.github/workflows/ci.yml

   1 # Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
   2 #
   3 # Licensed under the Apache License 2.0 (the "License").  You may not use
   4 # this file except in compliance with the License.  You can obtain a copy
   5 # in the file LICENSE in the source distribution or at
   6 # https://www.openssl.org/source/license.html
   7
   8 name: GitHub CI
   9
  10 on: [pull_request, push]
  11
  12 # for some reason, this does not work:
  13 # variables:
  14 #   BUILDOPTS: "-j4"
  15 #   HARNESS_JOBS: "${HARNESS_JOBS:-4}"
  16
  17 # for some reason, this does not work:
  18 # before_script:
  19 #     - make="make -s"
  20
  21 permissions:
  22   contents: read
  23
  24 env:
  25   OSSL_RUN_CI_TESTS: 1
  26
  27 jobs:
  28   check_update:
  29     runs-on: ubuntu-latest
  30     steps:
  31     - name: install unifdef
  32       run: |
  33         sudo apt-get update
  34         sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install unifdef
  35     - uses: actions/checkout@v4
  36       with:
  37         fetch-depth: 0
  38     - name: config
  39       run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
  40     - name: make build_generated
  41       run: make -s build_generated
  42     - name: make update
  43       run: make update
  44     - name: git diff
  45       run: git diff --exit-code
  46
  47   check_docs:
  48     runs-on: ubuntu-latest
  49     steps:
  50     - uses: actions/checkout@v4
  51     - name: config
  52       run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
  53     - name: make build_generated
  54       run: make -s build_generated
  55     - name: make doc-nits
  56       run: make doc-nits
  57     - name: make help
  58       run: make help
  59     - name: make md-nits
  60       run: |
  61           sudo gem install mdl
  62           make md-nits
  63
  64   # This checks that we use ANSI C language syntax and semantics.
  65   # We are not as strict with libraries, but rather adapt to what's
  66   # expected to be available in a certain version of each platform.
  67   check-c99:
  68     runs-on: ubuntu-latest
  69     steps:
  70     - uses: actions/checkout@v4
  71     - name: config
  72       run: CPPFLAGS='-std=c99 -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --strict-warnings --banner=Configured enable-sslkeylog no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips enable-lms && perl configdata.pm --dump
  73     - name: make
  74       run: make -s -j4
  75
  76   basic_gcc:
  77     runs-on: ubuntu-latest
  78     steps:
  79     - uses: actions/checkout@v4
  80     - name: checkout fuzz/corpora submodule
  81       run: git submodule update --init --depth 1 fuzz/corpora
  82     - name: localegen
  83       run: sudo locale-gen tr_TR.UTF-8
  84     - name: fipsvendor
  85       # Make one fips build use a customized FIPS vendor
  86       run: echo "FIPS_VENDOR=CI" >> VERSION.dat
  87     - name: config
  88       # enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
  89       run: CC=gcc ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-sslkeylog enable-fips enable-quic enable-lms && perl configdata.pm --dump
  90     - name: make
  91       run: make -s -j4
  92     - name: get cpu info
  93       run: |
  94         cat /proc/cpuinfo
  95         ./util/opensslwrap.sh version -c
  96     - name: make test
  97       run: .github/workflows/make-test
  98     - name: check fipsvendor
  99       run: |
 100         util/wrap.pl -fips apps/openssl list -providers | grep 'name: CI FIPS Provider for OpenSSL$'
 101     - name: save artifacts
 102       if: success() || failure()
 103       uses: actions/upload-artifact@v4
 104       with:
 105         name: "ci@basic-gcc"
 106         path: artifacts.tar.gz
 107
 108   basic_clang:
 109     runs-on: ubuntu-latest
 110     steps:
 111     - uses: actions/checkout@v4
 112     - name: checkout fuzz/corpora submodule
 113       run: git submodule update --init --depth 1 fuzz/corpora
 114     - name: config
 115       run: CC=clang ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-fips && perl configdata.pm --dump
 116     - name: make
 117       run: make -s -j4
 118     - name: get cpu info
 119       run: |
 120         cat /proc/cpuinfo
 121         ./util/opensslwrap.sh version -c
 122     - name: make test
 123       run: .github/workflows/make-test
 124     - name: save artifacts
 125       if: success() || failure()
 126       uses: actions/upload-artifact@v4
 127       with:
 128         name: "ci@basic-clang"
 129         path: artifacts.tar.gz
 130
 131   linux-arm64:
 132     runs-on: ${{ github.repository == 'openssl/openssl' && 'linux-arm64' || 'ubuntu-24.04-arm' }}
 133     steps:
 134     - uses: actions/checkout@v4
 135     - name: config
 136       run: ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
 137     - name: config dump
 138       run: ./configdata.pm --dump
 139     - name: make
 140       run: make -j4
 141     - name: get cpu info
 142       run: |
 143         cat /proc/cpuinfo
 144         ./util/opensslwrap.sh version -c
 145     - name: make test
 146       run: .github/workflows/make-test
 147     - name: save artifacts
 148       if: success() || failure()
 149       uses: actions/upload-artifact@v4
 150       with:
 151         name: "ci@linux-arm64"
 152         path: artifacts.tar.gz
 153
 154   freebsd-x86_64:
 155     runs-on: ubuntu-latest
 156     steps:
 157     - uses: actions/checkout@v4
 158     - name: config
 159       uses: cross-platform-actions/action@v0.26.0
 160       with:
 161         operating_system: freebsd
 162         version: "13.4"
 163         shutdown_vm: false
 164         run: |
 165           sudo pkg install -y gcc perl5
 166           ./config --strict-warnings enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
 167     - name: config dump
 168       uses: cross-platform-actions/action@v0.26.0
 169       with:
 170         operating_system: freebsd
 171         version: "13.4"
 172         shutdown_vm: false
 173         run: ./configdata.pm --dump
 174     - name: make
 175       uses: cross-platform-actions/action@v0.26.0
 176       with:
 177         operating_system: freebsd
 178         version: "13.4"
 179         shutdown_vm: false
 180         run: make -j4
 181     - name: make test
 182       uses: cross-platform-actions/action@v0.26.0
 183       with:
 184         operating_system: freebsd
 185         version: "13.4"
 186         run: |
 187           ./util/opensslwrap.sh version -c
 188           .github/workflows/make-test
 189     - name: save artifacts
 190       if: success() || failure()
 191       uses: actions/upload-artifact@v4
 192       with:
 193         name: "ci@BSD-x86_64"
 194         path: artifacts.tar.gz
 195
 196   minimal:
 197     runs-on: ubuntu-latest
 198     steps:
 199     - uses: actions/checkout@v4
 200     - name: checkout fuzz/corpora submodule
 201       run: git submodule update --init --depth 1 fuzz/corpora
 202     - name: config
 203       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-bulk no-pic no-asm no-lms -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
 204     - name: make
 205       run: make -j4 # verbose, so no -s here
 206     - name: get cpu info
 207       run: |
 208         cat /proc/cpuinfo
 209         ./util/opensslwrap.sh version -c
 210     - name: make test
 211       run: .github/workflows/make-test
 212     - name: save artifacts
 213       if: success() || failure()
 214       uses: actions/upload-artifact@v4
 215       with:
 216         name: "ci@minimal"
 217         path: artifacts.tar.gz
 218
 219   no-deprecated:
 220     runs-on: ubuntu-latest
 221     steps:
 222     - uses: actions/checkout@v4
 223     - name: checkout fuzz/corpora submodule
 224       run: git submodule update --init --depth 1 fuzz/corpora
 225     - name: config
 226       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-deprecated enable-fips && perl configdata.pm --dump
 227     - name: make
 228       run: make -s -j4
 229     - name: get cpu info
 230       run: |
 231         cat /proc/cpuinfo
 232         ./util/opensslwrap.sh version -c
 233     - name: make test
 234       run: .github/workflows/make-test
 235     - name: save artifacts
 236       if: success() || failure()
 237       uses: actions/upload-artifact@v4
 238       with:
 239         name: "ci@no-deprecated"
 240         path: artifacts.tar.gz
 241
 242   no-shared-ubuntu:
 243     runs-on: ubuntu-latest
 244     steps:
 245     - uses: actions/checkout@v4
 246     - name: checkout fuzz/corpora submodule
 247       run: git submodule update --init --depth 1 fuzz/corpora
 248     - name: config
 249       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
 250     - name: make
 251       run: make -s -j4
 252     - name: get cpu info
 253       run: |
 254         cat /proc/cpuinfo
 255         ./util/opensslwrap.sh version -c
 256     - name: make test
 257       run: .github/workflows/make-test
 258     - name: save artifacts
