Add wolfCOSE CBOR configuration loader

.github/docker/wolfsentry-ci/Dockerfile

@@ -4,7 +4,9 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         bubblewrap \
         dbus \
+        dwarves \
         gcc-arm-none-eabi \
+        gcc-multilib \
         iproute2 \
         iputils-ping \
         libnewlib-arm-none-eabi \

.github/workflows/examples.yml

@@ -195,7 +195,8 @@ jobs:
         path: lwip
     - name: Check out lwIP contrib
       run: |
-        git clone --branch STABLE-2_1_0_RELEASE --depth 1 \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry git clone --branch STABLE-2_1_0_RELEASE --depth 1 \
           https://git.savannah.nongnu.org/git/lwip/lwip-contrib.git \
           lwip/contrib
         test "$(git -C lwip/contrib rev-parse HEAD)" = \

.github/workflows/options-matrix.yml

@@ -65,10 +65,211 @@ jobs:
             target: no-addr-bitmask-matching-test
           - name: No IPv6
             target: no-ipv6-test
+          - name: C99
+            target: c99-test
+          - name: No alloca
+            target: no-alloca-test
+          - name: Static
+            target: static-build-test
+          - name: No inline
+            target: no-inline-test
+          - name: Fortify source
+            target: fortify-source-test
+          - name: Call trace
+            target: CALL_TRACE-test
+          - name: Small private data alignment
+            target: small-PRIVATE_DATA_ALIGNMENT-test
+          - name: Big private data alignment
+            target: big-PRIVATE_DATA_ALIGNMENT-test
+          - name: POSIX vanilla HPI
+            target: HPI_POSIX_VANILLA-test
+          - name: No malloc builtins
+            target: no-malloc-builtins-test
+          - name: Stripped function sections
+            target: stripped-function-sections-test
+          - name: Unoptimized
+            target: optim-O0-test
+          - name: Library dependencies single-threaded
+            target: library-dependency-singlethreaded-build-test
+          - name: Library dependencies multithreaded
+            target: library-dependency-multithreaded-build-test
+          - name: Distribution
+            target: dist-check
+          - name: Release archive
+            target: release-check
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
     - name: Trust workspace
       run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
     - name: Test configuration
       run: make -j2 ${{ matrix.target }}
+
+  wolfcose-deps:
+    name: Build COSE dependencies
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+    steps:
+    - name: Build wolfSSL and wolfCOSE
+      run: |
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        WOLFSSL_TAGS=$(retry git ls-remote --tags --refs \
+          https://github.com/wolfSSL/wolfssl.git 'v*-stable')
+        WOLFSSL_REF=$(awk -F/ '{print $NF}' <<<"$WOLFSSL_TAGS" | sort -V | tail -n 1)
+        test -n "$WOLFSSL_REF"
+        mkdir -p /opt/wolfsentry-deps
+        cd /opt/wolfsentry-deps
+        retry git clone --depth 1 --branch "$WOLFSSL_REF" \
+          https://github.com/wolfSSL/wolfssl.git wolfssl
+        WOLFCOSE_TAGS=$(retry git ls-remote --tags --refs \
+          https://github.com/wolfSSL/wolfCOSE.git 'v*')
+        WOLFCOSE_REF=$(awk -F/ '{print $NF}' <<<"$WOLFCOSE_TAGS" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1)
+        test -n "$WOLFCOSE_REF"
+        retry git clone --depth 1 --branch "$WOLFCOSE_REF" \
+          https://github.com/wolfSSL/wolfCOSE.git wolfCOSE
+        cd wolfssl
+        ./autogen.sh
+        ./configure --enable-ecc --enable-ed25519 --enable-ed448 \
+          --enable-curve25519 --enable-curve448 --enable-aesgcm \
+          --enable-aesccm --enable-sha384 --enable-sha512 --enable-keygen \
+          --enable-hkdf --enable-aeskeywrap --enable-chacha \
+          --enable-poly1305 --enable-rsapss \
+          --prefix=/opt/wolfsentry-deps/wolfssl-install
+        make -j"$(nproc)"
+        make install
+        cd ..
+        make -C wolfCOSE -j"$(nproc)" EXTRA_CFLAGS=-fPIC \
+          WOLFSSL_CFLAGS="-isystem /opt/wolfsentry-deps/wolfssl-install/include" \
+          WOLFSSL_LIBS="-L/opt/wolfsentry-deps/wolfssl-install/lib -lwolfssl" \
+          all
+        tar -C /opt -czf "$GITHUB_WORKSPACE/wolfsentry-deps.tar.gz" \
+          wolfsentry-deps/wolfssl-install wolfsentry-deps/wolfCOSE/include \
+          wolfsentry-deps/wolfCOSE/libwolfcose.a
+    - uses: actions/upload-artifact@v4
+      with:
+        name: wolfcose-deps
+        path: wolfsentry-deps.tar.gz
+        retention-days: 1
+
+  wolfcose:
+    name: COSE ${{ matrix.config }}
+    needs: wolfcose-deps
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - default
+          - no-json
+          - no-json-dom
+          - singlethreaded
+          - c99
+          - no-routes
+          - no-addr-family-names
+          - no-route-endpoints
+          - no-events
+          - no-user-values
+          - no-eventconfig
+          - no-transactions
+          - no-legacy-event-syntax
+          - no-error-messages
+          - no-text-numbers
+          - no-text-addresses
+          - minimal
+          - minimal-no-json
+          - reduced
+          - total-limit
+          - nesting-limit
+          - user-settings
+          - dynamic
+    env:
+      CPATH: /opt/wolfsentry-deps/wolfssl-install/include
+    steps:
+    - uses: actions/checkout@v4
+    - name: Trust workspace
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+    - uses: actions/download-artifact@v4
+      with:
+        name: wolfcose-deps
+    - name: Install dependencies
+      run: tar -C /opt -xzf wolfsentry-deps.tar.gz
+    - name: Test configuration
+      run: |
+        make -j2 WOLFCOSE_REQUIRED=1 \
+          WOLFCOSE_TEST_TOP=/opt/wolfsentry-deps/wolfCOSE \
+          wolfcose-${{ matrix.config }}-test
+
+  toolchain:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: m32
+            target: m32-test
+          - name: m32 C89
+            target: m32-c89-test
+          - name: Route holes
+            target: route-holes-test
+          - name: Struct layout
+            target: pahole-test
+          - name: FreeRTOS arm32
+            target: freertos-arm32-build-test
+          - name: FreeRTOS arm32 thumb
+            target: freertos-arm32-thumb-build-test
+          - name: FreeRTOS arm32 single-threaded
+            target: freertos-arm32-singlethreaded-build-test
+          - name: FreeRTOS arm32 C89
+            target: freertos-arm32-c89-build-test
+          - name: Linux lwIP
+            target: linux-lwip-test
+          - name: Linux lwIP no IPv6
+            target: linux-lwip-test-no-ipv6
+          - name: Linux lwIP C89 m32
+            target: linux-lwip-c89-m32-test
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        path: wolfsentry
+    - uses: actions/checkout@v4
+      with:
+        repository: FreeRTOS/FreeRTOS-Kernel
+        ref: dbf70559b27d39c1fdb68dfb9a32140b6a6777a0
+        path: third/FreeRTOS/FreeRTOS/Source
+    - uses: actions/checkout@v4
+      with:
+        repository: lwip-tcpip/lwip
+        ref: 3fe8d2fc43a9b69f7ed28c63d44a7744f9c0def9
+        path: third/lwip
+    - name: Apply the lwIP packet filter patch
+      run: patch --directory third/lwip --strip 1 < wolfsentry/lwip/LWIP_PACKET_FILTER_API.patch
+    - name: Build the wolfSentry CI image
+      run: |
+        docker build \
+          --file wolfsentry/.github/docker/wolfsentry-ci/Dockerfile \
+          --tag wolfsentry-ci:local wolfsentry
+    - name: Test configuration
+      env:
+        TARGET: ${{ matrix.target }}
+      run: |
+        # Ubuntu's arm-none-eabi-gcc links test_lwip slightly above the default limit.
+        docker run --rm \
+          --env TMPDIR=/tmp \
+          --env TARGET \
+          --volume "$GITHUB_WORKSPACE/wolfsentry:/workspace/wolfsentry:ro" \
+          --volume "$GITHUB_WORKSPACE/third:/workspace/third:ro" \
+          wolfsentry-ci:local bash -euc '
+            cp -R /workspace/wolfsentry /tmp/wolfsentry
+            cd /tmp/wolfsentry
+            make -j2 FREERTOS_TOP=/workspace/third/FreeRTOS \
+              LWIP_TOP=/workspace/third/lwip \
+              FREERTOS_ARM32_MAX_SECTIONS_SIZE=110000 "$TARGET"
+          '

