Skip unsupported SHA-1 and add PQC smoke examples

.github/workflows/fwtpm-test.yml

@@ -82,12 +82,11 @@ jobs:
             wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen --disable-sha384
             build_only: true
 
-          # Build-only: fwTPM with SHA-1 disabled (verifies !NO_SHA gating
-          # for SHA-1 PCR bank and RSA hash conversion)
+          # fwTPM with SHA-1 disabled: build plus PQC and benchmark smoke runs.
           - name: fwtpm-no-sha1
             os: ubuntu-latest
-            wolftpm_config: --enable-fwtpm --enable-swtpm
-            wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen --disable-sha
+            wolftpm_config: --enable-fwtpm --enable-swtpm --enable-pqc
+            wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen --enable-mldsa --enable-mlkem --disable-sha
             build_only: true
             extra_cflags: -DNO_SHA
 
@@ -350,6 +349,19 @@ jobs:
             make check
           fi
 
+      - name: Run no-SHA-1 PQC examples and benchmark
+        if: matrix.name == 'fwtpm-no-sha1'
+        run: |
+          set -euo pipefail
+          ./src/fwtpm/fwtpm_server --clear > /tmp/fwtpm_no_sha1.log 2>&1 &
+          server_pid=$!
+          trap 'kill "$server_pid" 2>/dev/null || true' EXIT
+          sleep 1
+          kill -0 "$server_pid"
+          ./examples/pqc/no_sha1_examples.sh
+          ./examples/bench/bench -iter=1 | tee /tmp/fwtpm_no_sha1_bench.log
+          grep -E '^SHA1[[:space:]]+Skipped [(]not supported[)]$' /tmp/fwtpm_no_sha1_bench.log
+
       - name: Print test-suite.log on failure
         if: ${{ failure() && !matrix.build_only }}
         run: |

examples/bench/bench.c

@@ -444,6 +444,7 @@ int TPM2_Wrapper_BenchArgs(void* userCtx, int argc, char *argv[])
     TPM2B_ECC_POINT pubPoint;
     double start;
     int count;
+    int sha1Supported;
     int skipDec = 0; /* skip a decrypt op whose paired encrypt was unsupported */
     TPM_ALG_ID paramEncAlg = TPM_ALG_NULL;
     WOLFTPM2_SESSION tpmSession;
@@ -577,10 +578,18 @@ int TPM2_Wrapper_BenchArgs(void* userCtx, int argc, char *argv[])
     if (rc != 0 && !WOLFTPM_IS_COMMAND_UNAVAILABLE(rc)) goto exit;
 
     /* Hashing Benchmarks */
-    /* SHA1 */
-    rc = bench_sym_hash(&dev, "SHA1", TPM_ALG_SHA1, message.buffer,
-        sizeof(message.buffer), cipher.buffer, TPM_SHA_DIGEST_SIZE, maxDuration);
-    if (rc != 0 && (rc & RC_MAX_FMT1) != TPM_RC_HASH) goto exit;
+    /* SHA1 is optional on current TPMs. Skip it when the TPM omits it. */
+    rc = wolfTPM2_IsAlgSupported(&dev, TPM_ALG_SHA1, &sha1Supported);
+    if (rc != 0) goto exit;
+    if (sha1Supported) {
+        rc = bench_sym_hash(&dev, "SHA1", TPM_ALG_SHA1, message.buffer,
+            sizeof(message.buffer), cipher.buffer, TPM_SHA_DIGEST_SIZE,
+            maxDuration);
+        if (rc != 0 && (rc & RC_MAX_FMT1) != TPM_RC_HASH) goto exit;
+    }
+    else {
+        printf("%-16s Skipped (not supported)\n", "SHA1");
+    }
     /* SHA256 */
     rc = bench_sym_hash(&dev, "SHA256", TPM_ALG_SHA256, message.buffer,
         sizeof(message.buffer), cipher.buffer, TPM_SHA256_DIGEST_SIZE, maxDuration);

examples/pqc/include.am

@@ -46,3 +46,4 @@ endif
 # PQC enabled (EXTRA_DIST inside a conditional is excluded from dist otherwise).
 EXTRA_DIST += examples/pqc/README.md
 EXTRA_DIST += examples/pqc/pqc_ctrl.sh
+EXTRA_DIST += examples/pqc/no_sha1_examples.sh

examples/pqc/no_sha1_examples.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Run examples that use PQC or SHA-256 without requiring SHA-1.
+# Build for the selected TPM transport first. For fwTPM, start fwtpm_server.
+
+set -eu
+cd "$(dirname "$0")/../.."
+
+check_example() {
+    expected=$1
+    shift
+    if output=$("$@" 2>&1); then
+        printf '%s\n' "$output"
+    else
+        printf '%s\n' "$output" >&2
+        return 1
+    fi
+    case $output in
+        *"$expected"*) ;;
+        *) printf 'Expected output missing: %s\n' "$expected" >&2; return 1 ;;
+    esac
+}
+
+check_example 'Digest (32 bytes):' ./examples/wrap/hash "wolfTPM SHA-256 smoke test" -sha256
+check_example 'PCR0 (SHA' ./examples/pqc/pqc_ctrl --caps --algs --pcrread=0
+check_example 'Round-trip OK: Pure ML-DSA sign + verify sequence' ./examples/pqc/mldsa_sign -mldsa=65
+check_example 'Round-trip OK: encapsulated secret matches decapsulated secret' ./examples/pqc/mlkem_encap -mlkem=768