Repository navigation

fix(kerberos): handle KDC_ERR_ETYPE_NOSUPP as KDC_ERR_PREAUTH_REQUIRED for smart card AS exchange #2092

Workflow file for this run

	name: CI

	on:
	push:
	branches:
	- master
	pull_request:
	types: [ opened, synchronize, reopened ]
	workflow_dispatch:

	jobs:
	formatting:
	name: Check formatting
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v6

	- name: Check formatting
	shell: pwsh
	run: \|
	Write-Host "Check formatting"
	cargo fmt --all -- --check
	if ($LastExitCode -eq 1) {
	throw "Bad formatting, please run 'cargo +stable fmt --all'"
	}

	lints:
	name: Lints [${{ matrix.os }}]
	runs-on: ${{ matrix.runner }}
	needs: formatting
	strategy:
	fail-fast: true
	matrix:
	os: [ win, osx, linux ]
	include:
	- os: win
	runner: windows-2022
	additional-args: --features tsssp
	- os: osx
	runner: macos-14
	- os: linux
	runner: ubuntu-latest

	steps:
	- uses: actions/checkout@v6

	# Compiling the ffi module is enough to lint the whole sspi workspace
	- name: Check clippy
	env:
	AWS_LC_SYS_NO_ASM: true
	run: cargo clippy --manifest-path ffi/Cargo.toml ${{ matrix.additional-args }} -- -D warnings -D clippy::print_stdout

	tests:
	name: Tests [${{ matrix.os }}] [${{ matrix.crate-name }}]
	runs-on: ${{ matrix.runner }}
	needs: formatting
	env:
	SSPI_RS_IS_RUNNING_TESTS: true
	strategy:
	fail-fast: true
	matrix:
	os: [ win, osx, linux ]
	manifest:
	- Cargo.toml
	- ffi/Cargo.toml
	- crates/dpapi/Cargo.toml
	- crates/winscard/Cargo.toml
	- crates/dpapi-pdu/Cargo.toml
	- crates/ffi-types/Cargo.toml
	- crates/dpapi-core/Cargo.toml
	- crates/dpapi-transport/Cargo.toml
	- crates/dpapi-native-transport/Cargo.toml

	include:
	# Map runner per OS
	- os: win
	runner: windows-2022
	- os: osx
	runner: macos-14
	- os: linux
	runner: ubuntu-latest

	# Map crate name per manifest
	- manifest: Cargo.toml
	crate-name: sspi
	- manifest: ffi/Cargo.toml
	crate-name: sspi-ffi
	- manifest: crates/dpapi/Cargo.toml
	crate-name: dpapi
	- manifest: crates/winscard/Cargo.toml
	crate-name: winscard
	- manifest: crates/dpapi-pdu/Cargo.toml
	crate-name: dpapi-pdu
	- manifest: crates/ffi-types/Cargo.toml
	crate-name: ffi-types
	- manifest: crates/dpapi-core/Cargo.toml
	crate-name: dpapi-core
	- manifest: crates/dpapi-transport/Cargo.toml
	crate-name: dpapi-transport
	- manifest: crates/dpapi-native-transport/Cargo.toml
	crate-name: dpapi-native-transport

	# Per-OS feature overrides for specific manifests.
	# `__test-data` enables the `tests/sspi/client_server` suite (gated on
	# `all(network_client, __test-data)`), which otherwise never runs in CI.
	- os: win
	manifest: Cargo.toml
	additional-args: --features network_client,dns_resolver,scard,tsssp,__test-data
	- os: osx
	manifest: Cargo.toml
	additional-args: --features network_client,scard,__test-data
	- os: linux
	manifest: Cargo.toml
	additional-args: --features network_client,dns_resolver,scard,__test-data

	- os: win
	manifest: ffi/Cargo.toml
	additional-args: --features tsssp

	- os: win
	manifest: crates/dpapi/Cargo.toml
	additional-args: --features tsssp

	steps:
	- uses: actions/checkout@v6

	- name: Test
	env:
	AWS_LC_SYS_NO_ASM: true
	run: cargo test --manifest-path ${{ matrix.manifest }} ${{ matrix.additional-args }}

	miri:
	name: Miri FFI tests
	runs-on: ubuntu-latest
	needs: formatting
	env:
	SSPI_RS_IS_RUNNING_TESTS: true

	steps:
	- uses: actions/checkout@v6

	# NOTE: Pinned to a specific nightly version for reproducibility.
	# Update this manually on a regular basis.
	- name: Install nightly toolchain and Miri
	run: \|
	rustup toolchain install nightly-2026-02-11 --component miri
	rustup override set nightly-2026-02-11

