Skip to content

Commit e9b84bb

Browse files
willieyzmkannwischer
willieyz
authored and
mkannwischer
committed
Port ec2_compatibilitytests from mlkem
- This commit port ec2_compatibilitytests from mlkem to mldsa - Also, due to the requement for ci_ec2_container.yml, this commit add the ci_ec2_container.yml based on ci_ec2_reuseable.yml, referencing from mlkem-native - About the AMI and AWS_ROLE we use, this commit aligns the AWS_ROLE and other parameters with those used in mlkem-native. we now use the same AMI, AWS_ROLE, and related configuration parameters for ec2_compatibilitytests to ensure consistency with mlkem-native. - Skip ACVP tests on Amazon Linux 2 containers when Python on these containers does not support hashlib sha512_224. - when adding several containers to ec2_compatibilitytests, we found that three Amazon Linux 2 containers could not run ACVP tests correctly due to missing support for newer hashlib hash types: * `amazonlinux-2-aarch:base` * `amazonlinux-2-aarch:gcc-7x` * `amazonlinux-2-aarch:clang-7x` - For these containers, we set `acvptest` to false. We also added a guard around `make quickcheck` in `ci_ec2_container.yml` and left a comment for future refinement. Signed-off-by: willieyz <[email protected]>
1 parent 01f7b12 commit e9b84bb

File tree

3 files changed

+327
-0
lines changed

3 files changed

+327
-0
lines changed

‎.github/actions/setup-yum/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Copyright (c) The mlkem-native project authors
2+
# Copyright (c) The mldsa-native project authors
3+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
4+
5+
name: Dependencies (yum)
6+
description: Install dependencies via yum
7+
8+
inputs:
9+
packages:
10+
description: Space-separated list of additional packages to install
11+
required: false
12+
default: ''
13+
sudo:
14+
required: false
15+
default: 'sudo'
16+
17+
runs:
18+
using: composite
19+
steps:
20+
- name: Install base packages
21+
shell: bash
22+
run: |
23+
${{ inputs.sudo }} yum install make gcc python3 git -y
24+
- name: Install additional packages
25+
if: ${{ inputs.packages != ''}}
26+
shell: bash
27+
run: |
28+
${{ inputs.sudo }} yum install ${{ inputs.packages }} -y

