Build out-of-tree CI configs with -Werror and the full warning set

.github/configs/os-check-linux.json

@@ -2,7 +2,6 @@
 {"name": "user-settings-all-compat", "minutes": 9.5,
  "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
  "user_settings": "examples/configs/user_settings_all.h",
- "cflags": "",
  "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]},
 {"name": "session-cache-ref", "minutes": 3.2,
  "comment": "NO_SESSION_CACHE_REF is now the configure default, so --enable-session-cache-ref is the only way back onto the client cache reference path and the generation check on it is covered nowhere else. savesession adds the persistence paths that restore those generations.",
@@ -157,10 +156,8 @@
 {"name": "lms-xmss-verify-only", "minutes": 2.5,
  "configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]},
 {"name": "sp-4096-m32", "minutes": 1.2,
- "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
- "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"],
- "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
- "ldflags": "-m32"},
+ "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing.",
+ "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"]},
 {"name": "opensslall-rng-seed-cb", "minutes": 2.2,
  "configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]},
 {"name": "opensslall-ecc-zero-hash", "minutes": 2.2,
@@ -268,7 +265,6 @@
 {"name": "user-settings-all", "minutes": 2.0,
  "comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.",
  "user_settings": "examples/configs/user_settings_all.h",
- "cflags": "",
  "configure": ["--enable-usersettings"]},
 {"name": "she-ext-cryptocb-sw-default", "minutes": 1.9,
  "configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils",
@@ -304,12 +300,10 @@
  "comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).",
  "configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]},
 {"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6,
- "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.",
+ "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words.",
  "configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding",
   "--disable-sha512", "--disable-sha384",
-  "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"],
- "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE",
- "ldflags": "-m32"},
+  "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"]},
 {"name": "no-client-no-client-auth", "minutes": 1.6,
  "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
 {"name": "ascon-experimental", "minutes": 1.6,
@@ -397,97 +391,76 @@
 {"name": "testwolfcrypt-ca", "minutes": 1.0,
  "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
  "user_settings": "examples/configs/user_settings_ca.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-dtls13", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_dtls13.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-ebsnet", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_EBSnet.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-eccnonblock", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_eccnonblock.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_curve25519nonblock.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-embedded", "minutes": 1.0,
  "comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.",
  "user_settings": "examples/configs/user_settings_embedded.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0,
  "comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.",
  "user_settings": "examples/configs/user_settings_embedded.h",
- "cflags": "",
  "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]],
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0,
  "comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.",
  "user_settings": "examples/configs/user_settings_embedded.h",
- "cflags": "",
  "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]],
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0,
  "comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.",
  "user_settings": "examples/configs/user_settings_embedded.h",
- "cflags": "",
  "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]],
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0,
  "comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.",
  "user_settings": "examples/configs/user_settings_embedded.h",
- "cflags": "",
  "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]],
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-min-ecc", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_min_ecc.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-openssl-compat", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_openssl_compat.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-pkcs7", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_pkcs7.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-pq", "minutes": 1.0,
  "comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.",
  "user_settings": "examples/configs/user_settings_pq.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-rsa-only", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_rsa_only.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-template", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_template.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-tls12", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_tls12.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-tls13", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_tls13.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_wolfboot_keytools.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-wolfssh", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_wolfssh.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-wolftpm", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_wolftpm.h",
- "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs",
  "name": "no-asn-strict-certs",
@@ -539,11 +512,10 @@
 {"name": "no-examples-no-malloc", "minutes": 0.8,
  "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]},
 {"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3,
- "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.",
+ "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.",
  "configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519",
   "--enable-keygen", "--disable-examples",
-  "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"],
- "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"},
+  "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"]},
 {"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false,
  "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.",
  "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource",

