Skip to content

YubiHSM Auth: Add YubiKey firmware version check before getting devic… #2350

YubiHSM Auth: Add YubiKey firmware version check before getting devic…

YubiHSM Auth: Add YubiKey firmware version check before getting devic… #2350

Workflow file for this run

name: Build and Test
on: [push, pull_request]
jobs:
build_debian_derivatives:
strategy:
fail-fast: false
matrix:
include:
- environment: "ubuntu:24.04"
cc: "gcc"
upload_for_test: "false"
- environment: "ubuntu:24.04"
cc: "clang"
upload_for_test: "false"
- environment: "ubuntu:23.10"
cc: "gcc"
upload_for_test: "false"
- environment: "ubuntu:23.10"
cc: "clang"
upload_for_test: "false"
- environment: "ubuntu:22.04"
cc: "gcc"
upload_for_test: "false"
- environment: "ubuntu:22.04"
cc: "clang"
upload_for_test: "true"
- environment: "ubuntu:20.04"
cc: "gcc"
upload_for_test: "false"
- environment: "ubuntu:20.04"
cc: "clang"
upload_for_test: "false"
# - environment: "ubuntu:18.04"
# cc: "gcc"
# upload_for_test: "false"
# - environment: "ubuntu:16.04"
# cc: "gcc"
# upload_for_test: "false"
# - environment: "ubuntu:14.04"
# cc: "gcc"
# upload_for_test: "false"
- environment: "debian:12"
cc: "gcc"
upload_for_test: "false"
- environment: "debian:12"
cc: "clang"
upload_for_test: "false"
- environment: "debian:11"
cc: "gcc"
upload_for_test: "false"
- environment: "debian:11"
cc: "clang"
upload_for_test: "false"
name: build on ${{ matrix.environment }} (${{ matrix.cc }},${{ matrix.upload_for_test}})
runs-on: ubuntu-latest
container: ${{ matrix.environment }}
steps:
- name: install dependencies from package management
env:
CC: ${{ matrix.cc }}
DEBIAN_FRONTEND: noninteractive
run: |
apt update
apt install -q -y build-essential \
cmake pkg-config \
gengetopt \
help2man \
libcurl4-openssl-dev \
libedit-dev \
libpcsclite-dev \
libusb-1.0-0-dev \
libssl-dev \
file \
curl \
jq
if [ "$CC" = "clang" ]; then
apt install -q -y clang llvm lld
fi
- name: clone the Yubico/yubihsm-shell repository
uses: actions/checkout@v4
with:
path: yubihsm-shell
- name: apply environment specific changes to CMakeLists.txt
working-directory: yubihsm-shell
if: ${{ matrix.environment == 'ubuntu:14.04' }}
run: |
# ubuntu 14.04 comes with cmake version 2.8, but the project requires 3.5
# we downgrade that requirement for the ubuntu 14.04 build
sed -i 's/cmake_minimum_required (VERSION 3.5)/cmake_minimum_required (VERSION 2.8)/' CMakeLists.txt
# we also remove the following policies which are not supported in the older cmake version
sed -i 's/cmake_policy(SET CMP0025 NEW)/#cmake_policy(SET CMP0025 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0042 NEW)/#cmake_policy(SET CMP0042 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0054 NEW)/#cmake_policy(SET CMP0054 NEW)/' CMakeLists.txt
# append the following flags: -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration
sed -i 's/-Wall -Wextra -Werror/-Wall -Wextra -Werror -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration/' cmake/SecurityFlags.cmake
- name: do build
working-directory: yubihsm-shell
env:
CC: ${{ matrix.cc }}
VERBOSE: 1
run: |
mkdir build
cd build
if [ "$CC" = "gcc" ]; then
cmake -DRELEASE_BUILD=1 -DWITHOUT_YKYH=1 ..
else
cmake -DRELEASE_BUILD=1 -DWITHOUT_YKYH=1 \
-DCMAKE_AR=/usr/bin/llvm-ar \
-DCMAKE_RANLIB=/usr/bin/llvm-ranlib \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
..
fi
cmake --build .
