Skip to content

Conversation

Einhornhool
Copy link
Contributor

Contribution description

So far the PSA Crypto implementation used MUSL C PRNG as the default random number generator, which is not cryptographically secure.
This PR uses the SHA256 RNG instead, which is a CSPRNG.

Testing procedure

When building examples/psa_crypto: make info-modules should list prng_sha256prng

@github-actions github-actions bot added the Area: sys Area: System label Mar 12, 2024
@benpicco benpicco added the CI: ready for build If set, CI server will compile all applications for all available boards for the labeled PR label Mar 12, 2024
@riot-ci
Copy link

riot-ci commented Mar 12, 2024

Murdock results

✔️ PASSED

1924b06 sys/psa_crypto: use SHA256 CSPRNG as default

Success Failures Total Runtime
10031 0 10031 10m:42s

Artifacts

@Teufelchen1 Teufelchen1 enabled auto-merge March 12, 2024 15:54
@Teufelchen1 Teufelchen1 added this pull request to the merge queue Mar 12, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Mar 12, 2024
@Teufelchen1
Copy link
Contributor

I am confused about the history of murdock actions here. The auto merge got aborted due to a failing build but the latest result from murdock succeeded? As far as I can tell, nobody initiated a re-run...so the result should be the same? Maybe I should go home for today...

@kaspar030
Copy link
Contributor

The auto merge got aborted due to a failing build but the latest result from murdock succeeded?

So we have a two-stage merge: first, the PR needs to succeed. then github adds the PR to a merge queue, which also has to succeed. if you click on the button "view details" next to the last "github-merge-queue removed this pull request ..." message, on the bottom there's alink to the failed build (https://ci.riot-os.org/details/a8022e73e76440269b7e481861624473).

@mguetschow mguetschow added this pull request to the merge queue Mar 17, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Mar 17, 2024
@mguetschow mguetschow added the CI: no fast fail don't abort PR build after first error label Mar 17, 2024
@mguetschow mguetschow added this pull request to the merge queue Mar 17, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Mar 17, 2024
@mguetschow mguetschow added the CI: full build disable CI build filter label Mar 18, 2024
@Teufelchen1
Copy link
Contributor

@Einhornhool I think you need to black-list more boards :/
Maybe have a look at ./dist/tools/insufficient_memory/create_makefile.ci.sh

@mguetschow
Copy link
Contributor

In theory, the re-triggered Murdock build should have been a full build with no fast fail, i.e., show all board where builds are failing. It should™ thus be sufficient to disable nucleo-l011k4 for tests/sys/psa_crypto_hashes.

@github-actions github-actions bot added the Area: tests Area: tests and testing framework label Mar 20, 2024
@mguetschow
Copy link
Contributor

Thanks for the update! How did you come up with the boards you've added to the files? The last Murdock build did succeed for tests/sys/psa_crypto_se_{ecdsa,mac} on arduino-leonardo:gnu: https://ci.riot-os.org/details/7bf60f6406c5401cbfe0917cc35efa8f/builds/tests:sys:psa_crypto_se_ecdsa and https://ci.riot-os.org/details/7bf60f6406c5401cbfe0917cc35efa8f/builds/tests:sys:psa_crypto_se_mac

@Teufelchen1
Copy link
Contributor

looks at Release'o'clock Ping @Einhornhool

@Einhornhool
Copy link
Contributor Author

Einhornhool commented Mar 25, 2024

I ran 'create_makefile.ci.sh' on all psa test directories.
I just ran it again to check and it turns out the same.
So looks like we can't trust that script. How should I proceed? I'd rather not check each test for each board manually.

@mguetschow
Copy link
Contributor

I ran 'create_makefile.ci.sh' on all psa test directories. I just ran it again to check and it turns out the same. So looks like we can't trust that script.

Hum strange, maybe a mismatch between the compiler versions used on the CI and on your system. The script should automatically build in Docker, so maybe your local docker container is outdated? Maybe try docker images to see how old your local copy is and docker image pull riot/riotbuild for updating it. Related to #20472.

How should I proceed? I'd rather not check each test for each board manually.

Given that the CI performed a full build (i.e. all that would also be built during merge) and only one board was reported as failing, I would suggest to fixup your last commit to only exclude nucleo-l011k4 for tests/sys/psa_crypto_hashes.

@mguetschow mguetschow removed CI: full build disable CI build filter CI: no fast fail don't abort PR build after first error labels Mar 25, 2024
@Einhornhool
Copy link
Contributor Author

I ran 'create_makefile.ci.sh' on all psa test directories. I just ran it again to check and it turns out the same. So looks like we can't trust that script.

Hum strange, maybe a mismatch between the compiler versions used on the CI and on your system. The script should automatically build in Docker, so maybe your local docker container is outdated? Maybe try docker images to see how old your local copy is and docker image pull riot/riotbuild for updating it. Related to #20472.

How should I proceed? I'd rather not check each test for each board manually.

Given that the CI performed a full build (i.e. all that would also be built during merge) and only one board was reported as failing, I would suggest to fixup your last commit to only exclude nucleo-l011k4 for tests/sys/psa_crypto_hashes.

I almost never build in docker, so yeah, could be a mismatch. I will update tomorrow morning, when I'm at HAW.

@Einhornhool
Copy link
Contributor Author

Sorry for the 35 force pushes. Should be fine now.

@mguetschow
Copy link
Contributor

Great thanks! Did docker pull do the trick?

Feel free to squash already.

Copy link
Contributor

@mguetschow mguetschow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks again!

@Einhornhool
Copy link
Contributor Author

Great thanks! Did docker pull do the trick?

Unfortunately not, I am trusting your word right now^^

@mguetschow mguetschow added this pull request to the merge queue Mar 26, 2024
Merged via the queue into RIOT-OS:master with commit edefdb7 Mar 27, 2024
@mguetschow
Copy link
Contributor

So for the record, I just checked the output of the arduino-leonardo:gnu build for tests/sys/psa_crypto_se_ecdsa again and it contains make: 'test-input-hash' is up to date., thereby actually skipping the build. That means we probably have two actually failing builds on master.

Given that the symlinks in those tests do not work well with the CI logic, we should consider changing them to actual copies. Or maybe @MrKevinWeiss has another idea?

@MrKevinWeiss
Copy link
Contributor

Or maybe @MrKevinWeiss has another idea?

Hmmm, I didn't consider the symlink thing... Maybe something like what we did with the ieee802.15.4 radio tests. For example: tests/drivers/cc2420

@MrKevinWeiss MrKevinWeiss added this to the Release 2024.04 milestone Apr 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area: sys Area: System Area: tests Area: tests and testing framework CI: ready for build If set, CI server will compile all applications for all available boards for the labeled PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants