Commit 970eeedb4a for strongswan.org
commit 970eeedb4a8055f672d00b078a6c8cafe2c29441
Author: Tobias Brunner <tobias@strongswan.org>
Date: Tue Nov 10 12:38:16 2026 +0100
github: Adapt to switch to Ubuntu 26.04 for ubuntu-latest
We need to build OpenSSL with PSK support as Python uses those functions
and is linked to our build.
For lcov/genhtml we ignore inconsistency errors as these are false
positives caused by e.g. multi-line if-statements. For lcov >= 2.2 we
could disable the whole check with `--rc check_data_consistency=0` but
that would fail with older versions. The error suppression already
works with 2.0 (e.g. in Ubuntu 24.04). It seems there might be a fix
for this in lcov > 2.6 (current master) via `merge_continuation_lines`
option (unfortunately, it doesn't seem to be enabled by default).
diff --git a/.github/active-transforms/openssl-sys-ubuntu-latest b/.github/active-transforms/openssl-sys-ubuntu-latest
new file mode 100644
index 0000000000..485847af0f
--- /dev/null
+++ b/.github/active-transforms/openssl-sys-ubuntu-latest
@@ -0,0 +1,111 @@
+AES_ECB[openssl]
+AES_ECB[openssl]
+AES_ECB[openssl]
+AES_CBC[openssl]
+AES_CBC[openssl]
+AES_CBC[openssl]
+AES_CTR[openssl]
+AES_CTR[openssl]
+AES_CTR[openssl]
+AES_CFB[openssl]
+AES_CFB[openssl]
+AES_CFB[openssl]
+CAMELLIA_CBC[openssl]
+CAMELLIA_CBC[openssl]
+CAMELLIA_CBC[openssl]
+CAMELLIA_CTR[openssl]
+CAMELLIA_CTR[openssl]
+CAMELLIA_CTR[openssl]
+CAST_CBC[openssl]
+BLOWFISH_CBC[openssl]
+3DES_CBC[openssl]
+DES_CBC[openssl]
+DES_ECB[openssl]
+NULL[openssl]
+AES_GCM_16[openssl]
+AES_GCM_16[openssl]
+AES_GCM_16[openssl]
+AES_GCM_12[openssl]
+AES_GCM_12[openssl]
+AES_GCM_12[openssl]
+AES_GCM_8[openssl]
+AES_GCM_8[openssl]
+AES_GCM_8[openssl]
+AES_CCM_16[openssl]
+AES_CCM_16[openssl]
+AES_CCM_16[openssl]
+AES_CCM_12[openssl]
+AES_CCM_12[openssl]
+AES_CCM_12[openssl]
+AES_CCM_8[openssl]
+AES_CCM_8[openssl]
+AES_CCM_8[openssl]
+CHACHA20_POLY1305[openssl]
+HMAC_MD5_96[openssl]
+HMAC_MD5_128[openssl]
+HMAC_SHA1_96[openssl]
+HMAC_SHA1_128[openssl]
+HMAC_SHA1_160[openssl]
+HMAC_SHA2_256_128[openssl]
+HMAC_SHA2_256_256[openssl]
+HMAC_SHA2_384_192[openssl]
+HMAC_SHA2_384_384[openssl]
+HMAC_SHA2_512_256[openssl]
+HMAC_SHA2_512_512[openssl]
+HASH_MD4[openssl]
+HASH_MD5[openssl]
+HASH_SHA1[openssl]
+HASH_SHA2_224[openssl]
+HASH_SHA2_256[openssl]
+HASH_SHA2_384[openssl]
+HASH_SHA2_512[openssl]
+HASH_SHA3_224[openssl]
+HASH_SHA3_256[openssl]
+HASH_SHA3_384[openssl]
+HASH_SHA3_512[openssl]
+HASH_IDENTITY[openssl]
+PRF_KEYED_SHA1[openssl]
+PRF_HMAC_MD5[openssl]
+PRF_HMAC_SHA1[openssl]
+PRF_HMAC_SHA2_256[openssl]
+PRF_HMAC_SHA2_384[openssl]
+PRF_HMAC_SHA2_512[openssl]
