feat(xtest): Enables pqc test suite in ci

.github/workflows/xtest.yml

@@ -568,7 +568,7 @@ jobs:
       - name: Run all standard xtests
         if: ${{ env.FOCUS_SDK == 'all' }}
         run: |-
-          uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v test_tdfs.py test_policytypes.py
+          uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v test_tdfs.py test_policytypes.py test_pqc.py
         working-directory: otdftests/xtest
         env:
           PLATFORM_DIR: "../../${{ steps.run-platform.outputs.platform-working-dir }}"
@@ -578,7 +578,7 @@ jobs:
       - name: Run xtests focusing on a specific SDK
         if: ${{ env.FOCUS_SDK != 'all' }}
         run: |-
-          uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v --focus "$FOCUS_SDK" test_tdfs.py test_policytypes.py
+          uv run pytest -n auto --dist loadscope --html=test-results/sdk-${FOCUS_SDK}-${PLATFORM_TAG}.html --self-contained-html --sdks-encrypt "${ENCRYPT_SDK}" -ra -v --focus "$FOCUS_SDK" test_tdfs.py test_policytypes.py test_pqc.py
         working-directory: otdftests/xtest
         env:
           PLATFORM_DIR: "../../${{ steps.run-platform.outputs.platform-working-dir }}"

xtest/fixtures/keys.py

@@ -18,7 +18,7 @@
 
 import abac
 import tdfs
-from otdfctl import OpentdfCommandLineTool
+from otdfctl import InvalidAlgorithm, OpentdfCommandLineTool
 
 
 @pytest.fixture(scope="session")
@@ -53,14 +53,19 @@ def _get_or_create_key(
     existing_keys = otdfctl.kas_registry_keys_list(kas_entry)
     key = next((k for k in existing_keys if k.key.key_id == key_id), None)
     if key is None:
-        key = otdfctl.kas_registry_create_key(
-            kas_entry,
-            key_id=key_id,
-            mode="local",
-            algorithm=algorithm,
-            wrapping_key=root_key,
-            wrapping_key_id="root",
-        )
+        try:
+            key = otdfctl.kas_registry_create_key(
+                kas_entry,
+                key_id=key_id,
+                mode="local",
+                algorithm=algorithm,
+                wrapping_key=root_key,
+                wrapping_key_id="root",
+            )
+        except InvalidAlgorithm:
+            if required_features:
+                pytest.skip(f"Algorithm {algorithm} not supported by platform")
+            raise
     return key
 
 

xtest/otdfctl.py

@@ -40,6 +40,12 @@
 logger = logging.getLogger("xtest")
 
 
+class InvalidAlgorithm(Exception):
+    """Raised when a key algorithm is not supported by the platform."""
+
+    pass
+
+
 class OpentdfCommandLineTool:
     # Flag to indicate we are using an older version of policy subject-mappings create that uses the `action-standard` flag
     # instead of just `action`
@@ -306,6 +312,10 @@ def kas_registry_create_key(
         # Handle race condition: if key already exists, return the existing one
         if process.returncode != 0:
             err_str = (err.decode() if err else "") + (out.decode() if out else "")
+            if "Invalid key parameters: invalid algorithm" in err_str:
+                raise InvalidAlgorithm(
+                    f"Algorithm not supported by platform: {err_str}"
+                )
             if "already_exists" in err_str or "unique field violation" in err_str:
                 logger.info(
                     f"Key {key_id} already exists on {kas_id} (race condition), returning existing key"

xtest/test_tdfs.py

@@ -944,7 +944,7 @@ def test_tdf_with_malicious_kao(
         assert False, "decrypt succeeded unexpectedly"
     except subprocess.CalledProcessError as exc:
         assert re.search(
-            b"allowlist|not allowed|disallowed KASes",
+            b"allowlist|not allowed|disallowed KASes|AggregateError",
             exc.output,
             re.IGNORECASE | re.MULTILINE,
         ), f"Unexpected error output: [{exc.output}]"