Skip to content

Commit 2952215

Browse files
traviertravier
authored
Merge pull request #35 from travier/main-ci
ci: Add more Rust checks & dependabot config
2 parents bea13c2 + 755e929 commit 2952215

File tree

6 files changed

+293
-38
lines changed

6 files changed

+293
-38
lines changed

‎.github/dependabot.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# SPDX-FileCopyrightText: Timothée Ravier <tim@siosm.fr>
2+
#
3+
# SPDX-License-Identifier: CC0-1.0
4+
5+
# Inspired by https://github.com/coreos/repo-templates
6+
7+
version: 2
8+
updates:
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
groups:
14+
actions:
15+
patterns:
16+
- "*"
17+
- package-ecosystem: "cargo"
18+
directory: "/"
19+
schedule:
20+
interval: "weekly"
21+
groups:
22+
rust:
23+
patterns:
24+
- "*"

‎.github/workflows/ci.yml‎

Lines changed: 229 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,248 @@
11
# SPDX-FileCopyrightText: 2021 Red Hat, Inc.
22
#
33
# SPDX-License-Identifier: MIT
4+
#
5+
# Inspired by https://github.com/coreos/repo-templates
6+
7+
name: "Rust"
8+
on:
9+
pull_request:
10+
branches:
11+
- "main"
12+
permissions:
13+
contents: "read"
14+
15+
# Don't waste job slots on superseded code
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
env:
21+
CARGO_TERM_COLOR: always
22+
# Pinned toolchain for linting
23+
ACTIONS_LINTS_TOOLCHAIN: 1.90.0
424

