ci: test more feature flag combinations

.github/workflows/ci.yml

@@ -110,117 +110,53 @@ jobs:
       matrix:
         features:
           - # Default
-          - --features=alloc
+          - --features alloc
           - --all-features
           - --no-default-features
-          - --no-default-features --features alloc,std,aws_lc_rs
-          - --no-default-features --features alloc,std,ring
+          - --no-default-features --features alloc
+          - --no-default-features --features aws-lc-rs
+          - --no-default-features --features ring
+          - --no-default-features --features alloc,aws-lc-rs
+          - --no-default-features --features alloc,ring
+          - --features aws-lc-rs # `std` is enabled by default
+          - --features ring # `std` is enabled by default
 
-        mode:
-          - # debug
-          - --release
+        host_os:
+          - ubuntu-latest
 
         rust_channel:
           - stable
-          - nightly
-          - beta
-
-        exclude:
-          - features: # Default
-          - features: --features=alloc
-          - features: --no-default-features
-          - features: --no-default-features --features alloc,std
-          - features: --no-default-features --features alloc,std,aws_lc_rs
-          - features: --no-default-features --features alloc,std,ring
-          - features: --all-features
-            mode: --release
-          - features: --all-features
-            mode: # debug
-            rust_channel: nightly
-          - features: --all-features
-            mode: # debug
-            rust_channel: beta
 
         include:
-          - features: # Default
-            mode: # debug
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          - features: --features=alloc
-            mode: # debug
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          - features: --no-default-features
-            mode: # debug
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          - features: --no-default-features --features alloc,std
-            mode: # debug
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          - features: --all-features
-            mode: --release
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          - features: --all-features
-            mode: # debug
-            rust_channel: nightly
-            host_os: ubuntu-latest
-
-          - features: --all-features
-            mode: # debug
+          # Test aws-lc-rs across Rust channels
+          - features: --features aws-lc-rs
             rust_channel: beta
             host_os: ubuntu-latest
 
-          - features: --all-features
-            mode: # debug
-            rust_channel: stable
-            host_os: macos-latest
-
-          - features: --all-features
-            mode: # debug
-            rust_channel: stable
-            host_os: windows-latest
-
-          - features: --all-features
-            mode: # debug
-            rust_channel: stable
+          - features: --features aws-lc-rs
+            rust_channel: nightly
             host_os: ubuntu-latest
 
-          # check aws-lc-rs alone
-          - features: --no-default-features --features alloc,std,aws-lc-rs
-            mode: # debug
+          # Test aws-lc-rs across OSes
+          - features: --features aws-lc-rs
             rust_channel: stable
             host_os: macos-latest
 
-          - features: --no-default-features --features alloc,std,aws-lc-rs
-            mode: # debug
+          - features: --features aws-lc-rs
             rust_channel: stable
             host_os: windows-latest
 
-          - features: --no-default-features --features alloc,std,aws-lc-rs
-            mode: # debug
-            rust_channel: stable
-            host_os: ubuntu-latest
-
-          # check ring alone
-          - features: --no-default-features --features alloc,std,ring
-            mode: # debug
+          # Test ring across OSes
+          - features: --features ring
             rust_channel: stable
             host_os: macos-latest
 
-          - features: --no-default-features --features alloc,std,ring
-            mode: # debug
+          - features: --features ring
             rust_channel: stable
             host_os: windows-latest
 
-          - features: --no-default-features --features alloc,std,ring
-            mode: # debug
+          # Test aws-lc-rs-fips on Linux only (stable only)
+          - features: --features aws-lc-rs-fips
             rust_channel: stable
             host_os: ubuntu-latest
 
@@ -239,8 +175,8 @@ jobs:
         if: runner.os == 'Windows'
         uses: seanmiddleditch/gha-setup-ninja@v6
 
-      - name: cargo test (${{ matrix.mode }}, ${{ matrix.features }})
-        run: cargo test --locked ${{ matrix.features }} ${{ matrix.mode }} -- --include-ignored
+      - name: cargo test (${{ matrix.features }})
+        run: cargo test --locked ${{ matrix.features }} -- --include-ignored
         env:
           RUSTFLAGS: "-D warnings"
           AWS_LC_SYS_PREBUILT_NASM: "1" # for benefit of rcgen

src/subject_name/ip_address.rs

@@ -564,7 +564,7 @@ mod tests {
     }
 }
 
-#[cfg(all(test, feature = "alloc"))]
+#[cfg(all(test, feature = "std"))]
 mod alloc_tests {
     use super::*;
 
@@ -672,7 +672,6 @@ mod alloc_tests {
         ("1003:fca::", "2001:db8::", "0000:0000::", Ok(true)),
     ];
 
-    #[cfg(feature = "std")]
     #[test]
     fn presented_matches_constraint_test() {
         use std::boxed::Box;

tests/amazon.rs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: ISC
-#![cfg(any(feature = "ring", feature = "aws-lc-rs"))]
+#![cfg(all(feature = "alloc", any(feature = "ring", feature = "aws-lc-rs")))]
 
 use core::time::Duration;
 

tests/generate.py

@@ -694,13 +694,14 @@ def _test(
 
         sig_path: str = os.path.join(output_dir, f"{lower_test_name}.sig.bin")
         write_der(sig_path, signature, force)
-        feature_gate = feature_gates.get(algorithm, 'feature = "alloc"')
+        feature_gate: str = feature_gates.get(algorithm, "")
+        if feature_gate:
+            feature_gate = f"#[cfg({feature_gate})]\n"
 
         print(
             """
 #[test]
-#[cfg(%(feature_gate)s)]
-fn %(lower_test_name)s() {
+%(feature_gate)sfn %(lower_test_name)s() {
     let ee = include_bytes!("%(cert_path)s");
     let message = include_bytes!("%(message_path)s");
     let signature = include_bytes!("%(sig_path)s");
@@ -716,8 +717,7 @@ def _test(
         print(
             """
 #[test]
-#[cfg(%(feature_gate)s)]
-fn %(lower_test_name)s_rpk() {
+%(feature_gate)sfn %(lower_test_name)s_rpk() {
     let rpk = include_bytes!("%(rpk_path)s");
     let message = include_bytes!("%(message_path)s");
     let signature = include_bytes!("%(sig_path)s");
@@ -769,7 +769,6 @@ def bad_algorithms_for_key(
         print(
             """
 #[test]
-#[cfg(feature = "alloc")]
 fn %(test_name_lower)s() {
     let ee = include_bytes!("%(cert_path)s");
     for algorithm in &[ %(unusable_algs_str)s ] {

tests/integration.rs

@@ -49,6 +49,7 @@ fn netflix() {
 }
 
 /// See also https://github.com/rustls/rustls/issues/2448
+#[cfg(feature = "alloc")]
 #[test]
 fn sanofi_rsa_signature_with_absent_algorithm_params() {
     let ee: &[u8] = include_bytes!("sanofi/ee.der");