.github/workflows/ci.yml

   1 # Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
   2 #
   3 # Licensed under the Apache License 2.0 (the "License").  You may not use
   4 # this file except in compliance with the License.  You can obtain a copy
   5 # in the file LICENSE in the source distribution or at
   6 # https://www.openssl.org/source/license.html
   7
   8 name: GitHub CI
   9
  10 on: [pull_request, push]
  11
  12 # for some reason, this does not work:
  13 # variables:
  14 #   BUILDOPTS: "-j4"
  15 #   HARNESS_JOBS: "${HARNESS_JOBS:-4}"
  16
  17 # for some reason, this does not work:
  18 # before_script:
  19 #     - make="make -s"
  20
  21 jobs:
  22   check_update:
  23     runs-on: ubuntu-latest
  24     steps:
  25     - name: install unifdef
  26       run: |
  27         sudo apt-get update
  28         sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install unifdef
  29     - uses: actions/checkout@v2
  30       with:
  31         fetch-depth: 0
  32     - name: config
  33       run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
  34     - name: make build_generated
  35       run: make -s build_generated
  36     - name: make update
  37       run: make update
  38     - name: git diff
  39       run: git diff --exit-code
  40
  41   check_docs:
  42     runs-on: ubuntu-latest
  43     steps:
  44     - uses: actions/checkout@v2
  45     - name: config
  46       run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
  47     - name: make build_generated
  48       run: make -s build_generated
  49     - name: make doc-nits
  50       run: make doc-nits
  51     - name: make md-nits
  52       run: |
  53           sudo gem install mdl
  54           make md-nits
  55
  56   # This checks that we use ANSI C language syntax and semantics.
  57   # We are not as strict with libraries, but rather adapt to what's
  58   # expected to be available in a certain version of each platform.
  59   check-ansi:
  60     runs-on: ubuntu-latest
  61     steps:
  62     - uses: actions/checkout@v2
  63     - name: config
  64       run: CPPFLAGS=-ansi ./config --banner=Configured no-asm no-makedepend enable-buildtest-c++ enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
  65     - name: make
  66       run: make -s -j4
  67
  68   basic_gcc:
  69     runs-on: ubuntu-latest
  70     steps:
  71     - uses: actions/checkout@v2
  72     - name: localegen
  73       run: sudo locale-gen tr_TR.UTF-8
  74     - name: config
  75       run: CC=gcc ./config --banner=Configured enable-fips --strict-warnings && perl configdata.pm --dump
  76     - name: make
  77       run: make -s -j4
  78     - name: make test
  79       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
  80
  81   basic_clang:
  82     runs-on: ubuntu-latest
  83     steps:
  84     - uses: actions/checkout@v2
  85     - name: config
  86       run: CC=clang ./config --banner=Configured no-fips --strict-warnings && perl configdata.pm --dump
  87     - name: make
  88       run: make -s -j4
  89     - name: make test
  90       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
  91
  92   minimal:
  93     runs-on: ubuntu-latest
  94     steps:
  95     - uses: actions/checkout@v2
  96     - name: config
  97       run: ./config --banner=Configured --strict-warnings no-bulk no-pic no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
  98     - name: make
  99       run: make -j4 # verbose, so no -s here
 100     - name: make test
 101       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 102
 103   no-deprecated:
 104     runs-on: ubuntu-latest
 105     steps:
 106     - uses: actions/checkout@v2
 107     - name: config
 108       run: ./config --banner=Configured --strict-warnings no-deprecated enable-fips && perl configdata.pm --dump
 109     - name: make
 110       run: make -s -j4
 111     - name: make test
 112       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 113
 114   no-shared:
 115     strategy:
 116       matrix:
 117         os: [ ubuntu-latest, macos-latest ]
 118     runs-on: ${{matrix.os}}
 119     steps:
 120     - uses: actions/checkout@v2
 121     - name: config
 122       run: ./config --banner=Configured --strict-warnings no-shared no-fips && perl configdata.pm --dump
 123     - name: make
 124       run: make -s -j4
 125     - name: make test
 126       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 127
 128   non-caching:
 129     runs-on: ubuntu-latest
 130     steps:
 131     - uses: actions/checkout@v2
 132     - name: config
 133       run: ./config --banner=Configured --debug enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
 134     - name: make
 135       run: make -s -j4
 136     - name: make test
 137       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
 138
 139   address_ub_sanitizer:
 140     runs-on: ubuntu-latest
 141     steps:
 142     - uses: actions/checkout@v2
 143     - name: config
 144       run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION && perl configdata.pm --dump
 145     - name: make
 146       run: make -s -j4
 147     - name: make test
 148       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
 149
 150   memory_sanitizer:
 151     runs-on: ubuntu-latest
 152     steps:
 153     - uses: actions/checkout@v2
 154     - name: config
 155       # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
 156       run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
 157     - name: make
 158       run: make -s -j4
 159     - name: make test
 160       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
 161
 162   threads_sanitizer:
 163     runs-on: ubuntu-latest
 164     steps:
 165     - uses: actions/checkout@v2
 166     - name: config