.github/configs/os-check-macos.json

@@ -10,11 +10,9 @@
 {"name": "user-settings-all", "minutes": 1.5,
  "comment": "The user_settings.h header-driven build path under Apple clang: macOS-specific guard ordering (e.g. WOLFSSL_SYS_CA_CERTS pulling in Security.framework) is distinct from the autotools --enable-all path above.",
  "user_settings": "examples/configs/user_settings_all.h",
- "cflags": "",
  "configure": ["--enable-usersettings"]},
 {"name": "apple-native-cert-validation", "minutes": 1.5,
- "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure (with \"cflags\": \"\" so the make-time --cflags do not override them), exactly like the old standalone job.",
- "cflags": "",
+ "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure, exactly like the old standalone job.",
  "configure": ["CFLAGS=-DWOLFSSL_APPLE_NATIVE_CERT_VALIDATION -DWOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION -DRSA_MIN_SIZE=2048 -DNO_WOLFSSL_CIPHER_SUITE_TEST"]},
 {"name": "cryptocb-swdev-ed25519", "minutes": 1.0,
  "comment": "swdev built with Apple ld64: tests/swdev/Makefile localizes its symbols with ld -r -exported_symbol instead of objcopy. CB_ONLY_ED25519 strips software Ed25519, so make check fails unless the swdev callback is linked and reachable.",

.github/scripts/parallel-make-check.py

@@ -308,6 +308,10 @@ def load_configs(opts: argparse.Namespace,
         for key in ("cflags", "extra_cflags", "ldflags"):
             if not isinstance(entry.get(key, ""), str):
                 error(f"{opts.json}: \"{key}\" must be a string in {name!r}")
+        if entry.get("cflags") == "" and not opts.cflags:
+            warn(f"{opts.json}: empty \"cflags\" in {name!r} has no effect "
+                 f"without --cflags; \"extra_cflags\": \"\" opts out of "
+                 f"--extra-cflags")
         minutes = entry.get("minutes", 1.0)
         if isinstance(minutes, bool) or not isinstance(minutes, (int, float)) \
                 or minutes < 0:

.github/workflows/afalg.yml

@@ -166,14 +166,14 @@ jobs:
           [
           {"name": "defaults-afalg", "minutes": 2,
            "configure": ["--enable-afalg"],
-           "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"},
+           "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"},
           {"name": "all-afalg", "minutes": 5,
            "configure": ["--enable-all", "--enable-testcert", "--enable-acert",
             "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch",
             "--enable-dtlscid", "--enable-quic", "--enable-afalg",
             "--disable-srtp", "--disable-sha224", "--disable-hashflags",
             "--disable-cryptocb", "--disable-aesgcm-stream"],
-           "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}
+           "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}
           ]
           EOF
           .github/scripts/parallel-make-check.py \

.github/workflows/enterprise.yml

@@ -89,7 +89,7 @@ jobs:
           .github/scripts/parallel-make-check.py \
             ${{ github.event_name == 'schedule' && '--build-only' || '' }} \
             --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \
-            --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
+            --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
             --private-dir=certs \
             .github/configs/enterprise.json
 

.github/workflows/os-check.yml

@@ -1,3 +1,3 @@
 name: Ubuntu-Macos-Windows Tests
 
 # START OF COMMON SECTION
@@ -244,18 +244,14 @@
       # refresh later - a stale value only packs the schedule worse. The
       # list is kept sorted by minutes for readability, but the schedule
       # sorts by the values, not list order.
-      # The CFLAGS that were previously passed to configure are applied at
-      # make time via --cflags, unchanged. --private-dir=certs gives every
-      # build dir its own certs/ copy: crl-gen-openssl.test writes generated
-      # CRLs under certs/crl/, which would race through the shared VPATH
-      # certs symlink.
+      # --private-dir=certs stops crl-gen-openssl.test racing on certs/crl/.
       - name: Build and make check this shard's configs (parallel, out-of-tree)
         if: ${{ env.SEED_DECLINED != 'true' }}
         run: |
           .github/scripts/parallel-make-check.py \
             ${{ (github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \
             --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \
-            --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
+            --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
             --private-dir=certs .github/configs/os-check-linux.json
 
       # Seed runs (a push to master, the cron, or a manual dispatch with
@@ -377,7 +373,7 @@
           .github/scripts/parallel-make-check.py \
             ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \
             --threads 1 --cc= \
-            --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
+            --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \
             --private-dir=certs .github/configs/os-check-macos.json
 
       - name: ccache stats