Add wolfCOSE and wolfIP compatibility checks

Author: aidangarske

.github/workflows/cross-library.yml

@@ -2,9 +2,10 @@ name: cross-library (reusable)
 
 # Reusable engine for compile-testing a downstream wolfSSL product against the
 # wolfSSL in this checkout. It builds wolfSSL once from this checkout (the PR
-# merge commit) with the flags a product needs, then compiles the product
-# against that install at both the product's default-branch HEAD and its highest
-# release tag (compile-only, no `make check`).
+# merge commit), then builds the product against that install at both the
+# product's default-branch HEAD and its highest release tag. A caller can also
+# select an inline Makefile build/test sequence for a project whose native CI
+# uses one.
 #
 # The wolfSSL build runs once and is shared: the build-wolfssl job installs
 # wolfSSL and uploads it as an artifact, and the compile matrix (head, latest)
@@ -32,8 +33,14 @@ on:
         default: ''
         type: string
       script:
-        description: 'Build script name under .github/workflows/cross-library/scripts/'
-        required: true
+        description: 'Build script name under .github/workflows/cross-library/scripts/; defaults to <product>.sh in script mode'
+        required: false
+        default: ''
+        type: string
+      build_mode:
+        description: 'Build implementation: script (default) or makefile (inline in this workflow)'
+        required: false
+        default: 'script'
         type: string
       apt_packages:
         description: 'Extra apt packages needed to build the product'
@@ -240,31 +247,91 @@ jobs:
           echo "Resolved ${{ matrix.ref_mode }} ref for $REPO: $ref"
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
-      # Compile-only (never `make check`). A compile failure is allowed ONLY if
-      # a wolfSSL commit since the last release tag declared it with a
-      # `breaks-<product>=<ref>` token (see check-break.sh); otherwise the job
-      # fails, forcing intentional breaks to be recorded in a commit.
+      # Build the product. Script-mode products use their existing adapters;
+      # Makefile-mode products run the same commands as their native CI here so
+      # their integration is reviewable without a second product-specific file.
+      # A build failure is allowed ONLY if a wolfSSL commit since the last release
+      # tag declared it with a breaks-<product>=<ref> token (see check-break.sh);
+      # otherwise the job fails, forcing intentional breaks to be recorded in a
+      # commit. The output gates the optional maintained-HEAD smoke test.
       # PRODUCT_CONFIGURE is intentionally unquoted so multiple flags split.
       - name: Compile ${{ inputs.product }} against wolfSSL
+        id: product_build
         env:
+          BUILD_MODE: ${{ inputs.build_mode }}
           REPO: ${{ inputs.repo }}
           PRODUCT_CONFIGURE: ${{ inputs.product_configure }}
           PRODUCT: ${{ inputs.product }}
+          PRODUCT_SCRIPT: ${{ inputs.script }}
           REF: ${{ steps.ref.outputs.ref }}
           MODE: ${{ matrix.ref_mode }}
         run: |
           S=.github/workflows/cross-library/scripts
           set +e
-          # shellcheck disable=SC2086  # $PRODUCT_CONFIGURE must word-split into flags
-          "$S/${{ inputs.script }}" -t "$REF" \
-            "$GITHUB_WORKSPACE/wolfssl-install" "$REPO" $PRODUCT_CONFIGURE
+          (
+            set -euo pipefail
+            case "$BUILD_MODE:$PRODUCT" in
+              script:*)
+                # Keep the allowed adapter list explicit: workflow_call inputs
+                # must not select an arbitrary executable from the checkout.
+                product_script="${PRODUCT_SCRIPT:-${PRODUCT}.sh}"
+                case "$product_script" in
+                  wolfclu.sh|wolfmqtt.sh|wolfpkcs11.sh|wolfprovider.sh|wolfssh.sh|wolftpm.sh)
+                    ;;
+                  *)
+                    echo "::error::unsupported cross-library product script: $product_script"
+                    exit 2
+                    ;;
+                esac
+                # shellcheck disable=SC2086  # $PRODUCT_CONFIGURE must word-split into flags
+                "$S/$product_script" -t "$REF" \
+                  "$GITHUB_WORKSPACE/wolfssl-install" "$REPO" $PRODUCT_CONFIGURE
+                ;;
+              makefile:wolfcose)
+                case "$REPO" in
+                  *://*|git@*) product_url="$REPO" ;;
+                  *) product_url="https://github.com/${REPO}.git" ;;
+                esac
+                git clone --depth 1 --branch "$REF" "$product_url" wolfCOSE
+                cd wolfCOSE
+                # Match wolfCOSE's hosted Makefile build, explicitly using the
+                # staged wolfSSL instead of a host /usr/local installation.
+                cflags="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -Os"
+                cflags+=" -Wall -Wextra -Wpedantic -Wshadow -Wconversion"
+                cflags+=" -Wvla -Werror=vla -ffunction-sections -fdata-sections -fstack-usage"
+                cflags+=" -I./include -isystem $GITHUB_WORKSPACE/wolfssl-install/include"
+                ldflags="-L$GITHUB_WORKSPACE/wolfssl-install/lib -Wl,-rpath,$GITHUB_WORKSPACE/wolfssl-install/lib -lwolfssl"
+                make "-j$(nproc)" CFLAGS="$cflags" LDFLAGS="$ldflags"
+                ;;
+              makefile:wolfip)
+                case "$REPO" in
+                  *://*|git@*) product_url="$REPO" ;;
+                  *) product_url="https://github.com/${REPO}.git" ;;
+                esac
+                git clone --depth 1 --branch "$REF" "$product_url" wolfip
+                cd wolfip
+                # wolfIP v1.0 predates generic WOLFSSL_PREFIX support on Linux,
+                # so point its header probe and link step at the staged install.
+                export WOLFSSL_PREFIX="$GITHUB_WORKSPACE/wolfssl-install"
+                export PKG_CONFIG_PATH="$WOLFSSL_PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+                export EXTRA_CFLAGS="${EXTRA_CFLAGS:+$EXTRA_CFLAGS }-I$WOLFSSL_PREFIX/include"
+                export LDFLAGS="${LDFLAGS:+$LDFLAGS }-L$WOLFSSL_PREFIX/lib -Wl,-rpath,$WOLFSSL_PREFIX/lib"
+                make "-j$(nproc)" build/test-wolfssl
+                ;;
+              *)
+                echo "::error::unsupported cross-library build mode/product: $BUILD_MODE/$PRODUCT"
+                exit 2
+                ;;
+            esac
+          )
           rc=$?
           set -e
 