.github/workflows/wolfssl-versions.yml

@@ -37,9 +37,10 @@ jobs:
     - name: Build matrix
       id: versions
       run: |
-        LATEST=$(git ls-remote --tags --refs \
-          https://github.com/wolfSSL/wolfssl.git 'v*-stable' \
-          | awk -F/ '{print $NF}' | sort -V | tail -n 1)
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        TAGS=$(retry git ls-remote --tags --refs \
+          https://github.com/wolfSSL/wolfssl.git 'v*-stable')
+        LATEST=$(awk -F/ '{print $NF}' <<<"$TAGS" | sort -V | tail -n 1)
         test -n "$LATEST"
         if [[ ! "$LATEST" =~ ^v[0-9]+(\.[0-9]+)+-stable$ ]]; then
           echo "Unexpected wolfSSL stable tag: $LATEST" >&2
@@ -83,7 +84,8 @@ jobs:
       env:
         WOLFSSL_REF: ${{ matrix.ref }}
       run: |
-        git clone --depth 1 --branch "$WOLFSSL_REF" \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry git clone --depth 1 --branch "$WOLFSSL_REF" \
           https://github.com/wolfSSL/wolfssl.git "$HOME/wolfssl"
         cd "$HOME/wolfssl"
         ./autogen.sh