From 1295140bcaedb09d425f74643c3057e5daafb6e2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 12 Sep 2025 17:46:42 +0200 Subject: [PATCH] Read patch files instead of taking a single patch as input Having separate patch files has several benefits: * They're available for integrators who wouldn't use our script to test compliance. * We keep them separate so they're easier for us to keep track of, and apply separately if needed. * No need to cheat with unchanged empty lines (normally represented by a line containing a single space in a patch file) to keep `check_files.py` happy. Signed-off-by: Gilles Peskine --- scripts/mbedtls_framework/psa_compliance.py | 28 ++++++++++++++------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/scripts/mbedtls_framework/psa_compliance.py b/scripts/mbedtls_framework/psa_compliance.py index c7bdd37e3..7deca5ecf 100644 --- a/scripts/mbedtls_framework/psa_compliance.py +++ b/scripts/mbedtls_framework/psa_compliance.py @@ -10,8 +10,10 @@ keep the list of known defects as up to date as possible. # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later import argparse +import glob import os import re +import shlex import shutil import subprocess import sys @@ -25,7 +27,7 @@ PSA_ARCH_TESTS_REPO = 'https://github.com/ARM-software/psa-arch-tests.git' #pylint: disable=too-many-branches,too-many-statements,too-many-locals def test_compliance(library_build_dir: str, psa_arch_tests_ref: str, - patch: str, + patch_files: List[str], expected_failures: List[int]) -> int: """Check out and run compliance tests. @@ -59,12 +61,12 @@ def test_compliance(library_build_dir: str, subprocess.check_call(['git', 'fetch', PSA_ARCH_TESTS_REPO, psa_arch_tests_ref]) subprocess.check_call(['git', 'checkout', '--force', 'FETCH_HEAD']) - if patch: + if patch_files: subprocess.check_call(['git', 'reset', '--hard']) - subprocess.run(['patch', '-p1'], - check=True, - encoding='utf-8', - input=patch) + for patch_file in patch_files: + abs_path = os.path.abspath(os.path.join(root_dir, patch_file)) + subprocess.check_call(['patch -p1 <' + shlex.quote(abs_path)], + shell=True) build_dir = 'api-tests/build' try: @@ -143,15 +145,15 @@ def test_compliance(library_build_dir: str, os.chdir(root_dir) def main(psa_arch_tests_ref: str, - patch: str = '', expected_failures: Optional[List[int]] = None) -> None: """Command line entry point. psa_arch_tests_ref: tag or sha to use for the arch-tests. - patch: patch to apply to the arch-tests with ``patch -p1``. expected_failures: default list of expected failures. """ build_dir = 'out_of_source_build' + default_patch_directory = os.path.join(build_tree.guess_project_root(), + 'scripts/data_files/psa-arch-tests') # pylint: disable=invalid-name parser = argparse.ArgumentParser() @@ -161,6 +163,9 @@ def main(psa_arch_tests_ref: str, help='''set the list of test codes which are expected to fail from the command line. If omitted the list given by EXPECTED_FAILURES (inside the script) is used.''') + parser.add_argument('--patch-directory', nargs=1, + default=default_patch_directory, + help='Directory containing patches (*.patch) to apply to psa-arch-tests') args = parser.parse_args() if args.build_dir is not None: @@ -173,7 +178,12 @@ def main(psa_arch_tests_ref: str, else: expected_failures_list = expected_failures + if args.patch_directory: + patch_files = glob.glob(os.path.join(args.patch_directory, '*.patch')) + else: + patch_files = [] + sys.exit(test_compliance(build_dir, psa_arch_tests_ref, - patch, + patch_files, expected_failures_list))