Skip to content

Commit

Permalink
Update QUIC workflow
Browse files Browse the repository at this point in the history
Signed-off-by: Khalid Alraddady <[email protected]>
  • Loading branch information
alraddady committed Feb 23, 2025
1 parent 3f69a7f commit 78507a6
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions .github/workflows/quic.yml
Original file line number Diff line number Diff line change
Expand Up @@ -45,54 +45,54 @@ jobs:
context: .
file: nginx/Dockerfile-QUIC
load: true
tags: nginx-quic
tags: ${{ env.TARGET_NAME }}/nginx-quic:latest

- name: Build cURL QUIC Docker image
uses: docker/build-push-action@v6
with:
context: .
file: curl/Dockerfile-QUIC
load: true
tags: curl-quic
tags: ${{ env.TARGET_NAME }}/curl-quic:latest

- name: Create a shared volume
run: docker volume create shared-1
shell: bash

- name: Generate a quantum-safe certificate chain
run: |
docker run -v shared-1:/certs $TARGET_NAME/openssl3 /bin/sh -c "\
docker run -v shared-1:/certs ${{ env.TARGET_NAME }}/openssl3 /bin/sh -c "\
openssl req -x509 -new -newkey rsa3072_falcon512 -keyout /certs/CA.key -out /certs/CA.crt -nodes -subj '/C=US/O=Open Quantum Safe/CN=OQS Demos' -days 1461 && \
openssl req -new -newkey sphincssha2128fsimple -keyout /certs/server.key -out /certs/server.csr -nodes -subj /CN=host.docker.internal && \
openssl req -new -newkey sphincssha2128fsimple -keyout /certs/server.key -out /certs/server.csr -nodes -subj '/CN=host.docker.internal' && \
openssl x509 -req -in /certs/server.csr -out /certs/server.crt -CA /certs/CA.crt -CAkey /certs/CA.key -CAcreateserial -days 365"
shell: bash

- name: Start NGINX server with QUIC support
run: |
docker run -d -p 443:443/udp -v shared-1:/certs --name nginx-quic-daemon nginx-quic:latest
docker run -d -p 443:443/udp -v shared-1:/certs --name nginx-quic-daemon ${{ env.TARGET_NAME }}/nginx-quic:latest
docker cp ${{ github.workspace }}/nginx/nginx-conf/nginx-quic.conf nginx-quic-daemon:/etc/nginx/nginx-quic.conf
docker exec nginx-quic-daemon bash -c "cd /etc/nginx && rm nginx.conf && mv nginx-quic.conf nginx.conf && nginx -s reload"
docker exec nginx-quic-daemon bash -c "cd /etc/nginx && mv nginx.conf nginx.conf.bak && mv nginx-quic.conf nginx.conf && nginx -s reload"
shell: bash

- name: Test cURL with QUIC support
run: |
docker run -v shared-1:/certs --add-host=host.docker.internal:host-gateway curl-quic:latest \
docker run -v shared-1:/certs --add-host=host.docker.internal:host-gateway ${{ env.TARGET_NAME }}/curl-quic:latest \
curl --cacert /certs/CA.crt --http3-only https://host.docker.internal --curves hqc192 -vvvv
shell: bash

- name: Scan cURL QUIC Docker Image
if: env.push == 'true'
uses: docker/[email protected]
with:
image: curl-quic
image: ${{ env.TARGET_NAME }}/curl-quic
command: cves,recommendations
sarif-file: curl-quic-scan-results.sarif

- name: Scan NGINX QUIC Docker Image
if: env.push == 'true'
uses: docker/[email protected]
with:
image: nginx-quic
image: ${{ env.TARGET_NAME }}/nginx-quic
command: cves,recommendations
sarif-file: nginx-quic-scan-results.sarif

Expand All @@ -113,6 +113,6 @@ jobs:
- name: Push Docker images to Docker Hub
if: env.push == 'true'
run: |
docker push $TARGET_NAME/curl-quic:latest
docker push $TARGET_NAME/nginx-quic:latest
docker push ${{ env.TARGET_NAME }}/curl-quic:latest
docker push ${{ env.TARGET_NAME }}/nginx-quic:latest
shell: bash

0 comments on commit 78507a6

Please sign in to comment.