Skip to content

Conversation

@aidangarske
Copy link
Contributor

@aidangarske aidangarske commented Oct 13, 2025

Description

  • Currently Add Initial FIPS support for wolfProvider Github CI #299 is failing because we need to start creating the deb packages on master before we actually start testing. Once this is merged we can then create packages for this pr to detect and use. But we are blocked from creating packages on this pr bc actions that use secrets are suppressed from running bc it could be used maliciously.
  • I added the build as .github/workflows/build-wolfprovider-debian.yml and .github/workflows/build-wolfprovider-debian-nightly.yml so we can have the old functionality still till we actually switch over.

The nightly will have options like this to run on the main branch so we can build certain supported .deb configurations. If we choose to expand.
image

@aidangarske aidangarske self-assigned this Oct 13, 2025
@aidangarske aidangarske marked this pull request as ready for review October 13, 2025 19:13
openssl_ref:
description: 'OpenSSL ref (tag/branch)'
required: false
default: 'openssl-3.5.2'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that in the case of debian, we ignore the version field and use whatever comes from Debian

required: false
default: 'openssl-3.5.2'
type: string
fips_ref:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Openssl build is agnostic of the fips setting, so we may want to specifically exclude that

matrix:
# When manually triggered with 'both', or on schedule, build both FIPS and non-FIPS
# When manually triggered with specific type, only build that type
fips_ref: ${{ (github.event_name == 'schedule' || github.event.inputs.fips_ref == 'both' || github.event.inputs.fips_ref == '') && fromJSON('["FIPS", "non-FIPS"]') || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we wrap long lines? eg:

  fips_ref: >-
    ${{ (github.event_name == 'schedule'
      || github.event.inputs.fips_ref == 'both'
      || github.event.inputs.fips_ref == '')
      && fromJSON('["FIPS", "non-FIPS"]')
      || fromJSON(format('["{0}"]', github.event.inputs.fips_ref)) }}

if: github.event_name != 'pull_request'
uses: actions/upload-artifact@v4
with:
name: debian-packages-${{ inputs.fips_ref }}${{ inputs.replace_default && '-replace-default' || '' }}-${{ inputs.wolfssl_ref }}-${{ inputs.openssl_ref }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to include github.sha to avoid collisions


# Try simple build first (without parameters)
echo "Trying simple build trigger..."
SIMPLE_URL="${JOB_URL}/build"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How do we tell Jenkins what ref's we need (commit id, wolfssl_ref, openssl_ref, etc)?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants