Add compatibility-layer fixes and workflows for 12 applications

.github/ci-deps/packages-ubuntu-24.04-full.txt

@@ -18,6 +18,7 @@ clang
 clang-14
 clang-19
 cmake
+flex
 g++-10
 g++-11
 g++-12
@@ -81,6 +82,7 @@ libsqlite3-dev
 libssl-dev
 libtool
 liburcu-dev
+libusb-1.0-0-dev
 libuv1-dev
 linux-libc-dev
 make
@@ -94,6 +96,7 @@ pkg-config
 pkgconf
 psmisc
 python3
+python3-cryptography
 python3-docutils
 python3-impacket
 python3-ldb

.github/workflows/bind.yml

@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
       matrix:
         # List of releases to test
-        ref: [ 9.18.0, 9.18.28, 9.18.33, 9.20.11 ]
+        ref: [ 9.18.0, 9.18.28, 9.18.33, 9.20.11, 9.20.23 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/codespell.yml

@@ -28,7 +28,7 @@ jobs:
         check_filenames: true
         check_hidden: true
           # Add comma separated list of words that occur multiple times that should be ignored (sorted alphabetically, case sensitive)
-        ignore_words_list: adin,ameba,aNULL,brunch,carryIn,chainG,ciph,cLen,cliKs,cna,dout,FPR,fpr,haveA,inCreated,inOut,inout,larg,LEAPYEAR,Merget,optionA,parm,parms,repid,rIn,userA,ser,siz,te,Te,HSI,failT,toLen,vor,checkin
+        ignore_words_list: adin,ameba,aNULL,brunch,buid,carryIn,chainG,ciph,cLen,cliKs,cna,dout,FPR,fpr,haveA,inCreated,inOut,inout,larg,LEAPYEAR,Merget,optionA,parm,parms,repid,rIn,userA,ser,siz,te,Te,HSI,failT,toLen,vor,checkin
           # The exclude_file contains lines of code that should be ignored. This is useful for individual lines which have non-words that can safely be ignored.
         exclude_file: '.codespellexcludelines'
           # To skip files entirely from being processed, add it to the following list:

.github/workflows/jwt-cpp.yml

@@ -50,6 +50,8 @@ jobs:
       fail-fast: false
       matrix:
         config:
+          - ref: 0.7.2
+            runner: ubuntu-24.04
           - ref: 0.7.0
             runner: ubuntu-24.04
           - ref: 0.6.0

.github/workflows/krb5.yml

@@ -51,7 +51,7 @@ jobs:
       fail-fast: false
       matrix:
         # List of releases to test
-        ref: [ 1.21.1 ]
+        ref: [ 1.21.1, 1.22.2 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-22.04