           # The breaks-<product>= mechanism applies ONLY to the latest release
           # tag. A head/master break is never waivable, never consults the
           # ledger, and must be fixed.
           if [ "$rc" -eq 0 ]; then
+            echo "compiled=true" >> "$GITHUB_OUTPUT"
             if [ "$MODE" = "latest" ] && "$S/check-break.sh" "$PRODUCT" "$REF" >/tmp/brk 2>/dev/null; then
               echo "::warning::$PRODUCT ($REF) compiled OK but a break is still declared, remove the stale breaks-$PRODUCT=$REF token:"
               cat /tmp/brk
@@ -277,6 +344,7 @@ jobs:
           if [ "$MODE" = "latest" ]; then
             # Released, immutable tag: allowed only if the exact tag is declared.
             if "$S/check-break.sh" "$PRODUCT" "$REF"; then
+              echo "compiled=false" >> "$GITHUB_OUTPUT"
               echo "::warning::$PRODUCT $REF failed to compile, but this break is DECLARED (see above). Treating as a known/tracked break."
               exit 0
             fi
@@ -295,3 +363,42 @@ jobs:
             echo "  * putting up a matching fix on $PRODUCT's $REF branch, then re-running this job."
           fi
           exit 1
+
+      # The Makefile-mode smoke suite covers the maintained default-branch HEAD,
+      # after a real successful build. Older releases retain compile-only
+      # coverage because their own runtime suites may not support the current
+      # wolfSSL baseline.
+      - name: Run ${{ inputs.product }} smoke tests
+        if: ${{ inputs.build_mode == 'makefile' && matrix.ref_mode == 'head' && steps.product_build.outputs.compiled == 'true' }}
+        env:
+          PRODUCT: ${{ inputs.product }}
+          WOLFSSL_INSTALL: ${{ github.workspace }}/wolfssl-install
+        run: |
+          set -euxo pipefail
+          case "$PRODUCT" in
+            wolfcose)
+              cd "$GITHUB_WORKSPACE/wolfCOSE"
+              export LD_LIBRARY_PATH="$WOLFSSL_INSTALL/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+              cflags="-std=c99 -DHAVE_ANONYMOUS_INLINE_AGGREGATES=1 -Os"
+              cflags+=" -Wall -Wextra -Wpedantic -Wshadow -Wconversion"
+              cflags+=" -Wvla -Werror=vla -ffunction-sections -fdata-sections -fstack-usage"
+              cflags+=" -I./include -isystem $WOLFSSL_INSTALL/include"
+              ldflags="-L$WOLFSSL_INSTALL/lib -Wl,-rpath,$WOLFSSL_INSTALL/lib -lwolfssl"
+              make test CFLAGS="$cflags" LDFLAGS="$ldflags"
+              make tool-test CFLAGS="$cflags" LDFLAGS="$ldflags"
+              ;;
+            wolfip)
+              cd "$GITHUB_WORKSPACE/wolfip"
+              export WOLFSSL_PREFIX="$WOLFSSL_INSTALL"
+              export PKG_CONFIG_PATH="$WOLFSSL_PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+              export EXTRA_CFLAGS="${EXTRA_CFLAGS:+$EXTRA_CFLAGS }-I$WOLFSSL_PREFIX/include"
+              export LDFLAGS="${LDFLAGS:+$LDFLAGS }-L$WOLFSSL_PREFIX/lib -Wl,-rpath,$WOLFSSL_PREFIX/lib"
+              export LD_LIBRARY_PATH="$WOLFSSL_PREFIX/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+              make "-j$(nproc)" unit-esp
+              ./build/test/unit-esp
+              ;;
+            *)
+              echo "::error::unsupported cross-library smoke test"
+              exit 1
+              ;;
+          esac