 259       if: success() || failure()
 260       uses: actions/upload-artifact@v4
 261       with:
 262         name: "ci@no-shared-ubuntu"
 263         path: artifacts.tar.gz
 264
 265   no-shared-macos:
 266     strategy:
 267       fail-fast: false
 268       matrix:
 269         os: [macos-13, macos-14]
 270     runs-on: ${{ matrix.os }}
 271     steps:
 272     - uses: actions/checkout@v4
 273     - name: checkout fuzz/corpora submodule
 274       run: git submodule update --init --depth 1 fuzz/corpora
 275     - name: config
 276       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
 277     - name: make
 278       run: make -s -j4
 279     - name: get cpu info
 280       run: |
 281         sysctl machdep.cpu
 282         ./util/opensslwrap.sh version -c
 283     - name: make test
 284       run: .github/workflows/make-test
 285     - name: save artifacts
 286       if: success() || failure()
 287       uses: actions/upload-artifact@v4
 288       with:
 289         name: "ci@no-shared-${{ matrix.os }}"
 290         path: artifacts.tar.gz
 291
 292   non-caching:
 293     runs-on: ubuntu-latest
 294     steps:
 295     - uses: actions/checkout@v4
 296     - name: checkout fuzz/corpora submodule
 297       run: git submodule update --init --depth 1 fuzz/corpora
 298     - name: Adjust ASLR for sanitizer
 299       run: |
 300         sudo cat /proc/sys/vm/mmap_rnd_bits
 301         sudo sysctl -w vm.mmap_rnd_bits=28
 302     - name: config
 303       run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
 304     - name: make
 305       run: make -s -j4
 306     - name: get cpu info
 307       run: |
 308         cat /proc/cpuinfo
 309         ./util/opensslwrap.sh version -c
 310     - name: make test
 311       run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
 312     - name: save artifacts
 313       if: success() || failure()
 314       uses: actions/upload-artifact@v4
 315       with:
 316         name: "ci@non-caching"
 317         path: artifacts.tar.gz
 318
 319   address_ub_sanitizer:
 320     runs-on: ubuntu-latest
 321     steps:
 322     - uses: actions/checkout@v4
 323     - name: checkout fuzz/corpora submodule
 324       run: git submodule update --init --depth 1 fuzz/corpora
 325     - name: Adjust ASLR for sanitizer
 326       run: |
 327         sudo cat /proc/sys/vm/mmap_rnd_bits
 328         sudo sysctl -w vm.mmap_rnd_bits=28
 329     - name: config
 330       run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips enable-lms && perl configdata.pm --dump
 331     - name: make
 332       run: make -s -j4
 333     - name: get cpu info
 334       run: |
 335         cat /proc/cpuinfo
 336         ./util/opensslwrap.sh version -c
 337     - name: make test
 338       run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
 339     - name: save artifacts
 340       if: success() || failure()
 341       uses: actions/upload-artifact@v4
 342       with:
 343         name: "ci@address_ub_sanitizer"
 344         path: artifacts.tar.gz
 345
 346   fuzz_tests:
 347     runs-on: ubuntu-latest
 348     steps:
 349     - uses: actions/checkout@v4
 350     - name: checkout fuzz/corpora submodule
 351       run: git submodule update --init --depth 1 fuzz/corpora
 352     - name: Adjust ASLR for sanitizer
 353       run: |
 354         sudo cat /proc/sys/vm/mmap_rnd_bits
 355         sudo sysctl -w vm.mmap_rnd_bits=28
 356     - name: config
 357       run: ./config --strict-warnings --banner=Configured --debug -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method enable-nextprotoneg && perl configdata.pm --dump
 358     - name: make
 359       run: make -s -j4
 360     - name: get cpu info
 361       run: |
 362         cat /proc/cpuinfo
 363         ./util/opensslwrap.sh version -c
 364     - name: make test
 365       run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
 366     - name: save artifacts
 367       if: success() || failure()
 368       uses: actions/upload-artifact@v4
 369       with:
 370         name: "ci@fuzz_tests"
 371         path: artifacts.tar.gz
 372         if-no-files-found: ignore
 373
 374   memory_sanitizer:
 375     runs-on: ubuntu-latest
 376     steps:
 377     - uses: actions/checkout@v4
 378     - name: checkout fuzz/corpora submodule
 379       run: git submodule update --init --depth 1 fuzz/corpora
 380     - name: Adjust ASLR for sanitizer
 381       run: |
 382         sudo cat /proc/sys/vm/mmap_rnd_bits
 383         sudo sysctl -w vm.mmap_rnd_bits=28
 384     - name: config