- name: do static build
working-directory: yubihsm-shell
env:
CC: ${{ matrix.cc }}
VERBOSE: 1
BUILD_ENVIRONMENT: ${{ matrix.environment }}
run: |
mkdir build-static
cd build-static
if [ "$CC" = "gcc" ]; then
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release ..
else
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_AR=/usr/bin/llvm-ar \
-DCMAKE_RANLIB=/usr/bin/llvm-ranlib \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
..
fi
cmake --build .
- name: prepare name for upload-artifact action
env:
DOCKER_IMAGE: ${{ matrix.environment }}
CC: ${{ matrix.cc }}
run: |
ESCAPED_IMAGE=$(echo -n "$DOCKER_IMAGE" | sed -E 's/[^a-zA-Z0-9]//g')
echo "ARTIFACT_NAME=yubihsm-shell_${ESCAPED_IMAGE}_${CC}" >> $GITHUB_ENV
- name: create compressed tar file
if: ${{ matrix.upload_for_test == 'true' }}
run: tar cfz yubihsm-shell.tar.gz yubihsm-shell
- name: upload artifacts for the test job
if: ${{ matrix.upload_for_test == 'true' }}
uses: actions/upload-artifact@v3
with:
name: "${{ env.ARTIFACT_NAME }}"
path: yubihsm-shell.tar.gz
build_centos_fedora:
strategy:
fail-fast: false
matrix:
include:
# we do not perform clang builds for all environments, only fedora
- environment: "fedora:40"
cc: "gcc"
upload_for_test: "true"
- environment: "fedora:40"
cc: "clang"
upload_for_test: "false"
- environment: "fedora:39"
cc: "gcc"
upload_for_test: "false"
- environment: "fedora:39"
cc: "clang"
upload_for_test: "false"
name: build on ${{ matrix.environment }} (${{ matrix.cc }}, ${{ matrix.upload_for_test }})
runs-on: ubuntu-latest
container: ${{ matrix.environment }}
steps:
- name: clone the Yubico/yubihsm-shell repository
uses: actions/checkout@v3
with:
path: yubihsm-shell
- name: extract platform name
env:
DOCKER_IMAGE: ${{ matrix.environment }}
run: |
# Remove everything from DOCKER_IMAGE that is not a letter or a number
PLATFORM=$(echo -n "$DOCKER_IMAGE" | sed -E 's/[^a-zA-Z0-9]//g')
echo "PLATFORM=$PLATFORM" >> $GITHUB_ENV
- name: install dependencies from package management
env:
CC: ${{ matrix.cc }}
PLATFORM: ${{ env.PLATFORM }}
run: |
cd yubihsm-shell/resources/release/linux
./install_redhat_dependencies.sh $PLATFORM
if [ "$CC" = "clang" ]; then
yum install -y clang llvm lld
fi
- name: apply environment specific changes to CMakeLists.txt
working-directory: yubihsm-shell
if: ${{ matrix.environment == 'centos:7' }}
run: |
# centos 7 comes with cmake version 2.8, but the project requires 3.5
# we downgrade that requirement for the centos 7 build
sed -i 's/cmake_minimum_required (VERSION 3.5)/cmake_minimum_required (VERSION 2.8)/' CMakeLists.txt
# we also remove the following policies which are not supported in the older cmake version
sed -i 's/cmake_policy(SET CMP0025 NEW)/#cmake_policy(SET CMP0025 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0042 NEW)/#cmake_policy(SET CMP0042 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0054 NEW)/#cmake_policy(SET CMP0054 NEW)/' CMakeLists.txt
# append the following flags: -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration
sed -i 's/-Wall -Wextra -Werror/-Wall -Wextra -Werror -Wno-missing-braces -Wno-missing-field-initializers/' cmake/SecurityFlags.cmake
- name: do build
working-directory: yubihsm-shell
env:
CC: ${{ matrix.cc }}
VERBOSE: 1
run: |
mkdir build
cd build
if [ "$CC" = "gcc" ]; then
cmake -DCMAKE_BUILD_TYPE=Release ..
else
cmake -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_AR=/usr/bin/llvm-ar \
-DCMAKE_RANLIB=/usr/bin/llvm-ranlib \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
..
fi
cmake --build .
