Switch to workspace, move ech-fetch to separate crate, add ECH CI coverage

.github/workflows/test.yaml

@@ -100,7 +100,7 @@ jobs:
             -DDYN_LINK=${{matrix.dyn_link}} \
             -DCMAKE_BUILD_TYPE=Debug \
             ${{ matrix.os == 'macos-latest' && '-DCMAKE_OSX_DEPLOYMENT_TARGET=14.5' || '' }} \
-            -S . -B build
+            -S librustls -B build
 
       - name: Build
         run: cmake --build build
@@ -120,14 +120,20 @@ jobs:
       - name: Build release binaries
         run: |
           cmake --build build -- clean
-          CC=${{matrix.cc}} CXX=${{matrix.cc}} cmake -S . -B build -DCRYPTO_PROVIDER=${{matrix.crypto}} -DCMAKE_BUILD_TYPE=Release
+          CC=${{matrix.cc}} CXX=${{matrix.cc}} cmake -S librustls -B build -DCRYPTO_PROVIDER=${{matrix.crypto}} -DCMAKE_BUILD_TYPE=Release
           cmake --build build
 
       - name: Verify release builds were not using ASAN
         if: runner.os == 'Linux' # For 'nm'
         run: |
           ! nm build/tests/client | grep '__asan_init' 
-          ! nm build/tests/server | grep '__asan_init' 
+          ! nm build/tests/server | grep '__asan_init'
+
+      - name: Run ECH connect test
+        if: matrix.crypto == 'aws-lc-rs' # No HPKE in ring
+        run: |
+          cmake --build build --target ech-test > ech-test.log
+          grep 'sni=encrypted' ech-test.log
 
       # Our integration tests rely on a built-in provider being enabled.
       # Double-check the library/unit tests work without any providers to
@@ -154,7 +160,7 @@ jobs:
           curl -L $LINK/$CARGO_C_FILE | tar xz -C ~/.cargo/bin
 
       - name: Setup cmake build
-        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release # No ASAN w/ Valgrind
+        run: cmake -S librustls -B build -DCMAKE_BUILD_TYPE=Release # No ASAN w/ Valgrind
 
       - run: VALGRIND=valgrind cmake --build build --target integration-test
 
@@ -186,7 +192,7 @@ jobs:
           cmake \
             -DFIPS=true \
             -DCMAKE_BUILD_TYPE=Release \
-            -S . -B build
+            -S librustls -B build
 
       - name: Integration tests
         run: cmake --build build --target integration-test
@@ -236,16 +242,25 @@ jobs:
           powershell -Command "Expand-Archive -Path cargo-c-windows-msvc.zip -DestinationPath $env:USERPROFILE\\.cargo\\bin -Force"
 
       - name: Configure CMake
-        run: cmake -DCRYPTO_PROVIDER="${{ matrix.crypto }}" -DCERT_COMPRESSION="${{ matrix.cert_compression }}" -DDYN_LINK="${{ matrix.dyn_link }}" -S . -B build
+        run: cmake -DCRYPTO_PROVIDER="${{ matrix.crypto }}" -DCERT_COMPRESSION="${{ matrix.cert_compression }}" -DDYN_LINK="${{ matrix.dyn_link }}" -S librustls -B build
 
       - name: Build
         run: cmake --build build --config "${{ matrix.config }}"
 
       - name: Integration test
         run: cmake --build build --config "${{matrix.config}}" --target integration-test
 
+      - name: Run ECH connect test
+        if: matrix.crypto == 'aws-lc-rs' # No HPKE in ring
+        run: |
+          cmake --build build --target ech-test > ech-test.log
+          grep 'sni=encrypted' ech-test.log
+
   ensure-header-updated:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: librustls
     steps:
       - uses: actions/checkout@v4
         with:
@@ -265,7 +280,7 @@ jobs:
 
       - run: cbindgen --version
 
-      - run: make src/rustls.h
+      - run: cbindgen > src/rustls.h
 
       - run: git diff --exit-code
 
@@ -323,7 +338,7 @@ jobs:
         run: pip install gersemi
 
       - name: Setup cmake build
-        run: cmake -S . -B build
+        run: cmake -S librustls -B build
 
       - name: Check formatting
         run: cmake --build build --target format-check
@@ -387,7 +402,7 @@ jobs:
           persist-credentials: false
 
       - name: Clang tidy
-        run: clang-tidy tests/*.c -- -I src/
+        run: clang-tidy librustls/tests/*.c -- -I librustls/src/
 
   miri:
     name: Miri

.gitignore

@@ -1,5 +1,6 @@
 target
 /build
+librustls/cmake-build*
 .idea
 .venv
-.vs
+.vs