From ba6533c87ad092ffe4ac4b88db34df742bcd4133 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 11:40:50 +0100 Subject: [PATCH 1/9] ssl-opt: rm references to !MBEDTLS_USE_PSA_CRYPTO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Also remove the "no USE_PSA" tests: they are not executed, and are not useful for the future - when we add support for restartable ECDH in TLS, we can just use the existing tests and update the assertions, which we'll have to do anyway (the tests being removed were asserting about a legacy crypto function that no longer exists). Signed-off-by: Manuel Pégourié-Gonnard --- tests/scripts/analyze_outcomes.py | 3 - tests/ssl-opt.sh | 126 +++--------------------------- 2 files changed, 13 insertions(+), 116 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 1a73a2a619..dfcc736bae 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -50,9 +50,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # We don't run ssl-opt.sh with Valgrind on the CI because # it's extremely slow. We don't intend to change this. 'DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)', - # TLS doesn't use restartable ECDH yet. - # https://github.com/Mbed-TLS/mbedtls/issues/7294 - re.compile(r'EC restart:.*no USE_PSA.*'), # The following test fails intermittently on the CI with a frequency # that significantly impacts CI throughput. They are thus disabled # for the time being. See diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 4a4ee4d1ef..56e47f5e6c 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9279,39 +9279,18 @@ run_test "EC restart: TLS, max_ops=65535" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -C "mbedtls_pk_sign.*\(4b00\|-248\)" -# The following test cases for restartable ECDH come in two variants: -# * The "(USE_PSA)" variant expects the current behavior, which is the behavior -# from Mbed TLS 3.x when MBEDTLS_USE_PSA_CRYPTO is enabled. This tests -# the partial implementation where ECDH in TLS is not actually restartable. -# * The "(no USE_PSA)" variant expects the desired behavior. These test -# cases cannot currently pass because the implementation of restartable ECC -# in TLS is partial: ECDH is not actually restartable. This is the behavior -# from Mbed TLS 3.x when MBEDTLS_USE_PSA_CRYPTO is disabled. +# The following test cases for restartable ECC are currently partial: we expect +# signature generation and verification to be restartable, but no ECDH. # -# As part of resolving https://github.com/Mbed-TLS/mbedtls/issues/7294, -# we will remove the "(USE_PSA)" test cases and run the "(no USE_PSA)" test -# cases. +# This is because TLS hasn't been updated yet to use the new interruptible ECDH +# interface from PSA: https://github.com/Mbed-TLS/mbedtls/issues/7294. +# Once this has been done, the lines -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" +# below can be updated to positive assertions about interruptible key +# generation, public export and key agreement. -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000 (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000 (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000" \ "$P_SRV groups=secp256r1 auth_mode=required" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ @@ -9322,8 +9301,7 @@ run_test "EC restart: TLS, max_ops=1000 (USE_PSA)" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# This works the same with & without USE_PSA as we never get to ECDH: -# we abort as soon as we determined the cert is bad. +# Note: wen never get to ECDH: abort as soon as we determined the cert is bad. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 run_test "EC restart: TLS, max_ops=1000, badsign" \ @@ -9342,31 +9320,9 @@ run_test "EC restart: TLS, max_ops=1000, badsign" \ -c "! mbedtls_ssl_handshake returned" \ -c "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required \ - crt_file=$DATA_FILES_PATH/server5-badsign.crt \ - key_file=$DATA_FILES_PATH/server5.key" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000 auth_mode=optional" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" \ - -c "! The certificate is not correctly signed by the trusted CA" \ - -C "! mbedtls_ssl_handshake returned" \ - -C "X509 - Certificate verification failed" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign" \ "$P_SRV groups=secp256r1 auth_mode=required \ crt_file=$DATA_FILES_PATH/server5-badsign.crt \ key_file=$DATA_FILES_PATH/server5.key" \ @@ -9382,31 +9338,9 @@ run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (USE_PSA) -C "! mbedtls_ssl_handshake returned" \ -C "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required \ - crt_file=$DATA_FILES_PATH/server5-badsign.crt \ - key_file=$DATA_FILES_PATH/server5.key" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - debug_level=1 ec_max_ops=1000 auth_mode=none" \ - 0 \ - -C "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" \ - -C "! The certificate is not correctly signed by the trusted CA" \ - -C "! mbedtls_ssl_handshake returned" \ - -C "X509 - Certificate verification failed" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign" \ "$P_SRV groups=secp256r1 auth_mode=required \ crt_file=$DATA_FILES_PATH/server5-badsign.crt \ key_file=$DATA_FILES_PATH/server5.key" \ @@ -9422,26 +9356,9 @@ run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (USE_PSA)" \ -C "! mbedtls_ssl_handshake returned" \ -C "X509 - Certificate verification failed" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: DTLS, max_ops=1000 (no USE_PSA)" \ - "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ - dtls=1 debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -c "mbedtls_pk_sign.*\(4b00\|-248\)" - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: DTLS, max_ops=1000 (USE_PSA)" \ +run_test "EC restart: DTLS, max_ops=1000" \ "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ key_file=$DATA_FILES_PATH/server5.key crt_file=$DATA_FILES_PATH/server5.crt \ @@ -9452,26 +9369,9 @@ run_test "EC restart: DTLS, max_ops=1000 (USE_PSA)" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# With USE_PSA disabled we expect full restartable behaviour. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -skip_next_test -run_test "EC restart: TLS, max_ops=1000 no client auth (no USE_PSA)" \ - "$P_SRV groups=secp256r1" \ - "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ - debug_level=1 ec_max_ops=1000" \ - 0 \ - -c "x509_verify_cert.*\(4b00\|-248\)" \ - -c "mbedtls_pk_verify.*\(4b00\|-248\)" \ - -c "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ - -C "mbedtls_pk_sign.*\(4b00\|-248\)" - - -# With USE_PSA enabled we expect only partial restartable behaviour: -# everything except ECDH (where TLS calls PSA directly). -requires_config_enabled MBEDTLS_ECP_RESTARTABLE -requires_config_enabled PSA_WANT_ECC_SECP_R1_256 -run_test "EC restart: TLS, max_ops=1000 no client auth (USE_PSA)" \ +run_test "EC restart: TLS, max_ops=1000 no client auth" \ "$P_SRV groups=secp256r1" \ "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ debug_level=1 ec_max_ops=1000" \ From bfeea315b71daf45a88e8e6e62e58c37e81358a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 11:55:39 +0100 Subject: [PATCH 2/9] tests: avoid useless use of low-level crypto deps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Take our low-level error for test from our own side of the split. Signed-off-by: Manuel Pégourié-Gonnard --- tests/suites/test_suite_error.data | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_error.data b/tests/suites/test_suite_error.data index ed9cf43a44..5b51fdc078 100644 --- a/tests/suites/test_suite_error.data +++ b/tests/suites/test_suite_error.data @@ -1,9 +1,9 @@ Single low error -depends_on:MBEDTLS_AES_C -error_strerror:-0x0020:"AES - Invalid key length" +depends_on:MBEDTLS_NET_C +error_strerror:-0x0042:"NET - Failed to open a socket" Single high error -depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:MBEDTLS_X509_CRT_PARSE_C +depends_on:MBEDTLS_X509_CRT_PARSE_C error_strerror:-0x2280:"X509 - The serial tag or value is invalid" Non existing high error From e0086863eda923909593db17266d74081781dfe1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 23 Feb 2026 12:55:51 +0100 Subject: [PATCH 3/9] Add test for dependencies on crypto-internal macros MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously this was tested indirectly by comparing driver vs reference components in analyze-outcomes.py, but now that the number of exceptions is low, it's much more efficient to test this directly. Signed-off-by: Manuel Pégourié-Gonnard --- tests/scripts/components-basic-checks.sh | 60 ++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 272efe2ae5..a1d1b5756b 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -100,6 +100,66 @@ component_check_test_cases () { unset opt } +component_check_test_dependencies () { + msg "Check: test cases dependencies: no crypto