1 # Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
3 # Licensed under the Apache License 2.0 (the "License"). You may not use
4 # this file except in compliance with the License. You can obtain a copy
5 # in the file LICENSE in the source distribution or at
6 # https://www.openssl.org/source/license.html
10 on: [pull_request, push]
12 # for some reason, this does not work:
15 # HARNESS_JOBS: "${HARNESS_JOBS:-4}"
17 # for some reason, this does not work:
29 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
31 - name: install unifdef
34 sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install unifdef
35 - uses: actions/checkout@v4
39 run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
40 - name: make build_generated
41 run: make -s build_generated
45 run: git diff --exit-code
48 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
50 - uses: actions/checkout@v4
52 run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
53 - name: make build_generated
54 run: make -s build_generated
64 # This checks that we use ANSI C language syntax and semantics.
65 # We are not as strict with libraries, but rather adapt to what's
66 # expected to be available in a certain version of each platform.
68 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
70 - uses: actions/checkout@v4
72 run: CPPFLAGS='-ansi -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --banner=Configured no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips --strict-warnings && perl configdata.pm --dump
77 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
79 - uses: actions/checkout@v4
80 - name: checkout fuzz/corpora submodule
81 run: git submodule update --init --depth 1 fuzz/corpora
83 run: sudo locale-gen tr_TR.UTF-8
85 # enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
86 run: CC=gcc ./config --banner=Configured enable-demos enable-h3demo enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
92 ./util/opensslwrap.sh version -c
94 run: .github/workflows/make-test
95 - name: save artifacts
96 uses: actions/upload-artifact@v3
99 path: artifacts.tar.gz
102 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
104 - uses: actions/checkout@v4
105 - name: checkout fuzz/corpora submodule
106 run: git submodule update --init --depth 1 fuzz/corpora
108 run: CC=clang ./config --banner=Configured enable-demos enable-h3demo no-fips --strict-warnings && perl configdata.pm --dump
114 ./util/opensslwrap.sh version -c
116 run: .github/workflows/make-test
117 - name: save artifacts
118 uses: actions/upload-artifact@v3
120 name: "ci@basic-clang"
121 path: artifacts.tar.gz
124 if: github.repository == 'openssl/openssl'
127 os: [freebsd-13.2, ubuntu-arm64-22.04]
128 runs-on: ${{ matrix.os }}-self-hosted
129 continue-on-error: true
131 - uses: actions/checkout@v4
133 run: ./config enable-demos enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
135 run: ./configdata.pm --dump
139 run: ./util/opensslwrap.sh version -c
141 run: .github/workflows/make-test
142 - name: save artifacts
143 uses: actions/upload-artifact@v3
145 name: "ci@self-hosted-${{ matrix.os }}"
146 path: artifacts.tar.gz
149 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
151 - uses: actions/checkout@v4
152 - name: checkout fuzz/corpora submodule
153 run: git submodule update --init --depth 1 fuzz/corpora
155 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-bulk no-pic no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
157 run: make -j4 # verbose, so no -s here
161 ./util/opensslwrap.sh version -c
163 run: .github/workflows/make-test
164 - name: save artifacts
165 uses: actions/upload-artifact@v3
168 path: artifacts.tar.gz
171 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
173 - uses: actions/checkout@v4
174 - name: checkout fuzz/corpora submodule
175 run: git submodule update --init --depth 1 fuzz/corpora
177 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-deprecated enable-fips && perl configdata.pm --dump
183 ./util/opensslwrap.sh version -c
185 run: .github/workflows/make-test
186 - name: save artifacts
187 uses: actions/upload-artifact@v3
189 name: "ci@no-deprecated"
190 path: artifacts.tar.gz
193 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
195 - uses: actions/checkout@v4
196 - name: checkout fuzz/corpora submodule
197 run: git submodule update --init --depth 1 fuzz/corpora
199 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
205 ./util/opensslwrap.sh version -c
207 run: .github/workflows/make-test
208 - name: save artifacts
209 uses: actions/upload-artifact@v3
211 name: "ci@no-shared-ubuntu"
212 path: artifacts.tar.gz
218 os: [macos-13, macos-14]
219 if: github.server_url == 'https://github.com'
220 runs-on: ${{ matrix.os }}
222 - uses: actions/checkout@v4
223 - name: checkout fuzz/corpora submodule
