CI: test on ppc64le, on a ppc64le runner as pyca/cryptography does

[alex]

First step of #55 (ppc64le). This PR only adds CI. The ISA model and the algorithms follow in their own PRs, stacked on this one (#108 → #109 → #110 → #111 / #117).

What

This adds a platform to the rust job's matrix. It runs the Rust tests natively on ppc64le and exports coverage there, using the same runner and image pair as pyca/cryptography's distros job:

- {IMAGE: "ubuntu-rolling:ppc64le", NOXSESSION: "tests", RUNNER: "ubuntu-24.04-ppc64le"}

That is, runs-on: ubuntu-24.04-ppc64le with container: ghcr.io/pyca/cryptography-runner-ubuntu-rolling:ppc64le. IBM has approved the repo, and the job runs and passes.

Rust installation: since Rust 1.99.0 (released 2026-10-01), rustup toolchain install stable can't upgrade the toolchain preinstalled in pyca's runner images ("failure removing component … share/man/man1/cargo.1"). The ppc64le job therefore uses a fresh RUSTUP_HOME=/tmp/verified-garbage-rustup, which installs the toolchain rather than upgrading it. That is the same fix #458 makes for the ARMv7 job, which fails the same way on main. This PR also carries #458's change to the ARMv7 matrix entry, so its CI is green whichever of the two lands first. The text is identical, so they merge cleanly.

The ppc64le build and the checks need a few small changes:

• src/cpu.rs: no module chooses among implementations on PPC64LE yet, so with -D warnings the ppc64le build rejected the CPU detection as dead code. This adds an allow(dead_code) for PPC64LE only. The ChaCha20 PR (ChaCha20 on PPC64LE: verified block function and keystream XOR #109) removes it again, since ChaCha20's backend selection uses the detection.

• ci/check_arch_gates.py: ARCHES (all architectures, for a file with no cfg) gets powerpc64. The files that named no architecture, but whose library code doesn't run on PPC64LE, now name the four it does run on:

  • the RFC 1321 tests and tests/acvp/mldsa.rs, the ML-DSA test macros, which use SHA-3;
  • the benchmarks of ChaCha20, HMAC-SHA-256, MD5, SHA-1, SHA-256 and SHA-512.

  Each algorithm's PPC64LE PR widens its gate again.

• ci/bench_arches.py: PPC64LE isn't benchmarked. A change to src/asm/powerpc64le/ used to fall through to the shared src/ rule, which benchmarked every module on every other architecture. Assembly of an architecture that isn't benchmarked now needs no benchmark.

Stable only

An exclude drops the 1.88 job for ppc64le, because inline assembly on PowerPC (and so naked_asm!) was only stabilized in Rust 1.95. I checked this locally: 1.94 rejects naked_asm! on powerpc64le-unknown-linux-gnu with E0658 ("inline assembly is not stable yet on this architecture"), and 1.95 through the current stable accept it. Once the ppc64le assembly lands, building for ppc64le needs Rust ≥ 1.95, even though rust-version stays 1.88 for the other targets. Whether to raise the MSRV instead is up to you.

Testing

All of the following pass locally on this branch merged with main (39aa9f4):

• cargo fmt
• cargo clippy --all-targets -D warnings, on the host and cross-built for powerpc64le-unknown-linux-gnu
• cargo test under qemu-ppc64le with RUSTFLAGS=-D warnings
• the bench crate's clippy
• ci/check_arch_gates.py, check_variants.py, algorithms_table.py --check and check_vectors.py

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fw6RULWHCeVgMDGc3wRrwE

[alex]

Please do this as a regular part of the matrix + an exclude

[alex]

Also needs IBM to approve this repo.

[alex]

Please rebase this

[alex]

Rebased onto current main (d71927b). One addition: tests/acvp/mldsa.rs, which landed on main after this PR's last CI run, names no architecture. With powerpc64 in ARCHES, ci/check_arch_gates.py would fail on it, so it now has the same four-architecture gate as SHA-3, which its macro uses (the mldsa44/65/87.rs files that expand it are gated already). cargo fmt, clippy (host, ppc64le and the bench crate), cargo test under qemu-ppc64le, and the arch-gate, variant, vector, bench and table checks pass locally.

---

Generated by Claude Code