API integration test by jenstopp · Pull Request #232 · Azure/azihsm-sdk

jenstopp · 2026-03-03T22:05:24Z

Add a provider-tests crate that exercises the azihsm provider through
the OpenSSL EVP API (not the CLI tool), enabling testing of session-based
ephemeral keys that cannot be tested via the command line.

Tests added:

SmokeTest: provider loads and reports correct name
EC session key sign/verify round trip (P-256, P-384, P-521)
RSA session key sign/verify (PKCS#1 v1.5 and PSS padding)
RSA session key encrypt/decrypt (OAEP)
ECDH session key derivation (to buffer and to file)
Negative tests: cross-key failures, tampered data, mismatched curves

jenstopp · 2026-03-03T22:08:17Z

The work is branched from the other not yet merged integration test PR #191
The API based test is just the last commit.

Will update once #191 is merged.

Copilot

Pull request overview

Adds new integration test coverage for the AZIHSM OpenSSL provider, including a new C++/EVP-based test crate for session-only keys and a Rust/lit-based shell-script suite, plus CI wiring to run them.

Changes:

Add provider-tests crate that builds/runs C++ GoogleTest cases exercising the provider via the OpenSSL EVP API.
Add integration-tests crate to run existing/new CLI-oriented provider tests via lit and bash scripts.
Update CI and xtask tooling to run the new integration suites; adjust RSA-PSS saltlen handling in the provider.

Reviewed changes

Copilot reviewed 60 out of 60 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
xtask/src/main.rs	Registers a new xtask command for integration tests.
xtask/src/integration_tests.rs	Adds an xtask to run the `integration-tests` crate.
xtask/src/coverage.rs	Updates workspace coverage invocation to exclude `integration-tests`.
provider-tests/cpp/utils/provider_ctx.hpp	RAII OpenSSL provider/libctx loader used by C++ tests.
provider-tests/cpp/utils/ossl_helpers.hpp	OpenSSL smart-pointer helpers for C++ tests.
provider-tests/cpp/utils/keygen_helpers.hpp	EC/RSA session key helper routines for C++ EVP tests.
provider-tests/cpp/tests.rs	Rust `libtest-mimic` harness to discover/run the C++ gtests.
provider-tests/cpp/smoke_tests.cpp	Basic provider load/name smoke tests.
provider-tests/cpp/rsa_session_sign_verify_tests.cpp	RSA session-key sign/verify (PKCS#1 + PSS) tests.
provider-tests/cpp/rsa_session_encrypt_decrypt_tests.cpp	RSA session-key OAEP encrypt/decrypt tests.
provider-tests/cpp/ecdh_session_keyexch_tests.cpp	ECDH session-key derive tests (buffer + file + negative).
provider-tests/cpp/ec_session_sign_verify_tests.cpp	EC session-key sign/verify tests across curves + negatives.
provider-tests/cpp/CMakeLists.txt	CMake build for the C++ gtest binary with pinned OpenSSL prefix.
provider-tests/build.rs	Cargo build script driving the CMake build of C++ tests.
provider-tests/Cargo.toml	Declares the `provider-tests` crate and its custom test target.
plugins/ossl_prov/src/azihsm_ossl_signature_rsa.c	Extends RSA-PSS saltlen handling to cover “auto”.
integration-tests/testfiles/rsa/verify/verify_wrong_key.sh	Adds RSA wrong-key verification negative case.
integration-tests/testfiles/rsa/verify/verify_negative_tampered_data.sh	Adds RSA tampered-data verification negative case.
integration-tests/testfiles/rsa/verify/verify.sh	RSA verify script under provider CLI tests.
integration-tests/testfiles/rsa/sign/sign.sh	RSA sign script under provider CLI tests.
integration-tests/testfiles/rsa/rsa_pss_default_padding/round_trip.sh	RSA-PSS default-padding round trip script.
integration-tests/testfiles/rsa/rsa-pss-specific/verify.sh	RSA-PSS specific-parameter verify script.
integration-tests/testfiles/rsa/rsa-pss-specific/sign.sh	RSA-PSS specific-parameter sign script.
integration-tests/testfiles/rsa/round_trip/round_trip.sh	RSA sign/verify round trip script.
integration-tests/testfiles/rsa/pkcs1_encryption/pkcs1_encryption.sh	RSA PKCS#1 encryption/decryption script.
integration-tests/testfiles/rsa/oneshot_verify/oneshot_verify.sh	RSA one-shot verify (pkeyutl) script.
integration-tests/testfiles/rsa/oneshot_sign/oneshot_sign.sh	RSA one-shot sign (pkeyutl) script.
integration-tests/testfiles/rsa/oneshot_round_trip/oneshot_round_trip.sh	RSA one-shot sign+verify round trip script.
integration-tests/testfiles/rsa/oaep_encryption/oaep_encryption.sh	RSA OAEP encryption/decryption script.
integration-tests/testfiles/rsa/import_key/import_key_negative_invalid_path.sh	RSA import negative test for missing input key file.
integration-tests/testfiles/rsa/import_key/import_key.sh	RSA import test for masked key creation/loading.
integration-tests/testfiles/rsa/default_padding/round_trip.sh	RSA default-padding sign/verify round trip script.
integration-tests/testfiles/rsa/certificate/certificate.sh	RSA certificate generation script via provider key.
integration-tests/testfiles/env.sh	Shared environment setup for bash-based integration scripts.
integration-tests/testfiles/ec/verify/verify_negative_wrong_key.sh	EC wrong-key verification negative case.
integration-tests/testfiles/ec/verify/verify_negative_tampered_data.sh	EC tampered-data verification negative case.
integration-tests/testfiles/ec/verify/verify.sh	EC verify script under provider CLI tests.
integration-tests/testfiles/ec/verify/oneshot_verify.sh	EC one-shot verify (pkeyutl) script.
integration-tests/testfiles/ec/sign/sign.sh	EC sign script under provider CLI tests.
integration-tests/testfiles/ec/sign/oneshot_sign.sh	EC one-shot sign (pkeyutl) script.
integration-tests/testfiles/ec/round_trip/round_trip_import.sh	EC import + sign/verify round trip script.
integration-tests/testfiles/ec/round_trip/round_trip.sh	EC sign/verify round trip script.
integration-tests/testfiles/ec/import_key_sec1/import_key_sec1.sh	EC SEC1 import script.
integration-tests/testfiles/ec/import_key/import_key_negative_invalid_path.sh	EC import negative test for missing input key file.
integration-tests/testfiles/ec/import_key/import_key.sh	EC import test for masked key creation/loading.
integration-tests/testfiles/ec/hmac/hmac.sh	ECDH→HKDF-derived HMAC compute script.
integration-tests/testfiles/ec/hkdf_key_derivation/hmac_key_derivation.sh	HKDF derivation for HMAC key material script.
integration-tests/testfiles/ec/hkdf_key_derivation/hkdf_key_derivation.sh	HKDF derivation for AES key material script.
integration-tests/testfiles/ec/ecdh_key_exchange/ecdh_key_exchange.sh	ECDH derive-to-file script.
integration-tests/testfiles/ec/ecdh_hkdf_hmac_roundtrip/ecdh_hkdf_hmac_roundtrip.sh	ECDH→HKDF→HMAC round trip script.
integration-tests/testfiles/ec/create_key/create_key_negative.sh	EC create-key negative (invalid curve) script.
integration-tests/testfiles/ec/create_key/create_key.sh	EC create-key script with session/usage variations.
integration-tests/testfiles/ec/certificate/certificate.sh	EC certificate generation script via provider key.
integration-tests/testfiles/digest/digest.sh	Digest correctness script vs default provider.
integration-tests/src/lib.rs	Rust test runner invoking `lit` across script directories/variants.
integration-tests/Cargo.toml	Declares the `integration-tests` crate and dependencies.
integration-tests/.gitignore	Ignores integration test artifacts produced by scripts.
Cargo.toml	Adds `integration-tests` and `provider-tests` to the workspace.
.github/workflows/rust.yml	Adds a CI job to build OpenSSL/provider and run both integration suites.
.cargo/audit.toml	Ignores specific RustSec advisories for test-only transitive deps.

