boot: zephyr: Fix boot banner #5440
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # For development, trigger this on any push. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| name: Sim | |
| concurrency: | |
| group: sim-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| environment: | |
| strategy: | |
| matrix: | |
| features: | |
| - "sig-ecdsa,sig-ecdsa-mbedtls,sig-ed25519,enc-kw,bootstrap" | |
| - "sig-rsa,sig-rsa3072,overwrite-only,validate-primary-slot,swap-move,swap-offset" | |
| - "enc-rsa,enc-rsa max-align-32" | |
| - "enc-aes256-rsa,enc-aes256-rsa max-align-32" | |
| - "enc-ec256,enc-ec256 overwrite-only validate-primary-slot max-align-16,enc-ec256 max-align-32" | |
| - "enc-aes256-ec256,enc-aes256-ec256 max-align-32" | |
| - "enc-x25519,enc-x25519 max-align-32" | |
| - "enc-aes256-x25519,enc-aes256-x25519 max-align-32" | |
| - "sig-rsa overwrite-only,sig-ecdsa overwrite-only,sig-ecdsa-mbedtls overwrite-only,multiimage overwrite-only" | |
| - "sig-rsa validate-primary-slot,sig-ecdsa validate-primary-slot,sig-ecdsa-mbedtls validate-primary-slot,sig-rsa multiimage validate-primary-slot" | |
| - "enc-kw overwrite-only,enc-kw overwrite-only max-align-32" | |
| - "enc-rsa overwrite-only,enc-rsa overwrite-only max-align-32" | |
| - "enc-aes256-kw overwrite-only,enc-aes256-kw overwrite-only max-align-32" | |
| - "sig-rsa enc-rsa validate-primary-slot,swap-move enc-rsa sig-rsa validate-primary-slot bootstrap,swap-offset enc-rsa sig-rsa validate-primary-slot bootstrap" | |
| - "sig-rsa enc-kw validate-primary-slot bootstrap,sig-ed25519 enc-x25519 validate-primary-slot" | |
| - "sig-ecdsa enc-kw validate-primary-slot" | |
| - "sig-ecdsa-mbedtls enc-kw validate-primary-slot" | |
| - "sig-rsa validate-primary-slot overwrite-only,sig-rsa validate-primary-slot overwrite-only max-align-32" | |
| - "sig-ecdsa enc-ec256 validate-primary-slot" | |
| - "sig-ecdsa-mbedtls enc-ec256-mbedtls validate-primary-slot" | |
| - "sig-ecdsa-mbedtls enc-aes256-ec256 validate-primary-slot" | |
| - "sig-rsa validate-primary-slot overwrite-only downgrade-prevention" | |
| - "sig-rsa validate-primary-slot ram-load" | |
| - "sig-rsa enc-rsa validate-primary-slot ram-load" | |
| - "sig-rsa validate-primary-slot direct-xip" | |
| - "sig-rsa validate-primary-slot ram-load multiimage" | |
| - "sig-rsa validate-primary-slot direct-xip multiimage" | |
| - "sig-ecdsa hw-rollback-protection multiimage" | |
| - "sig-ed25519 sig-second-key" | |
| # Logical sectors: swap bookkeeping in fixed 4K units | |
| # independent of the physical page layout. Covers each | |
| # upgrade strategy plus a signed variant; exercises the | |
| # small-page device (pages smaller than a logical sector) | |
| # and the negative tests that reject incompatible layouts. | |
| - "logical-sectors-4k,logical-sectors-4k swap-move,logical-sectors-4k swap-offset,logical-sectors-4k overwrite-only,sig-ecdsa logical-sectors-4k" | |
| # 128K logical sectors, where a sector spans several physical | |
| # pages of differing sizes. Only the ST devices tile at this | |
| # size, and the F769 is the sole device large enough for the | |