224 run: git submodule update --init --depth 1 fuzz/corpora
226 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
232 ./util/opensslwrap.sh version -c
234 run: .github/workflows/make-test
235 - name: save artifacts
236 uses: actions/upload-artifact@v3
238 name: "ci@no-shared-${{ matrix.os }}"
239 path: artifacts.tar.gz
242 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
244 - uses: actions/checkout@v4
245 - name: checkout fuzz/corpora submodule
246 run: git submodule update --init --depth 1 fuzz/corpora
247 - name: Adjust ASLR for sanitizer
249 sudo cat /proc/sys/vm/mmap_rnd_bits
250 sudo sysctl -w vm.mmap_rnd_bits=28
252 run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
258 ./util/opensslwrap.sh version -c
260 run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
261 - name: save artifacts
262 uses: actions/upload-artifact@v3
264 name: "ci@non-caching"
265 path: artifacts.tar.gz
267 address_ub_sanitizer:
268 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
270 - uses: actions/checkout@v4
271 - name: checkout fuzz/corpora submodule
272 run: git submodule update --init --depth 1 fuzz/corpora
273 - name: Adjust ASLR for sanitizer
275 sudo cat /proc/sys/vm/mmap_rnd_bits
276 sudo sysctl -w vm.mmap_rnd_bits=28
278 run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
284 ./util/opensslwrap.sh version -c
286 run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
287 - name: save artifacts
288 uses: actions/upload-artifact@v3
290 name: "ci@address_ub_sanitizer"
291 path: artifacts.tar.gz
294 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
296 - uses: actions/checkout@v4
297 - name: checkout fuzz/corpora submodule
298 run: git submodule update --init --depth 1 fuzz/corpora
299 - name: Adjust ASLR for sanitizer
301 sudo cat /proc/sys/vm/mmap_rnd_bits
302 sudo sysctl -w vm.mmap_rnd_bits=28
304 run: ./config --banner=Configured --debug -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method enable-nextprotoneg && perl configdata.pm --dump
310 ./util/opensslwrap.sh version -c
312 run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
313 - name: save artifacts
314 uses: actions/upload-artifact@v3
316 name: "ci@fuzz_tests"
317 path: artifacts.tar.gz
318 if-no-files-found: ignore
321 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
323 - uses: actions/checkout@v4
324 - name: checkout fuzz/corpora submodule
325 run: git submodule update --init --depth 1 fuzz/corpora
326 - name: Adjust ASLR for sanitizer
328 sudo cat /proc/sys/vm/mmap_rnd_bits
329 sudo sysctl -w vm.mmap_rnd_bits=28
331 # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
332 run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
338 ./util/opensslwrap.sh version -c
340 run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
341 - name: save artifacts
342 uses: actions/upload-artifact@v3
344 name: "ci@memory_sanitizer"
345 path: artifacts.tar.gz
348 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
350 - uses: actions/checkout@v4
351 - name: checkout fuzz/corpora submodule
352 run: git submodule update --init --depth 1 fuzz/corpora
353 - name: Adjust ASLR for sanitizer
355 sudo cat /proc/sys/vm/mmap_rnd_bits
356 sudo sysctl -w vm.mmap_rnd_bits=28
358 run: CC=clang ./config --banner=Configured no-fips --strict-warnings -fsanitize=thread && perl configdata.pm --dump
364 ./util/opensslwrap.sh version -c
366 run: .github/workflows/make-test V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
367 - name: save artifacts
368 uses: actions/upload-artifact@v3
370 name: "ci@threads_sanitizer"
371 path: artifacts.tar.gz
373 enable_non-default_options:
374 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
376 - uses: actions/checkout@v4
377 - name: checkout fuzz/corpora submodule
378 run: git submodule update --init --depth 1 fuzz/corpora
380 run: sudo modprobe tls
382 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-egd enable-ktls enable-fips no-threads && perl configdata.pm --dump
388 ./util/opensslwrap.sh version -c
390 run: .github/workflows/make-test
391 - name: save artifacts
392 uses: actions/upload-artifact@v3
394 name: "ci@enable_non-default_options"
395 path: artifacts.tar.gz
398 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
400 - uses: actions/checkout@v4
401 - name: checkout fuzz/corpora submodule
402 run: git submodule update --init --depth 1 fuzz/corpora
404 run: sudo modprobe tls
406 run: sudo modprobe sctp
407 - name: Enable auth in sctp
408 run: sudo sysctl -w net.sctp.auth_enable=1
409 - name: install extra config support
410 run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
412 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
418 ./util/opensslwrap.sh version -c
420 run: .github/workflows/make-test
421 - name: save artifacts
422 uses: actions/upload-artifact@v3
424 name: "ci@full_featured"
