certs: fix SIGPIPE race in the shipped-key fingerprint check

[dgarske]

The nightly workflow has failed on all but two nights since 2026-08-13, always on tests/credential-options.test, always with no diagnostic output. The failing job set differs every night, which made it look configuration-dependent; it is not.

certs/gen-certs.sh runs under set -euo pipefail, and reject_shipped_key() fingerprinted a key with openssl pkey ... | openssl dgst | awk. When the reader exits before the writer's output lands, openssl pkey dies of SIGPIPE and pipefail turns that into a fingerprint failure, so the check reports "could not be fingerprinted" instead of rejecting the shipped key. It now writes the DER public key to a file and digests the file, so no pipeline has a reader that can exit early. The four hardcoded fingerprints are unchanged - the file and pipe forms produce identical digests.

Also in this PR:

• tests/credential-options.test traces to stderr, logs each check to a file instead of /dev/null, and preserves its temporary directory on failure. Previously the only record of a failure was FAIL ... (exit status: 1).
• vault_test() in tests/unit_tests.c now unlinks vault.bin first, matching vault_reopen_test() and vault_corrupt_test(). It was inheriting items and encryption mode from whichever build ran last in the tree.
• fail-fast: false on every matrix, unique per-configuration failure-log artifact names, tests/*.log added to the uploads, and actions/checkout / actions/upload-artifact moved to @v5.

Introduced by PR #10 (d9874b9). Not present in any tagged release - the most recent tag is v1.1 from 2021, so only master is affected.

The ASan and UBSan jobs were failing on this same test, not on a sanitizer finding; neither job log contained any sanitizer diagnostic.

Test status

No hardware involved. Verified on x86-64 Linux against wolfSSL master built with the CI configure line.

• tests/credential-options.test under parallel load: 17 failures in 100 iterations before the fix, 0 in 900 after.
• make check clean in all six CI configurations, and under both -fsanitize=address and -fsanitize=undefined -fno-sanitize-recover=all with the workflow's sanitizer options.
• make dist plus the release credential generation check from the build workflow.

Scope

src/keymanager.c and the LoadPasswordFile() validation semantics are unchanged; that code is deterministic and was not implicated.

[Copilot]

🟡 Changes recommended

The nonportable EXIT trap condition can make the credential test fail immediately under /bin/sh on Ubuntu.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes intermittent shipped-key fingerprint failures caused by a SIGPIPE/pipefail race and improves test isolation and CI diagnostics.

Changes:

• Uses a temporary file for public-key fingerprinting.
• Adds credential-test logging and vault cleanup.
• Improves CI matrix handling, artifact naming, and action versions.

File summaries

File	Summary
tests/unit_tests.c	Cleans stale vault state before testing.
tests/credential-options.test	Adds tracing, logs, and failure preservation.
certs/gen-certs.sh	Removes the fingerprinting pipeline race.
.gitignore	Ignores preserved failure artifacts.
.github/workflows/test-pull.yml	Disables matrix fail-fast and labels configurations.
.github/workflows/test-nightly.yml	Disables matrix fail-fast and labels configurations.
.github/workflows/sanitizer.yml	Updates actions and diagnostic uploads.
.github/workflows/make-test.yml	Adds configuration-specific artifacts and logs.

Review details

• Files reviewed: 7/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.