+XOF_SHAKE128[openssl]
+XOF_SHAKE256[openssl]
+KDF_PRF[openssl]
+KDF_PRF_PLUS[openssl]
+DRBG_CTR_AES256[drbg]
+DRBG_CTR_AES128[drbg]
+DRBG_CTR_AES192[drbg]
+DRBG_HMAC_SHA1[drbg]
+DRBG_HMAC_SHA256[drbg]
+DRBG_HMAC_SHA384[drbg]
+DRBG_HMAC_SHA512[drbg]
+RNG_WEAK[openssl]
+RNG_STRONG[openssl]
+MODP_3072[openssl]
+MODP_4096[openssl]
+MODP_6144[openssl]
+MODP_8192[openssl]
+MODP_2048[openssl]
+MODP_2048_224[openssl]
+MODP_2048_256[openssl]
+MODP_1536[openssl]
+MODP_1024[openssl]
+MODP_1024_160[openssl]
+MODP_768[openssl]
+MODP_CUSTOM[openssl]
+ML_KEM_512[openssl]
+ML_KEM_768[openssl]
+ML_KEM_1024[openssl]
+ECP_256[openssl]
+ECP_384[openssl]
+ECP_521[openssl]
+ECP_224[openssl]
+ECP_192[openssl]
+ECP_256_BP[openssl]
+ECP_384_BP[openssl]
+ECP_512_BP[openssl]
+ECP_224_BP[openssl]
+CURVE_25519[openssl]
+CURVE_448[openssl]
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 6042671976..1de8e04791 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -57,7 +57,9 @@ jobs:
- test: no-testable-ke
- test: no-testable-ke
compiler: clang
- - test: fuzzing
+ # use the same base platform as oss-fuzz
+ - os: ubuntu-24.04
+ test: fuzzing
compiler: clang
monolithic: yes
env:
@@ -165,9 +167,19 @@ jobs:
fail-fast: false
matrix:
test: [ botan, wolfssl, openssl-sys, openssl-3, openssl-4, openssl-awslc ]
- os: [ ubuntu-latest, ubuntu-22.04 ]
+ os: [ ubuntu-latest, ubuntu-24.04, ubuntu-22.04 ]
exclude:
# test custom-built libs only on the latest platform
+ - os: ubuntu-24.04
+ test: botan
+ - os: ubuntu-24.04
+ test: wolfssl
+ - os: ubuntu-24.04
+ test: openssl-3
+ - os: ubuntu-24.04
+ test: openssl-4
+ - os: ubuntu-24.04
+ test: openssl-awslc
- os: ubuntu-22.04
test: botan
- os: ubuntu-22.04
@@ -183,6 +195,7 @@ jobs:
CC: ${{ matrix.compiler || 'gcc' }}
TEST: ${{ matrix.test }}
ACTIVE_TRANSFORMS_REF: .github/active-transforms/${{ matrix.test }}
+ ACTIVE_TRANSFORMS_REF_OS: .github/active-transforms/${{ matrix.test }}-${{ matrix.os }}
# only store a cache for some tests as the others have a minimal diff (if
# any) compared to the 'all' build
STORE_DEPS_CACHE: >-
@@ -249,7 +262,11 @@ jobs:
retention-days: 5
- name: Verify active transforms
run: |
- test ! -f $ACTIVE_TRANSFORMS_REF || diff -us --color=always $ACTIVE_TRANSFORMS_REF $TESTS_ACTIVE_TRANSFORMS
+ if [ -f $ACTIVE_TRANSFORMS_REF_OS ]; then
+ diff -us --color=always $ACTIVE_TRANSFORMS_REF_OS $TESTS_ACTIVE_TRANSFORMS
+ else
+ test ! -f $ACTIVE_TRANSFORMS_REF || diff -us --color=always $ACTIVE_TRANSFORMS_REF $TESTS_ACTIVE_TRANSFORMS
+ fi
- if: ${{ failure() }}
uses: actions/upload-artifact@v6
with:
@@ -265,7 +282,7 @@ jobs:
actions: write
strategy:
