Update abi_check.py to support standalone tf-psa-crypto by bensze01 · Pull Request #229 · Mbed-TLS/mbedtls-framework

bensze01 · 2025-10-22T05:46:15Z

Description

Move abi_check.py to the framework, and update it to support a standalone tf-psa-crypto

PR checklist

framework PR: Update abi_check.py to support standalone tf-psa-crypto #229
mbedtls-test PR: Run Crypto abi-check in TF-PSA-Crypto PRs mbedtls-test#241
TF-PSA-Crypto PR: Port abi_check.py to TF-PSA-Crypto TF-PSA-Crypto#541
development PR: Move abi_check.py to the framework mbedtls#10464
3.6 PR: [Backport 3.6] Move abi_check.py to the framework mbedtls#10465

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

… now disallowed, changed to concrete jpake algorithm (with SHA256 hash) Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

…thout_heap Enable p192[k|r]1 curves which are disabled by default in tf-psa-crypto. This is required to get the proper test coverage otherwise there are tests in 'test_suite_psa_crypto_op_fail' that would never be executed. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Move the PAKE hash algorithm parameter into the alg id

tests: configuration-crypto: enable p192 curves in test_psa_crypto_without_heap

Return a const char* instead of taking a char* as an argument. This aligns us with the interface used in TF PSA Crypto. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Previously these tests used values that will become PSA aliases, and so the tests will fail once they're changed. Signed-off-by: Felix Conway <felix.conway@arm.com>

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Signed-off-by: Felix Conway <felix.conway@arm.com>

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Signed-off-by: Felix Conway <felix.conway@arm.com>

Add more detail around how generation of configuration-independent files chooses a C compiler. Mention that setting HOSTCC or CC is recommended where there are multiple toolchains. Mention that the fallback location is the cc executable, which may help users troubleshooting when the file generation picks up the wrong toolchain (as in Mbed-TLS/mbedtls#10360). Signed-off-by: David Horstmann <david.horstmann@arm.com>

…PTO_RNG_HASH Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>

…tion-cc Clarify use of `CC` and friends for file generation

Remove all references to MBEDTLS_ECDSA_DETERMINISTIC from components-configuration-crypto.sh. Replace them with PSA_WANT_ALG_DETERMINISTIC_ECDSA. This is safe because: * MBEDTLS_ECDSA_DETERMINISTIC is only ever unset in components in order to avoid errors from disabling its dependency MBEDTLS_HMAC_DRBG_C. * MBEDTLS_ECDSA_DETERMINISTIC is only ever defined in config_adjust_legacy_from_psa.h, and only if PSA_WANT_ALG_DETERMINISTIC_ECDSA is defined. Therefore PSA_WANT_ALG_DETERMINISTIC_ECDSA's dependencies are a superset of MBEDTLS_ECDSA_DETERMINISTIC's dependencies and must include MBEDTLS_HMAC_DRBG_C, so disabling PSA_WANT_ALG_DETERMINISTIC_ECDSA is a sufficient substitute for disabling MBEDTLS_ECDSA_DETERMINISTIC. Signed-off-by: David Horstmann <david.horstmann@arm.com>

…ent directory CMakeLists.txt file Signed-off-by: Felix Conway <felix.conway@arm.com>

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

…ograms Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Signed-off-by: Felix Conway <felix.conway@arm.com>

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

…o_rng_hash crypto_config: Introduce MBEDTLS_PSA_CRYPTO_RNG_HASH (2/4)

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Argparse generally uses a return code of 2 for these situations. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

The same library may be present in the same build tree, eg. libtfpsacrypto.so, which gets copied from the tf-psa-crypto/core/ to library/ during an Mbed TLS build. Make sure that the duplicated libraries are byte-for-byte identical, otherwise abort the test. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

No functional changes. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

The only value that depended on us being in the project root was repo_path. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

The actual scripts will continue to live in the individual repositories. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

The default formatter coalesces all whitespace and reflows the text. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Use `find` to sort scripts/abi_check.py into a separate invocation of pylint. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

gilles-peskine-arm · 2025-12-19T11:39:03Z

@minosgalanakis This moves the file abi_check.py from mbedtls to mbedtls-framework, with its history. So it's pulling in the history of mbedtls (which was already mostly there from previous similar moves).

