Add official wolfTPM Rust wrapper crate

.github/workflows/rust-test.yml

@@ -0,0 +1,140 @@
+name: WolfTPM Rust Wrapper Tests
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '**' ]
+    types: [opened, synchronize, reopened, ready_for_review]
+  repository_dispatch:
+    types: [nightly-trigger]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Resolve the latest wolfSSL -stable tag so we also test the shipped release.
+  discover:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+    uses: ./.github/workflows/_resolve-wolfssl.yml
+
+  rust:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+    needs: discover
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: master
+            wolfssl_ref: master
+          - name: latest-stable
+            wolfssl_ref: ${{ needs.discover.outputs.latest_stable }}
+    steps:
+      - name: Checkout wolfTPM
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Build + install wolfSSL with the crypto-callback support the wrapper
+      # (and the TPM-backed TLS bridge) needs; installs to /usr/local so
+      # pkg-config finds it for both wolfTPM configure and the Rust build.rs.
+      - name: Setup wolfSSL
+        uses: ./.github/actions/setup-wolfssl
+        with:
+          ref: ${{ matrix.wolfssl_ref || 'master' }}
+          # fwTPM RSA object creation needs WOLFSSL_KEY_GEN and the raw-RSA
+          # padding path, or TPM2_Create returns TPM_RC_COMMAND_CODE for RSA
+          # keys (see src/fwtpm/README.md).
+          configure-flags: --enable-wolftpm --enable-pkcallbacks --enable-keygen
+          cflags: -DWC_RSA_NO_PADDING
+
+      # Use the runner's preinstalled rustup rather than a mutable third-party
+      # action, so no external action code runs with the job token.
+      - name: Install Rust
+        run: |
+          rustup toolchain install stable --profile minimal --component clippy --component rustfmt
+          rustup default stable
+
+      - name: Generate TPM port
+        run: |
+          MATRIX_HASH=$(echo -n "rust-${{ matrix.name }}" | cksum | cut -d' ' -f1)
+          TPM_PORT=$((40000 + (MATRIX_HASH % 1000) * 2))
+          echo "TPM_PORT=$TPM_PORT" >> $GITHUB_ENV
+          echo "TPM2_SWTPM_PORT=$TPM_PORT" >> $GITHUB_ENV
+          echo "TPM2_SWTPM_HOST=localhost" >> $GITHUB_ENV
+
+      # Build wolfTPM with our in-tree firmware TPM (fwtpm_server) as the
+      # software TPM the Rust tests run against — no external simulator.
+      - name: Build wolfTPM (swtpm + fwtpm)
+        run: |
+          ./autogen.sh
+          ./configure --enable-swtpm --enable-fwtpm --with-swtpm-port=$TPM_PORT
+          make -j"$(nproc)"
+
+      - name: Start fwTPM server
+        run: |
+          ./src/fwtpm/fwtpm_server --clear --port "$TPM_PORT" \
+            --platform-port "$((TPM_PORT + 1))" &
+          sleep 1
+
+      - name: Build Rust wrapper
+        working-directory: ./wrapper/rust/wolftpm
+        run: cargo build --all-targets --features swtpm-tests
+
+      # Style gates are advisory on the first runs (annotate, don't fail the
+      # pipeline); flip continue-on-error off once a `cargo fmt` pass is landed.
+      - name: Clippy
+        working-directory: ./wrapper/rust/wolftpm
+        continue-on-error: true
+        run: cargo clippy --all-targets --features swtpm-tests -- -D warnings
+
+      - name: Rustfmt check
+        working-directory: ./wrapper/rust/wolftpm
+        continue-on-error: true
+        run: cargo fmt --check
+
+      - name: Test against fwTPM
+        working-directory: ./wrapper/rust/wolftpm
+        run: cargo test --features swtpm-tests -- --test-threads=1
+
+      - name: Docs
+        working-directory: ./wrapper/rust/wolftpm
+        run: cargo doc --no-deps
+
+  # Compile-only against the Linux kernel-device transport, so the non-swtpm
+  # cfg paths and the callback-free open() build are exercised too.
+  rust-devtpm-compile:
+    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout wolfTPM
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Setup wolfSSL
+        uses: ./.github/actions/setup-wolfssl
+        with:
+          ref: master
+          configure-flags: --enable-wolftpm --enable-pkcallbacks
+      - name: Install Rust
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+      - name: Build wolfTPM (devtpm)
+        run: |
+          ./autogen.sh
+          ./configure --enable-devtpm
+          make -j"$(nproc)"
+      - name: Compile Rust wrapper (no swtpm)
+        working-directory: ./wrapper/rust/wolftpm
+        run: cargo build --all-targets
+
+      - name: Upload failure logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: wolftpm-rust-devtpm-logs
+          path: |
+            wrapper/rust/wolftpm/target/debug/build/*/output
+          retention-days: 5

