From 41d0f47970455fba4c753d9142ea7b7c0224af32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 11:40:50 +0100 Subject: [PATCH 1/9] ssl-opt: rm references to !MBEDTLS_USE_PSA_CRYPTO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Also remove the "no USE_PSA" tests: they are not executed, and are not useful for the future - when we add support for restartable ECDH in TLS, we can just use the existing tests and update the assertions, which we'll have to do anyway (the tests being removed were asserting about a legacy crypto function that no longer exists). Signed-off-by: Manuel Pégourié-Gonnard --- tests/scripts/analyze_outcomes.py | 3 - tests/ssl-opt.sh | 126 +++--------------------------- 2 files changed, 13 insertions(+), 116 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 1ab27b9347..318bccdba7 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -48,9 +48,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # We don't run ssl-opt.sh with Valgrind on the CI because # it's extremely slow. We don't intend to change this. 'DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)', - # TLS doesn't use restartable ECDH yet. - # https://github.com/Mbed-TLS/mbedtls/issues/7294 - re.compile(r'EC restart:.*no USE_PSA.*'), # The following test fails intermittently on the CI with a frequency # that significantly impacts CI throughput. They are thus disabled # for the time being. See diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 9d9209dc1e..dbfae4a2d1 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9316,39 +9316,18 @@ run_test "EC restart: TLS, max_ops=65535" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -C "mbedtls_pk_sign.*\(4b00\|-248\)" -# The following test cases for restartable ECDH come in two variants: -# * The "(USE_PSA)" variant expects the current behavior, which is the behavior -# from Mbed TLS 3.x when MBEDTLS_USE_PSA_CRYPTO is enabled. This tests -# the partial implementation where ECDH in TLS is not actually restartable. -# * The "(no USE_PSA)" variant expects the desired behavior. These test -# cases cannot currently pass because the implementation of restartable ECC -# in TLS is partial: ECDH is not actually restartable. This is the behavior -# from Mbed TLS 3.x when MBEDTLS_USE_PSA_CRYPTO is disabled. +# The following test cases for restartable ECC are currently partial: we expect +# signature generation and verification to be restartable, but no ECDH. # -# As part of resolving https://github.com/Mbed-TLS/mbedtls/issues/7294, -# we will remove the "(USE_PSA)" test cases and run the "(no USE_PSA)" test -# cases. +# This is because TLS hasn't been updated yet to use the new interruptible ECDH +# interface from PSA: https://github.com/Mbed-TLS/mbedtls/issues/7294. +# Once this has been done, the lines -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" +# below can be updated to positive assertions about interruptible key +# generation, public export and key agreement. -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000 (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000 (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000" \ "$P_SRV groups=secp256r1 auth_mode=required" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ @@ -9359,8 +9338,7 @@ run_test "EC restart: TLS, max_ops=1000 (USE_PSA)" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# This works the same with & without USE_PSA as we never get to ECDH: -# we abort as soon as we determined the cert is bad. +# Note: wen never get to ECDH: abort as soon as we determined the cert is bad. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 run_test "EC restart: TLS, max_ops=1000, badsign" \ @@ -9379,31 +9357,9 @@ run_test "EC restart: TLS, max_ops=1000, badsign" \ -c "! mbedtls_ssl_handshake returned" \ -c "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required \ - crt_file=$DATA_FILES_PATH/server5-badsign.crt \ - key_file=$DATA_FILES_PATH/server5.key" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000 auth_mode=optional" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" \ - -c "! The certificate is not correctly signed by the trusted CA" \ - -C "! mbedtls_ssl_handshake returned" \ - -C "X509 - Certificate verification failed" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign" \ "$P_SRV groups=secp256r1 auth_mode=required \ crt_file=$DATA_FILES_PATH/server5-badsign.crt \ key_file=$DATA_FILES_PATH/server5.key" \ @@ -9419,31 +9375,9 @@ run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (USE_PSA) -C "! mbedtls_ssl_handshake returned" \ -C "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required \ - crt_file=$DATA_FILES_PATH/server5-badsign.crt \ - key_file=$DATA_FILES_PATH/server5.key" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000 auth_mode=none" \ - 0 \ - -C "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" \ - -C "! The certificate is not correctly signed by the trusted CA" \ - -C "! mbedtls_ssl_handshake returned" \ - -C "X509 - Certificate verification failed" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign" \ "$P_SRV groups=secp256r1 auth_mode=required \ crt_file=$DATA_FILES_PATH/server5-badsign.crt \ key_file=$DATA_FILES_PATH/server5.key" \ @@ -9459,26 +9393,9 @@ run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (USE_PSA)" \ -C "! mbedtls_ssl_handshake returned" \ -C "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: DTLS, max_ops=1000 (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - dtls=1 debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: DTLS, max_ops=1000 (USE_PSA)" \ +run_test "EC restart: DTLS, max_ops=1000" \ "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ @@ -9489,26 +9406,9 @@ run_test "EC restart: DTLS, max_ops=1000 (USE_PSA)" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000 no client auth (no USE_PSA)" \ - "$P_SRV groups=secp256r1" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -C "mbedtls_pk_sign.