xtask/src/coverage.rs

plugins/ossl_prov/integration-tests/openssl-capi/build.rs

provider-tests/Cargo.toml

plugins/ossl_prov/integration-tests/openssl-capi/cpp/algo/rsa/enc_dec_tests.cpp

plugins/ossl_prov/integration-tests/openssl-capi/cpp/utils/keygen_helpers.hpp

plugins/ossl_prov/integration-tests/openssl-capi/cpp/algo/ec/keyexch_tests.cpp

Copilot

Pull request overview

Copilot reviewed 21 out of 59 changed files in this pull request and generated 3 comments.

plugins/ossl_prov/integration-tests/openssl-capi/cpp/algo/ec/keyexch_tests.cpp

plugins/ossl_prov/integration-tests/openssl-capi/Cargo.toml

plugins/ossl_prov/integration-tests/openssl-cli/src/openssl_cli_tests.rs

Copilot

Pull request overview

Copilot reviewed 21 out of 59 changed files in this pull request and generated 4 comments.

plugins/ossl_prov/integration-tests/openssl-capi/cpp/utils/keygen_helpers.hpp

plugins/ossl_prov/integration-tests/openssl-capi/cpp/algo/rsa/enc_dec_tests.cpp

plugins/ossl_prov/integration-tests/openssl-capi/cpp/capi_gtest_runner.rs

provider-integration-tests/openssl-capi/build.rs

Copilot

Pull request overview

Copilot reviewed 21 out of 59 changed files in this pull request and generated 2 comments.

