - {"name": "all-asm-sp", "minutes": 7, + {"name": "all-asm-sp", "minutes": 2.5, "configure": ["CPPFLAGS=-pedantic", "--enable-all-asm", "--enable-sp"]}, - {"name": "all", "minutes": 16, + {"name": "all", "minutes": 6, "configure": ["CPPFLAGS=-pedantic", "--enable-all"]}, - {"name": "all-nodh-extiv", "minutes": 16, + {"name": "all-nodh-extiv", "minutes": 6, "comment": "DH out of the boundary in v7; one-shot AES-GCM ext IV allowed", "configure": ["--enable-all", "--disable-dh", "CPPFLAGS=-pedantic -DWC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED -DWC_FIPS_AESGCM_NO_SHORT_NONCES"]}, - {"name": "all-pqc-asm-fallback-fuzzer", "minutes": 22, + {"name": "all-pqc-asm-fallback-fuzzer", "minutes": 8, "configure": ["--enable-all", "--enable-sp", "--enable-experimental", "--enable-all-quantum-crypto", "CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]}, - {"name": "kernel-settings", "minutes": 8, + {"name": "kernel-settings", "minutes": 9.5, "configure": ["--enable-kernel-settings", "--enable-dh", "CPPFLAGS=-pedantic"]}, - {"name": "kernel-settings-all-pqc-asm", "minutes": 22, + {"name": "kernel-settings-all-pqc-asm", "minutes": 17, "configure": ["--enable-kernel-settings", "--enable-all", "--enable-experimental", "--enable-all-quantum-crypto", "--enable-all-asm", "--enable-sp", "CPPFLAGS=-pedantic -DWC_DEBUG_CIPHER_LIFECYCLE -DWC_C_DYNAMIC_FALLBACK -DDEBUG_VECTOR_REGISTER_ACCESS -DDEBUG_VECTOR_REGISTER_ACCESS_FUZZING -DWC_DEBUG_VECTOR_REGISTERS_FUZZING_SEED=$FUZZING_SEED"]} diff --git a/.github/workflows/pq-all.yml b/.github/workflows/pq-all.yml index 15aa2a48346..71cfa85b3f5 100644 --- a/.github/workflows/pq-all.yml +++ b/.github/workflows/pq-all.yml @@ -37,8 +37,11 @@ jobs: shard: [1, 2] if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }} runs-on: ubuntu-24.04 - # Generous for a cold ccache; warm reruns finish in a fraction. - timeout-minutes: 30 + # Generous for a cold ccache; warm reruns finish in a fraction. The + # margin is deliberately wide: the "Install dependencies" step has been + # seen to spend 30 min pulling the cross-compilers from a slow archive + # mirror, which used up the whole budget before a single config built. + timeout-minutes: 45 steps: - uses: actions/checkout@v5 name: Checkout wolfSSL @@ -56,7 +59,12 @@ jobs: with: workflow-id: pq-all config-hash: shard-${{ matrix.shard }} - max-size: 350M + # A shard restores a seed cache that already sits at the cap, so + # every object this run compiles evicts one that is still needed: + # at 350M a shard reported 223 cleanups and a 43% hit rate, and + # configs took 3-5x their warm time. Size it to hold the seeded + # objects and this run's alongside them. + max-size: 700M # PRs read the cache the weekday seed writes; they never # save, so PR runs add nothing to the Actions cache. read-only: ${{ github.event_name == 'pull_request' }} @@ -78,6 +86,9 @@ jobs: # omit it for a new config (defaults to 1) and refresh later. The list # is kept sorted by minutes for readability, but the schedule sorts by # the values, not list order. + # Take the figure from a run whose ccache actually hit: the same config + # takes 3-5x longer when the cache is cold, so a value read off a cold + # run makes every warm run warn that the estimate is stale. - name: Build and make check this shard's configs (parallel, out-of-tree) run: | .github/scripts/parallel-make-check.py \ diff --git a/.github/workflows/trackmemory.yml b/.github/workflows/trackmemory.yml index 5294f673097..83c6725c235 100644 --- a/.github/workflows/trackmemory.yml +++ b/.github/workflows/trackmemory.yml @@ -35,8 +35,11 @@ jobs: runs-on: ubuntu-24.04 # Typical runs finish in 13-16 min, but the wolfEntropy configs gather # entropy from CPU timing jitter, whose runtime varies severalfold with - # runner contention (a 20-min limit was hit with one config left). - timeout-minutes: 40 + # runner contention (a 20-min limit was hit with one config left, and + # later a 40-min one: six configs were done inside 8 min while + # all-wolfentropy ran on for another 32). Cheap to leave high - a + # healthy run never approaches it. + timeout-minutes: 60 steps: - uses: actions/checkout@v5 name: Checkout wolfSSL @@ -54,7 +57,10 @@ jobs: with: workflow-id: trackmemory read-only: ${{ github.event_name == 'pull_request' }} - max-size: 250M + # 250M left the cache 100% full with 232 cleanups and a 44% hit + # rate, i.e. evicting objects this same run still needed; the + # configs then ran 2-3x their warm time. + max-size: 450M # Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor, # which would stop the test scripts from re-execing under