Trying to add RSB-checking CI job.

.github/workflows/return_stack_buffer.yml

@@ -0,0 +1,20 @@
+name: "Ensure the code can be protected against Spectre-RSB attacks."
+on:
+  pull_request:
+  push:
+
+jobs:
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        parameter_set: ["44", "65", "87"]
+    steps:
+    - uses: actions/checkout@v4
+    - uses: cachix/install-nix-action@v25
+      with:
+        nix_path: nixpkgs=channel:nixos-unstable
+    - run: nix-shell rsb-checker.nix --run 'echo Installed dependencies.'
+    - run: nix-shell rsb-checker.nix --run 'env PARAMETER_SET=${{ matrix.parameter_set }} make check-rsb'

Makefile

@@ -52,6 +52,10 @@ check-ct: $(IMPLEMENTATION)/ml_dsa.jazz
 check-sct: $(IMPLEMENTATION)/ml_dsa.jazz
 	env JASMINPATH="Common=$(COMMON)" $(JASMINCT) --speculative $^
 
+.PHONY: check-rsb
+check-rsb: $(IMPLEMENTATION)/ml_dsa.jazz
+	env JASMINPATH="Common=$(COMMON)" $(JASMINCT_RSB) --speculative $^
+
 .PHONY: run-interpreter
 run-interpreter: $(IMPLEMENTATION)/example.jazz $(IMPLEMENTATION)/ml_dsa.jazz
 	$(JASMINC) $(JASMINC_FLAGS) $< | grep 'true'

rsb-checker.nix

@@ -0,0 +1,14 @@
+with (import <nixpkgs> {});
+let
+    repo =  builtins.fetchGit {
+            url = "https://github.com/sarranz/jasmin";
+            ref = "rsb3";
+            rev = "324715a088a48b2a43bb3a22aafccdfd003992a2";
+    };
+
+    jasmin-rsb = import (repo + "/default.nix") { inherit pkgs; };
+in
+mkShell {
+    buildInputs = [ jasmin-rsb ];
+    JASMINCT_RSB = "${jasmin-rsb}/bin/jasmin-ct";
+}