diff --git a/.github/workflows/xtest.yml b/.github/workflows/xtest.yml index c008e15cd..14c15019b 100644 --- a/.github/workflows/xtest.yml +++ b/.github/workflows/xtest.yml @@ -568,7 +568,7 @@ jobs: - name: Run all standard xtests if: ${{ env.FOCUS_SDK == 'all' }} run: |- - uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v test_tdfs.py test_policytypes.py + uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v test_tdfs.py test_policytypes.py test_pqc.py working-directory: otdftests/xtest env: PLATFORM_DIR: "../../${{ steps.run-platform.outputs.platform-working-dir }}" @@ -578,7 +578,7 @@ jobs: - name: Run xtests focusing on a specific SDK if: ${{ env.FOCUS_SDK != 'all' }} run: |- - uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v --focus "$FOCUS_SDK" test_tdfs.py test_policytypes.py + uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v --focus "$FOCUS_SDK" test_tdfs.py test_policytypes.py test_pqc.py working-directory: otdftests/xtest env: PLATFORM_DIR: "../../${{ steps.run-platform.outputs.platform-working-dir }}" diff --git a/xtest/fixtures/keys.py b/xtest/fixtures/keys.py index a07518895..a02d43c3e 100644 --- a/xtest/fixtures/keys.py +++ b/xtest/fixtures/keys.py @@ -18,7 +18,7 @@ import abac import tdfs -from otdfctl import OpentdfCommandLineTool +from otdfctl import InvalidAlgorithm, OpentdfCommandLineTool @pytest.fixture(scope="session") @@ -53,14 +53,19 @@ def _get_or_create_key( existing_keys = otdfctl.kas_registry_keys_list(kas_entry) key = next((k for k in existing_keys if k.key.key_id == key_id), None) if key is None: - key = otdfctl.kas_registry_create_key( - kas_entry, - key_id=key_id, - mode="local", - algorithm=algorithm, - wrapping_key=root_key, - wrapping_key_id="root", - ) + try: + key = otdfctl.kas_registry_create_key( + kas_entry, + key_id=key_id, + mode="local", + algorithm=algorithm, + wrapping_key=root_key, + wrapping_key_id="root", + ) + except InvalidAlgorithm: + if required_features: + pytest.skip(f"Algorithm {algorithm} not supported by platform") + raise return key diff --git a/xtest/otdfctl.py b/xtest/otdfctl.py index 74318f19e..b937aa58c 100644 --- a/xtest/otdfctl.py +++ b/xtest/otdfctl.py @@ -40,6 +40,12 @@ logger = logging.getLogger("xtest") +class InvalidAlgorithm(Exception): + """Raised when a key algorithm is not supported by the platform.""" + + pass + + class OpentdfCommandLineTool: # Flag to indicate we are using an older version of policy subject-mappings create that uses the `action-standard` flag # instead of just `action` @@ -306,6 +312,10 @@ def kas_registry_create_key( # Handle race condition: if key already exists, return the existing one if process.returncode != 0: err_str = (err.decode() if err else "") + (out.decode() if out else "") + if "Invalid key parameters: invalid algorithm" in err_str: + raise InvalidAlgorithm( + f"Algorithm not supported by platform: {err_str}" + ) if "already_exists" in err_str or "unique field violation" in err_str: logger.info( f"Key {key_id} already exists on {kas_id} (race condition), returning existing key" diff --git a/xtest/test_tdfs.py b/xtest/test_tdfs.py index d20c18a8b..bfa896f1f 100644 --- a/xtest/test_tdfs.py +++ b/xtest/test_tdfs.py @@ -944,7 +944,7 @@ def test_tdf_with_malicious_kao( assert False, "decrypt succeeded unexpectedly" except subprocess.CalledProcessError as exc: assert re.search( - b"allowlist|not allowed|disallowed KASes", + b"allowlist|not allowed|disallowed KASes|AggregateError", exc.output, re.IGNORECASE | re.MULTILINE, ), f"Unexpected error output: [{exc.output}]"