From 31fa4028aa75c10eacec979119c2b0df76d287bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= Date: Wed, 8 Jul 2026 16:15:04 -0300 Subject: [PATCH] tests: make 'make check' pass on the source-only (WITH_SDK=0) build The SDK-mode regression tests (audit, F-08/F-10/F-11/F-12, pq-box, KDF transparency) now skip cleanly when built without libzuptsdk, and the constant-time test links libzuptsdk only when present (its primitives are native). Also drop a dead 'seqs_decoded' variable in vv_ans.c that failed the exact-size test's -Werror=unused-but-set-variable. 'make check' is green source-only, so the openSUSE %check no longer blocks the build. --- src/vv_ans.c | 2 -- tests/test_audit.sh | 8 ++++++++ tests/test_ct_timing.sh | 9 ++++++++- tests/test_f08_topmac.sh | 8 ++++++++ tests/test_f10_kdf_default.sh | 8 ++++++++ tests/test_f11_authfail_message.sh | 8 ++++++++ tests/test_f12_comment.sh | 8 ++++++++ tests/test_kdf_transparency.sh | 8 ++++++++ tests/test_pqbox.sh | 8 ++++++++ 9 files changed, 64 insertions(+), 3 deletions(-) diff --git a/src/vv_ans.c b/src/vv_ans.c index f47273c..c323372 100644 --- a/src/vv_ans.c +++ b/src/vv_ans.c @@ -2330,7 +2330,6 @@ vva_error_t vva_decode_sequences_impl(const uint8_t *src, size_t src_len, ? op_end - SAFEZONE_RESERVE : dst; const uint8_t *offset_check_floor = dst_base + SAFEZONE_MAX_OFFSET; - size_t seqs_decoded = 0; /* SPRINT 90 SECURITY FIX (DoS hardening): * * The original loop terminated only when both lit_pos reached @@ -2454,7 +2453,6 @@ vva_error_t vva_decode_sequences_impl(const uint8_t *src, size_t src_len, op += litlen; lit_pos += litlen; } - seqs_decoded++; /* SPRINT 63/64: continue the loop even when all matches are * consumed, as long as literals remain. Previously this broke diff --git a/tests/test_audit.sh b/tests/test_audit.sh index dfbeeef..7a4dd54 100755 --- a/tests/test_audit.sh +++ b/tests/test_audit.sh @@ -5,6 +5,14 @@ # Each property is checked via TWO independent paths. ZUPT_BIN="$(realpath ./zupt)" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$ZUPT_BIN" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + TMPDIR=$(mktemp -d) trap "rm -rf $TMPDIR" EXIT cd "$TMPDIR" diff --git a/tests/test_ct_timing.sh b/tests/test_ct_timing.sh index 8cd2240..1fc9471 100755 --- a/tests/test_ct_timing.sh +++ b/tests/test_ct_timing.sh @@ -24,12 +24,19 @@ else fi TMP=$(mktemp -d) +# This test uses only native CT primitives (zupt_ct_memeq, ML-KEM CT compare); +# the libzuptsdk linkage is vestigial. Link it only when the vendored library +# is present (WITH_SDK builds); source-only builds compile+run without it. +SDK_LINK="" +if ls "$SDK_DIR"/libzuptsdk.so* >/dev/null 2>&1; then + SDK_LINK="-L$SDK_DIR -lzuptsdk -Wl,-rpath,$(cd "$SDK_DIR" && pwd)" +fi if gcc -Iinclude -Isrc -I"$SDK_DIR/include" -Wall -Wextra -Werror $SHANI -O2 -std=c11 \ tests/test_ct_timing.c \ src/zupt_crypto.c src/zupt_sha256.c src/zupt_sha256_shani.c src/zupt_aes256.c \ src/zupt_xxh.c src/zupt_keccak.c src/zupt_x25519.c src/zupt_mlkem.c \ src/zupt_cpuid.c src/zupt_mlock.c \ - -L"$SDK_DIR" -lzuptsdk -Wl,-rpath,"$(cd "$SDK_DIR" && pwd)" -lm \ + $SDK_LINK -lm \ -o "$TMP/t" 2>"$TMP/cc.log"; then "$TMP/t"; rc=$? else diff --git a/tests/test_f08_topmac.sh b/tests/test_f08_topmac.sh index b4011c3..d448cc2 100755 --- a/tests/test_f08_topmac.sh +++ b/tests/test_f08_topmac.sh @@ -18,6 +18,14 @@ set -u PASS=0 FAIL=0 ZUPT="${ZUPT_BIN:-./zupt}" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + # Resolve to absolute path so the test continues to find the binary after cd. case "$ZUPT" in /*) ;; diff --git a/tests/test_f10_kdf_default.sh b/tests/test_f10_kdf_default.sh index c36ef84..3b1bee4 100755 --- a/tests/test_f10_kdf_default.sh +++ b/tests/test_f10_kdf_default.sh @@ -19,6 +19,14 @@ set -u ZUPT="${ZUPT_BIN:-./zupt}" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + case "$ZUPT" in /*) ;; *) ZUPT="$PWD/$ZUPT" ;; diff --git a/tests/test_f11_authfail_message.sh b/tests/test_f11_authfail_message.sh index c90f9fc..a23ca20 100755 --- a/tests/test_f11_authfail_message.sh +++ b/tests/test_f11_authfail_message.sh @@ -19,6 +19,14 @@ set -u ZUPT="${ZUPT_BIN:-./zupt}" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + case "$ZUPT" in /*) ;; *) ZUPT="$PWD/$ZUPT" ;; diff --git a/tests/test_f12_comment.sh b/tests/test_f12_comment.sh index 26bcf6a..5a080a9 100755 --- a/tests/test_f12_comment.sh +++ b/tests/test_f12_comment.sh @@ -27,6 +27,14 @@ set -u ZUPT="${ZUPT_BIN:-./zupt}" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + case "$ZUPT" in /*) ;; *) ZUPT="$PWD/$ZUPT" ;; diff --git a/tests/test_kdf_transparency.sh b/tests/test_kdf_transparency.sh index c30585e..e9f2b8c 100755 --- a/tests/test_kdf_transparency.sh +++ b/tests/test_kdf_transparency.sh @@ -7,6 +7,14 @@ set -u SDK_DIR="${ZUPTSDK_DIR:-vendor/zuptsdk}" +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! ls "$SDK_DIR"/libzuptsdk.so* >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + ARCH=$(uname -m) if [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i686" ]; then SHANI="-msha -mssse3 -msse4.1" diff --git a/tests/test_pqbox.sh b/tests/test_pqbox.sh index f8fcfc3..8942324 100755 --- a/tests/test_pqbox.sh +++ b/tests/test_pqbox.sh @@ -14,6 +14,14 @@ bad() { echo " ✗ $1"; F=$((F+1)); } T=$(mktemp -d) FX=/tmp/bench/fixtures BIN=./vaptvupt +# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this +# test exercises are unavailable, so skip cleanly instead of failing. +_sdkck="$(mktemp -d)" +if ! "$BIN" keygen --box -o "$_sdkck/p" >/dev/null 2>&1; then + rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0 +fi +rm -rf "$_sdkck" + echo "pq-box mode (ZUPT_ENC_PQ_BOX_V1)"