| # swap algorithms, which its varying page sizes would otherwise | |
| # rule out entirely. | |
| - "logical-sectors-128k,logical-sectors-128k swap-move,logical-sectors-128k swap-offset,logical-sectors-128k overwrite-only,sig-ecdsa logical-sectors-128k" | |
| - "sig-ecdsa-psa,sig-ecdsa-psa sig-p384,sig-ecdsa-psa swap-move bootstrap max-align-16" | |
| - "sig-ecdsa-psa enc-ec256 max-align-16, sig-ecdsa-psa enc-ec256 swap-offset validate-primary-slot max-align-16" | |
| # Same set, routed through Mbed TLS 4.1 via the mbedtls-v4 | |
| # feature. These mirror the 3.6 path above and should behave | |
| # identically — the crypto config is the same shape (ECDSA | |
| # P-256/P-384 + SHA-256). | |
| - "sig-ecdsa-psa mbedtls-v4,sig-ecdsa-psa sig-p384 mbedtls-v4,sig-ecdsa-psa swap-move bootstrap max-align-16 mbedtls-v4" | |
| # Orthogonal feature combinations untested on the 3.6 | |
| # sig-ecdsa-psa path but expected to work — swap/align/ | |
| # multiimage/validate don't touch crypto. Good shakedown for | |
| # the CMake-driven build surface. | |
| - "sig-ecdsa-psa swap-offset mbedtls-v4,sig-ecdsa-psa validate-primary-slot mbedtls-v4,sig-ecdsa-psa overwrite-only mbedtls-v4,sig-ecdsa-psa multiimage mbedtls-v4" | |
| # Reset/XIP/rollback combinations. Higher risk of surfacing | |
| # PSA-specific assumptions baked into these code paths; run | |
| # and triage. | |
| - "sig-ecdsa-psa ram-load mbedtls-v4,sig-ecdsa-psa direct-xip mbedtls-v4,sig-ecdsa-psa overwrite-only downgrade-prevention mbedtls-v4,sig-ecdsa-psa hw-rollback-protection multiimage mbedtls-v4" | |
| # Genuine PSA encryption via encrypted_psa.c (vs. the 3.6 | |
| # stub path above, which leaves PSA init as a no-op and uses | |
| # TinyCrypt). Mirrors the 3.6 enc-ec256 row. | |
| - "sig-ecdsa-psa enc-ec256 mbedtls-v4,sig-ecdsa-psa enc-ec256 swap-offset validate-primary-slot max-align-16 mbedtls-v4" | |
| # AES-256 variant. Same ECIES-P256 machinery, larger | |
| # BOOT_ENC_KEY_SIZE. PSA_KEY_TYPE_AES covers all AES key | |
| # sizes so no config delta. | |
| - "sig-ecdsa-psa enc-aes256-ec256 mbedtls-v4,sig-ecdsa-psa enc-aes256-ec256 swap-offset validate-primary-slot max-align-16 mbedtls-v4" | |
| - "ram-load enc-aes256-kw multiimage" | |
| - "ram-load enc-aes256-kw sig-ecdsa-mbedtls multiimage" | |
| - "custom-crypto,custom-crypto overwrite-only,custom-crypto validate-primary-slot,custom-crypto swap-offset" | |
| - "custom-enc-crypto,custom-enc-crypto validate-primary-slot,custom-enc-crypto swap-offset validate-primary-slot max-align-32" | |
| runs-on: ubuntu-latest | |
| env: | |
| MULTI_FEATURES: ${{ matrix.features }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| submodules: recursive | |
| - name: Print the environment | |
| run: | | |
| uname -a | |
| lscpu | |
| free | |
| pwd | |
| - name: Signed commit check | |
| if: ${{ github.event_name == 'pull_request' }} | |
| run: | | |
| ./ci/check-signed-off-by.sh | |
| - name: Install stable Rust | |
| uses: actions-rs/toolchain@v1 | |
| with: | |
| toolchain: stable | |
| - name: Sim install | |
| run: | | |
| ./ci/sim_install.sh | |
| - name: Sim run | |
| run: | | |
| ./ci/sim_run.sh |