Mbedtls 4 support

.github/workflows/build-and-test-macos.yaml

@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: ["macos-14", "macos-15", "macos-15-intel", "macos-26"]
         otp: ["26", "27", "28"]
-        mbedtls: ["mbedtls@3"]
+        mbedtls: ["mbedtls@3", "mbedtls@4"]
         cmake_opts_other: [""]
 
         include:

.github/workflows/build-and-test-on-freebsd.yaml

@@ -35,7 +35,7 @@ concurrency:
 jobs:
   build-and-test-on-freebsd:
     runs-on: ubuntu-24.04
-    name: Build and test AtomVM on FreeBSD
+    name: Build and test AtomVM on FreeBSD ${{ matrix.os_release }} (${{ matrix.mbedtls }})
     env:
       ATOMVM_EXAMPLE: "atomvm-example"
 
@@ -44,6 +44,10 @@ jobs:
 
       matrix:
         os_release: ["13.5", "14.3", "15.0"]
+        mbedtls: ["mbedtls@3"]
+        include:
+          - os_release: "14.3"
+            mbedtls: "mbedtls@4"
 
     steps:
 
@@ -60,10 +64,25 @@ jobs:
         sync: rsync
         copyback: false
 
+    - name: "Use latest pkg repo for MbedTLS 4"
+      if: matrix.mbedtls == 'mbedtls@4'
+      shell: freebsd {0}
+      run: |
+        mkdir -p /usr/local/etc/pkg/repos
+        echo 'FreeBSD: { url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest" }' > /usr/local/etc/pkg/repos/FreeBSD.conf
+        pkg update -f
+
     - name: "Install deps"
+      if: matrix.mbedtls == 'mbedtls@3'
+      shell: freebsd {0}
+      run: |
+        pkg install -y curl cmake gperf erlang elixir rebar3 ninja mbedtls3 socat
+
+    - name: "Install deps (MbedTLS 4)"
+      if: matrix.mbedtls == 'mbedtls@4'
       shell: freebsd {0}
       run: |
-        pkg install -y curl cmake gperf erlang elixir rebar3 mbedtls3 ninja socat
+        pkg install -y curl cmake gperf erlang elixir rebar3 ninja mbedtls4 socat
 
     - name: "Add hostname to /etc/hosts for distribution tests"
       shell: freebsd {0}
@@ -102,6 +121,15 @@ jobs:
         mkdir build
 
     - name: "Build: run cmake"
+      if: matrix.mbedtls == 'mbedtls@3'
+      shell: freebsd {0}
+      run: |
+        cd $GITHUB_WORKSPACE;
+        cd build
+        cmake .. -DAVM_WARNINGS_ARE_ERRORS=ON
+
+    - name: "Build: run cmake (MbedTLS 4)"
+      if: matrix.mbedtls == 'mbedtls@4'
       shell: freebsd {0}
       run: |
         cd $GITHUB_WORKSPACE;

.github/workflows/build-and-test.yaml

@@ -59,6 +59,7 @@ jobs:
         # We only test several OTP versions with default compilers for supported OSes (gcc 11, gcc 13, clang 14, clang 18)
         cc: ["gcc-11", "gcc-13", "clang-14", "clang-18"]
         otp: ["26", "27", "28"]
+        mbedtls: ["default"]
 
         include:
         ### gcc
@@ -159,6 +160,12 @@ jobs:
           otp: "master"
           elixir_version: "main"
 
+        # Additional mbedtls@4 coverage with the default Linux toolchain
+        - cc: "cc"
+          cxx: "c++"
+          otp: "28"
+          mbedtls: "mbedtls@4"
+
         # Additional latest & -Os compiler builds
         - cc: "gcc-14"
           cxx: "g++-14"
@@ -540,13 +547,26 @@ jobs:
       run: sudo apt update -y
 
     - name: "Install deps"
-      if: matrix.container != ''
-      run: sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen valgrind libmbedtls-dev socat
+      if: matrix.container != '' && matrix.mbedtls != 'mbedtls@4'
+      run: |
+        sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen valgrind libmbedtls-dev socat
+
+    - name: "Install deps (MbedTLS 4)"
+      if: matrix.container != '' && matrix.mbedtls == 'mbedtls@4'
+      run: |
+        sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen valgrind socat
 
     - name: "Install deps"
-      if: matrix.container == ''
+      if: matrix.container == '' && matrix.mbedtls != 'mbedtls@4'
+      run: |
+        sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen libc6-dbg libmbedtls-dev socat
+        # Get a more recent valgrind
+        sudo snap install valgrind --classic
+
+    - name: "Install deps (MbedTLS 4)"
+      if: matrix.container == '' && matrix.mbedtls == 'mbedtls@4'
       run: |
-        sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen libmbedtls-dev libc6-dbg socat
+        sudo apt install -y ${{ matrix.compiler_pkgs}} cmake gperf zlib1g-dev doxygen libc6-dbg socat
         # Get a more recent valgrind
         sudo snap install valgrind --classic
 
