1# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
2#
3# Licensed under the Apache License 2.0 (the "License").  You may not use
4# this file except in compliance with the License.  You can obtain a copy
5# in the file LICENSE in the source distribution or at
6# https://www.openssl.org/source/license.html
7
8name: Run-checker daily
9# Jobs run daily
10
11on:
12  schedule:
13    - cron: '30 02 * * *'
14  workflow_dispatch:
15
16permissions:
17  contents: read
18
19jobs:
20  run-checker:
21    strategy:
22      fail-fast: false
23      matrix:
24        opt: [
25          386,
26          no-afalgeng,
27          no-apps,
28          no-aria,
29          no-asan,
30          no-asm,
31          no-async,
32          no-atexit,
33          no-autoalginit,
34          no-autoerrinit,
35          no-autoload-config,
36          no-bf,
37          no-blake2,
38          no-buildtest-c++,
39          no-bulk,
40          no-cached-fetch,
41          no-camellia,
42          no-capieng,
43          no-cast,
44          no-chacha,
45          no-cmac,
46          no-comp,
47          enable-crypto-mdebug,
48          no-crypto-mdebug,
49          enable-crypto-mdebug-backtrace,
50          no-crypto-mdebug-backtrace,
51          no-deprecated,
52          no-des,
53          no-devcryptoeng,
54          no-docs,
55          no-dsa,
56          no-dtls1,
57          no-dtls1_2,
58          no-dtls1_2-method,
59          no-dtls1-method,
60          no-ecdh,
61          no-ecdsa,
62          enable-ec_nistp_64_gcc_128,
63          no-ec_nistp_64_gcc_128,
64          enable-egd,
65          no-egd,
66          no-engine,
67          no-external-tests,
68          enable-fips,
69          enable-fips enable-acvp-tests,
70          enable-fips no-tls1_3,
71          enable-fips no-des no-dsa no-ec2m,
72          no-fuzz-afl,
73          no-fuzz-libfuzzer,
74          no-gost,
75          enable-heartbeats,
76          no-heartbeats,
77          no-hw,
78          no-hw-padlock,
79          no-idea,
80          no-makedepend,
81          enable-md2,
82          no-md2,
83          no-md4,
84          no-mdc2,
85          no-msan,
86          no-multiblock,
87          no-nextprotoneg,
88          no-ocb,
89          no-padlockeng,
90          no-pic,
91          no-poly1305,
92          no-posix-io,
93          no-psk,
94          no-rc2,
95          no-rc4,
96          enable-rc5,
97          no-rc5,
98          no-rdrand,
99          no-rfc3779,
100          no-ripemd,
101          no-rmd160,
102          no-scrypt,
103          no-secure-memory,
104          no-seed,
105          no-shared,
106          no-siphash,
107          no-siv,
108          no-sm2,
109          no-sm2-precomp,
110          no-sm3,
111          no-sm4,
112          no-sock,
113          no-sse2,
114          no-ssl,
115          no-ssl3,
116          no-ssl3-method,
117          no-ssl-trace,
118          no-static-engine no-shared,
119          no-tests,
120          enable-tfo,
121          no-tls1,
122          no-tls1_1,
123          no-tls1_1-method,
124          no-tls1_2-method,
125          no-tls1-method,
126          no-trace,
127          no-ubsan,
128          no-ui-console,
129          no-unit-test,
130          enable-unit-test,
131          no-uplink,
132          no-weak-ssl-ciphers,
133          no-whirlpool,
134          no-zlib,
135          enable-zlib-dynamic,
136          no-zlib-dynamic,
137          -DOPENSSL_PEDANTIC_ZEROIZATION,
138          -DOPENSSL_PEDANTIC_ZEROIZATION enable-fips,
139          -DOPENSSL_NO_BUILTIN_OVERFLOW_CHECKING,
140          -DSSL3_ALIGN_PAYLOAD=4
141        ]
142    runs-on: ubuntu-latest
143    steps:
144    - uses: actions/checkout@v4
145    - name: checkout fuzz/corpora submodule
146      run: git submodule update --init --depth 1 fuzz/corpora
147    - name: config
148      run: CC=clang ./config --banner=Configured --strict-warnings ${{ matrix.opt }}
149    - name: config dump
150      run: ./configdata.pm --dump
151    - name: make
152      run: make -s -j4
153    - name: get cpu info
