CI: Add ACVP tests in CI

.github/workflows/all.yml

@@ -13,6 +13,13 @@ on:
     branches: ["main"]
     types: [ "opened", "synchronize" ]
 jobs:
+  base:
+    name: Base
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    uses: ./.github/workflows/base.yml
+    secrets: inherit
   nix:
     name: Nix
     permissions:
@@ -26,7 +33,6 @@ jobs:
     permissions:
       contents: 'read'
       id-token: 'write'
-    needs: [ nix ]
+    needs: [ base, nix ]
     uses: ./.github/workflows/cbmc.yml
     secrets: inherit
-

.github/workflows/base.yml

@@ -0,0 +1,42 @@
+# Copyright (c) The mlkem-native project authors
+# Copyright (c) The slhdsa-c project authors
+# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+
+name: Base
+permissions:
+  contents: read
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  quickcheck:
+    strategy:
+      fail-fast: false
+      matrix:
+        external:
+         - ${{ github.repository_owner != 'pq-code-package' }}
+        target:
+         - runner: pqcp-arm64
+           name: 'aarch64'
+         - runner: ubuntu-latest
+           name: 'x86_64'
+         - runner: macos-latest
+           name: 'macos (aarch64)'
+         - runner: macos-13
+           name: 'macos (x86_64)'
+        acvp-version: [v1.1.0.40, v1.1.0.39]
+        exclude:
+          - {external: true,
+             target: {
+               runner: pqcp-arm64,
+               name: 'aarch64'
+             }}
+    name: Quickcheck (${{ matrix.target.name }}, ACVP ${{ matrix.acvp-version }})
+    runs-on: ${{ matrix.target.runner }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run ACVP test
+        run: |
+          make
+          python3 test/acvp_client.py --version ${{ matrix.acvp-version }}

.gitignore

@@ -63,3 +63,5 @@ modules.order
 Module.symvers
 Mkfile.old
 dkms.conf
+# Downloaded ACVP test data
+test/.acvp-data/

Makefile

@@ -34,16 +34,8 @@ $(XTEST):	$(OBJS)
 %.o:	%.[cS]
 	$(CC) $(CFLAGS) -c $^ -o $@
 
-# without gnu parallel: bash test/acvp_cases.sh | tee test.log
-test:	$(XTEST) test/acvp_cases.sh
-	cat test/acvp_cases.sh | parallel --pipe bash | tee test.log
-	@echo "=== test summary ==="
-	@echo "PASS:" `grep -c PASS test.log`
-	@echo "SKIP:" `grep -c SKIP test.log`
-	@echo "FAIL:" `grep -c FAIL test.log`
-
-test/acvp_cases.sh:
-	cd test && $(MAKE) acvp_cases.sh
+test: $(XTEST)
+	python3 test/acvp_client.py
 
 clean:
 	$(RM) -rf $(XTEST) $(OBJS) *.rsp *.req *.log

cbmc.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) The mlkem-native project authors
- * Copyright (c) The slhdsa-native project authors
+ * Copyright (c) The slhdsa-c project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 

test/Makefile

@@ -21,20 +21,13 @@ $(XCOUNT):	$(OBJS) xcount.c my_dbg.c
 %.o:	%.[cS]
 	$(CC) $(CFLAGS) -c $^ -o $@
 
-acvp_cases.sh: ACVP-Server/gen-val/json-files
-	python3 test_slhdsa.py > $@
-
-new_param.csv: $(XCOUNT) test_param.py new_param.txt acvp_cases.sh
+new_param.csv: $(XCOUNT) test_param.py new_param.txt
 	echo "alg_id, pk, sk, sig, keygen, sign, vfy_ok, vfy_fail"> $@
 	./$(XCOUNT) | tee /dev/tty | sort >> $@
 	python3 test_param.py | parallel | tee /dev/tty | sort >> $@
 
-ACVP-Server/gen-val/json-files:
-	git submodule update --init ACVP-Server
-
 clean:
 	$(RM) -rf $(XCOUNT) $(OBJS) *.log
 	$(RM) -f *.pyc *.cprof */*.pyc *.rsp *.log
-	$(RM) -f acvp_cases.sh
 	$(RM) -rf __pycache__ */__pycache__