‎.github/workflows/ci.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -612,6 +612,92 @@ jobs:
612612
nix-shell: ""
613613
custom_shell: ${{ matrix.container.nix_shell && format('{0} --run \"bash -e {{0}}\"', matrix.container.nix_shell) || 'bash' }}
614614
gh_token: ${{ secrets.GITHUB_TOKEN }}
615+
ec2_compatibilitytests:
616+
strategy:
617+
max-parallel: 8
618+
fail-fast: false
619+
matrix:
620+
container:
621+
- id: amazonlinux-2-aarch:base
622+
# TODO: Python 3.7 on Amazon Linux 2 lacks `sha512_224` in hashlib; set to false to skip acvp.
623+
quickcheck: false
624+
acvptest: false
625+
- id: amazonlinux-2-aarch:gcc-7x
626+
# TODO: Python 3.7 on Amazon Linux 2 lacks `sha512_224` in hashlib; set to false to skip acvp.
627+
quickcheck: false
628+
acvptest: false
629+
- id: amazonlinux-2-aarch:clang-7x
630+
# TODO: Python 3.7 on Amazon Linux 2 lacks `sha512_224` in hashlib; set to false to skip acvp.
631+
quickcheck: false
632+
acvptest: false
633+
- id: amazonlinux-2023-aarch:base
634+
quickcheck: true
635+
acvptest: true
636+
- id: amazonlinux-2023-aarch:gcc-11x
637+
quickcheck: true
638+
acvptest: true
639+
- id: amazonlinux-2023-aarch:clang-15x
640+
quickcheck: true
641+
acvptest: true
642+
- id: amazonlinux-2023-aarch:clang-15x-sanitizer
643+
quickcheck: true
644+
acvptest: true
645+
# - id: amazonlinux-2023-aarch:cryptofuzz Not yet supported
646+
- id: ubuntu-22.04-aarch:gcc-12x
647+
quickcheck: true
648+
acvptest: true
649+
- id: ubuntu-22.04-aarch:gcc-11x
650+
quickcheck: true
651+
acvptest: true
652+
- id: ubuntu-20.04-aarch:gcc-8x
653+
quickcheck: true
654+
acvptest: true
655+
- id: ubuntu-20.04-aarch:gcc-7x
656+
quickcheck: true
657+
acvptest: true
658+
- id: ubuntu-20.04-aarch:clang-9x
659+
quickcheck: true
660+
acvptest: true
661+
- id: ubuntu-20.04-aarch:clang-8x
662+
quickcheck: true
663+
acvptest: true
664+
- id: ubuntu-20.04-aarch:clang-7x-bm-framework
665+
quickcheck: true
666+
acvptest: true
667+
- id: ubuntu-20.04-aarch:clang-7x
668+
quickcheck: true
669+
acvptest: true
670+
- id: ubuntu-20.04-aarch:clang-10x
671+
quickcheck: true
672+
acvptest: true
673+
- id: ubuntu-22.04-aarch:base
674+
quickcheck: true
675+
acvptest: true
676+
- id: ubuntu-20.04-aarch:base
677+
quickcheck: true
678+
acvptest: true
679+
name: Compatibility tests (${{ matrix.container.id }})
680+
permissions:
681+
contents: 'read'
682+
id-token: 'write'
683+
uses: ./.github/workflows/ci_ec2_container.yml
684+
if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
685+
with:
686+
container: ${{ matrix.container.id }}
687+
name: ${{ matrix.container.id }}
688+
ec2_instance_type: t4g.small
689+
ec2_ami: ubuntu-latest (custom AMI)
690+
ec2_ami_id: ami-0c9bc1901ef0d1066 # Has docker images preinstalled
691+
compile_mode: native
692+
opt: all
693+
functest: true
694+
kattest: true
695+
acvptest: ${{ matrix.container.acvptest }}
696+
quickcheck: ${{ matrix.container.quickcheck }}
697+
lint: false
698+
verbose: true
699+
cflags: "-O0"
700+
secrets: inherit
615701
check_autogenerated_files:
616702
strategy:
617703
fail-fast: false

