certs: fix SIGPIPE race in the shipped-key fingerprint check

.github/workflows/make-test.yml

@@ -14,6 +14,12 @@ on:
         required: false
         default: master
         type: string
+      # Short label for this configuration. Used to keep the failure-log
+      # artifact names unique across the caller's matrix.
+      config-name:
+        required: false
+        default: default
+        type: string
 
 jobs:
 
@@ -28,10 +34,10 @@ jobs:
           sudo apt install -y libevent-dev libpcap-dev
 
   # pull wolfKeyMgr
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
 
   # wolfSSL build, check and install
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
         with:
           repository: wolfssl/wolfssl
           ref: ${{ inputs.wolfssl-ref }}
@@ -93,9 +99,11 @@ jobs:
   # capture logs on failure
       - name: Upload failure logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
-          name: wolfKeyMgr-logs
+          name: wolfKeyMgr-${{ inputs.config-name }}-wolfssl-${{ inputs.wolfssl-ref }}-logs
           path: |
             test-suite.log
+            tests/*.log
+            tests/credential-options-failure/**
           retention-days: 5

.github/workflows/sanitizer.yml

@@ -38,7 +38,7 @@ jobs:
           sudo apt-get install -y libevent-dev libpcap-dev autoconf automake libtool
 
       - name: Checkout wolfKeyMgr
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build wolfSSL (${{ matrix.sanitizer.name }})
         run: |
@@ -70,10 +70,11 @@ jobs:
 
       - name: Upload failure logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: wolfKeyMgr-${{ matrix.sanitizer.name }}-wolfssl-${{ matrix.wolfssl-ref }}-logs
           path: |
             test-suite.log
             tests/*.log
+            tests/credential-options-failure/**
           retention-days: 5

.github/workflows/test-nightly.yml

@@ -23,65 +23,77 @@ jobs:
   build_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args:
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: default
 
   build_debug_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --enable-debug
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: debug
 
   build_no_vault_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-vault
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: no-vault
 
   build_no_sniffer_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-sniffer
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: no-sniffer
 
   build_vault_clear_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --enable-vault=clear
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: vault-clear
 
   build_minimal_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-sniffer --disable-vault
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: minimal

.github/workflows/test-pull.yml

@@ -16,65 +16,77 @@ jobs:
   build_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args:
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: default
 
   build_debug_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --enable-debug
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: debug
 
   build_no_vault_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-vault
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: no-vault
 
   build_no_sniffer_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-sniffer
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: no-sniffer
 
   build_vault_clear_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --enable-vault=clear
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: vault-clear
 
   build_minimal_test:
     needs: resolve
     strategy:
+      fail-fast: false
       matrix:
         wolfssl-ref: ${{ fromJson(needs.resolve.outputs.refs) }}
     uses: ./.github/workflows/make-test.yml
     with:
       config-args: --disable-sniffer --disable-vault
       make-args:
       wolfssl-ref: ${{ matrix.wolfssl-ref }}
+      config-name: minimal

.gitignore

@@ -68,3 +68,6 @@ tracefile.txt
 # test files
 vault.bin
 wolfkeymgr.vault
+
+# credential-options test failure capture
+/tests/credential-options-failure/

certs/gen-certs.sh

@@ -8,26 +8,43 @@ echo "Run from wolfkeymgr root"
 reject_shipped_key() {
     key_file="$1"
     shipped_fingerprint="$2"
+    pub_file="$1.pub.tmp"
 
-    if [ -f "$key_file" ]; then
-        if ! key_fingerprint=$(openssl pkey -in "$key_file" \
-                -passin pass:'wolfssl' -pubout -outform DER 2>/dev/null | \
-                openssl dgst -sha256 -r | awk '{print $1}'); then
-            echo "Refusing an existing key that could not be fingerprinted:" \
-                "$key_file" >&2
-            exit 1
-        fi
-        if [ -z "$key_fingerprint" ]; then
-            echo "Refusing an existing key with an empty fingerprint:" \
-                "$key_file" >&2
-            exit 1
-        fi
-        if [ "$key_fingerprint" = "$shipped_fingerprint" ]; then
-            echo "Refusing to reuse a credential shipped in an older release:" \
-                "$key_file" >&2
-            echo "Rotate the demo credentials with: ./certs/gen-certs.sh clean" >&2
-            exit 1
-        fi
+    if [ ! -f "$key_file" ]; then
+        return 0
+    fi
+
+    # Write the public key to a file rather than piping it into "openssl
+    # dgst". A pipeline whose reader can exit first lets the writer die of
+    # SIGPIPE, which "set -o pipefail" then reports as a fingerprint
+    # failure. That made this check intermittently take the wrong branch.
+    rm -f "$pub_file"
+    if ! openssl pkey -in "$key_file" -passin pass:'wolfssl' -pubout \
+            -outform DER -out "$pub_file" 2>/dev/null; then
+        rm -f "$pub_file"
+        echo "Refusing an existing key that could not be fingerprinted:" \
+            "$key_file" >&2
+        exit 1
+    fi
+    if ! key_fingerprint=$(openssl dgst -sha256 -r "$pub_file" \
+            | awk '{print $1}'); then
+        rm -f "$pub_file"
+        echo "Refusing an existing key that could not be fingerprinted:" \
+            "$key_file" >&2
+        exit 1
+    fi
+    rm -f "$pub_file"
+
+    if [ -z "$key_fingerprint" ]; then
+        echo "Refusing an existing key with an empty fingerprint:" \
+            "$key_file" >&2
+        exit 1
+    fi
+    if [ "$key_fingerprint" = "$shipped_fingerprint" ]; then
+        echo "Refusing to reuse a credential shipped in an older release:" \
+            "$key_file" >&2
+        echo "Rotate the demo credentials with: ./certs/gen-certs.sh clean" >&2
+        exit 1
     fi
 }