Skip extmu ML-DSA variants in generic signature tests#152
Merged
Conversation
liboqs main now enables the external-mu ML-DSA variants (ML-DSA-44-extmu, ML-DSA-65-extmu, ML-DSA-87-extmu). These cannot be signed via the standard OQS_SIG_sign path, so the generic correctness tests in test_sig.py, which iterate over all enabled mechanisms and call plain sign(), fail with "RuntimeError: Can not sign message". Exclude the extmu variants from the generic sign/verify tests to unblock CI. Proper support (a dedicated external-mu signing path plus tests) is tracked in #151. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
dstebila
force-pushed
the
skip-extmu-generic-sig-tests
branch
from
July 24, 2026 14:59
5505636 to
e8c72c8
Compare
dstebila
added a commit
that referenced
this pull request
Jul 24, 2026
liboqs enables the ML-DSA external-mu variants (ML-DSA-{44,65,87}-extmu),
which reuse the standard sign/verify C API but interpret the signed input as
the externally computed mu rather than a raw message.
- Add an is_extmu flag (instance attribute + details) derived from the
algorithm name, and document the external-mu input semantics on
sign()/verify(). The signing API stays uniform and algorithm-agnostic,
matching liboqs (which exposes no dedicated external-mu function and no
runtime mu length).
- Parametrize the generic sign/verify tests to use a 64-byte message for
extmu variants (mirroring liboqs's test_sig.c) and drop the "extmu"
stopgap from disabled_sig_patterns (added in #152).
- Add test_is_extmu_flag covering the new flag.
Closes #151.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The "GitHub actions simplified" CI workflow is failing on
main(and therefore on every open PR) in the unit-test step:Because the package version is a
devversion (0.16.1-dev), the CI builds liboqs frommainHEAD, which now enables the external-mu ML-DSA variants (ML-DSA-{44,65,87}-extmu). These cannot be signed via the standardOQS_SIG_signpath — they expect an externally-computed µ rather than a raw message. The generic correctness tests intests/test_sig.pyiterate over all enabled mechanisms and call plainsig.sign(message), so they fail for these variants.Fix
Add
"extmu"todisabled_sig_patternsintests/test_sig.pyso the generic sign/verify correctness tests skip the external-mu variants.This is a stopgap to unblock CI failures as identified in #150. Proper support — a dedicated external-mu signing path in the
Signaturewrapper plus tests that actually exercise these algorithms — is tracked in #151.🤖 Generated with Claude Code