425 path: artifacts.tar.gz
428 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
430 - uses: actions/checkout@v4
431 - name: checkout fuzz/corpora submodule
432 run: git submodule update --init --depth 1 fuzz/corpora
434 run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-legacy enable-fips && perl configdata.pm --dump
440 ./util/opensslwrap.sh version -c
442 run: .github/workflows/make-test
443 - name: save artifacts
444 uses: actions/upload-artifact@v3
447 path: artifacts.tar.gz
450 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
452 - uses: actions/checkout@v4
453 - name: checkout fuzz/corpora submodule
454 run: git submodule update --init --depth 1 fuzz/corpora
456 run: ./config --banner=Configured -Werror --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
462 ./util/opensslwrap.sh version -c
464 run: .github/workflows/make-test
465 - name: save artifacts
466 uses: actions/upload-artifact@v3
469 path: artifacts.tar.gz
471 # out-of-source-and-install checks multiple things at the same time:
472 # - That building, testing and installing works from an out-of-source
474 # - That building, testing and installing works with a read-only source
476 out-of-readonly-source-and-install-ubuntu:
477 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
479 - uses: actions/checkout@v4
482 - name: checkout fuzz/corpora submodule
483 run: git submodule update --init --depth 1 fuzz/corpora
484 working-directory: ./source
485 - name: make source read-only
486 run: chmod -R a-w ./source
487 - name: create build and install directories
493 ../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
494 perl configdata.pm --dump
495 working-directory: ./build
498 working-directory: ./build
502 ./util/opensslwrap.sh version -c
503 working-directory: ./build
505 run: ../source/.github/workflows/make-test
506 working-directory: ./build
507 - name: save artifacts
508 uses: actions/upload-artifact@v3
510 name: "ci@out-of-readonly-source-and-install-ubuntu"
511 path: build/artifacts.tar.gz
514 working-directory: ./build
516 out-of-readonly-source-and-install-macos:
520 os: [macos-13, macos-14]
521 runs-on: ${{ matrix.os }}
522 if: github.server_url == 'https://github.com'
524 - uses: actions/checkout@v4
527 - name: checkout fuzz/corpora submodule
528 run: git submodule update --init --depth 1 fuzz/corpora
529 working-directory: ./source
530 - name: make source read-only
531 run: chmod -R a-w ./source
532 - name: create build and install directories
538 ../source/config --banner=Configured enable-fips enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
539 perl configdata.pm --dump
540 working-directory: ./build
543 working-directory: ./build
547 ./util/opensslwrap.sh version -c
548 working-directory: ./build
550 run: ../source/.github/workflows/make-test
551 working-directory: ./build
552 - name: save artifacts
553 uses: actions/upload-artifact@v3
555 name: "ci@out-of-readonly-source-and-install-${{ matrix.os }}"
556 path: build/artifacts.tar.gz
559 working-directory: ./build
562 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
564 - uses: actions/checkout@v4
566 submodules: recursive
567 - name: package installs
570 sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
571 - name: install cpanm and Test2::V0 for gost_engine testing
572 uses: perl-actions/install-with-cpanm@stable
575 - name: setup hostname workaround
576 run: sudo hostname localhost
578 run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
584 ./util/opensslwrap.sh version -c
585 - name: test external gost-engine
586 run: make test TESTS="test_external_gost_engine"
587 - name: test external krb5
588 run: make test TESTS="test_external_krb5"
589 - name: test external_tlsfuzzer
590 run: make test TESTS="test_external_tlsfuzzer"
591 - name: test external oqs-provider
592 run: make test TESTS="test_external_oqsprovider"
595 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
603 - uses: actions/checkout@v4
605 submodules: recursive
606 - name: Configure OpenSSL
607 run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
611 uses: actions/setup-python@v5.1.0
613 python-version: ${{ matrix.PYTHON }}
614 - uses: dtolnay/rust-toolchain@master
616 toolchain: ${{ matrix.RUST }}
620 ./util/opensslwrap.sh version -c
621 - name: test external pyca
622 run: make test TESTS="test_external_pyca" VERBOSE=1
624 external-test-cf-quiche:
625 runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'ubuntu-22.04-self-hosted' }}
627 - uses: actions/checkout@v4
629 submodules: recursive
630 - name: Configure OpenSSL
631 run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump
634 - uses: dtolnay/rust-toolchain@stable
638 ./util/opensslwrap.sh version -c
639 - name: test external Cloudflare quiche
640 run: make test TESTS="test_external_cf_quiche" VERBOSE=1