Add GitHub Action to test PIN flag upgrade from v1.3.0 to v2.0.0 #155
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This workflow tests the issue where upgrading from wolfPKCS11 v1.3.0 to v2.0.0+ can result in the WP11_TOKEN_FLAG_USER_PIN_SET flag not being set when a PIN was configured in the old version. The test: 1. Builds wolfPKCS11 v1.3.0 and initializes a token with a PIN 2. Verifies the PIN works in v1.3.0 3. Builds the PR version (v2.0.0+) 4. Tests if the PIN flag is properly detected after upgrade This is a simplified version without TPM to focus on the PIN flag issue. Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
Can one of the admins verify this patch? |
The workflow failed because v1.3.0 doesn't have examples/init_token. This commit fixes the issue by: 1. Creating an inline token initialization program that uses PKCS#11 API directly (C_InitToken + C_InitPIN) to set up the token with a PIN 2. Pinning wolfSSL to v5.8.2-stable for compatibility with v1.3.0 3. Using consistent WOLFPKCS11_TOKEN_PATH env variable across all steps 4. Adding distinct exit code (100) for the expected bug (CKR_USER_PIN_NOT_INITIALIZED) to distinguish from workflow/setup errors 5. Improving error handling and diagnostics in the workflow The test is expected to fail with exit code 100, confirming the bug where WP11_TOKEN_FLAG_USER_PIN_SET is not set when upgrading from v1.3.0 to v2.0.0. Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
This adds a separate workflow to test the PIN flag upgrade issue from v1.3.0 to v2.0.0 using TPM storage (WOLFPKCS11_TPM_STORE). The workflow: 1. Sets up ibmswtpm2 (software TPM simulator) and wolfTPM 2. Builds wolfPKCS11 v1.3.0 with TPM support and initializes a token with PIN 3. Stops/restarts TPM server to flush NVChip (persists TPM state) 4. Builds PR version (v2.0.0+) with TPM support 5. Tests if the PIN flag is properly detected after upgrade This follows the pattern from PR #154 but uses inline C programs for token initialization and verification. The test uses exit code 100 for the expected bug (CKR_USER_PIN_NOT_INITIALIZED) to distinguish from workflow errors. Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
Member
|
Closing this, it isn't a problem for 1.3.0 -> 2.0.0. Only for an intermediate version that was not released. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add GitHub Action to test PIN flag upgrade from v1.3.0 to v2.0.0
Summary
This PR adds a GitHub Action workflow that tests for a PIN flag upgrade bug discovered in wolfPKCS11. When upgrading from v1.3.0 to v2.0.0, tokens with PINs set may not have the
WP11_TOKEN_FLAG_USER_PIN_SETflag set in the new version, causing authentication failures.The workflow:
Important: This test is EXPECTED to fail on current master because the bug exists and hasn't been fixed yet. The test serves to reproduce the issue so a fix can be developed and validated.
Unlike PR #154, this workflow is simplified (no TPM) to focus specifically on the file-based storage PIN flag issue.
Review & Testing Checklist for Human
0x00000102(CKR_USER_PIN_NOT_INITIALIZED) and displays the "BUG DETECTED" messageverify_pin_1.3.0.candverify_pin_2.0.0.ccompile successfully with the relative include pathsWOLFPKCS11_TOKEN_PATHenvironment variable properly propagates across workflow steps so v2.0.0 finds the v1.3.0 tokenTest Plan
Notes
WOLFPKCS11_TOKEN_PATHenvironment variable to ensure both versions access the same token storageLink to Devin run: https://app.devin.ai/sessions/899f11a4b0ab46cc835b55b8b785904a
Requested by: andrew@wolfssl.com (andrew@wolfssl.com)