 385       # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
 386       run: CC=clang ./config --strict-warnings --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips enable-lms no-slh-dsa && perl configdata.pm --dump
 387     - name: make
 388       run: make -s -j4
 389     - name: get cpu info
 390       run: |
 391         cat /proc/cpuinfo
 392         ./util/opensslwrap.sh version -c
 393     - name: make test
 394       run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
 395     - name: save artifacts
 396       if: success() || failure()
 397       uses: actions/upload-artifact@v4
 398       with:
 399         name: "ci@memory_sanitizer"
 400         path: artifacts.tar.gz
 401
 402   threads_sanitizer:
 403     runs-on: ubuntu-latest
 404     steps:
 405     - uses: actions/checkout@v4
 406     - name: checkout fuzz/corpora submodule
 407       run: git submodule update --init --depth 1 fuzz/corpora
 408     - name: Adjust ASLR for sanitizer
 409       run: |
 410         sudo cat /proc/sys/vm/mmap_rnd_bits
 411         sudo sysctl -w vm.mmap_rnd_bits=28
 412     - name: config
 413       run: CC=clang ./config --strict-warnings --banner=Configured no-shared no-fips -g -fsanitize=thread && perl configdata.pm --dump
 414     - name: make
 415       run: make -s -j4
 416     - name: get cpu info
 417       run: |
 418         cat /proc/cpuinfo
 419         ./util/opensslwrap.sh version -c
 420     - name: make test
 421       run: .github/workflows/make-test V=1 TESTS="test_lhash test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
 422     - name: save artifacts
 423       if: success() || failure()
 424       uses: actions/upload-artifact@v4
 425       with:
 426         name: "ci@threads_sanitizer"
 427         path: artifacts.tar.gz
 428
 429   enable_non-default_options:
 430     runs-on: ubuntu-latest
 431     steps:
 432     - uses: actions/checkout@v4
 433     - name: checkout fuzz/corpora submodule
 434       run: git submodule update --init --depth 1 fuzz/corpora
 435     - name: modprobe tls
 436       run: sudo modprobe tls
 437     - name: config
 438       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-egd enable-ktls enable-fips enable-lms no-threads && perl configdata.pm --dump
 439     - name: make
 440       run: make -s -j4
 441     - name: get cpu info
 442       run: |
 443         cat /proc/cpuinfo
 444         ./util/opensslwrap.sh version -c
 445     - name: make test
 446       run: .github/workflows/make-test
 447     - name: save artifacts
 448       if: success() || failure()
 449       uses: actions/upload-artifact@v4
 450       with:
 451         name: "ci@enable_non-default_options"
 452         path: artifacts.tar.gz
 453
 454   full_featured:
 455     runs-on: ubuntu-latest
 456     steps:
 457     - uses: actions/checkout@v4
 458     - name: checkout fuzz/corpora submodule
 459       run: git submodule update --init --depth 1 fuzz/corpora
 460     - name: modprobe tls
 461       run: sudo modprobe tls
 462     - name: Enable sctp
 463       run: sudo modprobe sctp
 464     - name: Enable auth in sctp
 465       run: sudo sysctl -w net.sctp.auth_enable=1
 466     - name: install extra config support
 467       run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
 468     - name: config
 469       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ktls enable-fips enable-lms enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
 470     - name: make
 471       run: make -s -j4
 472     - name: get cpu info
 473       run: |
 474         cat /proc/cpuinfo
 475         ./util/opensslwrap.sh version -c
 476     - name: make test
 477       run: .github/workflows/make-test
 478     - name: save artifacts
 479       if: success() || failure()
 480       uses: actions/upload-artifact@v4
 481       with:
 482         name: "ci@full_featured"
 483         path: artifacts.tar.gz
 484
 485   no-legacy:
 486     runs-on: ubuntu-latest
 487     steps:
 488     - uses: actions/checkout@v4
 489     - name: checkout fuzz/corpora submodule
 490       run: git submodule update --init --depth 1 fuzz/corpora
 491     - name: config
 492       run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo no-legacy enable-fips enable-lms && perl configdata.pm --dump
 493     - name: make
 494       run: make -s -j4
 495     - name: get cpu info
 496       run: |
 497         cat /proc/cpuinfo
 498         ./util/opensslwrap.sh version -c
 499     - name: make test
 500       run: .github/workflows/make-test
 501     - name: save artifacts