matrix:
- os: [ ubuntu-22.04 ]
+ os: [ ubuntu-22.04, ubuntu-24.04 ]
test: [ all, nm ]
compiler: [ gcc, clang ]
exclude:
diff --git a/Makefile.am b/Makefile.am
index bbae039f59..363241e13c 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -65,16 +65,17 @@ cov-reset: cov-reset-common
cov-report:
@mkdir $(top_builddir)/coverage
lcov -c -o $(top_builddir)/coverage/coverage.info -d $(top_builddir) \
- --rc branch_coverage=1
+ --rc branch_coverage=1 --ignore-errors inconsistent
lcov -r $(top_builddir)/coverage/coverage.info '*/tests/*' '*/suites/*' '/usr*' \
'*proposal_keywords_static.*' \
-o $(abs_top_builddir)/coverage/coverage.cleaned.info \
- --rc branch_coverage=1
+ --rc branch_coverage=1 --ignore-errors inconsistent
genhtml --num-spaces 4 --legend --branch-coverage --ignore-errors source \
-t "$(PACKAGE_STRING)" \
-o $(top_builddir)/coverage/html \
-p `readlink -m $(abs_top_srcdir)`/src \
- $(top_builddir)/coverage/coverage.cleaned.info
+ $(top_builddir)/coverage/coverage.cleaned.info \
+ --ignore-errors inconsistent
@echo "Coverage Report at $(top_builddir)/coverage/html" >&2
coverage:
diff --git a/scripts/test.sh b/scripts/test.sh
index 11ad3a194e..ff8b57b959 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -98,7 +98,7 @@ build_openssl()
: ${SSL_REV=openssl-3.6.5}
SSL_DIR=$DEPS_BUILD_DIR/openssl
SSL_INS=$DEPS_PREFIX/ssl
- SSL_OPT="-d shared no-dtls no-ssl3 no-zlib no-idea no-psk
+ SSL_OPT="-d shared no-dtls no-ssl3 no-zlib no-idea
no-tests enable-rfc3779 enable-ec_nistp_64_gcc_128"
if test -d "$SSL_DIR"; then
@@ -173,7 +173,7 @@ prepare_system_openssl()
# make sure we can properly whitelist functions with leak detective
DEPS="$DEPS binutils-dev"
CONFIG="$CONFIG --enable-bfd-backtraces"
- elif [ "$ID" = "ubuntu" -a "$VERSION_ID" != "24.04" ]; then
+ elif [ "$ID" = "ubuntu" -a "$VERSION_ID" = "22.04" ]; then
# with ASan we have to use the (extremely) slow stack unwind as the
# shipped version of the library is built with -fomit-frame-pointer
export ASAN_OPTIONS=fast_unwind_on_malloc=0
@@ -279,6 +279,9 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg|no-testable-ke)
libldap2-dev libpcsclite-dev libpam0g-dev binutils-dev libnm-dev
libjson-c-dev libtspi-dev libsystemd-dev
libselinux1-dev libiptc-dev ruby-rubygems python3-build tox"
+ if [ "$ID" = "ubuntu" -a "$VERSION_ID" != "22.04" ]; then
+ DEPS="$DEPS systemd-dev"
+ fi
if [ "$ID" = "ubuntu" -a "$VERSION_ID" = "22.04" -a "$1" = "build-deps" ]; then
# python3-build is broken on 22.04 with venv (https://bugs.launchpad.net/ubuntu/+source/python-build/+bug/1992108)
# while installing python3-virtualenv should help, it doesn't. as even