Merge branch 'upstream' of github.com:kassane/openssl-zig into zig-pkg

Author: kassane

.gitattributes

@@ -2,6 +2,8 @@
 *.der binary
 /fuzz/corpora/** binary
 *.pfx binary
+test/recipes/15-test_ml_dsa_codecs_data/*.dat   binary
+test/recipes/15-test_ml_kem_codecs_data/*.dat binary
 
 # For git archive
 fuzz/corpora/**                         export-ignore

.github/dependabot.yml

@@ -11,6 +11,5 @@ updates:
       - "dependencies"
       - "cla: trivial"
       - "approval: review pending"
-      - "approval: otc review pending"
     reviewers:
       - "openssl/committers"

.github/workflows/build_quic_interop_container.yml

@@ -2,11 +2,12 @@ name: "Build openssl interop container from master"
 
 on:
   schedule:
-    - cron:  '20 0 * * *'
+    - cron:  '40 02 * * *'
   workflow_dispatch:
 
 jobs:
   update_quay_container:
+    if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/deploy-docs-openssl-org.yml

@@ -10,6 +10,7 @@ on:
 
 jobs:
   trigger:
+    if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
       - name: "Trigger deployment workflow"

.github/workflows/interop-tests.yml

@@ -6,12 +6,14 @@
 name: Interoperability tests with GnuTLS and NSS
 on:
   schedule:
-    - cron: '0 6 * * *'
+    - cron: '55 02 * * *'
+  workflow_dispatch:
+
 jobs:
   test:
     runs-on: ubuntu-22.04
     container:
-      image: docker.io/fedora:39
+      image: docker.io/fedora:40
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0
     timeout-minutes: 90
     strategy:
@@ -48,6 +50,6 @@ jobs:
       - name: Run interop tests
         run: |
           cd interop
-          tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local execute -h tmt --interactive
+          tmt run -av plans -n interop tests -f "tag: interop-openssl & tag: interop-$COMPONENT" provision -h local --feeling-safe execute -h tmt --interactive
           openssl version
           echo "Finished - important to prevent unwanted output truncating"

.github/workflows/make-release.yml

@@ -0,0 +1,42 @@
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+name: "Make release"
+
+on:
+  push:
+    tags:
+      - "openssl-*"
+
+jobs:
+  release:
+    runs-on: "releaser"
+    steps:
+    - name: "Checkout"
+      uses: "actions/checkout@v4"
+      with:
+        fetch-depth: 1
+        ref: ${{ github.ref_name }}
+        github-server-url: "https://github.openssl.org/"
+        repository: "openssl/openssl"
+        token: ${{ secrets.GHE_TOKEN }}
+        path: ${{ github.ref_name }}
+    - name: "Prepare assets"
+      run: |
+        cd ${{ github.ref_name }}
+        ./util/mktar.sh
+        mkdir assets && mv ${{ github.ref_name }}.tar.gz assets/ && cd assets
+        openssl sha1 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha1
+        openssl sha256 -r ${{ github.ref_name }}.tar.gz > ${{ github.ref_name }}.tar.gz.sha256
+        gpg -u ${{ vars.signing_key_uid }} -o ${{ github.ref_name }}.tar.gz.asc -sba ${{ github.ref_name }}.tar.gz
+    - name: "Create release"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+      run: |
+        VERSION=$(echo ${{ github.ref_name }} | cut -d "-" -f 2-)
+        PRE_RELEASE=$([[ ${{ github.ref_name }} =~ alpha|beta ]] && echo "-p" || echo "")
+        gh release create ${{ github.ref_name }} $PRE_RELEASE -t "OpenSSL $VERSION" -d --notes " " -R ${{ github.repository }} ${{ github.ref_name }}/assets/*

