Update GitHub Actions workflows for stateful signatures

[SWilson4]

Integrate stateful signatures into our CI workflows.

I took the approach of simply switching on LMS and XMSS for all of our GitHub Actions builds that support all algorithms and adding an additional run in select places to test the configuration in which keygen and sign are disabled.

It looks like the logic around enabling / disabling keygen/sign needs to be tweaked in the XMSS KAT testing function.

We still need to test these on MacOS, which will require updating CircleCI, but I thought it best to put this draft up here as is for now to unblock anyone who wants to work on the test failures.

• Does this PR change the input/output behaviour of a cryptographic algorithm (i.e., does it change known answer test values)? (If so, a version bump will be required from x.y.z to x.(y+1).0.)
• Does this PR change the list of algorithms available -- either adding, removing, or renaming? Does this PR otherwise change an API? (If so, PRs in fully supported downstream projects dependent on these, i.e., oqs-provider and OQS-OpenSSH will also need to be ready for review and merge by the time this is merged.)

[SWilson4]

@baentsch @dstebila For your consideration: at a glance it looks to me like a lot of our CircleCI runs (most of the Linux and MacOS configs) could be ported over to GitHub Actions, and we might get M1 Mac testing "for free" in the process. Is there a reason to prefer keeping them on CircleCI? Since we have to revise the workflows anyway to enable stateful sigs, this seems like an opportunity to kill two birds with one stone: move as many as possible to GH and enable stateful sigs en route.

[baentsch]

Thanks! LGTM. What about adding one test config with only LMS, one only XMSS, one both disabled, too? I'd not suggest adding this to the matrix but maybe just to our primary build platform, a linux under x64 to catch "interdependency" errors in that alg category?

[baentsch]

Is there a reason to prefer keeping them on CircleCI?

Not really: I have a long-running goal of moving off CCI but there's (been?) a catch.

[ducnguyen-sb]

Hi @SWilson4 , I can help fix the XMSS errors. I've been away for a while, can you let me know what is the changes that lead to XMSS kat errors?

[SWilson4]

Hi @SWilson4 , I can help fix the XMSS errors. I've been away for a while, can you let me know what is the changes that lead to XMSS kat errors?

It looks to me like it's just a matter of the remaining / total signatures not printing correctly when keygen / sign are disabled:

liboqs/tests/kat_sig_stfl.c

Line 327 in 0a44a25

fprintf(fh, "remain = %llu\n", sigs_remain - 1);

[ducnguyen-sb]

Thanks @SWilson4 , I will handle it from here. Can I make a commit to this PR? (I assume yes, just ask to be sure)

[baentsch]

Can I make a commit to this PR? (I assume yes, just ask to be sure)

That would be great -- Goal would be to "turn CI green": Thanks in advance!

[SWilson4]

Thanks @SWilson4 , I will handle it from here. Can I make a commit to this PR? (I assume yes, just ask to be sure)

Yes please!

[dstebila]

@baentsch @dstebila For your consideration: at a glance it looks to me like a lot of our CircleCI runs (most of the Linux and MacOS configs) could be ported over to GitHub Actions, and we might get M1 Mac testing "for free" in the process. Is there a reason to prefer keeping them on CircleCI? Since we have to revise the workflows anyway to enable stateful sigs, this seems like an opportunity to kill two birds with one stone: move as many as possible to GH and enable stateful sigs en route.

Go for it! No reason to stick with CircleCI if we can get what we need from GitHub Actions.

[ducnguyen-sb]

All checks have passed. Please review this PR. @SWilson4 @baentsch

[baentsch]

This activates XMSS/LMS by default for android builds. Sensible for CI, not so for "unsuspecting" users of the script: Suggest to add at least an output warning message that this is an dangerous and not-recommended setting.

[SWilson4]

Good catch. I've reworked the script so that XMSS/LMS are disabled by default.

[baentsch]

Thanks for adding tests also with algs=ON and keygen/sig=ON|OFF! Apart from one nit LGTM.