- name: do static build
working-directory: yubihsm-shell
env:
CC: ${{ matrix.cc }}
VERBOSE: 1
PLATFORM: ${{ env.PLATFORM }}
run: |
mkdir build-static
cd build-static
if [ "$CC" = "gcc" ]; then
# lto breaks static builds on centos 7 so we disable it
if [ $PLATFORM = "centos7" ]; then
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release -DDISABLE_LTO=ON ..
else
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release ..
fi
else
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_AR=/usr/bin/llvm-ar \
-DCMAKE_RANLIB=/usr/bin/llvm-ranlib \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
..
fi
cmake --build .
- name: prepare name for upload-artifact action
env:
PLATFORM: ${{ env.PLATFORM }}
CC: ${{ matrix.cc }}
run: |
echo "ARTIFACT_NAME=yubihsm-shell_${PLATFORM}_${CC}" >> $GITHUB_ENV
- name: create compressed tar file
if: ${{ matrix.upload_for_test == 'true' }}
run: tar cfz yubihsm-shell.tar.gz yubihsm-shell
- name: upload artifacts for the test job
if: ${{ matrix.upload_for_test == 'true' }}
uses: actions/upload-artifact@v3
with:
name: "${{ env.ARTIFACT_NAME }}"
path: yubihsm-shell.tar.gz
build_macos:
name: build on macos
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- os: macos-latest
- os: macos-latest-xlarge
steps:
- name: install dependencies using brew
run: brew install gengetopt help2man libedit opensc
- name: clone the Yubico/yubihsm-shell repository
uses: actions/checkout@v4
with:
path: yubihsm-shell
- name: do build
working-directory: yubihsm-shell
env:
VERBOSE: 1
run: |
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
cmake --build .
- name: Test loading PKCS11 module
working-directory: yubihsm-shell
run: |
echo connector=http://127.0.0.1:12345 > yubihsm_pkcs11.conf
export YUBIHSM_PKCS11_CONF=$GITHUB_WORKSPACE/yubihsm-shell/yubihsm_pkcs11.conf
pkcs11-tool --module build/pkcs11/yubihsm_pkcs11.dylib --show-info | grep Yubico
- name: do static build
working-directory: yubihsm-shell
env:
VERBOSE: 1
run: |
mkdir build-static
cd build-static
cmake -DENABLE_STATIC=ON -DCMAKE_BUILD_TYPE=Release ..
cmake --build .
- name: check binaries for hardening
working-directory: yubihsm-shell
run: |
./resources/release/macos/check_hardening.sh "build/src/yubihsm-shell"
test:
strategy:
fail-fast: false
matrix:
include:
- environment: "ubuntu:22.04"
cc: "clang"
- environment: "fedora:40"
cc: "gcc"
name: run unit tests
runs-on: ubuntu-latest
container: ${{ matrix.environment }}
needs: [build_debian_derivatives, build_centos_fedora]
steps:
- name: install dependencies from package management (debian based)
env:
DEBIAN_FRONTEND: noninteractive
if: ${{ matrix.environment == 'ubuntu:22.04' }}
run: |
apt update
apt install -q -y build-essential cmake python3 python3-pip python3-setuptools curl libedit2 libpcsclite1 libengine-pkcs11-openssl opensc swig openjdk-11-jdk-headless libssl3
- name: install dependencies from package management (rpm based)
if: ${{ matrix.environment == 'fedora:40' }}
run: |
yum install -y gcc gcc-c++ cmake python3-devel python3-pip python3-setuptools curl libedit gengetopt openssl libcurl pcsc-lite swig java-11-openjdk-headless which