.github/workflows/make-test

@@ -38,6 +38,6 @@ echo "Test suite exited with $RESULT, artifacts path is $OSSL_CI_ARTIFACTS_PATH"
 echo "::endgroup::"
 
 echo "Archive artifacts"
-tar -czvf artifacts.tar.gz $OSSL_CI_ARTIFACTS_PATH
+tar -czf artifacts.tar.gz $OSSL_CI_ARTIFACTS_PATH
 
 exit $RESULT

.github/workflows/prov-compat-label.yml

@@ -113,10 +113,6 @@ jobs:
             name: openssl-3.0,
             dir: branch-3.0,
             tgz: branch-3.0.tar.gz,
-          }, {
-            name: openssl-3.1,
-            dir: branch-3.1,
-            tgz: branch-3.1.tar.gz,
           }, {
             name: openssl-3.2,
             dir: branch-3.2,
@@ -125,6 +121,14 @@ jobs:
             name: openssl-3.3,
             dir: branch-3.3,
             tgz: branch-3.3.tar.gz,
+          }, {
+            name: openssl-3.4,
+            dir: branch-3.4,
+            tgz: branch-3.4.tar.gz,
+          }, {
+            name: openssl-3.5,
+            dir: branch-3.5,
+            tgz: branch-3.5.tar.gz,
           }, {
             name: master,
             dir: branch-master,
@@ -193,18 +197,20 @@ jobs:
         # Note that releases are not used as a test environment for
         # later providers.  Problems in these situations ought to be
         # caught by cross branch testing before the release.
-        tree_a: [ branch-3.3, branch-3.2, branch-3.1, branch-3.0,
+        tree_a: [ branch-3.5, branch-3.4, branch-3.3, branch-3.2, branch-3.0,
                   openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
         tree_b: [ PR ]
         include:
           - tree_a: PR
             tree_b: branch-master
+          - tree_a: PR
+            tree_b: branch-3.5
+          - tree_a: PR
+            tree_b: branch-3.4
           - tree_a: PR
             tree_b: branch-3.3
           - tree_a: PR
             tree_b: branch-3.2
-          - tree_a: PR
-            tree_b: branch-3.1
           - tree_a: PR
             tree_b: branch-3.0
     steps:

.github/workflows/run_quic_interop.yml

@@ -7,33 +7,119 @@ on:
   workflow_dispatch:
 