plugins/ossl_prov/integration-tests/openssl-capi/cpp/utils/provider_ctx.hpp

plugins/ossl_prov/integration-tests/openssl-capi/cpp/capi_gtest_runner.rs

rajesh-gali · 2026-03-10T00:09:37Z

plugins/ossl_prov/integration-tests/openssl-capi/build.rs

I think we should move the tests to plugins/ossl_prov , as integration tests are specific to openssl provider

rajesh-gali · 2026-03-10T00:11:30Z

plugins/ossl_prov/integration-tests/openssl-capi/cpp/utils/keygen_helpers.hpp

Tests are covering only ECC and RSA, missing other supported cryptographic algos

rajesh-gali

please update readme with instructions to run the tests

rajesh-gali · 2026-03-10T21:41:50Z

.github/workflows/rust.yml

+
+    - name: Run C API integration tests
+      env:
+        OPENSSL_DIR: /opt/openssl-3.0.3


Openssl installation instructions in readme is different than ci.
Readme : OPENSSL_VERSION=3.0.16
Installation path is : OPENSSL_DIR=/opt/openssl-static

Yep, README is outdated. Using 3.0.3 for quite some time now.
I added the fix in the README in #243

Add a provider-tests crate that exercises the azihsm provider through the OpenSSL EVP API (not the CLI tool), enabling testing of session-based keys that cannot be tested via the command line. Tests added: - SmokeTest: provider loads and reports correct name - EC session key sign/verify round trip (P-256, P-384, P-521) - RSA session key sign/verify (PKCS#1 v1.5 and PSS padding) - RSA session key encrypt/decrypt (OAEP) - ECDH session key derivation (to buffer and to file) - Negative tests: cross-key failures, tampered data, mismatched curves Signed-off-by: Jens Topp <jens.topp@9elements.com>

Signed-off-by: Jens Topp <jens.topp@9elements.com>

Copilot AI review requested due to automatic review settings March 3, 2026 22:05

Copilot started reviewing on behalf of jenstopp March 3, 2026 22:06 View session

jenstopp marked this pull request as draft March 3, 2026 22:06

jenstopp linked an issue Mar 3, 2026 that may be closed by this pull request

OSSL test suite for testing with session keys #211

Open

Copilot AI reviewed Mar 3, 2026

View reviewed changes

mhatrevi added the ossl label Mar 4, 2026

jenstopp force-pushed the test/api-integration-test branch from c068c98 to a80f71d Compare March 7, 2026 09:24

Copilot AI review requested due to automatic review settings March 9, 2026 07:41

Copilot started reviewing on behalf of jenstopp March 9, 2026 07:41 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

plugins/ossl_prov/integration-tests/openssl-capi/cpp/algo/ec/keyexch_tests.cpp Show resolved Hide resolved

plugins/ossl_prov/integration-tests/openssl-capi/Cargo.toml Show resolved Hide resolved

plugins/ossl_prov/integration-tests/openssl-cli/src/openssl_cli_tests.rs Show resolved Hide resolved

Copilot AI review requested due to automatic review settings March 9, 2026 16:09

Copilot started reviewing on behalf of jenstopp March 9, 2026 16:10 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

jenstopp force-pushed the test/api-integration-test branch from a37f841 to 201b89b Compare March 9, 2026 16:20

Copilot AI review requested due to automatic review settings March 9, 2026 16:43

Copilot started reviewing on behalf of jenstopp March 9, 2026 16:43 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

plugins/ossl_prov/integration-tests/openssl-capi/cpp/utils/provider_ctx.hpp Show resolved Hide resolved

plugins/ossl_prov/integration-tests/openssl-capi/cpp/capi_gtest_runner.rs Show resolved Hide resolved

jenstopp marked this pull request as ready for review March 9, 2026 17:00

rajesh-gali reviewed Mar 10, 2026

View reviewed changes

rajesh-gali requested changes Mar 10, 2026

View reviewed changes

rajesh-gali reviewed Mar 10, 2026

View reviewed changes

jenstopp added 6 commits March 12, 2026 15:53

restructure tests

b17b93d

Signed-off-by: Jens Topp <jens.topp@9elements.com>

fix formatting

21fdb10

Signed-off-by: Jens Topp <jens.topp@9elements.com>

fix CI

7acf6f8

Signed-off-by: Jens Topp <jens.topp@9elements.com>

fix CI

ee0c928

Signed-off-by: Jens Topp <jens.topp@9elements.com>

copilot feedback

42be9c0

Signed-off-by: Jens Topp <jens.topp@9elements.com>

move integration tests to ./plugins/oss_prov

63efd74

Signed-off-by: Jens Topp <jens.topp@9elements.com>

jenstopp force-pushed the test/api-integration-test branch from 72458d6 to 63efd74 Compare March 12, 2026 15:30

Conversation

jenstopp commented Mar 3, 2026

Uh oh!

jenstopp commented Mar 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

rajesh-gali Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

rajesh-gali Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

rajesh-gali left a comment

Choose a reason for hiding this comment

Uh oh!

rajesh-gali Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jenstopp Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rajesh-gali Mar 10, 2026 •

edited

Loading