internals" + # The purpose of this component is to catch unjustified dependencies from + # mbedtls test on crypto internal feature macros. + # + # Most of the time, use of crypto internal feature macros are mistakes, + # which this component is maeant to catch. However a few of them are + # justified, or known issues yet to be resolved, so this component includes + # a list of expected exceptions. + + crypto="check-test-deps-crypto-$$" + used="check-test-deps-used-$$" + found="check-test-deps-found-$$" + expected="check-test-deps-expected-$$" + + ( + cd tf-psa-crypto + PYTHONPATH=framework/scripts python \ + -c 'from mbedtls_framework import config_macros; \ + print("\n".join(config_macros.Current().internal()))' + ) | sort -u > $crypto + + ( + grep depends_on tests/suites/test_suite_* | + sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | + tr ':' '\n' + egrep -oh '(PSA|MBEDTLS)_[A-Z0-9_]*' tests/ssl-opt.sh tests/opt-testcases/*.sh + ) | sort -u > $used + + # Find macros that are both used in mbedtls tests and crypto-internal. + comm -12 $crypto $used > $found + + # Expected ones with justification - keep in sorted order! + rm -f $expected + # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10618 + echo "MBEDTLS_PKCS1_V15" >> $expected + echo "MBEDTLS_PKCS1_V21" >> $expected + # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10619 + echo "MBEDTLS_RSA_C" >> $expected + # Acceptable: these are light wrappers around official PSA_WANT macros, + # to hide the fact that ECDSA could be randomized or deterministic. + echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected + echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected + echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected + + # Compare reality with expectation. + # We want an exact match, to ensure the above list remains up-to-date. + # + # The output should be empty. When it's not: + # - Each '+' line is a macro that was found but not expected. You want to + # find where that macro occurs, and either replace it with PSA macros, or + # add it to the exceptions list above with a justification. + # - Each '-' line is a macro that was expected but not found; it means the + # exceptions list above should be updated by removing that macro. + diff -U0 $expected $found + + rm $found $expected $crypto $used +} + component_check_doxygen_warnings () { msg "Check: doxygen warnings (builds the documentation)" # ~ 3s ./framework/scripts/doxygen.sh From ee36ad9f39f9d4e2182e08b87b73dee41cc85cc0 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Thu, 30 Apr 2026 09:10:06 +0100 Subject: [PATCH 4/9] test: remove obsolete macro checks Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index a1d1b5756b..e5bb7c1e67 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -134,11 +134,6 @@ component_check_test_dependencies () { # Expected ones with justification - keep in sorted order! rm -f $expected - # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10618 - echo "MBEDTLS_PKCS1_V15" >> $expected - echo "MBEDTLS_PKCS1_V21" >> $expected - # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10619 - echo "MBEDTLS_RSA_C" >> $expected # Acceptable: these are light wrappers around official PSA_WANT macros, # to hide the fact that ECDSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected From 00eb64a9d3ca015359cf73901c27ca779845de62 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 5 May 2026 11:05:29 +0100 Subject: [PATCH 5/9] tests: allow RSA helper dependency macros Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index e5bb7c1e67..2eb774ab44 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -135,10 +135,14 @@ component_check_test_dependencies () { # Expected ones with justification - keep in sorted order! rm -f $expected # Acceptable: these are light wrappers around official PSA_WANT macros, - # to hide the fact that ECDSA could be randomized or deterministic. + # to hide the fact that ECDSA and RSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected + echo "PSA_HAVE_ALG_RSA_PKCS1V15_SIGN" >> $expected + echo "PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_RSA_SIGN" >> $expected + echo "PSA_HAVE_ALG_SOME_RSA_VERIFY" >> $expected echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected # Compare reality with expectation. From 75aa62742ce0879bd7268863425e69468fd19b4a Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 5 May 2026 15:11:25 +0100 Subject: [PATCH 6/9] test: dependency macros order fix Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 2eb774ab44..35d4d37fe5 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -138,9 +138,9 @@ component_check_test_dependencies () { # to hide the fact that ECDSA and RSA could be randomized or deterministic. echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected - echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected echo "PSA_HAVE_ALG_RSA_PKCS1V15_SIGN" >> $expected echo "PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY" >> $expected + echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected echo "PSA_HAVE_ALG_SOME_RSA_SIGN" >> $expected echo "PSA_HAVE_ALG_SOME_RSA_VERIFY" >> $expected echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected From efcf4973d6570d7183e09492b5bbd9313e2e9a15 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 8 Jun 2026 14:14:20 +0100 Subject: [PATCH 7/9] fix typo Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 2 +- tests/ssl-opt.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 35d4d37fe5..6b48bf3e9c 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -106,7 +106,7 @@ component_check_test_dependencies () { # mbedtls test on crypto internal feature macros. # # Most of the time, use of crypto internal feature macros are mistakes, - # which this component is maeant to catch. However a few of them are + # which this component is meant to catch. However a few of them are # justified, or known issues yet to be resolved, so this component includes # a list of expected exceptions. diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 56e47f5e6c..1bdd1ecc14 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9301,7 +9301,7 @@ run_test "EC restart: TLS, max_ops=1000" \ -C "mbedtls_ecdh_make_public.*\(4b00\|-248\)" \ -c "mbedtls_pk_sign.*\(4b00\|-248\)" -# Note: wen never get to ECDH: abort as soon as we determined the cert is bad. +# Note: we never get to ECDH: abort as soon as we determined the cert is bad. requires_config_enabled MBEDTLS_ECP_RESTARTABLE requires_config_enabled PSA_WANT_ECC_SECP_R1_256 run_test "EC restart: TLS, max_ops=1000, badsign" \ From 8345e68b5311f0426452dfd674e11c4dc0a52837 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 12 Jun 2026 15:24:03 +0100 Subject: [PATCH 8/9] test: check both .data and .function Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 6b48bf3e9c..36a049816e 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -123,7 +123,9 @@ component_check_test_dependencies () { ) | sort -u > $crypto ( - grep depends_on tests/suites/test_suite_* | + grep depends_on \ + tests/suites/test_suite_*.data \ + tests/suites/test_suite_*.function | sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | tr ':' '\n' egrep -oh '(PSA|MBEDTLS)_[A-Z0-9_]*' tests/ssl-opt.sh tests/opt-testcases/*.sh From b3ab8755ee435f82c85dd57984ec2d151003bad7 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 15 Jun 2026 09:49:13 +0100 Subject: [PATCH 9/9] test: move temp files to out_of_source Signed-off-by: Yi Wu --- tests/scripts/components-basic-checks.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 36a049816e..f110bc0013 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -110,10 +110,12 @@ component_check_test_dependencies () { # justified, or known issues yet to be resolved, so this component includes # a list of expected exceptions. - crypto="check-test-deps-crypto-$$" - used="check-test-deps-used-$$" - found="check-test-deps-found-$$" - expected="check-test-deps-expected-$$" + out_of_source_dir="$OUT_OF_SOURCE_DIR/check-test-deps-$$" + mkdir -p "$out_of_source_dir" + crypto="$out_of_source_dir/crypto" + used="$out_of_source_dir/used" + found="$out_of_source_dir/found" + expected="$out_of_source_dir/expected" ( cd tf-psa-crypto @@ -123,7 +125,7 @@ component_check_test_dependencies () { ) | sort -u > $crypto ( - grep depends_on \ + grep depends_on \ tests/suites/test_suite_*.data \ tests/suites/test_suite_*.function | sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' | @@ -156,9 +158,9 @@ component_check_test_dependencies () { # add it to the exceptions list above with a justification. # - Each '-' line is a macro that was expected but not found; it means the # exceptions list above should be updated by removing that macro. - diff -U0 $expected $found + diff -U0 "$expected" "$found" - rm $found $expected $crypto $used + rm -rf "$out_of_source_dir" } component_check_doxygen_warnings () {