Modernize the CI/CD by migrating travis.yml to .github/workflows/CI.yml

[reactive-firewall]

Goal: get CI/CD working on OSS plan of GHA (open source GitHub Actions) instead of travis.

Tasks:

- [ ] assign to @reactive-firewall (optional)

• readup on Travis CI/CD config
• re-write for GHA (see below for details)
• Test on feature branch (Caveat: Expected failure without further maintenance to core project codebase 🙈 )
• Submit PR/MR review and hand off ticket . . .
  - [ ] assign back to @mbrossard (optional)
• Merge back (optional)

---

Re-write for GHA

• re-write for GHA

  • Initial re-write for GHA (before debug)
  • Read up on libsoftokn3
  Here are some useful (albeit OLD) links

  NSS Documentation: This includes detailed documentation on how to use NSS, including its libraries and APIs.
  NSS Documentation

  Source Code Repository: As we are looking for implementation details, we can also check the source code, which is hosted on GitHub.
  NSS GitHub Repository

  • find and document ALL broken C_Initialize definition in project (e.g. /* C_Initialize calls are broken see mbrossard/pkcs11#4 */)
    - [ ] read up on the project secmod.db in order to understand codebase better
  • re-write GHA environment to include NSS_LIB_PARAMS="configdir='$PWD' certPrefix='' keyPrefix='' secmod='secmod.db'"
  • Misc. (e.g. cleanup from complexity fan-out)
  • report back on this GHI summary findings

Findings

Migration from libssl3-dev to libssl-dev

• If you were previously using libssl3-dev with OpenSSL 1.1, we should be able to migrate to libssl-dev for OpenSSL 3.0 without significant issues, but may need to review the code for every deprecated functions or changes in the API between OpenSSL 1.1 and OpenSSL 3.0.

• As already mentioned: OpenSSL 3.0 introduced some changes, including a new licensing model and some API changes. (clarification from suspected to confirmed)

Tip

we can probably use simple conditionals on the incorrect pointer types:

    #if (OPENSSL_VERSION_NUMBER & 0xF0000000) >= 0x30000000
       // Code for when OPENSSL_VERSION_MAJOR is at least 3
    #else
       // Code for when OPENSSL_VERSION_MAJOR is less than 3
    #endif

see definition

Summary

• On Ubuntu 22.04, libssl-dev corresponds to OpenSSL 3.0.

• We can check the specific version using apt-cache policy libssl-dev.

• we can ignore the deprecated warnings (at least for the moment) as long as openssl does not define OPENSSL_NO_DEPRECATED_3_0 they are just deprecated attributes and the functions are still present.

• 🤔 the Travis CI is migrated to GHA (caveat: expected failures due to discussed API changes in dependencies 🙊 🙈 )

• 👍🏻 main goal accomplished

• 👎 Not sure I'm comfortable tweaking the more security relevant code with my level of understanding of cryptokit and NSSlib (or rather lack-there-of)

• I think I'll clean up the circleci config before anymore attempts at debugging the modernization issues (debugging the main code, if left to me alone, will have significant learning time-lag as I read all the things, so I want a solid test workflow setup in CI first)

[reactive-firewall]

@mbrossard,

🤔 ok some things have changed in openssl and gcc 🙊

Of note:

• GHA CI/CD runners need a gcc version between 10 and 12 (caveat: macOS can find a 13 and 14)
• openssl v3 (the default now) deprecated a bunch of stuff see: these logs in CI/CD (the build warnings)
  • if you don't plan to update the code, can you point me in the right direction for me to start learning the relevant API so I can debug this? 🙇

ignroe the issue tag commit list, I'm just using --amend while I debug.
The working GHA with the failing build/tests? are on the git commit:
2f08d3a

🙇 Hope this helps!

[mbrossard]

It seems libsoftokn3 has changed behavior. The current method that relied on fallbacks from C_Initialize calls do not work anymore. If you want (some) tests to succeed you need to set this environment variable: NSS_LIB_PARAMS="configdir='$PWD' certPrefix='' keyPrefix='' secmod='secmod.db'"

There are also some other changes to OpenSSL (the command-line arguments to genrsa and the ECDSA-support detection). It's probably easier to assume OpenSSL version 3.x.