 jobs:
-  run_quic_interop:
+  run_quic_interop_openssl_client:
     strategy:
       matrix:
-        tests: [http3, transfer, handshake, retry, chacha20, resumption, multiplexing]
+        tests: [http3, transfer, handshake, retry, chacha20, resumption, multiplexing, ipv6]
         servers: [quic-go, ngtcp2, mvfst, quiche, nginx, msquic, haproxy]
+        exclude:
+          - servers: msquic
+            tests: retry
       fail-fast: false
-    runs-on: ubuntu-latest 
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
          repository: 'quic-interop/quic-interop-runner'
          fetch-depth: 0
-      - name: Install dependencies
+      - name: Install python requirements
         run: |
-          pip install -r requirements.txt
-          sudo add-apt-repository ppa:wireshark-dev/stable
-          sudo apt-get update
-          sudo apt-get install -y tshark
+          for i in {1..3}; do pip install -r requirements.txt && break; sleep 10; done
+      - name: Add tshark repo
+        run: |
+          for i in {1..3}; do sudo add-apt-repository ppa:wireshark-dev/stable && break; sleep 10; done
+      - name: Update apt repos
+        run: |
+          for i in {1..3}; do sudo apt-get update && break; sleep 10; done
+      - name: Install tshark
+        run: |
+          for i in {1..3}; do sudo apt-get install -y tshark && break; sleep 10; done
       - name: Patch implementations file
         run: |
           jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
                          , url: "https://github.com/openssl/openssl"
-                         , role: "client"
+                         , role: "both"
                          }' ./implementations.json > ./implementations.tmp
           mv ./implementations.tmp implementations.json
-      - name: "run interop"
+      - name: "Update to docker-compose 2.36 and docker engine 28.1.1"
         run: |
-          python3 ./run.py -c openssl -t ${{ matrix.tests }} -s ${{ matrix.servers }} --log-dir ./logs -d
-
-
+          mkdir -p ~/.docker/cli-plugins/
+          curl -SL https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose
+          curl -SL "https://download.docker.com/linux/static/stable/x86_64/docker-28.1.1.tgz" -o ./docker-28.1.1.tgz
+          tar --strip-components=1 -xvzf docker-28.1.1.tgz
+          echo "$PWD" >> $GITHUB_PATH
+          chmod 755 ~/.docker/cli-plugins/docker-compose
+          chmod 755 ./docker
+          sudo mv ./dockerd $(which dockerd)
+          sudo systemctl restart docker
+      - name: Check docker version
+        run: |
+          docker version
+          docker compose version
+      - name: Patch Docker compose file
+        run: |
+          yq -i '.services.sim.networks.leftnet += {"interface_name" : "eth0"}
+                 | .services.sim.networks.rightnet += {"interface_name" : "eth1"}
+                 | .services.server.networks.rightnet += {"interface_name" : "eth0"}
+                 | .services.client.networks.leftnet += {"interface_name" : "eth0"}' docker-compose.yml
+      - name: "run interop with openssl client"
+        run: |
+          python3 ./run.py -c openssl -t ${{ matrix.tests }} -s ${{ matrix.servers }} --log-dir ./logs-client -d
+  run_quic_interop_openssl_server:
+    strategy:
+      matrix:
+        tests: [http3, transfer, handshake, retry, chacha20, resumption, amplificationlimit, ipv6]
+        clients: [quic-go, ngtcp2, mvfst, quiche, msquic, openssl, chrome]
+        exclude:
+          - clients: mvfst
+            tests: amplificationlimit
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+         repository: 'quic-interop/quic-interop-runner'
+         fetch-depth: 0
+      - name: Install python requirements
+        run: |
+          for i in {1..3}; do pip install -r requirements.txt && break; sleep 10; done
+      - name: Add tshark repo
+        run: |
+          for i in {1..3}; do sudo add-apt-repository ppa:wireshark-dev/stable && break; done
+      - name: Update apt repos
+        run: |
+          for i in {1..3}; do sudo apt-get update && break; done
+      - name: Install tshark
+        run: |
+          for i in {1..3}; do sudo apt-get install -y tshark && break; done
+      - name: Patch implementations file
+        run: |
+          jq '.openssl = { image: "quay.io/openssl-ci/openssl-quic-interop"
+                         , url: "https://github.com/openssl/openssl"
+                         , role: "both"
+                         }' ./implementations.json > ./implementations.tmp
+          mv ./implementations.tmp implementations.json
+      - name: "Update to docker-compose 2.36 and docker engine 28.1.1"
+        run: |
+          mkdir -p ~/.docker/cli-plugins/
+          curl -SL https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose
+          curl -SL "https://download.docker.com/linux/static/stable/x86_64/docker-28.1.1.tgz" -o ./docker-28.1.1.tgz
+          tar --strip-components=1 -xvzf docker-28.1.1.tgz
+          echo "$PWD" >> $GITHUB_PATH
+          chmod 755 ~/.docker/cli-plugins/docker-compose
+          chmod 755 ./docker
+          sudo mv ./dockerd $(which dockerd)
+          sudo systemctl restart docker
+      - name: Check docker version
+        run: |
+          docker version
+          docker compose version
+      - name: Patch Docker compose file
+        run: |
+          yq -i '.services.sim.networks.leftnet += {"interface_name" : "eth0"}
+                 | .services.sim.networks.rightnet += {"interface_name" : "eth1"}
+                 | .services.server.networks.rightnet += {"interface_name" : "eth0"}
+                 | .services.client.networks.leftnet += {"interface_name" : "eth0"}' docker-compose.yml
+      - name: "run interop with openssl server"
+        run: |
+          python3 ./run.py -s openssl -t ${{ matrix.tests }} -c ${{ matrix.clients }} --log-dir ./logs-server -d

.github/workflows/static-analysis-on-prem.yml

@@ -9,14 +9,15 @@ name: Static Analysis On Prem
 
 on:
   schedule:
-    - cron:  '20 0 * * *'
+    - cron:  '25 02 * * *'
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
   coverity-analysis:
+    if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     container: quay.io/openssl-ci/coverity-analysis:2024.3.1
     steps:
@@ -28,7 +29,7 @@ jobs:
         chmod 0600 /auth_key_file.txt
     - uses: actions/checkout@v4
     - name: Config
-      run: CC=gcc ./config --banner=Configured --debug enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
+      run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
     - name: Config dump
       run: ./configdata.pm --dump
     - name: Make