‎.github/workflows/ci_ec2_container.yml‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
# Copyright (c) The mlkem-native project authors
2+
# Copyright (c) The mldsa-native project authors
3+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
4+
5+
name: ci-ec2-reusable
6+
permissions:
7+
contents: read
8+
on:
9+
workflow_call:
10+
inputs:
11+
name:
12+
type: string
13+
description: Alternative name of instance
14+
default: Graviton2
15+
ec2_instance_type:
16+
type: string
17+
description: Type if EC2 instance to benchmark on
18+
default: t4g.small
19+
ec2_ami:
20+
type: string
21+
description: Textual description of AMI
22+
default: ubuntu-latest (aarch64)
23+
ec2_ami_id:
24+
type: string
25+
description: AMI ID
26+
default: ami-0e8c824f386e1de06
27+
cflags:
28+
type: string
29+
description: Custom CFLAGS for compilation
30+
default: ""
31+
verbose:
32+
description: Determine for the log verbosity
33+
type: boolean
34+
default: false
35+
compile_mode:
36+
type: string
37+
description: either all, native, cross or none
38+
default: all
39+
opt:
40+
type: string
41+
description: either all, opt or no_opt
42+
default: all
43+
functest:
44+
type: boolean
45+
default: true
46+
kattest:
47+
type: boolean
48+
default: true
49+
acvptest:
50+
type: boolean
51+
default: true
52+
quickcheck:
53+
type: boolean
54+
default: true
55+
lint:
56+
type: boolean
57+
default: true
58+
cbmc:
59+
type: boolean
60+
default: false
61+
cbmc_mldsa_parameter_set:
62+
type: string
63+
default: 44
64+
container:
65+
type: string
66+
default: ''
67+
env:
68+
AWS_ROLE: arn:aws:iam::559050233797:role/mlkem-c-aarch64-gh-action
69+
AWS_REGION: us-east-1
70+
AMI_UBUNTU_LATEST_X86_64: ami-0e86e20dae9224db8
71+
AMI_UBUNTU_LATEST_AARCH64: ami-096ea6a12ea24a797
72+
jobs:
73+
start-ec2-runner:
74+
name: Start instance (${{ inputs.ec2_instance_type }})
75+
permissions:
76+
contents: 'read'
77+
id-token: 'write'
78+
runs-on: ubuntu-latest
79+
if: ${{ always() }} # The point is to make this step non-cancellable,
80+
# avoiding race conditions where an instance is started,
81+
# but isn't yet done registering as a runner and reporting back.
82+
outputs:
83+
label: ${{ steps.remember-runner.outputs.label }}
84+
ec2-instance-id: ${{ steps.remember-runner.outputs.ec2-instance-id }}
85+
steps:
86+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
87+
- name: Determine AMI ID
88+
id: det_ami_id
89+
run: |
90+
if [[ "${{ inputs.ec2_ami }}" == "ubuntu-latest (x86_64)" ]]; then
91+
AMI_ID=${{ env.AMI_UBUNTU_LATEST_X86_64 }}
92+
elif [[ "${{ inputs.ec2_ami }}" == "ubuntu-latest (aarch64)" ]]; then
93+
AMI_ID=${{ env.AMI_UBUNTU_LATEST_AARCH64 }}
94+
elif [[ "${{ inputs.ec2_ami }}" == "ubuntu-latest (custom AMI)" ]]; then
95+
AMI_ID=${{ inputs.ec2_ami_id }}
96+
fi
97+
echo "Using AMI ID: $AMI_ID"
98+
echo "AMI_ID=$AMI_ID" >> $GITHUB_OUTPUT
99+
- name: Configure AWS credentials
100+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
101+
with:
102+
role-to-assume: ${{ env.AWS_ROLE }}
103+
aws-region: ${{ env.AWS_REGION }}
104+
- name: Start EC2 runner
105+
id: start-ec2-runner-first
106+
continue-on-error: true
107+
uses: machulav/ec2-github-runner@a6dbcefcf8a31a861f5e078bb153ed332130c512 # v2.4.3
108+
with:
109+
mode: start
110+
github-token: ${{ secrets.AWS_GITHUB_TOKEN }}
111+
ec2-image-id: ${{ steps.det_ami_id.outputs.AMI_ID }}
112+
ec2-instance-type: ${{ inputs.ec2_instance_type }}
113+
subnet-id: subnet-07b2729e5e065962f
114+
security-group-id: sg-0ab2e297196c8c381
115+
- name: Start EC2 runner (wait before retry)
