unix.yml

name: Linux and MacOS tests

permissions:
  contents: read

on: [ push, pull_request ]

jobs:

  stylecheck:
    name: Check code formatting
    container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Ensure code conventions are upheld
        run: python3 -m pytest --verbose tests/test_code_conventions.py
      - name: Check that doxygen can parse the documentation
        run: mkdir -p build/docs && doxygen docs/.Doxyfile
      - name: Validate CBOM
        run: scripts/validate_cbom.sh

  upstreamcheck:
    name: Check upstream code is properly integrated
    container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Verify copy_from_upstream state
        run: |
          git config --global user.name "ciuser" && \
          git config --global user.email "ci@openquantumsafe.org" && \
          export LIBOQS_DIR=`pwd` && \
          git config --global --add safe.directory $LIBOQS_DIR && \
          cd scripts/copy_from_upstream && \
          ! pip3 install --require-hashes -r requirements.txt 2>&1 | grep ERROR && \
          python3 copy_from_upstream.py copy && \
          ! git status | grep modified

  buildcheck:
    name: Check that code passes a basic build before starting heavier tests
    container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
    needs: [ stylecheck, upstreamcheck ]
    runs-on: ubuntu-latest
    env:
      KEM_NAME: kyber_768
      SIG_NAME: dilithium_3
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Configure
        run: |
          mkdir build && \
          cd build && \
          cmake .. --warn-uninitialized \
                   -GNinja \
                   -DOQS_MINIMAL_BUILD="KEM_$KEM_NAME;SIG_$SIG_NAME" \
                   > config.log 2>&1 && \
          cat config.log && \
          cmake -LA .. && \
          ! (grep "uninitialized variable" config.log)
      - name: Build code
        run: ninja
        working-directory: build
      - name: Build documentation
        run: ninja gen_docs
        working-directory: build

  linux_intel:
    needs: buildcheck
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: alpine
            container: openquantumsafe/ci-alpine-amd64:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_USE_OPENSSL=ON -DBUILD_SHARED_LIBS=ON
            PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
          - name: alpine-openssl-all
            container: openquantumsafe/ci-alpine-amd64:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_USE_OPENSSL=ON -DBUILD_SHARED_LIBS=ON -DOQS_USE_AES_OPENSSL=ON -DOQS_USE_SHA2_OPENSSL=ON -DOQS_USE_SHA3_OPENSSL=ON
            PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
          - name: alpine-noopenssl
            container: openquantumsafe/ci-alpine-amd64:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_USE_OPENSSL=OFF
            PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
          - name: focal-nistr4-openssl
            container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_ALGS_ENABLED=NIST_R4
            PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
          - name: jammy-std-openssl3
            container: openquantumsafe/ci-ubuntu-jammy:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_ALGS_ENABLED=STD -DBUILD_SHARED_LIBS=ON
            PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
          - name: jammy-std-openssl3-dlopen
            container: openquantumsafe/ci-ubuntu-jammy:latest
            CMAKE_ARGS: -DOQS_STRICT_WARNINGS=ON -DOQS_ALGS_ENABLED=STD -DBUILD_SHARED_LIBS=ON -DOQS_DLOPEN_OPENSSL=ON
            PYTEST_ARGS: --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py
          - name: address-sanitizer
            container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
            CMAKE_ARGS: -DCMAKE_C_COMPILER=clang-9 -DCMAKE_BUILD_TYPE=Debug -DUSE_SANITIZER=Address
            PYTEST_ARGS: --ignore=tests/test_distbuild.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py --numprocesses=auto --maxprocesses=10
    container:
      image: ${{ matrix.container }}
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Configure
        run: mkdir build && cd build && cmake -GNinja ${{ matrix.CMAKE_ARGS }} .. && cmake -LA ..
      - name: Build
        run: ninja
        working-directory: build
      - name: Run tests
        timeout-minutes: 60
        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py ${{ matrix.PYTEST_ARGS }}
      - name: Package .deb
        if: ${{ matrix.name }} == 'jammy-std-openssl3'
        run: cpack
        working-directory: build
      - name: Retain .deb file
        if: ${{ matrix.name }} == 'jammy-std-openssl3'
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # pin@v3
        with:
          name: liboqs-openssl3-shared-x64
          path: build/*.deb
      - name: Check STD algorithm and alias
        if: matrix.name == 'jammy-std-openssl3'
        run: 'tests/dump_alg_info | grep -zoP "ML-DSA-44:\n    isnull: false" && tests/dump_alg_info | grep -zoP "ML-DSA-44-ipd:\n    isnull: true" && tests/dump_alg_info | grep -zoP "ML-KEM-512:\n    isnull: false" && tests/dump_alg_info | grep -zoP "ML-KEM-512-ipd:\n    isnull: true"'
        working-directory: build