5-
name: Continuous Integration
6-
on: [push, pull_request]
725
jobs:
8-
formatting:
9-
name: Check formatting
10-
runs-on: ubuntu-latest
26+
tests-stable:
27+
name: "Tests, stable toolchain"
28+
runs-on: "ubuntu-24.04"
29+
container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"
30+
defaults:
31+
run:
32+
working-directory: ./clevis-pin-tpm2
1133
steps:
12-
- uses: actions/checkout@v4
13-
- name: Check formatting
14-
run: cargo fmt --all -- --check
15-
16-
tests:
17-
name: Perform tests
18-
runs-on: ubuntu-latest
19-
container: fedora:latest
34+
- name: "Check out repository"
35+
uses: actions/checkout@v5
36+
with:
37+
path: clevis-pin-tpm2
38+
- name: "Install dependencies"
39+
run: dnf install -y tpm2-tss-devel clang-devel swtpm swtpm-tools
40+
- name: "Install toolchain"
41+
uses: dtolnay/rust-toolchain@v1
42+
with:
43+
toolchain: stable
44+
- name: "Cache build artifacts"
45+
uses: Swatinem/rust-cache@v2
46+
- name: "cargo build"
47+
run: cargo build --all-targets
48+
- name: "Check out the policy signtool"
49+
uses: actions/checkout@v4
50+
with:
51+
path: clevis-pin-tpm2-signtool
52+
repository: puiterwijk/clevis-pin-tpm2-signtool
53+
- name: "Remove clevis-pin-tpm2"
54+
run: |
55+
rm -f /usr/bin/clevis-pin-tpm2 /usr/bin/clevis-*-tpm2plus
56+
- name: "Start swtpm"
57+
run: |
58+
mkdir /tmp/tpmdir
59+
swtpm_setup --tpm2 \
60+
--tpmstate /tmp/tpmdir \
61+
--createek --decryption --create-ek-cert \
62+
--create-platform-cert \
63+
--pcr-banks sha1,sha256 \
64+
--display
65+
swtpm socket --tpm2 \
66+
--tpmstate dir=/tmp/tpmdir \
67+
--flags startup-clear \
68+
--ctrl type=tcp,port=2322 \
69+
--server type=tcp,port=2321 \
70+
--daemon
71+
- name: "Run integration tests"
72+
run: |
73+
TCTI=swtpm: SKIP_CLEVIS=true cargo test --all-targets -- --nocapture
74+
echo "### Shell integration tests" >&2
75+
TCTI=swtpm: SKIP_CLEVIS=true ./tests/integration-test.sh
76+
- name: "Run policy tests"
77+
run: |
78+
TCTI=swtpm: ./tests/test_policy
79+
tests-release-stable:
80+
name: "Tests (release), stable toolchain"
81+
runs-on: "ubuntu-24.04"
82+
container: "ghcr.io/trusted-execution-clusters/buildroot:latest"
2083
defaults:
2184
run:
2285
working-directory: ./clevis-pin-tpm2
2386
steps:
24-
- uses: actions/checkout@v4
87+
- name: "Check out repository"
88+
uses: actions/checkout@v5
2589
with:
2690
path: clevis-pin-tpm2
27-
- name: Check out the policy signtool
91+
- name: "Install dependencies"
92+
run: dnf install -y tpm2-tss-devel clang-devel swtpm swtpm-tools
93+
- name: "Install toolchain"
94+
uses: dtolnay/rust-toolchain@v1
95+
with:
96+
toolchain: stable
97+
- name: "Cache build artifacts"
98+
uses: Swatinem/rust-cache@v2
99+
- name: "cargo build (release)"
100+
run: cargo build --all-targets --release
101+
- name: "Check out the policy signtool"
28102
uses: actions/checkout@v4
29103
with:
30104
path: clevis-pin-tpm2-signtool
31105
repository: puiterwijk/clevis-pin-tpm2-signtool
32-
- name: Install dependencies
106+
- name: "Remove clevis-pin-tpm2"
107+
run: |
108+
rm -f /usr/bin/clevis-pin-tpm2 /usr/bin/clevis-*-tpm2plus
109+
- name: "Start swtpm"
33110
run: |
34-
dnf install -y \
35-
tpm2-tss-devel clevis \
36-
swtpm swtpm-tools \
37-
rust cargo clippy \
38-
golang clang-devel \
39-
git-core
40-
- name: Remove clevis-pin-tpm2
111+
mkdir /tmp/tpmdir
112+
swtpm_setup --tpm2 \
113+
--tpmstate /tmp/tpmdir \
114+
--createek --decryption --create-ek-cert \
115+
--create-platform-cert \
116+
--pcr-banks sha1,sha256 \
117+
--display
118+
swtpm socket --tpm2 \
119+
--tpmstate dir=/tmp/tpmdir \
120+
--flags startup-clear \
121+
--ctrl type=tcp,port=2322 \
122+
--server type=tcp,port=2321 \
123+
--daemon
124+
- name: "Run integration tests"
125+
run: |
126+
TCTI=swtpm: SKIP_CLEVIS=true cargo test --all-targets --release -- --nocapture
127+
echo "### Shell integration tests" >&2
128+
TCTI=swtpm: SKIP_CLEVIS=true ./tests/integration-test.sh
129+
- name: "Run policy tests"
130+
run: |
131+
TCTI=swtpm: ./tests/test_policy
132+
tests-release-msrv:
133+
name: "Tests (release), minimum supported toolchain"
134+
runs-on: "ubuntu-24.04"
135+
container: "ghcr.io/trusted-execution-clusters/buildroot:latest"
136+
defaults:
137+
run:
138+
working-directory: ./clevis-pin-tpm2
139+
steps:
140+
- name: "Check out repository"
141+
uses: actions/checkout@v5
142+
with:
143+
path: clevis-pin-tpm2
144+
- name: "Install dependencies"
145+
run: dnf install -y tpm2-tss-devel clang-devel swtpm swtpm-tools
146+
- name: "Detect crate MSRV"
147+
run: |
148+
msrv=$(cargo metadata --format-version 1 --no-deps | \
149+
jq -r '.packages[0].rust_version')
150+
echo "Crate MSRV: $msrv"
151+
echo "MSRV=$msrv" >> $GITHUB_ENV
152+
- name: "Install toolchain"
153+
uses: dtolnay/rust-toolchain@v1
154+
with:
155+
toolchain: ${{ env.MSRV }}
156+
- name: "Cache build artifacts"
157+
uses: Swatinem/rust-cache@v2
158+
- name: "cargo build (release)"
159+
run: cargo build --all-targets --release
160+
- name: "Check out the policy signtool"
161+
uses: actions/checkout@v4
162+
with:
163+
path: clevis-pin-tpm2-signtool
164+
repository: puiterwijk/clevis-pin-tpm2-signtool
165+
- name: "Remove clevis-pin-tpm2"
166+
run: |
167+
rm -f /usr/bin/clevis-pin-tpm2 /usr/bin/clevis-*-tpm2plus
168+
- name: "Start swtpm"
169+
run: |
170+
mkdir /tmp/tpmdir
171+
swtpm_setup --tpm2 \
172+
--tpmstate /tmp/tpmdir \
173+
--createek --decryption --create-ek-cert \
174+
--create-platform-cert \
175+
--pcr-banks sha1,sha256 \
176+
--display
177+
swtpm socket --tpm2 \
178+
--tpmstate dir=/tmp/tpmdir \
179+
--flags startup-clear \
180+
--ctrl type=tcp,port=2322 \
181+
--server type=tcp,port=2321 \
182+
--daemon
183+
- name: "Run integration tests"
184+
run: |
185+
TCTI=swtpm: SKIP_CLEVIS=true cargo test --all-targets --release -- --nocapture
186+
echo "### Shell integration tests" >&2
187+
TCTI=swtpm: SKIP_CLEVIS=true ./tests/integration-test.sh
188+
- name: "Run policy tests"
189+
run: |
190+
TCTI=swtpm: ./tests/test_policy
191+
linting:
192+
name: "Lints, pinned toolchain"
193+
runs-on: "ubuntu-24.04"
194+
container: "ghcr.io/trusted-execution-clusters/buildroot:latest"
195+
steps:
196+
- name: "Check out repository"
197+
uses: actions/checkout@v5
198+
- name: "Install dependencies"
199+
run: dnf install -y tpm2-tss-devel clang-devel
200+
- name: "Install toolchain"
201+
uses: dtolnay/rust-toolchain@v1
202+
with:
203+
toolchain: ${{ env.ACTIONS_LINTS_TOOLCHAIN }}
204+
components: rustfmt, clippy
205+
- name: "Cache build artifacts"
206+
uses: Swatinem/rust-cache@v2
207+
- name: "cargo fmt (check)"
208+
run: cargo fmt -- --check -l
209+
- name: "cargo clippy (warnings)"
210+
run: cargo clippy --all-targets -- -D warnings
211+
tests-other-channels:
212+
name: "Tests, unstable toolchain"
213+
runs-on: "ubuntu-24.04"
214+
container: "ghcr.io/trusted-execution-clusters/buildroot:latest"
215+
defaults:
216+
run:
217+
working-directory: ./clevis-pin-tpm2
218+
continue-on-error: true
219+
strategy:
220+
matrix:
221+
channel: [beta, nightly]
222+
steps:
223+
- name: "Check out repository"
224+
uses: actions/checkout@v5
225+
with:
226+
path: clevis-pin-tpm2
227+
- name: "Install dependencies"
228+
run: dnf install -y tpm2-tss-devel clang-devel swtpm swtpm-tools
229+
- name: "Install toolchain"
230+
uses: dtolnay/rust-toolchain@v1
231+
with:
232+
toolchain: ${{ matrix.channel }}
233+
- name: "Cache build artifacts"
234+
uses: Swatinem/rust-cache@v2
235+
- name: "cargo build"
236+
run: cargo build --all-targets
237+
- name: "Check out the policy signtool"
238+
uses: actions/checkout@v4
239+
with:
240+
path: clevis-pin-tpm2-signtool
241+
repository: puiterwijk/clevis-pin-tpm2-signtool
242+
- name: "Remove clevis-pin-tpm2"
41243
run: |
42244
rm -f /usr/bin/clevis-pin-tpm2 /usr/bin/clevis-*-tpm2plus
43-
- name: Build
44-
run: cargo build
45-
- name: Start swtpm
245+
- name: "Start swtpm"
46246
run: |
47247
mkdir /tmp/tpmdir
48248
swtpm_setup --tpm2 \
@@ -57,13 +257,11 @@ jobs:
57257
--ctrl type=tcp,port=2322 \
58258
--server type=tcp,port=2321 \
59259
--daemon
60-
- name: Run integration tests
260+
- name: "Run integration tests"
61261
run: |
62-
TCTI=swtpm: SKIP_CLEVIS=true cargo test -- --nocapture
262+
TCTI=swtpm: SKIP_CLEVIS=true cargo test --all-targets -- --nocapture
63263
echo "### Shell integration tests" >&2
64264
TCTI=swtpm: SKIP_CLEVIS=true ./tests/integration-test.sh
65-
- name: Run policy tests
265+
- name: "Run policy tests"
66266
run: |
67267
TCTI=swtpm: ./tests/test_policy
68-
- name: Run clippy
69-
run: cargo clippy -- -D warnings