116+
if: steps.start-ec2-runner-first.outcome == 'failure'
117+
shell: bash
118+
run: |
119+
sleep 30 # Wait 30s before retrying
120+
sleep $((1 + RANDOM % 30))
121+
- name: Start EC2 runner (retry)
122+
id: start-ec2-runner-second
123+
if: steps.start-ec2-runner-first.outcome == 'failure'
124+
uses: machulav/ec2-github-runner@a6dbcefcf8a31a861f5e078bb153ed332130c512 # v2.4.3
125+
with:
126+
mode: start
127+
github-token: ${{ secrets.AWS_GITHUB_TOKEN }}
128+
ec2-image-id: ${{ steps.det_ami_id.outputs.AMI_ID }}
129+
ec2-instance-type: ${{ inputs.ec2_instance_type }}
130+
subnet-id: subnet-07b2729e5e065962f
131+
security-group-id: sg-0ab2e297196c8c381
132+
- name: Remember runner
133+
id: remember-runner
134+
shell: bash
135+
run: |
136+
if [[ "${{ steps.start-ec2-runner-first.outcome }}" == "failure" ]]; then
137+
echo "label=${{ steps.start-ec2-runner-second.outputs.label }}" >> "$GITHUB_OUTPUT"
138+
echo "ec2-instance-id=${{ steps.start-ec2-runner-second.outputs.ec2-instance-id }}" >> "$GITHUB_OUTPUT"
139+
else
140+
echo "label=${{ steps.start-ec2-runner-first.outputs.label }}" >> "$GITHUB_OUTPUT"
141+
echo "ec2-instance-id=${{ steps.start-ec2-runner-first.outputs.ec2-instance-id }}" >> "$GITHUB_OUTPUT"
142+
fi
143+
144+
tests:
145+
name: Run tests
146+
needs: start-ec2-runner
147+
if: ${{ inputs.container != '' }}
148+
runs-on: ${{ needs.start-ec2-runner.outputs.label }}
149+
container:
150+
localhost:5000/${{ inputs.container }}
151+
steps:
152+
# We're not using the checkout action here because on it's not supported
153+
# on all containers we want to test. Resort to a manual checkout.
154+
#
155+
# We can't hoist this into an action since calling an action can only
156+
# be done after checkout.
157+
- name: Manual checkout
158+
shell: bash
159+
run: |
160+
if /usr/bin/which yum; then
161+
yum install git -y
162+
elif /usr/bin/which apt; then
163+
apt update
164+
apt install git -y
165+
fi
166+
167+
git init
168+
git remote add origin $GITHUB_SERVER_URL/$GITHUB_REPOSITORY
169+
git fetch origin --depth 1 $GITHUB_SHA
170+
git checkout FETCH_HEAD
171+
- uses: ./.github/actions/setup-os
172+
with:
173+
sudo: ""
174+
- name: make quickcheck
175+
if: ${{ inputs.quickcheck }}
176+
run: |
177+
OPT=0 make quickcheck
178+
make clean >/dev/null
179+
OPT=1 make quickcheck
180+
- name: Functional Tests
181+
uses: ./.github/actions/multi-functest
182+
with:
183+
nix-shell: ""
184+
gh_token: ${{ secrets.AWS_GITHUB_TOKEN }}
185+
cflags: ${{ inputs.cflags }}
186+
compile_mode: ${{ inputs.compile_mode }}
187+
opt: ${{ inputs.opt }}
188+
func: ${{ inputs.functest }}
189+
kat: ${{ inputs.kattest }}
190+
acvp: ${{ inputs.acvptest }}
191+
stop-ec2-runner:
192+
name: Stop instance (${{ inputs.ec2_instance_type }})
193+
permissions:
194+
contents: 'read'
195+
id-token: 'write'
196+
needs:
197+
- start-ec2-runner
198+
- tests
199+
runs-on: ubuntu-latest
200+
if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
201+
steps:
202+
- name: Configure AWS credentials
203+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
204+
with:
205+
role-to-assume: ${{ env.AWS_ROLE }}
206+
aws-region: ${{ env.AWS_REGION }}
207+
- name: Stop EC2 runner
208+
uses: machulav/ec2-github-runner@a6dbcefcf8a31a861f5e078bb153ed332130c512 # v2.4.3
209+
with:
210+
mode: stop
211+
github-token: ${{ secrets.AWS_GITHUB_TOKEN }}
212+
label: ${{ needs.start-ec2-runner.outputs.label }}
213+
ec2-instance-id: ${{ needs.start-ec2-runner.outputs.ec2-instance-id }}

0 commit comments

Comments
 (0)