[pull] master from libressl-portable:master

.github/scripts/changelog.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+# Copyright (c) 2023 Joshua Sing <[email protected]>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+#
+# Usage: changelog.sh <version>
+#  Reads the changelog for the specified version from the changelog file.
+#  The output will be reformatted for use in GitHub releases.
+#
+#  The changelog file defaults to "ChangeLog", but can be changed by setting
+#  the environment variable $CHANGELOG_FILE
+#
+
+set -e
+
+# Check if the version argument is provided
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <version>" 1>&2
+    exit 1
+fi
+
+version="${1#v}"
+changelog_file="${CHANGELOG_FILE:-ChangeLog}"
+found_version=false
+changelog=""
+
+# Check if the specified changelog file exists
+if [ ! -f "$changelog_file" ]; then
+    echo "Error: Changelog file '$changelog_file' not found" 1>&2
+    exit 1
+fi
+
+# Read the changelog file line by line
+while IFS= read -r line; do
+    # Check for the version line
+    if echo "$line" | grep -Eq "^${version} - "; then
+      found_version=true
+      continue
+    fi
+
+    # Continue reading the changelog until the next version or end of file,
+    # skipping empty lines
+    if $found_version; then
+      echo "$line" | grep -Eq "^\s*$" && continue
+      echo "$line" | grep -Eq "^[0-9]+\.[0-9]+\.[0-9]+ - " && break
+      changelog="${changelog}${line}\n"
+    fi
+done < "$changelog_file"
+
+# If the specified version was not found, print an error
+if ! $found_version; then
+    echo "Error: Version $version was not found in changelog" 1>&2
+    exit 1
+fi
+
+# Tidy up the changelog for displaying on GitHub
+changelog=$(echo "$changelog" | sed -e 's/^\t\*/###/' -e 's/^\t//')
+
+# Print the changelog for the specified version
+echo "$changelog"
+echo
+echo "Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog"
+exit 0

.github/workflows/android.yml

@@ -0,0 +1,35 @@
+# GitHub Actions workflow to run tests on Android.
+name: "Android"
+
+on: [push, pull_request]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: "Test ${{ matrix.name }}"
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: "Android 8-9"
+            min-nal: 26
+            max-nal: 28
+          - name: "Android 10-11"
+            min-nal: 29
+            max-nal: 30
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v4
+
+      - name: "Run CI script"
+        run: ./scripts/test
+        env:
+          ARCH: "android"
+          MIN_NAL: "${{ matrix.min-nal }}"
+          MAX_NAL: "${{ matrix.max-nal }}"

.github/workflows/cifuzz.yml

@@ -0,0 +1,33 @@
+name: CIFuzz
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Build Fuzzers
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'libressl'
+        dry-run: false
+        language: c++
+    - name: Run Fuzzers
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'libressl'
+        fuzz-seconds: 300
+        dry-run: false
+        language: c++
+    - name: Upload Crash
+      uses: actions/upload-artifact@v4
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: artifacts
+        path: ./out/artifacts

.github/workflows/cmake-config.yml

@@ -0,0 +1,98 @@
+# GitHub Actions workflow to check CMake config.
+name: "CMake Check"
+
+on:
+  push: {}
+  pull_request: {}
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: "${{ matrix.os }}"
+    runs-on: "${{ matrix.os }}"
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ "windows-2022", "macos-14", "ubuntu-24.04" ]
+    defaults:
+      run:
+        shell: "bash"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v4
+
+      - name: "Setup Windows dependencies"
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@v2
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+
+      - name: "Setup macOS dependencies"
+        if: runner.os == 'macOS'
+        run: brew install automake libtool
+
+      - name: "Prepare source tree for build (Windows)"
+        if: runner.os == 'Windows'
+        shell: "msys2 {0}"
+        run: ./autogen.sh
+
+      - name: "Prepare source tree for build (Unix)"
+        if: runner.os != 'Windows'
+        run: ./autogen.sh
+
+      - name: "Configure"
+        run: |
+          cmake -S . \
+            -B build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
+
+      - name: "Build"
+        run: cmake --build build --config Release --verbose
+
+      - name: "Install"
+        run: cmake --install build --config Release
+
+      - name: "Consume from the build directory - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
+
+      - name: "Consume from the build directory - Build"
+        run: cmake --build consumer-build --config Release --verbose
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-prefix \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Build"
+        run: cmake --build consumer-install-prefix --config Release --verbose
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-dir \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Build"
+        run: cmake --build consumer-install-dir --config Release --verbose

.github/workflows/coverity.yml

@@ -0,0 +1,69 @@
+# GitHub Actions workflow to run Coverity scans.
+name: "Coverity"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *" # At 00:00 daily.
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: "Scan"
+    runs-on: "ubuntu-24.04"
+    if: github.repository_owner == 'libressl' # Prevent running on forks
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v4
+
+      - name: "Install dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake ninja-build
+
+      - name: "Download Coverity build tool"
+        env:
+          PROJECT: "libressl-portable%2Fportable"
+          COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}"
+        run: |
+          wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
+          mkdir coverity_tool
+          tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
+
+      - name: "Setup"
+        run: |
+          ./autogen.sh
+          ./configure
+          make dist
+          tar zxf libressl-*.tar.gz
+          rm libressl-*.tar.gz
+          cd libressl-*
+          mkdir build-static
+          mkdir build-shared 
+          cmake -GNinja -DBUILD_SHARED_LIBS=ON ..
+
+      - name: "Build with Coverity build tool"
+        run: |
+          export PATH=`pwd`/coverity_tool/bin:$PATH
+          cd libressl-*
+          cov-build --dir cov-int ninja
+
+      - name: "Submit build result to Coverity Scan"
+        env:
+          EMAIL: "[email protected]"
+          PROJECT: "libressl-portable%2Fportable"
+          COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}"
+        run: |
+          cd libressl-*
+          tar czvf cov.tar.gz cov-int
+          curl --form token=$COVERITY_SCAN_TOKEN \
+            --form email=$EMAIL \
+            --form [email protected] \
+            --form version="Commit $GITHUB_SHA" \
+            --form description="Build submitted via CI" \
+            https://scan.coverity.com/builds?project=$PROJECT