.github/workflows/cross-library/README.md

@@ -1,17 +1,22 @@
-# Cross-library compile testing
+# Cross-library compatibility testing
 
 Compile tests the wolfSSL product family (wolfSSH, wolfCLU, wolfTPM, wolfMQTT,
-wolfPKCS11, wolfProvider) against **this** wolfSSL, so a wolfSSL change that
-would stop a downstream product from *compiling* is caught in CI.
-
-**Compile only. There is no runtime testing here** (the product scripts run
-`make`, never `make check`). Each product is built twice: at the HEAD of its
-default branch and at its latest tagged release.
+wolfPKCS11, wolfProvider, wolfCOSE, wolfIP) against **this** wolfSSL, so a
+wolfSSL change that would stop a downstream product from *compiling* is caught
+in CI.
+
+Each product is built twice: at the HEAD of its default branch and at its
+latest tagged release. Most products use a small product adapter. wolfCOSE and
+wolfIP use their native Makefile commands inline in the reusable workflow and
+also run deterministic, unprivileged smoke tests after a successful HEAD build.
+Release tags retain compile-only coverage because their older runtime suites may
+not support the current wolfSSL baseline; privileged/network-emulator tests
+remain in those products' own CI.
 
 > Note: the workflow `.yml` files (the reusable engine `cross-library.yml` and
 > the per-product `cross-<product>.yml` callers) live in `.github/workflows/`
 > itself, because GitHub only discovers workflows directly in that directory,
-> not in subfolders. Everything else (these scripts) lives here.
+> not in subfolders. Shared helpers and legacy product adapters live here.
 
 ## Layout
 
@@ -35,11 +40,14 @@ The engine (`cross-library.yml`) runs one job in a clean container
    required `wolfssl_configure` flags and installs it to a local dir.
 4. **`resolve-ref.sh`** resolves the ref to build: the highest version tag
    (`ref_mode: latest`) or the default branch (`ref_mode: head`).
-5. **`<product>.sh`** clones the product at that ref and compiles it against the
-   installed wolfSSL (`--with-wolfssl=<install dir>`).
+5. The selected build mode clones the product at that ref and compiles it
+   against the installed wolfSSL. Script mode uses `<product>.sh`; Makefile mode
+   keeps the product's native build commands inline in `cross-library.yml`.
 6. If the compile fails, **`check-break.sh`** decides whether it was a
    *declared* break (allowed, tracked) or an *undeclared* one (job fails). See
    below.
+7. A Makefile-mode caller runs its inline smoke suite only after a successful
+   default-branch HEAD build. A smoke-test failure is always a failure.
 