To review, check the following:

f4dbe69 was at some point the head of main in https://github.com/Mbed-TLS/mbedtls-framework.
6a9be3d was at some point the head of development in https://github.com/Mbed-TLS/mbedtls.
The commit chain from 6a9be3d to ebd2cd5 is correct for its purpose.
ebd2cd5 is a merge of f4dbe69 and the chain from the previous step.
The chain of commits after ebd2cd5 are correct for their purpose.

bensze01 · 2025-12-19T12:00:18Z

2 more things that might be good to check:

I tried to minimize the history of Mbed TLS we needed to pull in, so 6a9be3d is the merge commit of the most recent PR that modified abi_check.py (Use submodule work trees during ABI check mbedtls#10416)
49e9d30 deletes all files from the mbedtls tree except the ones to be moved (abi_check.py)

gilles-peskine-arm

LGTM at 12fe6e3 except for reporting pylint errors.

gilles-peskine-arm

LGTM at 12fe6e3

minosgalanakis

LGTM

amtkarm1 and others added 30 commits August 12, 2025 13:50

Create a changelog entry

e807318

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Fixed the changelog entry, missing trailing newline

e2c5ca3

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Fixed the changelog entry wording

e8be4ee

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Deleted the changelog entry as requested

143d5d8

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Fixed issues with policy verification, since wildcard JPAKE policy is…

6eb5335

… now disallowed, changed to concrete jpake algorithm (with SHA256 hash) Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Update tf-psa-crypto to current development

eca92dc

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

Merge pull request #10049 from amtkarm1/iss9321

e96491c

Move the PAKE hash algorithm parameter into the alg id

Merge pull request #10355 from valeriosetti/issue10283-fix-test-coverage

265e98d

tests: configuration-crypto: enable p192 curves in test_psa_crypto_without_heap

Simplify runtime version info string methods

b2ba9fa

Return a const char* instead of taking a char* as an argument. This aligns us with the interface used in TF PSA Crypto. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Change values for error tests

8616ee7

Previously these tests used values that will become PSA aliases, and so the tests will fail once they're changed. Signed-off-by: Felix Conway <felix.conway@arm.com>

Update CMake linkage tests to new call signature

783d8ad

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Update PSASim tests to new call signature

0e5fe87

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Add const to serial argument in mbedtls_x509write_crt_set_serial_raw

3f52374

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Unify generic errors to PSA errors

37ede2c

Signed-off-by: Felix Conway <felix.conway@arm.com>

Add Changelog and documentation

f5b48c3

Signed-off-by: Felix Conway <felix.conway@arm.com>

Add ChangeLog

f8b4aa1

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Fix ssl tests expecting old X509 error output

e984d35

Signed-off-by: Felix Conway <felix.conway@arm.com>

Remove tf-psa-crypto/include/mbedtls/private from Doxygen

1a1ff64

Signed-off-by: Felix Conway <felix.conway@arm.com>

components-configuration-crypto.sh: Added setters for MBEDTLS_PSA_CRY…

f3486e1

…PTO_RNG_HASH Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>

Merge pull request #10365 from davidhorstmann-arm/clarify-file-genera…

7ec90c2

…tion-cc Clarify use of `CC` and friends for file generation

Removed the directory with the programs, and its inclusion in the par…

ed70587

…ent directory CMakeLists.txt file Signed-off-by: Felix Conway <felix.conway@arm.com>

Added a changelog entry for the removal

87ae4e6

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Adjusted the Makefile in the programs directory - removed the pkey pr…

