1# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
2#
3# Licensed under the Apache License 2.0 (the "License").  You may not use
4# this file except in compliance with the License.  You can obtain a copy
5# in the file LICENSE in the source distribution or at
6# https://www.openssl.org/source/license.html
7
8name: Run-checker daily
9# Jobs run daily
10
11on:
12  schedule:
13    - cron: '30 02 * * *'
14  workflow_dispatch:
15
16permissions:
17  contents: read
18
19jobs:
20  run-checker:
21    strategy:
22      fail-fast: false
23      matrix:
24        opt: [
25          386,
26          no-afalgeng,
27          no-apps,
28          no-aria,
29          no-asan,
30          no-asm,
31          no-async,
32          no-atexit,
33          no-autoalginit,
34          no-autoerrinit,
35          no-autoload-config,
36          no-bf,
37          no-blake2,
38          no-buildtest-c++,
39          no-bulk,
40          no-cached-fetch,
41          no-camellia,
42          no-capieng,
43          no-cast,
44          no-chacha,
45          no-cmac,
46          no-comp,
47          enable-crypto-mdebug,
48          no-crypto-mdebug,
49          enable-crypto-mdebug-backtrace,
50          no-crypto-mdebug-backtrace,
51          no-deprecated,
52          no-des,
53          no-devcryptoeng,
54          no-docs,
55          no-dsa,
56          no-dtls1,
57          no-dtls1_2,
58          no-dtls1_2-method,
59          no-dtls1-method,
60          no-ecdh,
61          no-ecdsa,
62          enable-ec_nistp_64_gcc_128,
63          no-ec_nistp_64_gcc_128,
64          enable-egd,
65          no-egd,
66          no-engine,
67          no-external-tests,
68          enable-fips,
69          enable-fips enable-acvp-tests,
70          enable-fips no-tls1_3,
71          enable-fips no-des no-dsa no-ec2m,
72          no-fuzz-afl,
73          no-fuzz-libfuzzer,
74          no-gost,
75          enable-heartbeats,
76          no-heartbeats,
77          no-hw,
78          no-hw-padlock,
79          no-idea,
80          no-makedepend,
81          enable-md2,
82          no-md2,
83          no-md4,
84          no-mdc2,
85          no-msan,
86          no-multiblock,
87          no-nextprotoneg,
88          no-ocb,
89          no-padlockeng,
90          no-pic,
91          no-poly1305,
92          no-posix-io,
93          no-psk,
94          no-rc2,
95          no-rc4,
96          enable-rc5,
97          no-rc5,
98          no-rdrand,
99          no-rfc3779,
100          no-ripemd,
101          no-rmd160,
102          no-scrypt,
103          no-secure-memory,
104          no-seed,
105          no-shared,
106          no-siphash,
107          no-siv,
108          no-sm2,
109          no-sm2-precomp,
110          no-sm3,
111          no-sm4,
112          no-sock,
113          no-sse2,
114          no-ssl,
115          no-ssl3,
116          no-ssl3-method,
117          no-ssl-trace,
118          no-static-engine no-shared,
119          no-tests,
120          enable-tfo,
121          no-tls1,
122          no-tls1_1,
123          no-tls1_1-method,
124          no-tls1_2-method,
125          no-tls1-method,
126          no-trace,
127          no-ubsan,
128          no-ui-console,
129          no-unit-test,
130          enable-unit-test,
131          no-uplink,
132          no-weak-ssl-ciphers,
133          no-whirlpool,
134          no-zlib,
135          enable-zlib-dynamic,
136          no-zlib-dynamic,
137          -DOPENSSL_NO_BUILTIN_OVERFLOW_CHECKING,
138          -DSSL3_ALIGN_PAYLOAD=4
139        ]
140    runs-on: ubuntu-latest
141    steps:
142    - uses: actions/checkout@v4
143    - name: checkout fuzz/corpora submodule
144      run: git submodule update --init --depth 1 fuzz/corpora
145    - name: config
146      run: CC=clang ./config --banner=Configured --strict-warnings ${{ matrix.opt }}
147    - name: config dump
148      run: ./configdata.pm --dump
149    - name: make
150      run: make -s -j4
151    - name: get cpu info
152      run: |
153        cat /proc/cpuinfo
154        if [ -x apps/openssl ] ; then ./util/opensslwrap.sh version -c ; fi
155    - name: make test
156      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
157
158  run-checker-sctp:
159    runs-on: ubuntu-latest
160    steps:
161    - uses: actions/checkout@v4
162    - name: checkout fuzz/corpora submodule
163      run: git submodule update --init --depth 1 fuzz/corpora
164    - name: Install Dependencies for sctp option
165      run:  |
166        sudo apt-get update
167        sudo apt-get -yq install lksctp-tools libsctp-dev
168
169    - name: Check SCTP and enable auth
170      id: sctp_auth
171      continue-on-error: true
172      run:  |
173        checksctp
174        sudo sysctl -w net.sctp.auth_enable=1
175
176    - name: config
177      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
178      run: CC=clang ./config --banner=Configured --strict-warnings enable-sctp
179
180    - name: config dump
181      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
182      run: ./configdata.pm --dump
183
184    - name: make
185      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
186      run: make -s -j4
187
188    - name: get cpu info
189      run: |
190        cat /proc/cpuinfo
191        ./util/opensslwrap.sh version -c
192
193    - name: make test
194      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
195      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
196
197  jitter:
198    runs-on: ubuntu-latest
199    steps:
200    - name: checkout openssl
201      uses: actions/checkout@v4
202    - name: checkout jitter
203      uses: actions/checkout@v4
204      with:
205        repository: smuellerDD/jitterentropy-library
206        ref: v3.5.0
207        path: jitter
208    - name: build jitter
209      run: make -C jitter/
210    - name: checkout fuzz/corpora submodule
211      run: git submodule update --init --depth 1 fuzz/corpora
212    - name: config
