Repository navigation
Generate the test certificates once under parallel make - #188
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
.SECONDARY prevents missing certificate sources from being regenerated when their objects already exist.
1 open finding
What changed in this PR
This PR consolidates test certificate generation to prevent concurrent writes and intermittent wolfSSL test link failures under parallel make.
Changes:
- Replaces three recipes with one multi-target pattern rule.
- Adds
.SECONDARYto retain generated certificate sources.
| File | Description |
|---|---|
| Makefile | Consolidates certificate generation and adjusts generated-source retention. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ca_cert.c, server_key.c and server_cert.c each had their own rule running tools/certs/mkcerts.sh, and the script rewrites all of the cert files. With make -j the three rules run at the same time, overwrite each other's keys and certificates, and can leave server_cert.c without server_der, so build/test-wolfssl fails to link with an undefined reference to server_der. wolfSSL's cross-library CI hits this intermittently. One pattern rule now names all three files as targets, which GNU make treats as a single recipe that writes all of them, so mkcerts.sh runs once under -j. The files are also named as plain targets so make does not treat them as intermediates: they survive the build and a deleted one is regenerated.
Frauschi
force-pushed
the
mkcerts-parallel-race
branch
from
October 16, 2026 09:02
2769dc2 to
a8c3955
Compare
danielinux
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
build/certs/ca_cert.c,server_key.candserver_cert.ceach had their own rule runningtools/certs/mkcerts.sh, which rewrites all of the cert files. Undermake -jthe three rules run at once and overwrite each other's output, soserver_cert.ccan end up withoutserver_derandbuild/test-wolfsslfails to link. wolfSSL's cross-library CI hits this intermittently on several unrelated PRs.The three files are now targets of a single pattern rule, which
makeruns as one recipe, somkcerts.shruns once and a missing file still triggers it. The files are also named as plain targets somakedoes not treat them as intermediates: they survive the build and a deleted one is regenerated.