5b49f31

…ograms Signed-off-by: Anton Matkin <anton.matkin@arm.com>

Update & fix changelog

3962284

Signed-off-by: Felix Conway <felix.conway@arm.com>

Remove programs from gitignore and documentation

1cf9a15

Signed-off-by: Felix Conway <felix.conway@arm.com>

Renamed and corrected ChangeLog

32e100a

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Merge pull request #10320 from minosgalanakis/feature/introduce_crypt…

0387ca6

…o_rng_hash crypto_config: Introduce MBEDTLS_PSA_CRYPTO_RNG_HASH (2/4)

bensze01 added 16 commits December 18, 2025 20:20

Merge branch mbedtls/development into abicheck-port

ebd2cd5

Fix import path

fc6b642

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Fix reporting invalid arguments

fdb9b08

Argparse generally uses a return code of 2 for these situations. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Remove dead code related to the old crypto submodule

a154f63

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Log output of failed subprocesses

40eb9b1

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Build library using CMake

dad0f26

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Allow calling abi_check.py from tf-psa-crypto

315dc8a

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Remove stray debugging bypasses

feed060

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Make the name-clash detection more readable

9f715c0

No functional changes. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Do not change the working directory

7816208

The only value that depended on us being in the project root was repo_path. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Rename abi_check and convert it to a pure-play module

25872c3

The actual scripts will continue to live in the individual repositories. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Remove unused version parameter

074abc1

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Preserve the docstring's formatting in the description

f9c2d65

The default formatter coalesces all whitespace and reflows the text. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Work around code duplication warning in pylint

5066f2c

Use `find` to sort scripts/abi_check.py into a separate invocation of pylint. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

Fix copypasta in check-python-files.sh

12fe6e3

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>

bensze01 force-pushed the abicheck-port branch from 4179d1c to 12fe6e3 Compare December 18, 2025 19:22

gilles-peskine-arm requested changes Dec 19, 2025

View reviewed changes

Comment thread scripts/check-python-files.sh

gilles-peskine-arm added needs-work and removed needs-review Every commit must be reviewed by at least two team members. needs-ci Needs to pass CI tests needs-reviewer This PR needs someone to pick it up for review labels Dec 19, 2025

gilles-peskine-arm approved these changes Dec 22, 2025

View reviewed changes

minosgalanakis approved these changes Dec 22, 2025

View reviewed changes

github-project-automation Bot moved this from In Development to Has Approval in Roadmap pull requests (new board) Dec 22, 2025

bensze01 removed the needs-work label Dec 22, 2025

bensze01 merged commit 7e8ddd4 into Mbed-TLS:main Dec 22, 2025
2 checks passed

github-project-automation Bot moved this from Has Approval to Done in Roadmap pull requests (new board) Dec 22, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update abi_check.py to support standalone tf-psa-crypto#229

Update abi_check.py to support standalone tf-psa-crypto#229
bensze01 merged 1137 commits into
Mbed-TLS:mainfrom
bensze01:abicheck-port

bensze01 commented Oct 22, 2025 •

edited

Loading

Uh oh!

gilles-peskine-arm commented Dec 19, 2025

Uh oh!

bensze01 commented Dec 19, 2025

Uh oh!

gilles-peskine-arm left a comment •

edited

Loading

Uh oh!

Uh oh!

gilles-peskine-arm left a comment •

edited

Loading

Uh oh!

minosgalanakis left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Conversation

bensze01 commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

PR checklist

Uh oh!

gilles-peskine-arm commented Dec 19, 2025

Uh oh!

bensze01 commented Dec 19, 2025

Uh oh!

gilles-peskine-arm left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gilles-peskine-arm left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

minosgalanakis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

bensze01 commented Oct 22, 2025 •

edited

Loading

gilles-peskine-arm left a comment •

edited

Loading

gilles-peskine-arm left a comment •

edited

Loading