154      run: |
155        cat /proc/cpuinfo
156        if [ -x apps/openssl ] ; then ./util/opensslwrap.sh version -c ; fi
157    - name: make test
158      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
159
160  run-checker-sctp:
161    runs-on: ubuntu-latest
162    steps:
163    - uses: actions/checkout@v4
164    - name: checkout fuzz/corpora submodule
165      run: git submodule update --init --depth 1 fuzz/corpora
166    - name: Install Dependencies for sctp option
167      run:  |
168        sudo apt-get update
169        sudo apt-get -yq install lksctp-tools libsctp-dev
170
171    - name: Check SCTP and enable auth
172      id: sctp_auth
173      continue-on-error: true
174      run:  |
175        checksctp
176        sudo sysctl -w net.sctp.auth_enable=1
177
178    - name: config
179      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
180      run: CC=clang ./config --banner=Configured --strict-warnings enable-sctp
181
182    - name: config dump
183      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
184      run: ./configdata.pm --dump
185
186    - name: make
187      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
188      run: make -s -j4
189
190    - name: get cpu info
191      run: |
192        cat /proc/cpuinfo
193        ./util/opensslwrap.sh version -c
194
195    - name: make test
196      if: steps.sctp_auth.outcome == 'success' && steps.sctp_auth.conclusion == 'success'
197      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
198
199  jitter:
200    runs-on: ubuntu-latest
201    steps:
202    - name: checkout openssl
203      uses: actions/checkout@v4
204    - name: checkout jitter
205      uses: actions/checkout@v4
206      with:
207        repository: smuellerDD/jitterentropy-library
208        ref: v3.5.0
209        path: jitter
210    - name: build jitter
211      run: make -C jitter/
212    - name: checkout fuzz/corpora submodule
213      run: git submodule update --init --depth 1 fuzz/corpora
214    - name: config
215      run: ./config --with-rand-seed=none enable-jitter enable-fips-jitter --with-jitter-include=jitter/ --with-jitter-lib=jitter/ -DOPENSSL_DEFAULT_SEED_SRC=JITTER && perl configdata.pm --dump
216    - name: make
217      run: make -s -j4
218    - name: get cpu info
219      run: |
220        cat /proc/cpuinfo
221        ./util/opensslwrap.sh version -c
222    - name: make test
223      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
224
225  enable_brotli_dynamic:
226    runs-on: ubuntu-latest
227    steps:
228    - name: install brotli
229      run: |
230        sudo apt-get update
231        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
232    - name: checkout openssl
233      uses: actions/checkout@v4
234    - name: checkout fuzz/corpora submodule
235      run: git submodule update --init --depth 1 fuzz/corpora
236    - name: config
237      run: ./config enable-comp enable-brotli enable-brotli-dynamic && perl configdata.pm --dump
238    - name: make
239      run: make -s -j4
240    - name: get cpu info
241      run: |
242        cat /proc/cpuinfo
243        ./util/opensslwrap.sh version -c
244    - name: make test
245      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
246
247  enable_zstd_dynamic:
248    runs-on: ubuntu-latest
249    steps:
250    - name: install zstd
251      run: |
252        sudo apt-get update
253        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
254    - name: checkout openssl
255      uses: actions/checkout@v4
256    - name: checkout fuzz/corpora submodule
257      run: git submodule update --init --depth 1 fuzz/corpora
258    - name: config
259      run: ./config enable-comp enable-zstd enable-zstd-dynamic && perl configdata.pm --dump
260    - name: make
261      run: make -s -j4
262    - name: get cpu info
263      run: |
264        cat /proc/cpuinfo
265        ./util/opensslwrap.sh version -c
266    - name: make test
267      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
268
269  enable_brotli_and_zstd_dynamic:
270    runs-on: ubuntu-latest