 502       if: success() || failure()
 503       uses: actions/upload-artifact@v4
 504       with:
 505         name: "ci@no-legacy"
 506         path: artifacts.tar.gz
 507
 508   legacy:
 509     runs-on: ubuntu-latest
 510     steps:
 511     - uses: actions/checkout@v4
 512     - name: checkout fuzz/corpora submodule
 513       run: git submodule update --init --depth 1 fuzz/corpora
 514     - name: config
 515       run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
 516     - name: make
 517       run: make -s -j4
 518     - name: get cpu info
 519       run: |
 520         cat /proc/cpuinfo
 521         ./util/opensslwrap.sh version -c
 522     - name: make test
 523       run: .github/workflows/make-test
 524     - name: save artifacts
 525       if: success() || failure()
 526       uses: actions/upload-artifact@v4
 527       with:
 528         name: "ci@legacy"
 529         path: artifacts.tar.gz
 530
 531   # out-of-source-and-install checks multiple things at the same time:
 532   # - That building, testing and installing works from an out-of-source
 533   #   build tree
 534   # - That building, testing and installing works with a read-only source
 535   #   tree
 536   out-of-readonly-source-and-install-ubuntu:
 537     runs-on: ubuntu-latest
 538     steps:
 539     - uses: actions/checkout@v4
 540       with:
 541         path: ./source
 542     - name: checkout fuzz/corpora submodule
 543       run: git submodule update --init --depth 1 fuzz/corpora
 544       working-directory: ./source
 545     - name: make source read-only
 546       run: chmod -R a-w ./source
 547     - name: create build and install directories
 548       run: |
 549         mkdir ./build
 550         mkdir ./install
 551     - name: config
 552       run: |
 553         ../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-lms enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
 554         perl configdata.pm --dump
 555       working-directory: ./build
 556     - name: make
 557       run: make -s -j4
 558       working-directory: ./build
 559     - name: get cpu info
 560       run: |
 561         cat /proc/cpuinfo
 562         ./util/opensslwrap.sh version -c
 563       working-directory: ./build
 564     - name: make test
 565       run: ../source/.github/workflows/make-test
 566       working-directory: ./build
 567     - name: save artifacts
 568       if: success() || failure()
 569       uses: actions/upload-artifact@v4
 570       with:
 571         name: "ci@out-of-readonly-source-and-install-ubuntu"
 572         path: build/artifacts.tar.gz
 573     - name: make install
 574       run: make install
 575       working-directory: ./build
 576
 577   out-of-readonly-source-and-install-macos:
 578     strategy:
 579       fail-fast: false
 580       matrix:
 581         os: [macos-13, macos-14]
 582     runs-on: ${{ matrix.os }}
 583     steps:
 584     - uses: actions/checkout@v4
 585       with:
 586         path: ./source
 587     - name: checkout fuzz/corpora submodule
 588       run: git submodule update --init --depth 1 fuzz/corpora
 589       working-directory: ./source
 590     - name: make source read-only
 591       run: chmod -R a-w ./source
 592     - name: create build and install directories
 593       run: |
 594         mkdir ./build
 595         mkdir ./install
 596     - name: config
 597       run: |
 598         ../source/config --banner=Configured enable-fips enable-lms enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
 599         perl configdata.pm --dump
 600       working-directory: ./build
 601     - name: make
 602       run: make -s -j4
 603       working-directory: ./build
 604     - name: get cpu info
 605       run: |
 606         sysctl machdep.cpu
 607         ./util/opensslwrap.sh version -c
 608       working-directory: ./build
 609     - name: make test
 610       run: ../source/.github/workflows/make-test
 611       working-directory: ./build
 612     - name: save artifacts
 613       if: success() || failure()
 614       uses: actions/upload-artifact@v4
 615       with:
 616         name: "ci@out-of-readonly-source-and-install-${{ matrix.os }}"
 617         path: build/artifacts.tar.gz
 618     - name: make install
 619       run: make install
 620       working-directory: ./build
 621
 622   external-tests-misc:
 623     runs-on: ubuntu-latest
 624     steps:
 625     - uses: actions/checkout@v4
 626       with:
 627         submodules: recursive
 628     - name: package installs
 629       run: |
