Repository navigation
Fix CI for the replaced Alpine apk-tools and wolfSSL master PBKDF2 - #287
Merged
Merged
Conversation
The Alpine jobs pinned apk-tools-static-2.14.12-r0 from the v3.22 repository on dl-cdn. Alpine keeps only the newest revision of a package, so the URL started to return 404 once 2.14.13-r0 replaced it, and every Alpine job failed at "Fetch static apk-tools". Read the package's current version from the repository's APKINDEX and fetch that, then hash the extracted apk.static for setup-alpine's apk-tools-url. The binary is no longer checked against a hash kept in the workflow; it is trusted over HTTPS from dl-cdn, the repository the rest of the Alpine packages are installed from.
wolfSSL now declares wc_PBKDF2 only when HMAC is available (9e972225e, "Guard PBKDF2 prototypes and PBES2 tests"). A --disable-hmac build defines NO_HMAC and already leaves CKM_PKCS5_PBKD2 out, but WP11_PBKDF2 still called wc_PBKDF2, so the build failed against current wolfSSL master with an implicit declaration. Guard the wrapper and its prototype the same way as its only caller.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Deriving the expected checksum from the downloaded binary without verifying the package signature removes independent integrity protection, allowing a compromised CDN to supply malicious code that executes on the runner.
1 open issue
What changed in this PR
This PR addresses two CI failures: Alpine’s removed apk-tools-static package and wolfSSL master’s restriction of PBKDF2 to builds with HMAC enabled.
Changes:
- Resolve the available Alpine package version from
APKINDEXand compute its binary checksum at runtime. - Guard the
WP11_PBKDF2declaration and implementation withNO_HMAC, matching its caller.
| File | Description |
|---|---|
wolfpkcs11/internal.h |
Excludes the PBKDF2 declaration when HMAC is disabled. |
src/internal.c |
Excludes the PBKDF2 implementation when HMAC is disabled. |
.github/workflows/alpine-architecture-tests.yml |
Replaces the pinned package URL and digest with dynamic version lookup and hashing. |
Review effort: Balanced
Looking the package up at run time left apk.static checked only against a hash of itself, so a package from a compromised mirror would have run on the runner. setup-alpine verifies every later package with the Alpine keys it bundles, which left this binary as the one unverified link. Verify the package the way apk does: the control stream must carry an RSA signature by alpine-devel@lists.alpinelinux.org-6165ee59, Alpine's x86_64 signing key, and the data stream must match the control stream's datahash. The key is committed under .github/keys and matches the copies in Alpine's alpine-keys and in setup-alpine. If Alpine rotates the key, this step fails with "missing .SIGN.RSA.<key>".
LinuxJedi
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI fails on every PR in two places: the Alpine jobs can no longer download their pinned apk-tools, and the
no_hmacbuild no longer compiles against wolfSSL master.Changes
apk-tools-staticversion from the v3.22APKINDEXon dl-cdn, since Alpine keeps only the newest package and the pinned 2.14.12-r0 now returns 404..github/keys) and itsdatahashbefore extractingapk.static.WP11_PBKDF2withNO_HMAClike its only caller, as wolfSSL 9e972225e now declareswc_PBKDF2only when HMAC is available.Testing
no_hmacunit-test job on this PR.