271    steps:
272    - name: install brotli and zstd
273      run: |
274        sudo apt-get update
275        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
276        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
277    - name: checkout openssl
278      uses: actions/checkout@v4
279    - name: checkout fuzz/corpora submodule
280      run: git submodule update --init --depth 1 fuzz/corpora
281    - name: config
282      run: ./config enable-comp enable-brotli enable-brotli-dynamic enable-zstd enable-zstd-dynamic && perl configdata.pm --dump
283    - name: make
284      run: make -s -j4
285    - name: get cpu info
286      run: |
287        cat /proc/cpuinfo
288        ./util/opensslwrap.sh version -c
289    - name: make test
290      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
291
292  enable_brotli_and_asan_ubsan:
293    runs-on: ubuntu-latest
294    steps:
295    - name: install brotli
296      run: |
297        sudo apt-get update
298        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install brotli libbrotli1 libbrotli-dev
299    - name: checkout openssl
300      uses: actions/checkout@v4
301    - name: checkout fuzz/corpora submodule
302      run: git submodule update --init --depth 1 fuzz/corpora
303    - name: Adjust ASLR for sanitizer
304      run: |
305        sudo cat /proc/sys/vm/mmap_rnd_bits
306        sudo sysctl -w vm.mmap_rnd_bits=28
307    - name: config
308      run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-comp enable-brotli -DPEDANTIC && perl configdata.pm --dump
309    - name: make
310      run: make -s -j4
311    - name: get cpu info
312      run: |
313        cat /proc/cpuinfo
314        ./util/opensslwrap.sh version -c
315    - name: make test
316      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
317
318  enable_zstd_and_asan_ubsan:
319    runs-on: ubuntu-latest
320    steps:
321    - name: install zstd
322      run: |
323        sudo apt-get update
324        sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install zstd libzstd1 libzstd-dev
325    - name: checkout openssl
326      uses: actions/checkout@v4
327    - name: checkout fuzz/corpora submodule
328      run: git submodule update --init --depth 1 fuzz/corpora
329    - name: Adjust ASLR for sanitizer
330      run: |
331        sudo cat /proc/sys/vm/mmap_rnd_bits
332        sudo sysctl -w vm.mmap_rnd_bits=28
333    - name: config
334      run: ./config --banner=Configured --debug enable-asan enable-ubsan enable-comp enable-zstd -DPEDANTIC && perl configdata.pm --dump
335    - name: make
336      run: make -s -j4
337    - name: get cpu info
338      run: |
339        cat /proc/cpuinfo
340        ./util/opensslwrap.sh version -c
341    - name: make test
342      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
343
344  enable_tfo:
345    strategy:
346      matrix:
347        os: [ ubuntu-latest, macos-13, macos-14 ]
348    runs-on: ${{matrix.os}}
349    steps:
350    - uses: actions/checkout@v4
351    - name: checkout fuzz/corpora submodule
352      run: git submodule update --init --depth 1 fuzz/corpora
353    - name: config
354      run: CC=gcc ./config --banner=Configured enable-tfo --strict-warnings && perl configdata.pm --dump
355    - name: make
356      run: make -s -j4
357    - name: get cpu info
358      run: ./util/opensslwrap.sh version -c
359    - name: make test
360      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
361
362  enable_buildtest:
363    runs-on: ubuntu-latest
364    steps:
365    - uses: actions/checkout@v4
366    - name: checkout fuzz/corpora submodule
367      run: git submodule update --init --depth 1 fuzz/corpora
368    - name: config
369      run: ./config --banner=Configured no-asm no-makedepend enable-buildtest-c++ enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
370    - name: make
371      run: make -s -j4
372    - name: get cpu info
373      run: |
374        cat /proc/cpuinfo
375        ./util/opensslwrap.sh version -c
376    - name: make test
377      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
378