nginx PQC CI: skip pre-PQC-floor wolfSSL stable (master-only until v5.9.2); fix wget TLS by setting LD_LIBRARY_PATH after nginx download

Author: aidangarske

.github/nginx/Dockerfile

@@ -39,9 +39,11 @@ RUN OPENSSL_TAG=${OPENSSL_REF} WOLFSSL_TAG=${WOLFSSL_REF} \
 
 ENV WOLFPROV_ROOT=/opt/wolfProvider
 ENV O=/opt/wolfProvider/openssl-install
-ENV LD_LIBRARY_PATH=/opt/wolfProvider/wolfprov-install/lib:/opt/wolfProvider/wolfssl-install/lib:/opt/wolfProvider/openssl-install/lib:/opt/wolfProvider/openssl-install/lib64
 
-# Build nginx against the wolfProvider-backed OpenSSL.
+# Build nginx against the wolfProvider-backed OpenSSL. The download and build
+# run BEFORE LD_LIBRARY_PATH points at the wolfProvider OpenSSL: otherwise
+# wget's own HTTPS to nginx.org would route through wolfProvider and fail
+# certificate verification. nginx finds the libs at runtime via -rpath.
 WORKDIR /opt/wolfProvider
 RUN wget -q "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" \
     && tar -zxf "nginx-${NGINX_VERSION}.tar.gz" && rm "nginx-${NGINX_VERSION}.tar.gz"
@@ -51,6 +53,10 @@ RUN ./configure --prefix=/opt/nginx --with-http_ssl_module \
         --with-ld-opt="-L${O}/lib -L${O}/lib64 -Wl,-rpath,${O}/lib -Wl,-rpath,${O}/lib64 -Wl,-rpath,/opt/wolfProvider/wolfprov-install/lib -Wl,-rpath,/opt/wolfProvider/wolfssl-install/lib" \
     && make -j"$(nproc)" && make install
 
+# From here on the wolfProvider-backed OpenSSL is the default for cert
+# generation and the runtime server.
+ENV LD_LIBRARY_PATH=/opt/wolfProvider/wolfprov-install/lib:/opt/wolfProvider/wolfssl-install/lib:/opt/wolfProvider/openssl-install/lib:/opt/wolfProvider/openssl-install/lib64
+
 # Generate the ML-DSA CA + server certificate through wolfProvider (the oqs-demos
 # SIG_ALG=mldsa65 arrangement) and lay down the PQC nginx config + test page.
 WORKDIR /opt/nginx

.github/workflows/nginx-pqc.yml

@@ -55,20 +55,37 @@ jobs:
           echo "Latest stable wolfSSL: $LATEST"
           echo "Latest OpenSSL: $OSSL"
           echo "openssl-tag=$OSSL" >> "$GITHUB_OUTPUT"
-          # Only PQC-eligible wolfSSL: the latest -stable (>= v5.9.2-stable) and
-          # master, each in normal and force-fail anti-test mode. The matrix
-          # owns the force-fail axis; the test step hands its raw result to
-          # check-workflow-result.sh which inverts the expectation.
-          MATRIX=$(jq -nc --arg latest "$LATEST" '{
-            include: [
-              {"name":("latest stable (" + $latest + ")"),
-               "wolfssl-ref":$latest,"force_fail":""},
-              {"name":("latest stable (" + $latest + ") [force-fail]"),
-               "wolfssl-ref":$latest,"force_fail":"WOLFPROV_FORCE_FAIL=1"},
-              {"name":"master","wolfssl-ref":"master","force_fail":""},
-              {"name":"master [force-fail]",
-               "wolfssl-ref":"master","force_fail":"WOLFPROV_FORCE_FAIL=1"}
-            ]
+          # PQC needs the wc_MlDsaKey_* seed/message API that lands after
+          # v5.9.1-stable, so the floor is v5.9.2-stable. master is always
+          # eligible; the latest -stable row is only added once it is past the
+          # floor (i.e. v5.9.2-stable+ is released). Until then only master
+          # runs -- a pre-floor -stable would just fail the --enable-pqc gate.
+          PQC_FLOOR="v5.9.1-stable"
+          if [ "$(printf '%s\n%s\n' "$PQC_FLOOR" "$LATEST" \
+                  | sort -V | tail -n1)" != "$PQC_FLOOR" ]; then
+            LATEST_PQC_ELIGIBLE=true
+          else
+            LATEST_PQC_ELIGIBLE=false
+          fi
+          echo "latest-stable PQC eligible: $LATEST_PQC_ELIGIBLE"
+          # Each eligible wolfSSL ref runs in normal and force-fail anti-test
+          # mode. The matrix owns the force-fail axis; the test step hands its
+          # raw result to check-workflow-result.sh which inverts the
+          # expectation.
+          MATRIX=$(jq -nc --arg latest "$LATEST" \
+              --argjson latest_pqc "$LATEST_PQC_ELIGIBLE" '{
+            include: (
+              [ {"name":"master","wolfssl-ref":"master","force_fail":""},
+                {"name":"master [force-fail]","wolfssl-ref":"master",
+                 "force_fail":"WOLFPROV_FORCE_FAIL=1"} ]
+              + (if $latest_pqc then
+                  [ {"name":("latest stable (" + $latest + ")"),
+                     "wolfssl-ref":$latest,"force_fail":""},
+                    {"name":("latest stable (" + $latest + ") [force-fail]"),
+                     "wolfssl-ref":$latest,
+                     "force_fail":"WOLFPROV_FORCE_FAIL=1"} ]
+                 else [] end)
+            )
           }')
           echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"