‎Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ authors = ["Patrick Uiterwijk <patrick@puiterwijk.org>"]
1010
edition = "2018"
1111
homepage = "https://github.com/fedora-iot/clevis-pin-tpm2"
1212
license = "MIT"
13+
rust-version = "1.90.0"
1314

1415
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
1516

‎tests/integration-test.sh‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,21 @@ die() {
88
exit 1
99
}
1010

11+
# Default to debug, search for release
12+
debug="./target/debug/clevis-pin-tpm2"
13+
release="./target/release/clevis-pin-tpm2"
14+
if [[ -f "${debug}" ]]; then
15+
bin="${debug}"
16+
elif [[ -f "${release}" ]]; then
17+
bin="${release}"
18+
else
19+
die "No binary found. Run cargo build first"
20+
fi
21+
1122
PLAINTEXT=foobar
12-
jwe="$(echo "${PLAINTEXT}" | ./target/debug/clevis-pin-tpm2 encrypt {})"
23+
jwe="$(echo "${PLAINTEXT}" | "${bin}" encrypt {})"
1324

14-
dec="$(echo "$jwe" | ./target/debug/clevis-pin-tpm2 decrypt)" \
25+
dec="$(echo "$jwe" | "${bin}" decrypt)" \
1526
|| die "Unable to decrypt JWE passed with newline added"
1627

1728
[ "${dec}" = "${PLAINTEXT}" ] \

‎tests/integration_test.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ use anyhow::{bail, Context, Result};
88

99
type CheckFunction = dyn Fn(&str) -> Result<()>;
1010
struct EncryptFunc {
11+
#[allow(clippy::type_complexity)]
1112
func: Box<dyn Fn(&str, &str) -> Result<String>>,
1213
name: &'static str,
1314
}
1415
struct DecryptFunc {
16+
#[allow(clippy::type_complexity)]
1517
func: Box<dyn Fn(&str) -> Result<String>>,
1618
name: &'static str,
1719
}

0 commit comments

Comments
 (0)