Commit bf7d0fecdf for openssl.org

commit bf7d0fecdf4b8f5351afec7bb04feaa4f965ba4c
Author: Dmitry Misharov <dmitry@openssl.org>
Date:   Mon Nov 9 15:31:55 2026 +0100

    .github/workflows/os-zoo.yml: add a Graviton4 aarch64 matrix

    Covers configurations that change aarch64 code paths: Graviton3
    and Graviton2 armcap, no CPU features, no-asm, no-shared, sanitizers,
    and the FIPS ACVP tests.

    Assisted-by: Claude:claude-opus-5-5
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Wed Nov 11 19:14:13 2026
    Merged-from: https://github.com/openssl/openssl/pull/33618

diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml
index 7c368d4bcc..ef2940e310 100644
--- a/.github/workflows/os-zoo.yml
+++ b/.github/workflows/os-zoo.yml
@@ -356,6 +356,72 @@ jobs:
     - name: make test
       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}

+  linux-aarch64-graviton4:
+    needs: [validate-dispatch-inputs]
+    if: |
+      github.repository == 'openssl/openssl' &&
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
+    runs-on: graviton4-zoo
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: fips-acvp
+            config: enable-fips enable-acvp-tests enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+          # Older CPUs' code paths via the armcap they would detect, a subset of Graviton4's.
+          # Graviton3: no SVE2
+          - name: graviton3
+            config: enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+            armcap: '0x139fd'
+          # Graviton2: ARMv8.0 crypto extensions only
+          - name: graviton2
+            config: enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+            armcap: '0xbd'
+          - name: no-cpu-features
+            config: enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+            armcap: '0x0'
+          - name: no-asm
+            config: no-asm enable-fips
+          - name: no-shared
+            config: no-shared enable-fips enable-ec_nistp_64_gcc_128
+          - name: asan-ubsan
+            config: --debug enable-asan enable-ubsan enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5
+    name: linux-aarch64-graviton4 (${{ matrix.name }})
+    env:
+      HARNESS_JOBS: 8
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+        ref: ${{ github.event.inputs.head_sha || github.sha }}
+    - name: config
+      run: ./config --strict-warnings ${{ matrix.config }}
+    - name: config dump
+      run: ./configdata.pm --dump
+    - name: make
+      run: make -j8
+    - name: get cpu info
+      run: |
+        cat /proc/cpuinfo
+        ./util/opensslwrap.sh version -c
+        ./util/opensslwrap.sh info -cpusettings
+    - name: make test
+      if: matrix.armcap == ''
+      run: .github/workflows/make-test
+    - name: make test (OPENSSL_armcap=${{ matrix.armcap }})
+      if: matrix.armcap != ''
+      env:
+        OPENSSL_armcap: ${{ matrix.armcap }}
+      run: .github/workflows/make-test
+    - name: save artifacts
+      if: success() || failure()
+      uses: actions/upload-artifact@v6
+      with:
+        name: "ci@linux-aarch64-graviton4-${{ matrix.name }}"
+        path: artifacts.tar.gz
+
   linux-x86:
     needs: [validate-dispatch-inputs]
     if: |