.github/workflows/libimobiledevice.yml

@@ -0,0 +1,224 @@
+name: libimobiledevice Tests
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+jobs:
+  build_wolfssl:
+    name: Build wolfSSL
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    # Just to keep it the same as the testing target
+    runs-on: ubuntu-24.04
+    # This should be a safe limit for the tests to run.
+    timeout-minutes: 4
+    steps:
+      - name: Build wolfSSL
+        uses: wolfSSL/actions-build-autotools-project@v1
+        with:
+          path: wolfssl
+          configure: --enable-all --enable-tlsv10
+          install: true
+          check: false
+
+      - name: tar build-dir
+        run: tar -zcf build-dir.tgz build-dir
+
+      - name: Upload built lib
+        uses: actions/upload-artifact@v6
+        with:
+          name: wolf-install-libimobiledevice
+          path: build-dir.tgz
+          retention-days: 5
+
+  libimobiledevice_check:
+    strategy:
+      fail-fast: false
+      matrix:
+        # List of releases to test
+        include:
+          - ref: 1.4.0
+            libplist: 2.7.0
+            glue: 1.3.2
+            libusbmuxd: 2.1.1
+            libtatsu: 1.0.5
+    name: ${{ matrix.ref }}
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    # This should be a safe limit for the tests to run.
+    timeout-minutes: 15
+    needs: build_wolfssl
+    steps:
+      - name: Checkout wolfSSL CI actions
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+          fetch-depth: 1
+
+      - name: Download lib
+        uses: actions/download-artifact@v7
+        with:
+          name: wolf-install-libimobiledevice
+
+      - name: untar build-dir
+        run: tar -xf build-dir.tgz
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-apt-deps
+        with:
+          packages: libusb-1.0-0-dev libcurl4-openssl-dev libreadline-dev python3-cryptography
+          ghcr-debs-tag: ubuntu-24.04-full
+
+      - name: Checkout OSP
+        uses: actions/checkout@v5
+        with:
+          repository: wolfssl/osp
+          path: osp
+          fetch-depth: 1
+
+      # The Ubuntu packages are too old (libtatsu needs libplist >= 2.6.0)
+      # and libimobiledevice-glue/libtatsu are not packaged, so build the
+      # dependency chain from source into the wolfSSL prefix. None of these
+      # use OpenSSL or wolfSSL.
+      - name: Checkout libplist
+        uses: actions/checkout@v5
+        with:
+          repository: libimobiledevice/libplist
+          path: libplist
+          ref: ${{ matrix.libplist }}
+          fetch-depth: 1
+
+      - name: Checkout libimobiledevice-glue
+        uses: actions/checkout@v5
+        with:
+          repository: libimobiledevice/libimobiledevice-glue
+          path: libimobiledevice-glue
+          ref: ${{ matrix.glue }}
+          fetch-depth: 1
+
+      - name: Checkout libusbmuxd
+        uses: actions/checkout@v5
+        with:
+          repository: libimobiledevice/libusbmuxd
+          path: libusbmuxd
+          ref: ${{ matrix.libusbmuxd }}
+          fetch-depth: 1
+
+      - name: Checkout libtatsu
+        uses: actions/checkout@v5
+        with:
+          repository: libimobiledevice/libtatsu
+          path: libtatsu
+          ref: ${{ matrix.libtatsu }}
+          fetch-depth: 1
+
+      - name: Checkout libimobiledevice
+        uses: actions/checkout@v5
+        with:
+          repository: libimobiledevice/libimobiledevice
+          path: libimobiledevice
+          ref: ${{ matrix.ref }}
+          fetch-depth: 1
+
+      - name: Build dependencies
+        run: |
+          export PKG_CONFIG_PATH=$GITHUB_WORKSPACE/build-dir/lib/pkgconfig
+          for dep in libplist libimobiledevice-glue libusbmuxd libtatsu; do
+            pushd $dep
+            ./autogen.sh --prefix=$GITHUB_WORKSPACE/build-dir --without-cython
+            make -j
+            make install
+            popd
+          done
+
+      - name: Build libimobiledevice
+        working-directory: libimobiledevice
+        run: |
+          export PKG_CONFIG_PATH=$GITHUB_WORKSPACE/build-dir/lib/pkgconfig
+          patch -p1 < $GITHUB_WORKSPACE/osp/libimobiledevice/${{ matrix.ref }}.patch
+          ./autogen.sh --prefix=$GITHUB_WORKSPACE/build-dir --enable-wolfssl --without-cython
+          make -j
+          make install
+
+      # libimobiledevice has no test suite and a runner has no iOS device.
+      # .github/scripts/idevice-emulator.py plays one: it serves the usbmuxd
+      # socket named by USBMUXD_SOCKET_ADDRESS and the lockdownd service
+      # behind it, checks the pair record the tools generate through wolfSSL
+      # and requires the session TLS. The second run reports iOS 9, for which
+      # libimobiledevice pins the session to TLS 1.0 (needs --enable-tlsv10).
+      - name: Test libimobiledevice
+        env:
+          UDID: 1e2f3a4b5c6d7e8f90a1b2c3d4e5f60718293a4b
+          USBMUXD_SOCKET_ADDRESS: UNIX:/tmp/idevice-emulator.sock
+        run: |
+          export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib
+          bin=$GITHUB_WORKSPACE/build-dir/bin
+          ldd $GITHUB_WORKSPACE/build-dir/lib/libimobiledevice-1.0.so | grep wolfssl
+          ldd $bin/idevicepair | grep wolfssl
+
+          run_against_emulator() {
+            local version=$1 want_tls=$2 emulator i devices
+            local log=/tmp/idevice-emulator-$version.log
+            rm -f /tmp/idevice-emulator.sock
+            python3 .github/scripts/idevice-emulator.py \
+              --socket /tmp/idevice-emulator.sock --log $log \
+              --udid $UDID --product-version $version &
+            emulator=$!
+            for i in $(seq 1 100); do
+              [ -S /tmp/idevice-emulator.sock ] && break
+              sleep 0.1
+            done
+
+            # Assign on its own line: a command substitution inside test,
+            # or inside a `local` declaration, would discard idevice_id's
+            # exit status.
+            devices=$($bin/idevice_id -l)
+            test "$devices" = "$UDID"
+            $bin/idevicepair pair
+            $bin/idevicepair validate
+            $bin/ideviceinfo | grep "^ProductVersion: $version\$"
+            $bin/idevicepair unpair
+
+            # Also checks that the emulator exits cleanly on SIGTERM.
+            kill $emulator
+            wait $emulator
+
+            # What the emulator saw: pair record OK, session over the expected
+            # TLS version with the RootCertificate as client certificate,
+            # requests served inside it, unpair reached the record store.
+            grep -q 'pair: pair record verified: ' $log
+            grep -q 'private keys match their certificates' $log
+            grep -qE "tls: session established version=$want_tls" $log
+            grep -q 'matches RootCertificate from the pair record' $log
+            grep -q 'lockdown: GetValue .* \[session ' $log
+            grep -q 'usbmux: DeletePairRecord .* -> deleted' $log
+            if grep -qE 'REJECTED|NOT the RootCertificate' $log; then
+              exit 1
+            fi
+          }
+
+          run_against_emulator 18.6 'TLSv1\.[23] '
+          run_against_emulator 9.3 'TLSv1 '
+
+      - name: Emulator logs
+        if: always()
+        run: |
+          for log in /tmp/idevice-emulator-*.log; do
+            [ -f "$log" ] || continue
+            echo "=== $log ==="
+            cat "$log"
+          done

