From f58d049e0f6696f187cd3c3114ea8ddcbf6c7f06 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Thu, 15 Oct 2026 14:51:48 +0100 Subject: [PATCH] Update wolfBoot emulator CI image to m33mu v1.25 The stm32h5-pkcs11-single-boot job fails intermittently (about 3% of attempts since August) during first-boot token provisioning, with CKR_PIN_INCORRECT from C_Login(SO) or C_Login(USER), or CKR_FUNCTION_FAILED from C_InitToken or C_CreateObject. A re-run passes. The failures happen with and without recent wolfPKCS11 changes, and the run is cycle-identical up to the failing call, so this is not a wolfPKCS11 bug. The v1.2 image was built on 2026-03-25. m33mu has since fixed many exception-handling, IT-block and FPU emulation bugs, including the handling of Non-secure interrupts that preempt Secure code. That is the path this test exercises: the test app runs a 1 kHz SysTick during the Secure PKCS11 calls. wolfBoot's own CI runs the same first-boot test on the latest image (v1.25) and has had no PKCS11 failures in its last 400 runs. --- .github/workflows/wolfboot-integration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml index f4dd2f7b..0fe733a7 100644 --- a/.github/workflows/wolfboot-integration.yml +++ b/.github/workflows/wolfboot-integration.yml @@ -15,7 +15,7 @@ jobs: name: stm32h5-pkcs11-single-boot runs-on: ubuntu-latest container: - image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.2 + image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.25 timeout-minutes: 15 steps: