Commit 29c285923a for openssl.org

commit 29c285923a1a9c7124fb78e371ef3bc82eca5989
Author: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Date:   Thu Aug 27 15:59:40 2026 +0100

    CI: Add AArch64 GCS validation build job

    Add an AArch64 CI job on ubuntu-26.04-arm runner which builds with
    -mbranch-protection=standard and links with -z gcs=always and
    -z gcs-report=error. This verifies the presence of AArch64 GCS
    annotations for all object files. The job will fail at link time if
    GCS annotations are either missing or incompatible. The CI job does
    not run `make tests` because there is no GCS enabled environment in
    the CI setup in which to run these tests currently.

    Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
    Merge-date: Tue Sep 15 10:23:40 2026
    Merged-from: https://github.com/openssl/openssl/pull/32631

diff --git a/.github/workflows/aarch64-more-cross-compiles.yml b/.github/workflows/aarch64-more-cross-compiles.yml
index 10858433f3..2a0e00d42f 100644
--- a/.github/workflows/aarch64-more-cross-compiles.yml
+++ b/.github/workflows/aarch64-more-cross-compiles.yml
@@ -239,3 +239,35 @@ jobs:
         name: "cross-compiles-aarch64@${{ matrix.platform.capslabel }}"
         path: artifacts.tar.gz
         if-no-files-found: ignore
+
+  gcs-validation-aarch64:
+    # pull request title contains 'aarch64'
+    # pull request title contains 'arm64'
+    # pull request body contains '[aarch64 ci]'
+    # push event commit message contains '[aarch64 ci]'
+    # cron job
+    # manual dispatch
+    needs: [validate-dispatch-inputs]
+    if: >-
+      (contains(github.event.pull_request.title, 'aarch64') || contains(github.event.pull_request.title, 'AArch64') || contains(github.event.pull_request.title, 'arm64') || contains(github.event.pull_request.body, '[aarch64 ci]') || contains(github.event.head_commit.message, '[aarch64 ci]') || (github.event_name == 'schedule' && github.repository == 'openssl/openssl') || github.event_name == 'workflow_dispatch') &&
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
+    runs-on: ubuntu-26.04-arm
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+        ref: ${{ github.event.inputs.head_sha || github.sha }}
+    - name: print tool versions
+      run: |
+        gcc --version
+        ld --version
+    - name: config
+      run: |
+        CFLAGS='-mbranch-protection=standard' \
+        LDFLAGS='-Wl,-z,gcs=always -Wl,-z,gcs-report=error' \
+        ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace --banner=Configured
+    - name: config dump
+      run: ./configdata.pm --dump
+    - name: make
+      run: make -j4