	- name: Test
	run: cargo miri test --manifest-path ffi/Cargo.toml --no-default-features --features ring

	wasm:
	name: WASM target
	runs-on: ubuntu-latest
	needs: formatting

	steps:
	- uses: actions/checkout@v6

	- name: Prepare runner
	run: sudo apt-get install wabt

	- name: Check
	shell: pwsh
	run: ./tools/wasm-testcompile/check.ps1

	build-native:
	name: Build native
	needs: formatting
	uses: ./.github/workflows/build-native.yml

	pack-musl:
	name: Pack musl libraries
	runs-on: ubuntu-latest
	needs: build-native

	steps:
	- uses: actions/checkout@v6

	- uses: actions/setup-dotnet@v5
	with:
	dotnet-version: 10.0.x

	- name: Download glibc x64 library
	uses: actions/download-artifact@v8
	with:
	name: sspi-linux-x64-release
	path: dependencies/runtimes/linux-x64

	- name: Download glibc arm64 library
	uses: actions/download-artifact@v8
	with:
	name: sspi-linux-arm64-release
	path: dependencies/runtimes/linux-arm64

	- name: Download musl x64 library
	uses: actions/download-artifact@v8
	with:
	name: sspi-linux-musl-x64-release
	path: dependencies/runtimes/linux-musl-x64

	- name: Download musl arm64 library
	uses: actions/download-artifact@v8
	with:
	name: sspi-linux-musl-arm64-release
	path: dependencies/runtimes/linux-musl-arm64

	- name: Build and check NuGet package
	shell: pwsh
	run: \|
	dotnet build ffi/dotnet/Devolutions.Sspi/Devolutions.Sspi.csproj -c Release -o package
	if ($LASTEXITCODE -ne 0) { throw "NuGet build failed" }

	Add-Type -AssemblyName System.IO.Compression
	$Packages = @(Get-ChildItem package -Filter 'Devolutions.Sspi.*.nupkg')
	if ($Packages.Count -ne 1) { throw "Expected one NuGet package, found $($Packages.Count)" }

	$Archive = [System.IO.Compression.ZipFile]::OpenRead($Packages[0].FullName)
	try {
	$Paths = @($Archive.Entries \| ForEach-Object FullName)
	foreach ($Rid in @('linux-x64', 'linux-arm64', 'linux-musl-x64', 'linux-musl-arm64')) {
	$NativePath = "runtimes/$Rid/native/libDevolutionsSspi.so"
	if ($Paths -notcontains $NativePath) { throw "Missing $NativePath in NuGet package" }
	}
	} finally {
	$Archive.Dispose()
	}

	- uses: actions/upload-artifact@v7
	with:
	name: sspi-musl-nupkg
	path: package/*.nupkg
	if-no-files-found: error

	test-musl-package:
	name: Test NuGet on Alpine [${{ matrix.arch }}]
	runs-on: ${{ matrix.runner }}
	needs: pack-musl
	strategy:
	fail-fast: false
	matrix:
	include:
	- arch: x64
	runner: ubuntu-24.04
	- arch: arm64
	runner: ubuntu-24.04-arm

	steps:
	- uses: actions/download-artifact@v8
	with:
	name: sspi-musl-nupkg
	path: package

	- name: Restore, publish and load the native library on Alpine
	env:
	RID: linux-musl-${{ matrix.arch }}
	run: \|
	docker run --rm -v "$PWD:/workspace:ro" -w /tmp -e RID \
	mcr.microsoft.com/dotnet/sdk:10.0-alpine sh -euc '
	dotnet new console --framework net10.0 --no-restore -o smoke
	dotnet add smoke package Devolutions.Sspi --source /workspace/package
	printf "%s\n" \
	"using Devolutions.Sspi;" \
	"unsafe" \
	"{" \
	" var table = Sspi.InitSecurityInterfaceW();" \
	" if (table == null \|\| table->dwVersion > 1000)" \
	" throw new Exception(\"Invalid SSPI table\");" \
	"}" > smoke/Program.cs
	dotnet publish smoke -r "$RID" --self-contained false -p:AllowUnsafeBlocks=true -o published
	test -f published/libDevolutionsSspi.so
	dotnet published/smoke.dll
	'

	success:
	name: Success
	runs-on: ubuntu-latest
	if: ${{ always() }}
	needs:
	- formatting
	- lints
	- tests
	- miri
	- wasm
	- build-native
	- pack-musl
	- test-musl-package

	steps:
	- name: CI succeeded
	id: succeeded
	if: ${{ !contains(needs.*.result, 'failure') }}
	run: exit 0

	- name: CI failed
	if: ${{ steps.succeeded.outcome == 'skipped' }}
	run: exit 1

Navigation Menu

Repository navigation

fix(kerberos): handle KDC_ERR_ETYPE_NOSUPP as KDC_ERR_PREAUTH_REQUIRED for smart card AS exchange #2092

Workflow file

fix(kerberos): handle KDC_ERR_ETYPE_NOSUPP as KDC_ERR_PREAUTH_REQUIRED for smart card AS exchange #2092

Uh oh!

Workflow file for this run