  linux_arm_emulated:
    needs: buildcheck
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: armhf
            ARCH: armhf
            CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_OPT_TARGET=generic
            PYTEST_ARGS: --ignore=tests/test_alg_info.py --ignore=tests/test_kat_all.py
          # no longer supporting armel
          # - name: armel
          #   ARCH: armel
          #   CMAKE_ARGS: -DOQS_ENABLE_SIG_SPHINCS=OFF -DOQS_USE_OPENSSL=OFF -DOQS_OPT_TARGET=generic
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Install the emulation handlers
        run: docker run --rm --privileged multiarch/qemu-user-static:register --reset
      - name: Build in an x86_64 container
        run: |
          docker run --rm \
                     -v `pwd`:`pwd` \
                     -w `pwd` \
                     openquantumsafe/ci-debian-buster-amd64:latest /bin/bash \
                     -c "mkdir build && \
                         (cd build && \
                          cmake .. -GNinja ${{ matrix.CMAKE_ARGS }} \
                                   -DCMAKE_TOOLCHAIN_FILE=../.CMake/toolchain_${{ matrix.ARCH }}.cmake && \
                          cmake -LA .. && \
                          ninja)"
      - name: Run the tests in an ${{ matrix.ARCH }} container
        timeout-minutes: 60
        run: |
          docker run --rm -e SKIP_TESTS=style,mem_kem,mem_sig \
                          -v `pwd`:`pwd` \
                          -w `pwd` \
                          openquantumsafe/ci-debian-buster-${{ matrix.ARCH }}:latest /bin/bash \
                          -c "mkdir -p tmp && \
                              python3 -m pytest --verbose \
                                                --numprocesses=auto \
                                                --ignore=tests/test_code_conventions.py ${{ matrix.PYTEST_ARGS }}"

  linux_cross_compile:
    needs: buildcheck
    runs-on: ubuntu-latest
    container: openquantumsafe/ci-ubuntu-focal-x86_64:latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: windows-binaries
            CMAKE_ARGS: -DCMAKE_TOOLCHAIN_FILE=../.CMake/toolchain_windows-amd64.cmake
          - name: windows-dll
            CMAKE_ARGS: -DCMAKE_TOOLCHAIN_FILE=../.CMake/toolchain_windows-amd64.cmake -DBUILD_SHARED_LIBS=ON
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Configure
        run: mkdir build && cd build && cmake -GNinja ${{ matrix.CMAKE_ARGS }} .. && cmake -LA ..
      - name: Build
        run: ninja
        working-directory: build

  macos:
    needs: buildcheck
    strategy:
      fail-fast: false
      matrix:
        os:
          # macos-14 runs on aarch64; the others run on x64
          - macos-12
          - macos-13
          - macos-14
        CMAKE_ARGS:
          - -DCMAKE_C_COMPILER=gcc-13
          - -DOQS_USE_OPENSSL=OFF
          - -DBUILD_SHARED_LIBS=ON -DOQS_DIST_BUILD=OFF
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Install dependencies
        run: env HOMEBREW_NO_AUTO_UPDATE=1 brew install ninja && pip3 install --break-system-packages --require-hashes -r .github/workflows/requirements.txt
      - name: Get system information
        run: sysctl -a | grep machdep.cpu
      - name: Configure
        run: mkdir -p build && cd build && source ~/.bashrc && cmake -GNinja -DOQS_STRICT_WARNINGS=ON ${{ matrix.CMAKE_ARGS }} .. && cmake -LA ..
      - name: Build
        run: ninja
        working-directory: build
      - name: Run tests
        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --ignore=tests/test_kat_all.py ${{ matrix.PYTEST_ARGS }}
        timeout-minutes: 60

  linux_openssl330-dev:
    needs: buildcheck
    runs-on: ubuntu-latest
    container:
      image: openquantumsafe/ci-ubuntu-jammy:latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
      - name: Retrieve OpenSSL330 from cache
        id: cache-openssl330
        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # pin@v3
        with:
          path: .localopenssl330
          key: ${{ runner.os }}-openssl330
      - name: Checkout the OpenSSL v3.3.0 commit
        if: steps.cache-openssl330.outputs.cache-hit != 'true'
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4
        with:
          repository: 'openssl/openssl'
          ref: 'openssl-3.3.0-beta1'
          path: openssl
      - name: Prepare the OpenSSL build directory
        if: steps.cache-openssl330.outputs.cache-hit != 'true'
        run: mkdir .localopenssl330
        working-directory: openssl
      - name: Build openssl3 if not cached
        if: steps.cache-openssl330.outputs.cache-hit != 'true'
        run: |
          ./config --prefix=`pwd`/../.localopenssl330 && make -j 4 && make install_sw install_ssldirs
        working-directory: openssl
      - name: Save OpenSSL
        id: cache-openssl-save
        if: steps.cache-openssl330.outputs.cache-hit != 'true'
        uses: actions/cache/save@e12d46a63a90f2fae62d114769bbf2a179198b5c # pin@v3
        with:
          path: |
            .localopenssl330
          key: ${{ runner.os }}-openssl330
      - name: Configure
        run: mkdir build && cd build && cmake -GNinja -DOQS_STRICT_WARNINGS=ON -DOPENSSL_ROOT_DIR=../.localopenssl330 -DOQS_USE_OPENSSL=ON -DBUILD_SHARED_LIBS=ON -DOQS_USE_AES_OPENSSL=ON -DOQS_USE_SHA2_OPENSSL=ON -DOQS_USE_SHA3_OPENSSL=ON .. && cmake -LA ..
      - name: Build
        run: ninja
        working-directory: build
      - name: Run tests
        timeout-minutes: 60
        run: mkdir -p tmp && python3 -m pytest --verbose --ignore=tests/test_code_conventions.py --ignore=tests/test_leaks.py --ignore=tests/test_kat_all.py