Moves OpenSK to Wasefire

.cargo/config.toml

@@ -0,0 +1,2 @@
+[unstable]
+panic-immediate-abort = true

.github/workflows/cargo_audit.yml

@@ -6,14 +6,19 @@ on:
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: github.repository == 'google/OpenSK'
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: "true"
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
       - name: Set up OpenSK
         run: ./setup.sh
       - uses: actions-rs/audit-check@v1

.github/workflows/cargo_bloat.yml

@@ -1,14 +1,19 @@
 name: Binary size report
-on: pull_request
+on: workflow_dispatch  # Not working at the moment, disabled
 
 jobs:
   cargo_bloat:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       # Setup
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
       - uses: actions-rs/cargo@v1
         with:
           command: install
@@ -21,7 +26,7 @@ jobs:
       - name: Set up OpenSK
         run: ./setup.sh
       - name: Run bloat on the PR
-        run: RUSTFLAGS="-C link-arg=-icf=all -C force-frame-pointers=no -C link-arg=-Tnrf52840_layout.ld" cargo bloat --release --target=thumbv7em-none-eabi --features=config_command,with_ctap1 --crates >> .github/workflows/bloat_output_new.txt
+        run: RUSTFLAGS="-C link-arg=-icf=all -C force-frame-pointers=no" cargo bloat --release --target=thumbv7em-none-eabi --features=config-command,ctap1 --crates >> .github/workflows/bloat_output_new.txt
 
       # Second run: PR
       - uses: actions/checkout@v4
@@ -34,7 +39,7 @@ jobs:
         run: ./setup.sh
       - name: Run bloat on base
         working-directory: ./OpenSK_base
-        run: RUSTFLAGS="-C link-arg=-icf=all -C force-frame-pointers=no -C link-arg=-Tnrf52840_layout.ld" cargo bloat --release --target=thumbv7em-none-eabi --features=config_command,with_ctap1 --crates >> "$GITHUB_WORKSPACE/.github/workflows/bloat_output_old.txt"
+        run: RUSTFLAGS="-C link-arg=-icf=all -C force-frame-pointers=no" cargo bloat --release --target=thumbv7em-none-eabi --features=config-command,ctap1 --crates >> "$GITHUB_WORKSPACE/.github/workflows/bloat_output_old.txt"
 
       - name: Run output formatter to echo workflow command
         run: ./.github/workflows/bloat_formatter.sh bloat_output_new.txt bloat_output_old.txt bloat_comment.md

.github/workflows/ci.yml

@@ -16,16 +16,16 @@ concurrency:
 
 jobs:
   runtests:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
       - run: ./setup.sh
       - run: ./run_desktop_tests.sh

.github/workflows/cifuzz.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Build Fuzzers
       id: build

.github/workflows/coveralls.yml

@@ -11,16 +11,19 @@ jobs:
   coveralls:
     name: OpenSK code coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: "true"
-      - name: Install Rust toolchain
-        run: rustup show
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
       - name: Set up OpenSK
         run: ./setup.sh
       - name: Install llvm tools

.github/workflows/mdlint.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   mdlint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: markdownlint-cli

.gitignore

@@ -1,15 +1,6 @@
+__pycache__
 target/
 /build/
-/py_virtual_env/
-
-# Local installation of elf2tab.
-/elf2tab/
 
 # Prevent people from commiting sensitive files.
 /crypto_data/
-
-# Temporary files.
-/reproducible/binaries.sha256sum
-/reproducible/elf2tab.txt
-/reproducible/reproduced.tar
-__pycache__

.gitmodules

@@ -1,8 +1,3 @@
-[submodule "third_party/libtock-rs"]
-	path = third_party/libtock-rs
-	url = https://github.com/tock/libtock-rs
-	ignore = dirty
-[submodule "third_party/tock"]
-	path = third_party/tock
-	url = https://github.com/tock/tock
-	ignore = dirty
+[submodule "third_party/wasefire"]
+	path = third_party/wasefire
+	url = https://github.com/google/wasefire