@@ -582,6 +602,19 @@ jobs:
           https://repo.hex.pm
           https://cdn.jsdelivr.net/hex
 
+    - name: "Install specific MbedTLS version"
+      if: matrix.mbedtls == 'mbedtls@4'
+      run: |
+        git clone --depth 1 --branch mbedtls-4.0.0 --recurse-submodules https://github.com/Mbed-TLS/mbedtls
+        cd mbedtls
+        mkdir build
+        cd build
+        cmake -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=On -DCMAKE_INSTALL_PREFIX=/usr/local ..
+        make -j$(nproc)
+        sudo make install
+        sudo ldconfig
+        echo "MBEDTLS_ROOT_DIR=/usr/local" >> $GITHUB_ENV
+
     # Builder info
     - name: "System info"
       run: |
@@ -619,13 +652,23 @@ jobs:
         key: ${{ matrix.otp || env.DEFAULT_OTP_VERSION }}-${{ hashFiles('**/build-and-test.yaml', 'tests/**/*.erl', 'tests/**/*.hrl', 'tests/**/*.ex') }}-${{ matrix.jit_target_arch || 'nojit' }}-${{ contains(matrix.cmake_opts_other, 'AVM_DISABLE_JIT_DWARF=OFF') && 'dwarf' || 'nodwarf' }}
 
     - name: "Build: run cmake"
+      if: matrix.mbedtls != 'mbedtls@4'
       working-directory: build
       run: |
         cmake ${{ matrix.cmake_opts_fp }} ${{ matrix.cmake_opts_smp }} ${{ matrix.cmake_opts_other || env.DEFAULT_CMAKE_OPTS_OTHER }} ..
         # git clone will use more recent timestamps than cached beam files
         # touch them so we can benefit from the cache and avoid costly beam file rebuild.
         find . -name '*.beam' -exec touch {} \;
 
+    - name: "Build: run cmake (MbedTLS 4)"
+      if: matrix.mbedtls == 'mbedtls@4'
+      working-directory: build
+      run: |
+        cmake -DMBEDTLS_ROOT_DIR=/usr/local ${{ matrix.cmake_opts_fp }} ${{ matrix.cmake_opts_smp }} ${{ matrix.cmake_opts_other || env.DEFAULT_CMAKE_OPTS_OTHER }} ..
+        # git clone will use more recent timestamps than cached beam files
+        # touch them so we can benefit from the cache and avoid costly beam file rebuild.
+        find . -name '*.beam' -exec touch {} \;
+
     - name: "Build: run make"
       working-directory: build
       run: make -j3

.github/workflows/build-libraries.yaml

@@ -19,6 +19,8 @@ jobs:
     runs-on: "ubuntu-22.04"
     strategy:
       fail-fast: false
+      matrix:
+        mbedtls: ["default", "mbedtls@4"]
 
     steps:
     - name: "Checkout repo"
@@ -36,10 +38,26 @@ jobs:
 
     - name: "Install deps"
       run: |
-        sudo apt install -y build-essential cmake gperf zlib1g-dev libmbedtls-dev
+        sudo apt install -y build-essential cmake gperf zlib1g-dev
+        if [[ "${{ matrix.mbedtls }}" == "default" ]]; then
+            sudo apt install -y libmbedtls-dev
+        fi
         # Get a more recent valgrind
         sudo snap install valgrind --classic
 
+    - name: "Install specific MbedTLS version"
+      if: matrix.mbedtls == 'mbedtls@4'
+      run: |
+        git clone --depth 1 --branch mbedtls-4.0.0 --recurse-submodules https://github.com/Mbed-TLS/mbedtls
+        cd mbedtls
+        mkdir build
+        cd build
+        cmake -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=On -DCMAKE_INSTALL_PREFIX=/usr/local ..
+        make -j$(nproc)
+        sudo make install
+        sudo ldconfig
+        echo "MBEDTLS_ROOT_DIR=/usr/local" >> $GITHUB_ENV
+
     # Builder info
     - name: "System info"
       run: |
@@ -64,7 +82,7 @@ jobs:
     - name: "Build: run cmake"
       working-directory: build
       run: |
-        cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
+        cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo ${MBEDTLS_ROOT_DIR:+-DMBEDTLS_ROOT_DIR=$MBEDTLS_ROOT_DIR} ..
 
     - name: "Build: run make"
       working-directory: build
@@ -124,7 +142,7 @@ jobs:
 
     - name: Release
       uses: softprops/action-gh-release@v1
-      if: startsWith(github.ref, 'refs/tags/')
+      if: startsWith(github.ref, 'refs/tags/') && matrix.mbedtls == 'default'
       with:
         draft: true
         fail_on_unmatched_files: true

.github/workflows/wasm-build.yaml

@@ -107,13 +107,21 @@ jobs:
     needs: compile_tests
     runs-on: ubuntu-24.04
     container: emscripten/emsdk
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - mbedtls_label: "mbedtls3"
+            mbedtls_git_tag: "v3.6.3.1"
+          - mbedtls_label: "mbedtls4"
+            mbedtls_git_tag: "v4.0.0"
 
     steps:
     - name: Checkout repo
       uses: actions/checkout@v4
 
     - name: "Install deps"
-      run: sudo apt update -y && sudo apt install -y cmake gperf
+      run: sudo apt update -y && sudo apt install -y cmake gperf python3-jinja2 python3-jsonschema
 
