Define "light" subset of MD
See docs/architecture/psa-migration/md-cipher-dispatch.md
Regarding testing, the no_md component was never very useful, as that's
not something people are likely to want to do: it was mostly useful as
executable documentation of what depends on MD. It's going to be even
less useful when more and more modules auto-enable MD_LIGHT or even
MD_C. So, recycle it to test the build with only MD_LIGHT, which is
something that might happen in practice, and is necessary to ensure that
the division is consistent.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 7d91fa2..c4a8fe6 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -1219,19 +1219,25 @@
tests/ssl-opt.sh -f 'Default\|opaque'
}
-component_test_crypto_full_no_md () {
- msg "build: crypto_full minus MD"
+component_test_crypto_full_md_light_only () {
+ msg "build: crypto_full with only the light subset of MD"
scripts/config.py crypto_full
+ # Disable MD
scripts/config.py unset MBEDTLS_MD_C
- # Direct dependencies
+ # Disable direct dependencies of MD
scripts/config.py unset MBEDTLS_HKDF_C
scripts/config.py unset MBEDTLS_HMAC_DRBG_C
scripts/config.py unset MBEDTLS_PKCS7_C
- # Indirect dependencies
- scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC
- make
+ # Disable indirect dependencies of MD
+ scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # needs HMAC_DRBG
+ # Enable "light" subset of MD
+ scripts/config.py set MBEDTLS_MD_LIGHT
+ make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
- msg "test: crypto_full minus MD"
+ # Make sure we don't have the HMAC functions
+ not grep mbedtls_md_hmac library/md.o
+
+ msg "test: crypto_full with only the light subset of MD"
make test
}