213      run: ./config --with-rand-seed=none enable-jitter enable-fips-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump
214    - name: make
215      run: make -s -j4
216    - name: get cpu info
217      run: |
218        cat /proc/cpuinfo
219        ./util/opensslwrap.sh version -c
220    - name: make test
221      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
222
223  enable_brotli_dynamic:
224    runs-on: ubuntu-latest
225    steps:
226    - name: install brotli
227      run: |
228        sudo apt-get update
229        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
230    - name: checkout openssl
231      uses: actions/checkout@v4
232    - name: checkout fuzz/corpora submodule
233      run: git submodule update --init --depth 1 fuzz/corpora
234    - name: config
235      run: ./config enable-comp enable-brotli enable-brotli-dynamic && perl configdata.pm --dump
236    - name: make
237      run: make -s -j4
238    - name: get cpu info
239      run: |
240        cat /proc/cpuinfo
241        ./util/opensslwrap.sh version -c
242    - name: make test
243      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
244
245  enable_zstd_dynamic:
246    runs-on: ubuntu-latest
247    steps:
248    - name: install zstd
249      run: |
250        sudo apt-get update
251        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
252    - name: checkout openssl
253      uses: actions/checkout@v4
254    - name: checkout fuzz/corpora submodule
255      run: git submodule update --init --depth 1 fuzz/corpora
256    - name: config
257      run: ./config enable-comp enable-zstd enable-zstd-dynamic && perl configdata.pm --dump
258    - name: make
259      run: make -s -j4
260    - name: get cpu info
261      run: |
262        cat /proc/cpuinfo
263        ./util/opensslwrap.sh version -c
264    - name: make test
265      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
266
267  enable_brotli_and_zstd_dynamic:
268    runs-on: ubuntu-latest
269    steps:
270    - name: install brotli and zstd
271      run: |
272        sudo apt-get update
273        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
274        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
275    - name: checkout openssl
276      uses: actions/checkout@v4
277    - name: checkout fuzz/corpora submodule
278      run: git submodule update --init --depth 1 fuzz/corpora
279    - name: config
280      run: ./config enable-comp enable-brotli enable-brotli-dynamic enable-zstd enable-zstd-dynamic && perl configdata.pm --dump
281    - name: make
282      run: make -s -j4
283    - name: get cpu info
284      run: |
285        cat /proc/cpuinfo
286        ./util/opensslwrap.sh version -c
287    - name: make test
288      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
289
290  enable_brotli_and_asan_ubsan:
291    runs-on: ubuntu-latest
292    steps:
293    - name: install brotli
294      run: |
295        sudo apt-get update
296        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
297    - name: checkout openssl
298      uses: actions/checkout@v4
299    - name: checkout fuzz/corpora submodule
300      run: git submodule update --init --depth 1 fuzz/corpora
301    - name: Adjust ASLR for sanitizer
302      run: |
303        sudo cat /proc/sys/vm/mmap_rnd_bits
304        sudo sysctl -w vm.mmap_rnd_bits=28
305    - name: config
306      run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-comp enable-brotli -DPEDANTIC && perl configdata.pm --dump
307    - name: make
308      run: make -s -j4
309    - name: get cpu info
310      run: |
311        cat /proc/cpuinfo
312        ./util/opensslwrap.sh version -c
313    - name: make test
314      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
315
316  enable_zstd_and_asan_ubsan:
317    runs-on: ubuntu-latest
318    steps:
319    - name: install zstd
320      run: |
321        sudo apt-get update
322        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
323    - name: checkout openssl
324      uses: actions/checkout@v4
325    - name: checkout fuzz/corpora submodule
326      run: git submodule update --init --depth 1 fuzz/corpora
327    - name: Adjust ASLR for sanitizer
328      run: |
329        sudo cat /proc/sys/vm/mmap_rnd_bits
330        sudo sysctl -w vm.mmap_rnd_bits=28
331    - name: config
332      run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-comp enable-zstd -DPEDANTIC && perl configdata.pm --dump
333    - name: make
334      run: make -s -j4
335    - name: get cpu info
336      run: |
337        cat /proc/cpuinfo
338        ./util/opensslwrap.sh version -c
339    - name: make test
340      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
341
342  enable_tfo:
343    strategy:
344      matrix:
345        os: [ ubuntu-latest, macos-13, macos-14 ]
346    runs-on: ${{matrix.os}}
347    steps:
348    - uses: actions/checkout@v4
349    - name: checkout fuzz/corpora submodule
350      run: git submodule update --init --depth 1 fuzz/corpora
351    - name: config
352      run: CC=gcc ./config --banner=Configured enable-tfo --strict-warnings && perl configdata.pm --dump
353    - name: make
354      run: make -s -j4
355    - name: get cpu info
356      run: ./util/opensslwrap.sh version -c
357    - name: make test
358      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
359
360  enable_buildtest:
361    runs-on: ubuntu-latest
362    steps:
363    - uses: actions/checkout@v4
364    - name: checkout fuzz/corpora submodule
365      run: git submodule update --init --depth 1 fuzz/corpora
366    - name: config
367      run: ./config --banner=Configured no-asm no-makedepend enable-buildtest-c++ enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
368    - name: make
369      run: make -s -j4
370    - name: get cpu info
371      run: |
372        cat /proc/cpuinfo
373        ./util/opensslwrap.sh version -c
374    - name: make test
375      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
376