*\(4b00\|-248\)" - - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000 no client auth (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000 no client auth" \ "$P_SRV groups=secp256r1" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ debug_level=1 ec_max_ops=1000" \ From e8ed43bceef13425ae8f5c96e59ae69ad9eda13c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 11:55:39 +0100 Subject: [PATCH 2/9] tests: avoid useless use of low-level crypto deps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Take our low-level error for test from our own side of the split. Signed-off-by: Manuel Pégourié-Gonnard --- tests/suites/test_suite_error.data | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_error.data b/tests/suites/test_suite_error.data index ed9cf43a44..5b51fdc078 100644 --- a/tests/suites/test_suite_error.data +++ b/tests/suites/test_suite_error.data @@ -1,9 +1,9 @@ Single low error -depends_on:MBEDTLS_AES_C -error_strerror:-0x0020:"AES - Invalid key length" +depends_on:MBEDTLS_NET_C +error_strerror:-0x0042:"NET - Failed to open a socket" Single high error -depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:MBEDTLS_X509_CRT_PARSE_C +depends_on:MBEDTLS_X509_CRT_PARSE_C error_strerror:-0x2280:"X509 - The serial tag or value is invalid" Non existing high error From b157aa1fce6558d703986666d2970a22a3f6f174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 12:55:51 +0100 Subject: [PATCH 3/9] Add test for dependencies on crypto-internal macros MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously this was tested indirectly by comparing driver vs reference components in analyze-outcomes.py, but now that the number of exceptions is low, it's much more efficient to test this directly. Signed-off-by: Manuel Pégourié-Gonnard --- tests/scripts/components-basic-checks.sh | 60 ++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 272efe2ae5..a1d1b5756b 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -100,6 +100,66 @@ component_check_test_cases () { unset opt } +component_check_test_dependencies () { + msg "Check: test cases dependencies: no crypto internals" + # The purpose of this component is to catch unjustified dependencies from + # mbedtls test on crypto internal feature macros. + # + # Most of the time, use of crypto internal feature macros are mistakes, + # which this component is maeant to catch. However a few of them are + # justified, or known issues yet to be resolved, so this component includes + # a list of expected exceptions. + + crypto="check-test-deps-crypto-$$" + used="check-test-deps-used-$$" + found="check-test-deps-found-$$" + expected="check-test-deps-expected-$$" + + ( + cd tf-psa-crypto + PYTHONPATH=framework/scripts python \ + -c 'from mbedtls_framework import config_macros; \ + print("\n".join(config_macros.Current().internal()))' + ) | sort -u > $crypto + + ( + grep depends_on tests/suites/test_suite_* | + sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | + tr ':' '\n' + egrep -oh '(PSA|MBEDTLS)_[A-Z0-9_]*' tests/ssl-opt.sh tests/opt-testcases/*.sh + ) | sort -u > $used + + # Find macros that are both used in mbedtls tests and crypto-internal. + comm -12 $crypto $used > $found + + # Expected ones with justification - keep in sorted order! + rm -f $expected + # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10618 + echo "MBEDTLS_PKCS1_V15" >> $expected + echo "MBEDTLS_PKCS1_V21" >> $expected + # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10619 + echo "MBEDTLS_RSA_C" >> $expected + # Acceptable: these are light wrappers around official PSA_WANT macros, + # to hide the fact that ECDSA could be randomized or deterministic. + echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected + echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected + echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected + + # Compare reality with expectation. + # We want an exact match, to ensure the above list remains up-to-date. + # + # The output should be empty. When it's not: + # - Each '+' line is a macro that was found but not expected. You want to + # find where that macro occurs, and either replace it with PSA macros, or + # add it to the exceptions list above with a justification. + # - Each '-' line is a macro that was expected but not found; it means the + # exceptions list above should be updated by removing that macro. + diff -U0 $expected $found + + rm $found $expected $crypto $used +} + component_check_doxygen_warnings () { msg "Check: doxygen warnings (builds the documentation)" # ~ 3s ./framework/scripts/doxygen.sh From 2965533b0829c090bf8d008919a7203ec0d979d5 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Thu, 30 Apr 2026 09:10:06 +0100 Subject: [PATCH 4/9] test: remove obsolete macro checks Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index a1d1b5756b..e5bb7c1e67 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -134,11 +134,6 @@ component_check_test_dependencies () { # Expected ones with justification - keep in sorted order! rm -f $expected - # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10618 - echo "MBEDTLS_PKCS1_V15" >> $expected - echo "MBEDTLS_PKCS1_V21" >> $expected - # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10619 - echo "MBEDTLS_RSA_C" >> $expected # Acceptable: these are light wrappers around official PSA_WANT macros, # to hide the fact that ECDSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected From 937f0066328ab6bf73d324c45aa905e64ce7ee6d Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 5 May 2026 11:05:29 +0100 Subject: [PATCH 5/9] tests: allow RSA helper dependency macros Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index e5bb7c1e67..2eb774ab44 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -135,10 +135,14 @@ component_check_test_dependencies () { # Expected ones with justification - keep in sorted order! rm -f $expected # Acceptable: these are light wrappers around official PSA_WANT macros, - # to hide the fact that ECDSA could be randomized or deterministic. + # to hide the fact that ECDSA and RSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected + echo "PSA_HAVE_ALG_RSA_PKCS1V15_SIGN" >> $expected + echo "PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_RSA_SIGN" >> $expected + echo "PSA_HAVE_ALG_SOME_RSA_VERIFY" >> $expected echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected # Compare reality with expectation. From 37a33ab5cc36679d2e00f4f0fab386cb256aa031 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 5 May 2026 15:11:25 +0100 Subject: [PATCH 6/9] test: dependency macros order fix Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 2eb774ab44..35d4d37fe5 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -138,9 +138,9 @@ component_check_test_dependencies () { # to hide the fact that ECDSA and RSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected - echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected echo "PSA_HAVE_ALG_RSA_PKCS1V15_SIGN" >> $expected echo "PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected echo "PSA_HAVE_ALG_SOME_RSA_SIGN" >> $expected echo "PSA_HAVE_ALG_SOME_RSA_VERIFY" >> $expected echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected From 4947a45c194e19665000e456ae4b7f6a2357c493 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 8 Jun 2026 14:14:20 +0100 Subject: [PATCH 7/9] fix typo Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 2 +- tests/ssl-opt.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 35d4d37fe5..6b48bf3e9c 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -106,7 +106,7 @@ component_check_test_dependencies () { # mbedtls test on crypto internal feature macros. # # Most of the time, use of crypto internal feature macros are mistakes, - # which this component is maeant to catch. However a few of them are + # which this component is meant to catch. However a few of them are # justified, or known issues yet to be resolved, so this component includes # a list of expected exceptions. diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index dbfae4a2d1..511c7c24f3 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9338,7 +9338,7 @@ run_test "EC restart: TLS, max_ops=1000" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# Note: wen never get to ECDH: abort as soon as we determined the cert is bad. +# Note: we never get to ECDH: abort as soon as we determined the cert is bad. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 run_test "EC restart: TLS, max_ops=1000, badsign" \ From 65dbfc8e87f3184fda2f94be3547b91ceef34de2 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 12 Jun 2026 15:24:03 +0100 Subject: [PATCH 8/9] test: check both .data and .function Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 6b48bf3e9c..36a049816e 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -123,7 +123,9 @@ component_check_test_dependencies () { ) | sort -u > $crypto ( - grep depends_on tests/suites/test_suite_* | + grep depends_on \ + tests/suites/test_suite_*.data \ + tests/suites/test_suite_*.function | sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | tr ':' '\n' egrep -oh '(PSA|MBEDTLS)_[A-Z0-9_]*' tests/ssl-opt.sh tests/opt-testcases/*.sh From 7bd7981302f7d1ad4dbec223cc7f7f46668cba48 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 15 Jun 2026 09:49:13 +0100 Subject: [PATCH 9/9] test: move temp files to out_of_source Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 36a049816e..f110bc0013 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -110,10 +110,12 @@ component_check_test_dependencies () { # justified, or known issues yet to be resolved, so this component includes # a list of expected exceptions. - crypto="check-test-deps-crypto-$$" - used="check-test-deps-used-$$" - found="check-test-deps-found-$$" - expected="check-test-deps-expected-$$" + out_of_source_dir="$OUT_OF_SOURCE_DIR/check-test-deps-$$" + mkdir -p "$out_of_source_dir" + crypto="$out_of_source_dir/crypto" + used="$out_of_source_dir/used" + found="$out_of_source_dir/found" + expected="$out_of_source_dir/expected" ( cd tf-psa-crypto @@ -123,7 +125,7 @@ component_check_test_dependencies () { ) | sort -u > $crypto ( - grep depends_on \ + grep depends_on \ tests/suites/test_suite_*.data \ tests/suites/test_suite_*.function | sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | @@ -156,9 +158,9 @@ component_check_test_dependencies () { # add it to the exceptions list above with a justification. # - Each '-' line is a macro that was expected but not found; it means the # exceptions list above should be updated by removing that macro. - diff -U0 $expected $found + diff -U0 "$expected" "$found" - rm $found $expected $crypto $used + rm -rf "$out_of_source_dir" } component_check_doxygen_warnings () {