pqcrypto/.github/workflows/interop.yml at develop · turkananation/pqcrypto · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: Interop (OpenSSL and liboqs)

# Independent native interoperability proof for every standardized algorithm
# family exposed by pqcrypto. Pull requests run this before merge; push runs are
# limited to integration branches after merge to avoid duplicate branch+PR work.
# Provider builds are pinned and cached because GitHub-hosted runners do not
# ship the required OpenSSL/liboqs versions.
on:
  push:
    branches:
      - develop
      - main
  pull_request:
    branches:
      - develop
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

env:
  OPENSSL_VERSION: "4.0.1"
  OPENSSL_PREFIX: ${{ github.workspace }}/.openssl-cache
  LIBOQS_VERSION: "0.15.0"
  LIBOQS_COMMIT: "97f6b86b1b6d109cfd43cf276ae39c2e776aed80"
  LIBOQS_PREFIX: ${{ github.workspace }}/.liboqs-cache
  NATIVE_BUILD_JOBS: "4"

jobs:
  openssl-interop:
    name: OpenSSL ↔ pqcrypto ML-KEM, ML-DSA, SLH-DSA
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Cache OpenSSL ${{ env.OPENSSL_VERSION }}
        id: cache-openssl
        uses: actions/cache@v4
        with:
          path: ${{ env.OPENSSL_PREFIX }}
          key: openssl-${{ env.OPENSSL_VERSION }}-${{ hashFiles('tool/openssl_interop/tool/build_openssl.sh') }}-${{ runner.os }}-${{ runner.arch }}

      - name: Build OpenSSL ${{ env.OPENSSL_VERSION }} (cache miss only)
        if: steps.cache-openssl.outputs.cache-hit != 'true'
        run: bash tool/build_openssl.sh
        working-directory: tool/openssl_interop

      - name: Verify libcrypto exposes all pqcrypto families
        run: |
          set -euxo pipefail
          LD_LIBRARY_PATH="${OPENSSL_PREFIX}/lib" "${OPENSSL_PREFIX}/bin/openssl" list -kem-algorithms | grep -i 'ml-kem'
          LD_LIBRARY_PATH="${OPENSSL_PREFIX}/lib" "${OPENSSL_PREFIX}/bin/openssl" list -signature-algorithms | grep -i 'ml-dsa'
          LD_LIBRARY_PATH="${OPENSSL_PREFIX}/lib" "${OPENSSL_PREFIX}/bin/openssl" list -signature-algorithms | grep -i 'slh-dsa'

      - name: Set up Dart SDK (stable)
        uses: dart-lang/setup-dart@v1
        with:
          sdk: stable

      - name: Analyze shared interop package
        run: |
          dart pub get
          dart analyze
        working-directory: tool/interop_common

      - name: Analyze OpenSSL interop package
        run: |
          dart pub get
          dart analyze
        working-directory: tool/openssl_interop

      - name: Run complete OpenSSL interop suite
        run: dart test --concurrency=1
        working-directory: tool/openssl_interop
        env:
          LIBCRYPTO_PATH: ${{ env.OPENSSL_PREFIX }}/lib/libcrypto.so

      - name: Run ML-KEM human-readable harness
        run: dart run bin/openssl_pqcrypto_interop.dart
        working-directory: tool/openssl_interop
        env:
          LIBCRYPTO_PATH: ${{ env.OPENSSL_PREFIX }}/lib/libcrypto.so

  liboqs-interop:
    name: liboqs ↔ pqcrypto ML-KEM, ML-DSA, SLH-DSA
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Cache liboqs ${{ env.LIBOQS_VERSION }}
        id: cache-liboqs
        uses: actions/cache@v4
        with:
          path: ${{ env.LIBOQS_PREFIX }}
          key: liboqs-${{ env.LIBOQS_VERSION }}-${{ env.LIBOQS_COMMIT }}-${{ hashFiles('tool/liboqs_interop/tool/build_liboqs.sh') }}-${{ runner.os }}-${{ runner.arch }}

      - name: Build liboqs ${{ env.LIBOQS_VERSION }} (cache miss only)
        if: steps.cache-liboqs.outputs.cache-hit != 'true'
        run: bash tool/build_liboqs.sh
        working-directory: tool/liboqs_interop

      - name: Verify liboqs exports generic KEM and signature APIs
        run: |
          set -euxo pipefail
          nm -D "${LIBOQS_PREFIX}/lib/liboqs.so" | grep ' OQS_KEM_keypair_derand$'
          nm -D "${LIBOQS_PREFIX}/lib/liboqs.so" | grep ' OQS_SIG_sign_with_ctx_str$'

      - name: Set up Dart SDK (stable)
        uses: dart-lang/setup-dart@v1
        with:
          sdk: stable

      - name: Analyze shared interop package
        run: |
          dart pub get
          dart analyze
        working-directory: tool/interop_common

      - name: Analyze liboqs interop package
        run: |
          dart pub get
          dart analyze
        working-directory: tool/liboqs_interop

      - name: Run complete liboqs interop suite
        run: dart test --concurrency=1
        working-directory: tool/liboqs_interop
        env:
          LIBOQS_PATH: ${{ env.LIBOQS_PREFIX }}/lib/liboqs.so