- name: prepare name for download-artifact action
env:
DOCKER_IMAGE: ${{ matrix.environment }}
CC: ${{ matrix.cc }}
run: |
ESCAPED_IMAGE=$(echo -n "$DOCKER_IMAGE" | sed -E 's/[^a-zA-Z0-9]//g')
echo "ARTIFACT_NAME=yubihsm-shell_${ESCAPED_IMAGE}_${CC}" >> $GITHUB_ENV
- name: download artifacts from the build job
uses: actions/download-artifact@v3
with:
name: "${{ env.ARTIFACT_NAME }}"
- name: decompress yubihsm-shell.tar.gz
run: tar xfz yubihsm-shell.tar.gz
- name: prepare ghostunnel
env:
TLSPWD: ${{ secrets.TLSKEY }}
# GODEBUG required for ghostunnel to temporarily enable Common Name matching
GODEBUG: x509ignoreCN=0
run: |
curl -o /tmp/ghostunnel -L https://github.com/ghostunnel/ghostunnel/releases/download/v1.6.0/ghostunnel-v1.6.0-linux-amd64
chmod +x /tmp/ghostunnel
openssl aes-256-cbc \
-k "$TLSPWD" \
-md sha256 \
-in yubihsm-shell/.ci/client-combined.pem.enc \
-out yubihsm-shell/.ci/client-combined.pem \
-d
/tmp/ghostunnel client \
--listen localhost:12345 \
--target hsm-connector01.sthlm.in.yubico.org:8443 \
--keystore yubihsm-shell/.ci/client-combined.pem \
--cacert yubihsm-shell/.ci/server-crt.pem > /dev/null 2>&1 &
sleep 3
DEFAULT_CONNECTOR_URL=$(curl -s http://localhost:12345/dispatcher/request)
test -n "$DEFAULT_CONNECTOR_URL" || (echo "Unable to obtain a connector URL, aborting"; exit 1)
echo "DEFAULT_CONNECTOR_URL=$DEFAULT_CONNECTOR_URL" >> $GITHUB_ENV
- name: clone the YubicoLabs/pkcs11test repository
uses: actions/checkout@v3
with:
repository: YubicoLabs/pkcs11test
path: pkcs11test
- name: build the pkcs11test binary
working-directory: pkcs11test
run: |
make
echo "PKCS11TEST_PATH=`pwd`" >> $GITHUB_ENV
- name: reset the hsm
working-directory: yubihsm-shell/build/src
run: |
./yubihsm-shell --connector "$DEFAULT_CONNECTOR_URL" -p password -a reset
sleep 3
- name: run tests with ctest
working-directory: yubihsm-shell/build
env:
DOCKER_IMAGE: ${{ matrix.environment }}
run: |
if [ $DOCKER_IMAGE = "debian:11" ]; then
# we skip the engine tests (for now) since it ships with a broken curl version
ctest --output-on-failure -E engine
elif [ $DOCKER_IMAGE = "centos:7" ]; then
# we skip the ecdh_derive tests (for now) since there is an issue with generating secp224r1 keys
ctest --output-on-failure -E ecdh_derive\|aes\|ecdh_sp800
else
ctest --output-on-failure
fi
- name: clone the YubicoLabs/python-pkcs11tester repository
uses: actions/checkout@v3
with:
repository: YubicoLabs/python-pkcs11tester
path: python-pkcs11tester
- name: run python-pkcs11tester
env:
DOCKER_IMAGE: ${{ matrix.environment }}
run: |
if [ $DOCKER_IMAGE = "centos:7" ]; then
# the pypi cryptography package requires an up-to-date version of pip
# https://github.com/pyca/cryptography/issues/5753
pip3 install --upgrade pip
fi
export YUBIHSM_PKCS11_MODULE=`pwd`/yubihsm-shell/build/pkcs11/yubihsm_pkcs11.so
cd python-pkcs11tester
echo "connector=$DEFAULT_CONNECTOR_URL" > yubihsm_pkcs11.conf
python3 -m pip install 'pykcs11' 'cryptography>=1.4.0'
python3 setup.py test
- name: cleanup
if: ${{ always() }}
run: |
if [ -n "$DEFAULT_CONNECTOR_URL" ]; then
curl -s http://localhost:12345/dispatcher/release?connector=$DEFAULT_CONNECTOR_URL
fi