Mbed-TLS · gilles-peskine-arm · Mar 19, 2026 · Mar 3, 2026 · Mar 19, 2026 · Feb 26, 2026
diff --git a/framework b/framework
diff --git a/scripts/ci.requirements.txt b/scripts/ci.requirements.txt
@@ -1,6 +1,7 @@
 # Python package requirements for Mbed TLS testing.
 
 -r driver.requirements.txt
+-r ../framework/scripts/ci.requirements.txt
 
 # The dependencies below are only used in scripts that we run on the Linux CI.
 
@@ -16,13 +17,3 @@ pylint == 2.4.4; platform_system == 'Linux'
 #   https://github.com/Mbed-TLS/mbedtls-framework/issues/50
 # mypy 0.942 is the version in Ubuntu 22.04.
 mypy == 0.942; platform_system == 'Linux'
-
-# At the time of writing, only needed for tests/scripts/audit-validity-dates.py.
-# It needs >=35.0.0 for correct operation, and that requires Python >=3.6.
-# >=35.0.0 also requires Rust to build from source, which we are forced to do on
-# FreeBSD, since PyPI doesn't carry binary wheels for the BSDs.
-cryptography >= 35.0.0; platform_system == 'Linux'
-
-# For building `framework/data_files/server9-bad-saltlen.crt` and check python
-# files.
-asn1crypto; platform_system == 'Linux'
diff --git a/scripts/memory.sh b/scripts/memory.sh
@@ -90,7 +90,7 @@ do_config()
     kill $SRV_PID
     wait $SRV_PID
 
-    scripts/massif_max.pl massif.out.*
+    framework/scripts/massif_max.pl massif.out.*
     mv massif.out.* massif-$NAME.$$
 }
 

diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh
@@ -792,7 +792,7 @@ component_test_everest () {
     make test
 
     msg "test: metatests (clang, ASan)"
-    tests/scripts/run-metatests.sh any asan poison
+    framework/scripts/run-metatests.sh any asan poison
 
     msg "test: Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
     tests/ssl-opt.sh -f ECDH

diff --git a/tests/scripts/components-configuration.sh b/tests/scripts/components-configuration.sh
@@ -22,7 +22,7 @@ component_test_default_out_of_box () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 component_test_default_cmake_gcc_asan () {
@@ -34,13 +34,13 @@ component_test_default_cmake_gcc_asan () {
     make test
 
     msg "program demos (ASan build)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 
     msg "test: selftest (ASan build)" # ~ 10s
     programs/test/selftest
 
     msg "test: metatests (GCC, ASan build)"
-    tests/scripts/run-metatests.sh any asan poison
+    framework/scripts/run-metatests.sh any asan poison
 
     msg "test: ssl-opt.sh (ASan build)" # ~ 1 min
     tests/ssl-opt.sh
@@ -142,10 +142,10 @@ component_test_full_cmake_clang () {
     programs/test/cpp_dummy_build
 
     msg "test: metatests (clang)"
-    tests/scripts/run-metatests.sh any pthread
+    framework/scripts/run-metatests.sh any pthread
 
     msg "program demos (full config, clang)" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 
     msg "test: psa_constant_names (full config, clang)" # ~ 1s
     $FRAMEWORK/scripts/test_psa_constant_names.py
@@ -216,7 +216,7 @@ component_test_full_deprecated_warning () {
     make test
 
     msg "program demos: full config + MBEDTLS_TEST_DEPRECATED" # ~10s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 component_build_baremetal () {

diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh
@@ -353,7 +353,7 @@ component_test_arm_linux_gnueabi_gcc_arm5vte () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_arm_linux_gnueabi_gcc_arm5vte () {
@@ -373,7 +373,7 @@ component_test_arm_linux_gnueabi_gcc_thumb_1_opt_0 () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_arm_linux_gnueabi_gcc_thumb_1_opt_0 () {
@@ -391,7 +391,7 @@ component_test_arm_linux_gnueabi_gcc_thumb_1_opt_s () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_arm_linux_gnueabi_gcc_thumb_1_opt_s () {
@@ -409,7 +409,7 @@ component_test_arm_linux_gnueabihf_gcc_armv7 () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_arm_linux_gnueabihf_gcc_armv7 () {
@@ -427,7 +427,7 @@ component_test_arm_linux_gnueabihf_gcc_thumb_2 () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_arm_linux_gnueabihf_gcc_thumb_2 () {
@@ -445,7 +445,7 @@ component_test_aarch64_linux_gnu_gcc () {
     programs/test/selftest
 
     msg "program demos: make, default config (out-of-box)" # ~0s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 }
 
 support_test_aarch64_linux_gnu_gcc () {

diff --git a/tests/scripts/components-sanitizers.sh b/tests/scripts/components-sanitizers.sh
@@ -180,10 +180,10 @@ component_test_memsan () {
     make test
 
     msg "test: metatests (MSan)"
-    tests/scripts/run-metatests.sh any msan
+    framework/scripts/run-metatests.sh any msan
 
     msg "program demos (MSan)" # ~20s
-    tests/scripts/run_demos.py
+    framework/scripts/run_demos.py
 
     msg "test: ssl-opt.sh (MSan)" # ~ 1 min
     tests/ssl-opt.sh

diff --git a/tests/scripts/run_demos.py b/tests/scripts/run_demos.py
@@ -44,7 +44,9 @@ def run_all_demos(quiet=False):
 
