xref: /openssl/.github/workflows/ci.yml (revision 5c5b8d2d)
1# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
2#
3# Licensed under the Apache License 2.0 (the "License").  You may not use
4# this file except in compliance with the License.  You can obtain a copy
5# in the file LICENSE in the source distribution or at
6# https://www.openssl.org/source/license.html
7
8name: GitHub CI
9
10on: [pull_request, push]
11
12# for some reason, this does not work:
13# variables:
14#   BUILDOPTS: "-j4"
15#   HARNESS_JOBS: "${HARNESS_JOBS:-4}"
16
17# for some reason, this does not work:
18# before_script:
19#     - make="make -s"
20
21permissions:
22  contents: read
23
24env:
25  OSSL_RUN_CI_TESTS: 1
26
27jobs:
28  check_update:
29    runs-on: ubuntu-latest
30    steps:
31    - name: install unifdef
32      run: |
33        sudo apt-get update
34        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install unifdef
35    - uses: actions/checkout@v4
36      with:
37        fetch-depth: 0
38    - name: config
39      run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
40    - name: make build_generated
41      run: make -s build_generated
42    - name: make update
43      run: make update
44    - name: git diff
45      run: git diff --exit-code
46
47  check_docs:
48    runs-on: ubuntu-latest
49    steps:
50    - uses: actions/checkout@v4
51    - name: config
52      run: ./config --banner=Configured --strict-warnings enable-fips && perl configdata.pm --dump
53    - name: make build_generated
54      run: make -s build_generated
55    - name: make doc-nits
56      run: make doc-nits
57    - name: make help
58      run: make help
59    - name: make md-nits
60      run: |
61          sudo gem install mdl
62          make md-nits
63
64  # This checks that we use ANSI C language syntax and semantics.
65  # We are not as strict with libraries, but rather adapt to what's
66  # expected to be available in a certain version of each platform.
67  check-ansi:
68    runs-on: ubuntu-latest
69    steps:
70    - uses: actions/checkout@v4
71    - name: config
72      run: CPPFLAGS='-ansi -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --banner=Configured enable-sslkeylog no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips --strict-warnings && perl configdata.pm --dump
73    - name: make
74      run: make -s -j4
75
76  basic_gcc:
77    runs-on: ubuntu-latest
78    steps:
79    - uses: actions/checkout@v4
80    - name: checkout fuzz/corpora submodule
81      run: git submodule update --init --depth 1 fuzz/corpora
82    - name: localegen
83      run: sudo locale-gen tr_TR.UTF-8
84    - name: fipsvendor
85      # Make one fips build use a customized FIPS vendor
86      run: echo "FIPS_VENDOR=CI" >> VERSION.dat
87    - name: config
88      # enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
89      run: CC=gcc ./config --banner=Configured enable-demos enable-h3demo enable-sslkeylog enable-fips enable-quic --strict-warnings && perl configdata.pm --dump
90    - name: make
91      run: make -s -j4
92    - name: get cpu info
93      run: |
94        cat /proc/cpuinfo
95        ./util/opensslwrap.sh version -c
96    - name: make test
97      run: .github/workflows/make-test
98    - name: check fipsvendor
99      run: |
100        util/wrap.pl -fips apps/openssl list -providers | grep 'name: CI FIPS Provider for OpenSSL$'
101    - name: save artifacts
102      uses: actions/upload-artifact@v3
103      with:
104        name: "ci@basic-gcc"
105        path: artifacts.tar.gz
106
107  basic_clang:
108    runs-on: ubuntu-latest
109    steps:
110    - uses: actions/checkout@v4
111    - name: checkout fuzz/corpora submodule
112      run: git submodule update --init --depth 1 fuzz/corpora
113    - name: config
114      run: CC=clang ./config --banner=Configured enable-demos enable-h3demo no-fips --strict-warnings && perl configdata.pm --dump
115    - name: make
116      run: make -s -j4
117    - name: get cpu info
118      run: |
119        cat /proc/cpuinfo
120        ./util/opensslwrap.sh version -c
121    - name: make test
122      run: .github/workflows/make-test
123    - name: save artifacts
124      uses: actions/upload-artifact@v3
125      with:
126        name: "ci@basic-clang"
127        path: artifacts.tar.gz
128
129  self-hosted:
130    if: github.repository == 'openssl/openssl'
131    strategy:
132      matrix:
133        os: [freebsd-13.2, ubuntu-arm64-22.04]
134    runs-on: ${{ matrix.os }}-self-hosted
135    continue-on-error: true
136    steps:
137    - uses: actions/checkout@v4