 167       run: CC=clang ./config --banner=Configured no-fips --strict-warnings -fsanitize=thread && perl configdata.pm --dump
 168     - name: make
 169       run: make -s -j4
 170     - name: make test
 171       run: make V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp" test HARNESS_JOBS=${HARNESS_JOBS:-4}
 172
 173   enable_non-default_options:
 174     runs-on: ubuntu-latest
 175     steps:
 176     - uses: actions/checkout@v2
 177     - name: modprobe tls
 178       run: sudo modprobe tls
 179     - name: config
 180       run: ./config --banner=Configured --strict-warnings no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-crypto-mdebug-backtrace enable-egd enable-ktls enable-fips && perl configdata.pm --dump
 181     - name: make
 182       run: make -s -j4
 183     - name: make test
 184       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 185
 186   fips_and_ktls:
 187     runs-on: ubuntu-latest
 188     steps:
 189     - uses: actions/checkout@v2
 190     - name: modprobe tls
 191       run: sudo modprobe tls
 192     - name: config
 193       run: ./config --banner=Configured --strict-warnings enable-ktls enable-fips && perl configdata.pm --dump
 194     - name: make
 195       run: make -s -j4
 196     - name: make test
 197       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 198
 199   no-legacy:
 200     runs-on: ubuntu-latest
 201     steps:
 202     - uses: actions/checkout@v2
 203     - name: config
 204       run: ./config --banner=Configured --strict-warnings no-legacy enable-fips && perl configdata.pm --dump
 205     - name: make
 206       run: make -s -j4
 207     - name: make test
 208       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 209
 210   legacy:
 211     runs-on: ubuntu-latest
 212     steps:
 213     - uses: actions/checkout@v2
 214     - name: config
 215       run: ./config --banner=Configured -Werror --debug no-afalgeng no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
 216     - name: make
 217       run: make -s -j4
 218     - name: make test
 219       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 220
 221   enable-tfo:
 222     strategy:
 223       matrix:
 224         os: [ ubuntu-latest, macos-latest ]
 225     runs-on: ${{matrix.os}}
 226     steps:
 227     - uses: actions/checkout@v2
 228     - name: config
 229       run: CC=gcc ./config --banner=Configured enable-tfo --strict-warnings && perl configdata.pm --dump
 230     - name: make
 231       run: make -s -j4
 232     - name: make test
 233       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 234
 235   buildtest:
 236     runs-on: ubuntu-latest
 237     steps:
 238     - uses: actions/checkout@v2
 239     - name: config
 240       run: ./config --banner=Configured no-asm no-makedepend enable-buildtest-c++ enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
 241     - name: make
 242       run: make -s -j4
 243     - name: make test
 244       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 245
 246   out-of-source-and-install:
 247     strategy:
 248       matrix:
 249         os: [ubuntu-latest, macos-latest ]
 250     runs-on: ${{matrix.os}}
 251     steps:
 252     - uses: actions/checkout@v2
 253     - name: extra preparations
 254       run: |
 255         mkdir ./build
 256         mkdir ./install
 257     - name: config
 258       run: ../config --banner=Configured enable-fips enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd) && perl configdata.pm --dump
 259       working-directory: ./build
 260     - name: make
 261       run: make -s -j4
 262       working-directory: ./build
 263     - name: make test
 264       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 265       working-directory: ./build
 266     - name: make install
 267       run: make install
 268       working-directory: ./build
 269
 270   external-tests:
 271     runs-on: ubuntu-latest
 272     steps:
 273     - uses: actions/checkout@v2
 274       with:
 275         submodules: recursive
 276     - name: package installs
 277       run: |
 278         sudo apt-get update
 279         sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
 280     - name: install cpanm and Test2::V0 for gost_engine testing
 281       uses: perl-actions/install-with-cpanm@v1
 282       with:
 283         install: Test2::V0
 284     - name: setup hostname workaround
 285       run: sudo hostname localhost
 286     - name: config
 287       run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
 288     - name: make
 289       run: make -s -j4
 290     - name: test external gost-engine
 291       run: make test TESTS="test_external_gost_engine"
 292     - name: test external krb5
 293       run: make test TESTS="test_external_krb5"
 294     - name: test external_tlsfuzzer
 295       run: make test TESTS="test_external_tlsfuzzer"
 296     - name: test external oqs-provider
 297       run: make test TESTS="test_external_oqsprovider"
 298
 299   external-test-pyca:
 300     runs-on: ubuntu-latest
 301     strategy:
 302       matrix:
 303         RUST:
 304           - 1.51.0
 305         PYTHON:
 306           - 3.9
 307     steps:
 308     - uses: actions/checkout@v2
 309       with:
 310         submodules: recursive
 311     - name: Configure OpenSSL
 312       run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
 313     - name: make
 314       run: make -s -j4
 315     - name: Setup Python
 316       uses: actions/setup-python@v2.2.2
 317       with:
 318         python-version: ${{ matrix.PYTHON }}
 319     - uses: actions-rs/toolchain@v1
 320       with:
 321         profile: minimal
 322         toolchain: ${{ matrix.RUST }}
 323         override: true
 324         default: true
 325     - name: test external pyca
 326       run: make test TESTS="test_external_pyca" VERBOSE=1