.github/workflows/libspdm.yml

@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
       matrix:
         # List of releases to test
-        ref: [ 3.7.0 ]
+        ref: [ 3.7.0, 3.8.2 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/libvncserver.yml

@@ -48,7 +48,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ref: [ 0.9.13, 0.9.14 ]
+        ref: [ 0.9.13, 0.9.14, 0.9.15 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/msmtp.yml

@@ -46,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ref: [ 1.8.28 ]
+        ref: [ 1.8.28, 1.8.32 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/net-snmp.yml

@@ -49,6 +49,11 @@ jobs:
         # List of releases to test
         include:
           - ref: 5.9.3
+            patch_file: $GITHUB_WORKSPACE/osp/net-snmp/5.9.3.patch
+            test_opts: -e 'agentxperl'
+          # 5.9.5+ has wolfSSL support upstream, no patch needed
+          - ref: 5.9.5.2
+            patch_file: ''
             test_opts: -e 'agentxperl'
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
@@ -78,7 +83,7 @@ jobs:
           repository: net-snmp/net-snmp
           ref: v${{ matrix.ref }}
           path: net-snmp
-          patch-file: $GITHUB_WORKSPACE/osp/net-snmp/${{ matrix.ref }}.patch
+          patch-file: ${{ matrix.patch_file }}
           configure: --disable-shared --with-wolfssl=$GITHUB_WORKSPACE/build-dir
           check: false
 

.github/workflows/openldap.yml

@@ -55,6 +55,8 @@ jobs:
             git_ref: OPENLDAP_REL_ENG_2_6_7
           - osp_ref: 2.6.9
             git_ref: OPENLDAP_REL_ENG_2_6_9
+          - osp_ref: 2.6.13
+            git_ref: OPENLDAP_REL_ENG_2_6_13
     name: ${{ matrix.osp_ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/python.yml

@@ -96,6 +96,22 @@ jobs:
                 test_urllib2_localnet
                 test_xmlrpc
                 test_docxmlrpc
+            - python_ver: 3.14.5
+              tests: >-
+                test_ssl
+                test.test_asyncio.test_ssl
+                test.test_asyncio.test_sslproto
+                test_hashlib
+                test_hmac
+                test_secrets
+                test_ftplib
+                test_imaplib
+                test_poplib
+                test_smtplib
+                test_httplib
+                test_urllib2_localnet
+                test_xmlrpc
+                test_docxmlrpc
     name: Python ${{ matrix.python_ver }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04

.github/workflows/socat.yml

@@ -56,6 +56,8 @@ jobs:
             expect_fail: "23,36,64,146,155,156,205,207,216,227,307,309,310,321,386,399,402,403,459,460,467,468,475,478,491,492,494,528,529"
           - socat_version: "1.8.0.3"
             expect_fail: "23,146,155,156,205,207,307,321,386,399,402,459,460,467,468,475,478,491,492,494,495,528,529"
+          - socat_version: "1.8.1.1"
+            expect_fail: "23,146,155,156,205,207,307,321,386,399,467,468,475,478,491,492,494,495,528,529"
     steps:
       - name: Checkout wolfSSL CI actions
         uses: actions/checkout@v5

.github/workflows/softhsm.yml

@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
       matrix:
         # List of releases to test
-        ref: [ 2.6.1 ]
+        ref: [ 2.6.1, 2.7.0 ]
     name: ${{ matrix.ref }}
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     runs-on: ubuntu-24.04