138    - name: config
139      run: ./config enable-demos enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
140    - name: config dump
141      run: ./configdata.pm --dump
142    - name: make
143      run: make -j4
144    - name: get cpu info
145      run: ./util/opensslwrap.sh version -c
146    - name: make test
147      run: .github/workflows/make-test
148    - name: save artifacts
149      uses: actions/upload-artifact@v3
150      with:
151        name: "ci@self-hosted-${{ matrix.os }}"
152        path: artifacts.tar.gz
153
154  minimal:
155    runs-on: ubuntu-latest
156    steps:
157    - uses: actions/checkout@v4
158    - name: checkout fuzz/corpora submodule
159      run: git submodule update --init --depth 1 fuzz/corpora
160    - name: config
161      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-bulk no-pic no-asm -DOPENSSL_NO_SECURE_MEMORY -DOPENSSL_SMALL_FOOTPRINT && perl configdata.pm --dump
162    - name: make
163      run: make -j4 # verbose, so no -s here
164    - name: get cpu info
165      run: |
166        cat /proc/cpuinfo
167        ./util/opensslwrap.sh version -c
168    - name: make test
169      run: .github/workflows/make-test
170    - name: save artifacts
171      uses: actions/upload-artifact@v3
172      with:
173        name: "ci@minimal"
174        path: artifacts.tar.gz
175
176  no-deprecated:
177    runs-on: ubuntu-latest
178    steps:
179    - uses: actions/checkout@v4
180    - name: checkout fuzz/corpora submodule
181      run: git submodule update --init --depth 1 fuzz/corpora
182    - name: config
183      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-deprecated enable-fips && perl configdata.pm --dump
184    - name: make
185      run: make -s -j4
186    - name: get cpu info
187      run: |
188        cat /proc/cpuinfo
189        ./util/opensslwrap.sh version -c
190    - name: make test
191      run: .github/workflows/make-test
192    - name: save artifacts
193      uses: actions/upload-artifact@v3
194      with:
195        name: "ci@no-deprecated"
196        path: artifacts.tar.gz
197
198  no-shared-ubuntu:
199    runs-on: ubuntu-latest
200    steps:
201    - uses: actions/checkout@v4
202    - name: checkout fuzz/corpora submodule
203      run: git submodule update --init --depth 1 fuzz/corpora
204    - name: config
205      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
206    - name: make
207      run: make -s -j4
208    - name: get cpu info
209      run: |
210        cat /proc/cpuinfo
211        ./util/opensslwrap.sh version -c
212    - name: make test
213      run: .github/workflows/make-test
214    - name: save artifacts
215      uses: actions/upload-artifact@v3
216      with:
217        name: "ci@no-shared-ubuntu"
218        path: artifacts.tar.gz
219
220  no-shared-macos:
221    strategy:
222      fail-fast: false
223      matrix:
224        os: [macos-13, macos-14]
225    runs-on: ${{ matrix.os }}
226    steps:
227    - uses: actions/checkout@v4
228    - name: checkout fuzz/corpora submodule
229      run: git submodule update --init --depth 1 fuzz/corpora
230    - name: config
231      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-shared no-fips && perl configdata.pm --dump
232    - name: make
233      run: make -s -j4
234    - name: get cpu info
235      run: |
236        sysctl machdep.cpu
237        ./util/opensslwrap.sh version -c
238    - name: make test
239      run: .github/workflows/make-test
240    - name: save artifacts
241      uses: actions/upload-artifact@v3
242      with:
243        name: "ci@no-shared-${{ matrix.os }}"
244        path: artifacts.tar.gz
245
246  non-caching:
247    runs-on: ubuntu-latest
248    steps:
249    - uses: actions/checkout@v4
250    - name: checkout fuzz/corpora submodule
251      run: git submodule update --init --depth 1 fuzz/corpora
252    - name: Adjust ASLR for sanitizer
253      run: |
254        sudo cat /proc/sys/vm/mmap_rnd_bits
255        sudo sysctl -w vm.mmap_rnd_bits=28
256    - name: config
257      run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan no-cached-fetch no-fips no-dtls no-tls1 no-tls1-method no-tls1_1 no-tls1_1-method no-async && perl configdata.pm --dump
258    - name: make
259      run: make -s -j4
260    - name: get cpu info
261      run: |
262        cat /proc/cpuinfo
263        ./util/opensslwrap.sh version -c
264    - name: make test
265      run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_sslapi -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
266    - name: save artifacts