 630         sudo apt-get update
 631         sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb libtls-dev
 632     - name: install cpanm and Test2::V0 for gost_engine testing
 633       uses: perl-actions/install-with-cpanm@stable
 634       with:
 635         install: Test2::V0
 636     - name: setup hostname workaround
 637       run: sudo hostname localhost
 638     - name: config
 639       run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
 640     - name: make
 641       run: make -s -j4
 642     - uses: dtolnay/rust-toolchain@stable
 643     - name: get cpu info
 644       run: |
 645         cat /proc/cpuinfo
 646         ./util/opensslwrap.sh version -c
 647     - name: test external gost-engine
 648       run: make test TESTS="test_external_gost_engine"
 649     - name: test external krb5
 650       run: make test TESTS="test_external_krb5"
 651     - name: test external tlsfuzzer
 652       run: make test TESTS="test_external_tlsfuzzer"
 653     - name: test external Cloudflare quiche
 654       run: make test TESTS="test_external_cf_quiche" VERBOSE=1
 655     - name: test external rpki client
 656       run: make test TESTS="test_external_rpki-client-portable"
 657     - name: test ability to produce debuginfo files
 658       run: |
 659         make debuginfo
 660         gdb < <(echo -e "file ./libcrypto.so.3\nquit") > ./results
 661         grep -q "Reading symbols from.*libcrypto\.so\.3\.debug" results
 662
 663   external-tests-oqs-provider:
 664     runs-on: ubuntu-latest
 665     steps:
 666     - uses: actions/checkout@v4
 667       with:
 668         submodules: recursive
 669     - name: config
 670       run: ./config --strict-warnings --banner=Configured --debug enable-external-tests && perl configdata.pm --dump
 671     - name: make
 672       run: make -s -j4
 673     - name: get cpu info
 674       run: |
 675         cat /proc/cpuinfo
 676         ./util/opensslwrap.sh version -c
 677     - name: test external oqs-provider
 678       run: make test TESTS="test_external_oqsprovider"
 679
 680   external-tests-pkcs11-provider:
 681     runs-on: ubuntu-latest
 682     container: fedora:latest
 683     steps:
 684     - name: package installs
 685       run: |
 686         dnf install -y perl-FindBin perl-IPC-Cmd perl-File-Compare perl-File-Copy perl-Test-Simple perl-Test-Harness python3 make g++ perl git meson opensc expect kryoptic
 687     - uses: actions/checkout@v4
 688     - name: checkout fuzz/corpora and pkcs11-provider submodule
 689       run: |
 690         git config --global --add safe.directory /__w/openssl/openssl
 691         git submodule update --init --depth 1 fuzz/corpora
 692         git submodule update --init --depth 1 pkcs11-provider
 693     - name: config
 694       run: ./config --strict-warnings --banner=Configured --debug enable-external-tests no-fips && perl configdata.pm --dump
 695     - name: make
 696       run: make -s -j4
 697     # Run all tests except external tests to make sure they work fine on Fedora because
 698     # this is the only job running on Fedora, only then execute pkcs11-provider external
 699     # test.
 700     - name: test (except external tests)
 701       run: make test TESTS="-test_external_*"
 702     - name: test external pkcs11-provider
 703       run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
 704     - name: get cpu info
 705       run: |
 706         cat /proc/cpuinfo
 707         ./util/opensslwrap.sh version -c
 708
 709   external-tests-pyca:
 710     runs-on: ubuntu-latest
 711     strategy:
 712       matrix:
 713         PYTHON:
 714           - 3.9
 715     steps:
 716     - uses: actions/checkout@v4
 717       with:
 718         submodules: recursive
 719     - name: package installs
 720       run: |
 721         sudo apt-get update
 722         sudo apt-get -yq install pkgconf libssl-dev
 723     - name: Configure OpenSSL
 724       run: ./config --strict-warnings --banner=Configured --debug enable-external-tests && perl configdata.pm --dump
 725     - name: make
 726       run: make -s -j4
 727     - name: Setup Python
 728       uses: actions/setup-python@v5.3.0
 729       with:
 730         python-version: ${{ matrix.PYTHON }}
 731     - uses: dtolnay/rust-toolchain@stable
 732       with:
 733         toolchain: stable
 734     - name: get cpu info
 735       run: |
 736         cat /proc/cpuinfo
 737         ./util/opensslwrap.sh version -c
 738     - name: test external pyca
 739       run: make test TESTS="test_external_pyca" VERBOSE=1