 ## Scripts
 
@@ -50,7 +58,8 @@ The engine (`cross-library.yml`) runs one job in a clean container
 | `resolve-ref.sh <repo> <mode>` | Echo the ref for `head` (default branch) or `latest` (highest tag). |
 | `latest-tag.sh <repo>` | Poll the highest version tag (`git ls-remote --sort=-v:refname`, robust to mixed tag styles). |
 | `check-break.sh <product> <ref>` | Break declaration check (see below). |
-| `<product>.sh [-t <ref>] <install> <repo> [product_configure...]` | Per-product build. Most just call `cross_build_autotools`; `wolfprovider.sh` also passes `--with-openssl`. |
+| `<product>.sh [-t <ref>] <install> <repo> [product_configure...]` | Per-product build adapter for script mode. Most just call `cross_build_autotools`; `wolfprovider.sh` also passes `--with-openssl`. |
+| Inline `makefile` cases in `cross-library.yml` | Native Makefile build and maintained-HEAD smoke commands for wolfCOSE and wolfIP. |
 
 ## Break declarations
 
@@ -93,6 +102,9 @@ Because the token names the exact tag, it automatically stops matching once the
 product releases a newer tag, forcing a fresh, explicit declaration if the new
 release is still broken.
 
+Break declarations apply only to compile compatibility. If the maintained
+product HEAD compiles and then its optional smoke test fails, the job is red.
+
 The failure message depends on which leg broke:
 
 - **`latest` (a released tag)**: the tag is immutable, so the job explains the
@@ -107,8 +119,11 @@ The failure message depends on which leg broke:
 
 1. Copy an existing `cross-<product>.yml` caller and set `product`, `repo`,
    `wolfssl_configure` (the wolfSSL flags that product documents), optional
-   `product_configure`, `script`, and optional `apt_packages`.
-2. Add a `scripts/<product>.sh`. If it is a standard autotools project, it is
+   `product_configure`, `script`, and optional `apt_packages`. Script mode is
+   the default and uses `scripts/<product>.sh` when `script` is omitted; set
+   `script` explicitly only when its filename differs.
+2. Add a `scripts/<product>.sh` for script mode. If it is a standard autotools
+   project, it is
    just:
    ```sh
    #!/usr/bin/env bash
@@ -118,6 +133,10 @@ The failure message depends on which leg broke:
    ```
    Non-autotools products (see `wolfprovider.sh`) can `_prepare "$@"` and then
    run their own build steps.
+3. For a project whose own CI is Makefile-based, set `build_mode: makefile` and
+   add an explicitly allowlisted inline build and maintained-HEAD smoke case to
+   `cross-library.yml`. Keep privileged, hardware, and network-emulator flows
+   in the downstream project.
 
 Get each product's required `wolfssl_configure` from that product's own
 README or CI, not by guessing. The flags matter (e.g. wolfPKCS11 and

.github/workflows/cross-wolfcose.yml

@@ -0,0 +1,34 @@
+name: wolfCOSE cross-library
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+jobs:
+  cross-library:
+    uses: ./.github/workflows/cross-library.yml
+    with:
+      product: wolfcose
+      repo: wolfSSL/wolfCOSE
+      # Match wolfCOSE's complete supported algorithm configuration.
+      wolfssl_configure: >-
+        --enable-ecc --enable-ed25519 --enable-ed448 --enable-curve25519
+        --enable-curve448 --enable-aesgcm --enable-aesccm --enable-aescbc
+        --enable-sha384 --enable-sha512 --enable-keygen --enable-hkdf
+        --enable-aeskeywrap --enable-chacha --enable-poly1305 --enable-mldsa
+        --enable-rsapss
+      # wolfCOSE's native CI is Makefile-based; keep the matching commands
+      # inline in the reusable workflow rather than in a product shell adapter.
+      build_mode: makefile

.github/workflows/cross-wolfip.yml

@@ -0,0 +1,30 @@
+name: wolfIP cross-library
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+jobs:
+  cross-library:
+    uses: ./.github/workflows/cross-library.yml
+    with:
+      product: wolfip
+      repo: wolfSSL/wolfip
+      # Match wolfIP's standard Linux CI configuration.
+      wolfssl_configure: --enable-all --enable-md5
+      # wolfIP's native CI is Makefile-based; keep the matching commands
+      # inline in the reusable workflow rather than in a product shell adapter.
+      build_mode: makefile
+      apt_packages: check