267      uses: actions/upload-artifact@v3
268      with:
269        name: "ci@non-caching"
270        path: artifacts.tar.gz
271
272  address_ub_sanitizer:
273    runs-on: ubuntu-latest
274    steps:
275    - uses: actions/checkout@v4
276    - name: checkout fuzz/corpora submodule
277      run: git submodule update --init --depth 1 fuzz/corpora
278    - name: Adjust ASLR for sanitizer
279      run: |
280        sudo cat /proc/sys/vm/mmap_rnd_bits
281        sudo sysctl -w vm.mmap_rnd_bits=28
282    - name: config
283      run: ./config --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
284    - name: make
285      run: make -s -j4
286    - name: get cpu info
287      run: |
288        cat /proc/cpuinfo
289        ./util/opensslwrap.sh version -c
290    - name: make test
291      run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
292    - name: save artifacts
293      uses: actions/upload-artifact@v3
294      with:
295        name: "ci@address_ub_sanitizer"
296        path: artifacts.tar.gz
297
298  fuzz_tests:
299    runs-on: ubuntu-latest
300    steps:
301    - uses: actions/checkout@v4
302    - name: checkout fuzz/corpora submodule
303      run: git submodule update --init --depth 1 fuzz/corpora
304    - name: Adjust ASLR for sanitizer
305      run: |
306        sudo cat /proc/sys/vm/mmap_rnd_bits
307        sudo sysctl -w vm.mmap_rnd_bits=28
308    - name: config
309      run: ./config --banner=Configured --debug -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method enable-nextprotoneg && perl configdata.pm --dump
310    - name: make
311      run: make -s -j4
312    - name: get cpu info
313      run: |
314        cat /proc/cpuinfo
315        ./util/opensslwrap.sh version -c
316    - name: make test
317      run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
318    - name: save artifacts
319      uses: actions/upload-artifact@v3
320      with:
321        name: "ci@fuzz_tests"
322        path: artifacts.tar.gz
323        if-no-files-found: ignore
324
325  memory_sanitizer:
326    runs-on: ubuntu-latest
327    steps:
328    - uses: actions/checkout@v4
329    - name: checkout fuzz/corpora submodule
330      run: git submodule update --init --depth 1 fuzz/corpora
331    - name: Adjust ASLR for sanitizer
332      run: |
333        sudo cat /proc/sys/vm/mmap_rnd_bits
334        sudo sysctl -w vm.mmap_rnd_bits=28
335    - name: config
336      # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
337      run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
338    - name: make
339      run: make -s -j4
340    - name: get cpu info
341      run: |
342        cat /proc/cpuinfo
343        ./util/opensslwrap.sh version -c
344    - name: make test
345      run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0
346    - name: save artifacts
347      uses: actions/upload-artifact@v3
348      with:
349        name: "ci@memory_sanitizer"
350        path: artifacts.tar.gz
351
352  threads_sanitizer:
353    runs-on: ubuntu-latest
354    steps:
355    - uses: actions/checkout@v4
356    - name: checkout fuzz/corpora submodule
357      run: git submodule update --init --depth 1 fuzz/corpora
358    - name: Adjust ASLR for sanitizer
359      run: |
360        sudo cat /proc/sys/vm/mmap_rnd_bits
361        sudo sysctl -w vm.mmap_rnd_bits=28
362    - name: config
363      run: CC=clang ./config --banner=Configured no-fips --strict-warnings -fsanitize=thread && perl configdata.pm --dump
364    - name: make
365      run: make -s -j4
366    - name: get cpu info
367      run: |
368        cat /proc/cpuinfo
369        ./util/opensslwrap.sh version -c
370    - name: make test
371      run: .github/workflows/make-test V=1 TESTS="test_threads test_internal_provider test_provfetch test_provider test_pbe test_evp_kdf test_pkcs12 test_store test_evp test_quic*"
372    - name: save artifacts
373      uses: actions/upload-artifact@v3
374      with:
375        name: "ci@threads_sanitizer"
376        path: artifacts.tar.gz
377
378  enable_non-default_options:
379    runs-on: ubuntu-latest
380    steps:
381    - uses: actions/checkout@v4
382    - name: checkout fuzz/corpora submodule
383      run: git submodule update --init --depth 1 fuzz/corpora
384    - name: modprobe tls
385      run: sudo modprobe tls
386    - name: config
387      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-ec enable-ssl-trace enable-zlib enable-zlib-dynamic enable-crypto-mdebug enable-egd enable-ktls enable-fips no-threads && perl configdata.pm --dump
388    - name: make
389      run: make -s -j4
