blob: 5fd96b31596c6e8a2eb8d724673eb23dbfb4b657 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
name: FIPS Check and ABIDIFF
on:
pull_request:
paths-ignore:
- 'doc/**'
- '*.md'
- '*.pod'
- 'README*'
- 'funding.json'
- 'LICENSE.txt'
- 'VERSION.dat'
permissions:
contents: read
jobs:
compute-checksums:
runs-on: ubuntu-latest
steps:
- name: install unifdef
run: |
sudo apt-get update
sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install unifdef
- name: create build dirs
run: |
mkdir ./build-pristine
mkdir ./source-pristine
mkdir ./build
mkdir ./source
mkdir ./artifact
- uses: actions/checkout@v6
with:
repository: ${{ github.event.pull_request.base.repo.full_name }}
ref: ${{ github.event.pull_request.base.ref }}
path: source-pristine
persist-credentials: false
- name: config pristine
run: ../source-pristine/config enable-fips
working-directory: ./build-pristine
- name: config pristine dump
run: ./configdata.pm --dump
working-directory: ./build-pristine
- name: make build_generated pristine
run: make -s build_generated
working-directory: ./build-pristine
- name: make fips-checksums pristine
run: make fips-checksums
working-directory: ./build-pristine
- uses: actions/checkout@v6
with:
path: source
persist-credentials: false
- name: config
run: ../source/config enable-fips
working-directory: ./build
- name: config dump
run: ./configdata.pm --dump
working-directory: ./build
- name: make build_generated
run: make -s build_generated
working-directory: ./build
- name: make fips-checksums
run: make fips-checksums
working-directory: ./build
- name: update checksums
run: |
cp -a build-pristine/providers/fips.module.sources.new source/providers/fips.module.sources
cp -a build-pristine/providers/fips-sources.checksums.new source/providers/fips-sources.checksums
cp -a build-pristine/providers/fips.checksum.new source/providers/fips.checksum
- name: make diff-fips-checksums
run: make diff-fips-checksums && touch ../artifact/fips_unchanged || ( touch ../artifact/fips_changed ; echo FIPS CHANGED )
working-directory: ./build
- name: save PR number
run: echo ${{ github.event.number }} > ./artifact/pr_num
- name: save artifact
uses: actions/upload-artifact@v4
with:
name: fips_checksum
path: artifact/
compute-abidiff:
runs-on: ubuntu-latest
env:
BUILD_OPTS: -g --strict-warnings enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-trace enable-zlib enable-zstd
steps:
- name: create build dirs
run: |
mkdir ./build-pristine
mkdir ./source-pristine
mkdir ./build
mkdir ./source
mkdir ./artifact
- name: install extra config support
run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
- uses: actions/checkout@v6
with:
repository: ${{ github.event.pull_request.base.repo.full_name }}
ref: ${{ github.event.pull_request.base.ref }}
path: source-pristine
persist-credentials: false
- name: config pristine
run: ../source-pristine/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
working-directory: ./build-pristine
- name: make pristine
run: make -s -j4
working-directory: ./build-pristine
- uses: actions/checkout@v6
with:
path: source
persist-credentials: false
- name: config
run: ../source/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
working-directory: ./build
- name: make
run: make -s -j4
working-directory: ./build
- name: abidiff
run: abidiff --headers-dir1 build-pristine/include/openssl --headers-dir2 build/include/openssl --drop-private-types ./build-pristine/libcrypto.so ./build/libcrypto.so && abidiff --headers-dir1 build-pristine/include/openssl --headers-dir2 build/include/openssl --drop-private-types ./build-pristine/libssl.so ./build/libssl.so && touch ./artifact/abi_unchanged || ( touch ./artifact/abi_changed ; echo ABI CHANGED )
- name: save PR number
run: echo ${{ github.event.number }} > ./artifact/pr_num
- name: save artifact
uses: actions/upload-artifact@v5
with:
name: abidiff
path: artifact/
|