     - name: Build
       shell: bash
@@ -122,7 +130,7 @@ jobs:
         set -euo pipefail
         mkdir build
         cd build
-        emcmake cmake ..
+        emcmake cmake .. -DAVM_FETCH_MBEDTLS_GIT_TAG=${{ matrix.mbedtls_git_tag }}
         emmake make -j
 
     - name: Download AtomVM and test modules
@@ -147,7 +155,7 @@ jobs:
         node src/AtomVM.js ../../../../build/tests/erlang_tests/test_crypto.beam
 
     - name: "Rename and write sha256sum (node)"
-      if: startsWith(github.ref, 'refs/tags/')
+      if: startsWith(github.ref, 'refs/tags/') && matrix.mbedtls_label == 'mbedtls3'
       shell: bash
       working-directory: src/platforms/emscripten/build/src
       run: |
@@ -160,7 +168,7 @@ jobs:
 
     - name: "Release (node)"
       uses: softprops/action-gh-release@v1
-      if: startsWith(github.ref, 'refs/tags/')
+      if: startsWith(github.ref, 'refs/tags/') && matrix.mbedtls_label == 'mbedtls3'
       with:
         draft: true
         fail_on_unmatched_files: true
@@ -181,14 +189,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["javascript-typescript"]
+        include:
+          - language: "javascript-typescript"
+            mbedtls_label: "mbedtls3"
+            mbedtls_git_tag: "v3.6.3.1"
+          - language: "javascript-typescript"
+            mbedtls_label: "mbedtls4"
+            mbedtls_git_tag: "v4.0.0"
 
     steps:
     - name: Checkout repo
       uses: actions/checkout@v4
 
     - name: "Install deps"
-      run: sudo apt update -y && sudo apt install -y cmake gperf
+      run: sudo apt update -y && sudo apt install -y cmake gperf python3-jinja2 python3-jsonschema
 
     - name: "Initialize CodeQL"
       uses: github/codeql-action/init@v3
@@ -204,7 +218,7 @@ jobs:
         set -euo pipefail
         mkdir build
         cd build
-        emcmake cmake .. -DAVM_EMSCRIPTEN_ENV=web
+        emcmake cmake .. -DAVM_EMSCRIPTEN_ENV=web -DAVM_FETCH_MBEDTLS_GIT_TAG=${{ matrix.mbedtls_git_tag }}
         emmake make -j
 
     - name: "Perform CodeQL Analysis"
@@ -213,7 +227,7 @@ jobs:
     - name: Upload wasm build for web
       uses: actions/upload-artifact@v4
       with:
-        name: atomvm-js-web
+        name: atomvm-js-web-${{ matrix.mbedtls_label }}
         path: |
             src/platforms/emscripten/build/**/*.wasm
             src/platforms/emscripten/build/**/*.js
@@ -222,6 +236,12 @@ jobs:
   wasm_test_web:
     needs: [compile_tests, wasm_build_web]
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - mbedtls_label: "mbedtls3"
+          - mbedtls_label: "mbedtls4"
     steps:
     - name: Checkout repo
       uses: actions/checkout@v4
@@ -235,7 +255,7 @@ jobs:
     - name: Download wasm build for web
       uses: actions/download-artifact@v4
       with:
-        name: atomvm-js-web
+        name: atomvm-js-web-${{ matrix.mbedtls_label }}
         path: src/platforms/emscripten/build
 
     - name: Download emscripten test modules
@@ -270,7 +290,7 @@ jobs:
         retention-days: 7
 
     - name: "Rename and write sha256sum (web)"
-      if: startsWith(github.ref, 'refs/tags/')
+      if: startsWith(github.ref, 'refs/tags/') && matrix.mbedtls_label == 'mbedtls3'
       shell: bash
       working-directory: src/platforms/emscripten/build/src
       run: |
@@ -283,7 +303,7 @@ jobs:
 
     - name: "Release (web)"
       uses: softprops/action-gh-release@v1
-      if: startsWith(github.ref, 'refs/tags/')
+      if: startsWith(github.ref, 'refs/tags/') && matrix.mbedtls_label == 'mbedtls3'
       with:
         draft: true
         fail_on_unmatched_files: true

CMakeModules/FetchMbedTLS.cmake

@@ -20,10 +20,12 @@
 
 include(FetchContent)
 
+set(AVM_FETCH_MBEDTLS_GIT_TAG "v3.6.3.1" CACHE STRING "MbedTLS git tag to fetch for Emscripten builds")
+
 FetchContent_Declare(
   mbedtls
   GIT_REPOSITORY http://github.com/mbed-TLS/mbedtls.git
-  GIT_TAG        v3.6.3.1
+  GIT_TAG        ${AVM_FETCH_MBEDTLS_GIT_TAG}
   GIT_SHALLOW    1
 )