390    - name: get cpu info
391      run: |
392        cat /proc/cpuinfo
393        ./util/opensslwrap.sh version -c
394    - name: make test
395      run: .github/workflows/make-test
396    - name: save artifacts
397      uses: actions/upload-artifact@v3
398      with:
399        name: "ci@enable_non-default_options"
400        path: artifacts.tar.gz
401
402  full_featured:
403    runs-on: ubuntu-latest
404    steps:
405    - uses: actions/checkout@v4
406    - name: checkout fuzz/corpora submodule
407      run: git submodule update --init --depth 1 fuzz/corpora
408    - name: modprobe tls
409      run: sudo modprobe tls
410    - name: Enable sctp
411      run: sudo modprobe sctp
412    - name: Enable auth in sctp
413      run: sudo sysctl -w net.sctp.auth_enable=1
414    - name: install extra config support
415      run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
416    - name: config
417      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
418    - name: make
419      run: make -s -j4
420    - name: get cpu info
421      run: |
422        cat /proc/cpuinfo
423        ./util/opensslwrap.sh version -c
424    - name: make test
425      run: .github/workflows/make-test
426    - name: save artifacts
427      uses: actions/upload-artifact@v3
428      with:
429        name: "ci@full_featured"
430        path: artifacts.tar.gz
431
432  no-legacy:
433    runs-on: ubuntu-latest
434    steps:
435    - uses: actions/checkout@v4
436    - name: checkout fuzz/corpora submodule
437      run: git submodule update --init --depth 1 fuzz/corpora
438    - name: config
439      run: ./config --banner=Configured --strict-warnings enable-demos enable-h3demo no-legacy enable-fips && perl configdata.pm --dump
440    - name: make
441      run: make -s -j4
442    - name: get cpu info
443      run: |
444        cat /proc/cpuinfo
445        ./util/opensslwrap.sh version -c
446    - name: make test
447      run: .github/workflows/make-test
448    - name: save artifacts
449      uses: actions/upload-artifact@v3
450      with:
451        name: "ci@no-legacy"
452        path: artifacts.tar.gz
453
454  legacy:
455    runs-on: ubuntu-latest
456    steps:
457    - uses: actions/checkout@v4
458    - name: checkout fuzz/corpora submodule
459      run: git submodule update --init --depth 1 fuzz/corpora
460    - name: config
461      run: ./config --banner=Configured -Werror --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
462    - name: make
463      run: make -s -j4
464    - name: get cpu info
465      run: |
466        cat /proc/cpuinfo
467        ./util/opensslwrap.sh version -c
468    - name: make test
469      run: .github/workflows/make-test
470    - name: save artifacts
471      uses: actions/upload-artifact@v3
472      with:
473        name: "ci@legacy"
474        path: artifacts.tar.gz
475
476  # out-of-source-and-install checks multiple things at the same time:
477  # - That building, testing and installing works from an out-of-source
478  #   build tree
479  # - That building, testing and installing works with a read-only source
480  #   tree
481  out-of-readonly-source-and-install-ubuntu:
482    runs-on: ubuntu-latest
483    steps:
484    - uses: actions/checkout@v4
485      with:
486        path: ./source
487    - name: checkout fuzz/corpora submodule
488      run: git submodule update --init --depth 1 fuzz/corpora
489      working-directory: ./source
490    - name: make source read-only
491      run: chmod -R a-w ./source
492    - name: create build and install directories
493      run: |
494        mkdir ./build
495        mkdir ./install
496    - name: config
497      run: |
498        ../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
499        perl configdata.pm --dump
500      working-directory: ./build
501    - name: make
502      run: make -s -j4
503      working-directory: ./build
504    - name: get cpu info
505      run: |
506        cat /proc/cpuinfo
507        ./util/opensslwrap.sh version -c
508      working-directory: ./build
509    - name: make test
510      run: ../source/.github/workflows/make-test
511      working-directory: ./build
512    - name: save artifacts
513      uses: actions/upload-artifact@v3
514      with:
515        name: "ci@out-of-readonly-source-and-install-ubuntu"
516        path: build/artifacts.tar.gz
517    - name: make install
518      run: make install
519      working-directory: ./build
520
521  out-of-readonly-source-and-install-macos:
522    strategy:
523      fail-fast: false
524      matrix:
525        os: [macos-13, macos-14]