     Return True if all demos passed and False if a demo fails.
     """
-    all_demos = glob.glob('programs/*/*_demo.sh')
+    mbedtls_demos = glob.glob('programs/*/*_demo.sh')
+    tf_psa_crypto_demos = glob.glob('tf-psa-crypto/programs/*/*_demo.sh')
+    all_demos = mbedtls_demos + tf_psa_crypto_demos
     if not all_demos:
         # Keep the message on one line. pylint: disable=line-too-long
         raise Exception('No demos found. run_demos needs to operate from the Mbed TLS toplevel directory.')

diff --git a/tests/scripts/test_config_script.py b/tests/scripts/test_config_script.py
@@ -130,7 +130,7 @@ def run_one(options, args, stem_prefix='', input_file=None):
 ### config.py stops handling that case correctly.
 TEST_SYMBOLS = [
     'CUSTOM_SYMBOL', # does not exist
-    'MBEDTLS_AES_C', # set, no value
+    'PSA_WANT_KEY_TYPE_AES', # set, no value
     'MBEDTLS_MPI_MAX_SIZE', # unset, has a value
     'MBEDTLS_NO_UDBL_DIVISION', # unset, in "System support"
     'MBEDTLS_PLATFORM_ZEROIZE_ALT', # unset, in "Customisation configuration options"
+468 −0		scripts/audit-validity-dates.py
+20 −11		scripts/check-python-files.sh
+11 −0		scripts/ci.requirements.txt
+237 −0		scripts/ecp_comb_table.py
+96 −0		scripts/gen_ctr_drbg.pl
+101 −0		scripts/gen_gcm_decrypt.pl
+84 −0		scripts/gen_gcm_encrypt.pl
+74 −0		scripts/gen_pkcs1_v21_sign_verify.pl
+71 −0		scripts/generate-afl-tests.sh
+87 −0		scripts/generate_server9_bad_saltlen.py
+36 −0		scripts/massif_max.pl
+0 −4		scripts/mbedtls_framework/code_wrapper/psa_buffer.py
+4 −16		scripts/mbedtls_framework/code_wrapper/psa_test_wrapper.py
+30 −30		scripts/mbedtls_framework/code_wrapper/psa_wrapper.py
+89 −0		scripts/run-metatests.sh
+65 −0		scripts/run_demos.py
+175 −0		scripts/test_config_script.py
+1 −1		tests/include/test/arguments.h
+1 −1		tests/include/test/asn1_helpers.h
+1 −1		tests/include/test/bignum_codepath_check.h
+1 −1		tests/include/test/bignum_helpers.h
+24 −0		tests/include/test/build_info.h
+1 −1		tests/include/test/constant_flow.h
+1 −1		tests/include/test/fake_external_rng_for_test.h
+1 −1		tests/include/test/helpers.h
+1 −1		tests/include/test/macros.h
+1 −1		tests/include/test/memory.h
+1 −1		tests/include/test/pk_helpers.h
+1 −1		tests/include/test/psa_crypto_helpers.h
+1 −1		tests/include/test/psa_exercise_key.h
+1 −1		tests/include/test/psa_helpers.h
+1 −1		tests/include/test/psa_memory_poisoning_wrappers.h
+1 −1		tests/include/test/random.h
+1 −1		tests/include/test/threading_helpers.h
+1 −1		tests/programs/metatest.c
+1 −0		tests/src/asn1_helpers.c
+1 −0		tests/src/bignum_codepath_check.c
+2 −1		tests/src/bignum_helpers.c
+2 −0		tests/src/fake_external_rng_for_test.c
+2 −0		tests/src/helpers.c
+1 −0		tests/src/pk_helpers.c
+1 −0		tests/src/psa_crypto_helpers.c
+1 −0		tests/src/psa_crypto_stubs.c
+10 −0		tests/src/psa_exercise_key.c
+2 −0		tests/src/psa_memory_poisoning_wrappers.c
+1 −0		tests/src/random.c
+9 −7		tests/src/test_common.h
+1 −0		tests/src/test_memory.c
+1 −0		tests/src/threading_helpers.c