wrapper/include.am

@@ -2,6 +2,7 @@
 # All paths should be given relative to the root
 
 include wrapper/CSharp/include.am
+include wrapper/rust/include.am
 
 wrapperdir = $(docdir)/wrapper
 dist_wrapper_DATA= wrapper/wolfTPM-csharp.sln

wrapper/rust/README.md

@@ -0,0 +1,17 @@
+# wolfTPM Rust wrapper
+
+Official Rust bindings for wolfTPM. The crate lives in [`wolftpm/`](wolftpm/);
+see its [README](wolftpm/README.md) for the full API, build, and test details.
+
+```sh
+# 1. build the C library first (with a software TPM for testing)
+cd ../..                       # wolfTPM repo root
+./autogen.sh && ./configure --enable-swtpm --enable-fwtpm && make
+
+# 2. build the Rust crate against it
+cd wrapper/rust/wolftpm
+cargo build
+
+# 3. test (needs a running software TPM on localhost:2321)
+cargo test --features swtpm-tests -- --test-threads=1
+```

wrapper/rust/include.am

@@ -0,0 +1,48 @@
+# vim:ft=automake
+# included from wrapper/include.am
+# All paths should be given relative to the root
+
+EXTRA_DIST += wrapper/rust/README.md
+EXTRA_DIST += wrapper/rust/wolftpm/Cargo.toml
+EXTRA_DIST += wrapper/rust/wolftpm/README.md
+EXTRA_DIST += wrapper/rust/wolftpm/build.rs
+EXTRA_DIST += wrapper/rust/wolftpm/headers.h
+EXTRA_DIST += wrapper/rust/wolftpm/src/lib.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/sys.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/device.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/key.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/sign.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/seal.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/nv.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/pcr.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/certify.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/rsa.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/persist.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/hmac.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/session.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/caps.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/symmetric.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/ecdh.rs
+EXTRA_DIST += wrapper/rust/wolftpm/src/credential.rs
+EXTRA_DIST += wrapper/rust/wolftpm/examples/create_primary.rs
+EXTRA_DIST += wrapper/rust/wolftpm/examples/full_flow.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/smoke.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/common/mod.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/keys.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/sign.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/seal.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/nv.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/pcr.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/certify.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/ek.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/persist.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/rsa.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/hmac.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/seal_pcr.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/session.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/caps.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/quote.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/credential.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/ecdh.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/symmetric.rs
+EXTRA_DIST += wrapper/rust/wolftpm/tests/import.rs

wrapper/rust/wolftpm/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "wolftpm"
+version = "0.4.0"
+edition = "2021"
+description = "Rust wrapper for the wolfTPM TPM 2.0 library"
+license = "GPL-3.0-or-later"
+repository = "https://github.com/wolfSSL/wolfTPM"
+documentation = "https://github.com/wolfSSL/wolfTPM/tree/master/wrapper/rust"
+keywords = ["wolftpm", "tpm", "tpm2", "security", "api-bindings"]
+categories = ["cryptography", "hardware-support", "api-bindings"]
+readme = "README.md"
+
+[features]
+default = []
+# Gate the socket integration tests that need a running swtpm/fwtpm server.
+swtpm-tests = []
+
+[build-dependencies]
+bindgen = "0.72"
+regex = "1.5"