From 1fbffe7f08f0d551038520b569b817f58084f77b Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 20 Apr 2026 00:49:06 +0200 Subject: [PATCH] GHA: use more OpenSSL 4, enable ECH in more jobs for Linux and macOS. Closes #21379 --- .github/workflows/linux.yml | 16 ++++++++++------ .github/workflows/macos.yml | 34 +++++++++++++++++----------------- 2 files changed, 27 insertions(+), 23 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 7bc0e2e390..02d6fed2c6 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -301,12 +301,13 @@ jobs: - name: 'clang-tidy' install_packages: clang-20 clang-tidy-20 libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev install_steps: skiprun mbedtls-latest-intel rustls wolfssl-opensslextra-intel - install_steps_brew: gsasl + install_steps_brew: openssl@4 gsasl CC: clang-20 LDFLAGS: >- -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib -Wl,-rpath,/home/runner/mbedtls/lib -Wl,-rpath,/home/runner/rustls/lib + -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl@4/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/gsasl/lib PKG_CONFIG_PATH: "\ @@ -315,7 +316,8 @@ jobs: /home/runner/rustls/lib/pkgconfig:\ /home/linuxbrew/.linuxbrew/opt/gsasl/lib/pkgconfig" generate: >- - -DCURL_USE_OPENSSL=ON -DCURL_USE_WOLFSSL=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON + -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4 + -DCURL_USE_WOLFSSL=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DCURL_USE_GSASL=ON -DUSE_ECH=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20 @@ -323,7 +325,7 @@ jobs: - name: 'clang-tidy H3 c-ares !examples' install_packages: clang-20 clang-tidy-20 libidn2-dev libssh-dev libnghttp2-dev install_steps: skiprun - install_steps_brew: openssl libngtcp2 libnghttp3 c-ares + install_steps_brew: libngtcp2 libnghttp3 c-ares CC: clang-20 LDFLAGS: >- -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl/lib @@ -359,7 +361,7 @@ jobs: - name: 'address-sanitizer H3 c-ares' install_packages: clang-20 libubsan1 libasan8 libtsan2 install_steps: pytest - install_steps_brew: openssl libssh2 libngtcp2 libnghttp3 c-ares + install_steps_brew: openssl@4 libssh2 libngtcp2 libnghttp3 c-ares CC: clang-20 CFLAGS: >- -fsanitize=address,bounds,leak,signed-integer-overflow,undefined @@ -375,7 +377,9 @@ jobs: /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:\ /home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:\ /home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig" - generate: -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON + generate: >- + -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4 -DUSE_ECH=ON -DUSE_NGTCP2=ON + -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON - name: 'thread-sanitizer' install_packages: clang-20 libtsan2 @@ -383,7 +387,7 @@ jobs: CC: clang-20 CFLAGS: -fsanitize=thread -g LDFLAGS: -fsanitize=thread - generate: -DOPENSSL_ROOT_DIR=/home/runner/openssl -DENABLE_DEBUG=ON + generate: -DOPENSSL_ROOT_DIR=/home/runner/openssl -DUSE_ECH=ON -DENABLE_DEBUG=ON - name: 'memory-sanitizer' install_packages: clang-20 diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index a433962405..9494cea4f6 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -238,8 +238,8 @@ jobs: - name: 'OpenSSL libssh c-ares' compiler: clang - install: libssh - configure: --enable-debug --with-libssh --with-openssl=/opt/homebrew/opt/openssl --enable-ares --with-fish-functions-dir --with-zsh-functions-dir + install: openssl@4 libssh + configure: --enable-debug --with-libssh --with-openssl=/opt/homebrew/opt/openssl@4 --enable-ech --enable-ares --with-fish-functions-dir --with-zsh-functions-dir - name: 'OpenSSL libssh' compiler: llvm@18 @@ -289,9 +289,9 @@ jobs: - name: 'OpenSSL gsasl AppleIDN SecTrust +examples' compiler: clang - install: libnghttp3 libngtcp2 gsasl + install: openssl@4 libnghttp3 libngtcp2 gsasl generate: >- - -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON + -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON -DUSE_APPLE_SECTRUST=ON -DCURL_ENABLE_NTLM=ON - name: 'MultiSSL AppleIDN clang-tidy +examples' @@ -370,26 +370,33 @@ jobs: - name: 'OpenSSL torture 1' compiler: clang - install: libnghttp3 + install: openssl@4 libnghttp3 install_steps: torture - generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_ENABLE_NTLM=ON + generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON tflags: '-t --shallow=25 --min=480 1 to 500' - name: 'OpenSSL torture 2' compiler: clang - install: libnghttp3 + install: openssl@4 libnghttp3 install_steps: torture - generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_ENABLE_NTLM=ON + generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON tflags: '-t --shallow=25 --min=730 501 to 1250' - name: 'OpenSSL torture 3' compiler: clang - install: libnghttp3 + install: openssl@4 libnghttp3 install_steps: torture - generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_ENABLE_NTLM=ON + generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON tflags: '-t --shallow=25 --min=628 1251 to 9999' steps: + - name: 'brew unlink openssl' + if: ${{ contains(matrix.build.install, 'aws-lc') || contains(matrix.build.install, 'libressl') || contains(matrix.build.install, 'openssl@4') }} + run: | + if [ -d "$(brew --prefix)"/include/openssl ]; then + brew unlink openssl + fi + - name: 'brew install' timeout-minutes: 5 # Run this command with retries because of spurious failures seen @@ -415,13 +422,6 @@ jobs: false Too many retries done - - name: 'brew unlink openssl' - if: ${{ contains(matrix.build.install, 'aws-lc') || contains(matrix.build.install, 'libressl') }} - run: | - if [ -d "$(brew --prefix)"/include/openssl ]; then - brew unlink openssl - fi - - name: 'toolchain versions' run: | [[ "${MATRIX_COMPILER}" = 'llvm'* ]] && CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"