From 897840e855380b3776dd51f9645f54dd7995bb69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= <tobias@wolfssl.com>
Date: Fri, 16 Oct 2026 09:54:21 +0200
Subject: [PATCH] Generate wolfIP test certificates before the parallel build

wolfIP releases up to v1.1.0 have three Makefile rules that each run
tools/certs/mkcerts.sh, one per generated cert source. Under make -j
they run concurrently and clobber each other's files, leaving
server_cert.c without server_der, so build/test-wolfssl intermittently
fails to link. On the latest-release leg the job then asks for a
breaks-wolfip= token although wolfSSL broke nothing.

Run mkcerts.sh once before make so the cert sources already exist.
This stays harmless once wolfIP serializes the rule itself, and keeps
the released tags, which will never get that fix, building reliably.
The script is only run when present so a later wolfIP layout change
cannot fail the job here.
---
 .github/workflows/cross-library.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/cross-library.yml b/.github/workflows/cross-library.yml
index c67bf33d593..272046f4091 100644
--- a/.github/workflows/cross-library.yml
+++ b/.github/workflows/cross-library.yml
@@ -359,6 +359,8 @@ jobs:
                 export PKG_CONFIG_PATH="$WOLFSSL_PREFIX/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
                 export EXTRA_CFLAGS="${EXTRA_CFLAGS:+$EXTRA_CFLAGS }-I$WOLFSSL_PREFIX/include"
                 export LDFLAGS="${LDFLAGS:+$LDFLAGS }-L$WOLFSSL_PREFIX/lib -Wl,-rpath,$WOLFSSL_PREFIX/lib"
+                # Releases up to v1.1.0 run mkcerts.sh once per cert file under -j.
+                if [ -x tools/certs/mkcerts.sh ]; then tools/certs/mkcerts.sh; fi
                 if [ "$REF" = "v1.0" ]; then
                   # v1.0 predates EXTRA_CFLAGS on Linux, so its header probe
                   # sees only CFLAGS. Keep its native warning/thread flags.