526    runs-on: ${{ matrix.os }}
527    steps:
528    - uses: actions/checkout@v4
529      with:
530        path: ./source
531    - name: checkout fuzz/corpora submodule
532      run: git submodule update --init --depth 1 fuzz/corpora
533      working-directory: ./source
534    - name: make source read-only
535      run: chmod -R a-w ./source
536    - name: create build and install directories
537      run: |
538        mkdir ./build
539        mkdir ./install
540    - name: config
541      run: |
542        ../source/config --banner=Configured enable-fips enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
543        perl configdata.pm --dump
544      working-directory: ./build
545    - name: make
546      run: make -s -j4
547      working-directory: ./build
548    - name: get cpu info
549      run: |
550        sysctl machdep.cpu
551        ./util/opensslwrap.sh version -c
552      working-directory: ./build
553    - name: make test
554      run: ../source/.github/workflows/make-test
555      working-directory: ./build
556    - name: save artifacts
557      uses: actions/upload-artifact@v3
558      with:
559        name: "ci@out-of-readonly-source-and-install-${{ matrix.os }}"
560        path: build/artifacts.tar.gz
561    - name: make install
562      run: make install
563      working-directory: ./build
564
565  external-tests-misc:
566    runs-on: ubuntu-latest
567    steps:
568    - uses: actions/checkout@v4
569      with:
570        submodules: recursive
571    - name: package installs
572      run: |
573        sudo apt-get update
574        sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb
575    - name: install cpanm and Test2::V0 for gost_engine testing
576      uses: perl-actions/install-with-cpanm@stable
577      with:
578        install: Test2::V0
579    - name: setup hostname workaround
580      run: sudo hostname localhost
581    - name: config
582      run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
583    - name: make
584      run: make -s -j4
585    - uses: dtolnay/rust-toolchain@stable
586    - name: get cpu info
587      run: |
588        cat /proc/cpuinfo
589        ./util/opensslwrap.sh version -c
590    - name: test external gost-engine
591      run: make test TESTS="test_external_gost_engine"
592    - name: test external krb5
593      run: make test TESTS="test_external_krb5"
594    - name: test external tlsfuzzer
595      run: make test TESTS="test_external_tlsfuzzer"
596    - name: test external Cloudflare quiche
597      run: make test TESTS="test_external_cf_quiche" VERBOSE=1
598    - name: test ability to produce debuginfo files
599      run: |
600        make debuginfo
601        gdb < <(echo -e "file ./libcrypto.so.3\nquit") > ./results
602        grep -q "Reading symbols from.*libcrypto\.so\.3\.debug" results
603
604  external-tests-providers:
605    runs-on: ubuntu-latest
606    steps:
607    - uses: actions/checkout@v4
608      with:
609        submodules: recursive
610    - name: package installs
611      run: |
612        sudo apt-get update
613        sudo apt-get -yq install meson pkg-config gnutls-bin libnss3-tools libnss3-dev libsofthsm2 opensc expect
614    - name: config
615      run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
616    - name: make
617      run: make -s -j4
618    - name: get cpu info
619      run: |
620        cat /proc/cpuinfo
621        ./util/opensslwrap.sh version -c
622    - name: test external oqs-provider
623      run: make test TESTS="test_external_oqsprovider"
624    - name: test external pkcs11-provider
625      run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
626
627  external-tests-pyca:
628    runs-on: ubuntu-latest
629    strategy:
630      matrix:
631        RUST:
632          - 1.51.0
633        PYTHON:
634          - 3.9
635    steps:
636    - uses: actions/checkout@v4
637      with:
638        submodules: recursive
639    - name: Configure OpenSSL
640      run: ./config --banner=Configured --strict-warnings --debug enable-external-tests && perl configdata.pm --dump
641    - name: make
642      run: make -s -j4
643    - name: Setup Python
644      uses: actions/setup-python@v5.3.0
645      with:
646        python-version: ${{ matrix.PYTHON }}
647    - uses: dtolnay/rust-toolchain@master
648      with:
649        toolchain: ${{ matrix.RUST }}
650    - name: get cpu info
651      run: |
652        cat /proc/cpuinfo
653        ./util/opensslwrap.sh version -c
654    - name: test external pyca
655      run: make test TESTS="test_external_pyca" VERBOSE=1
656