From patchwork Wed Feb 12 21:52:32 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 4134 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:1d8f:b0:5e7:b9eb:58e8 with SMTP id hp15csp192624mab; Wed, 12 Feb 2025 13:52:55 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCVhH1Dbc7Ol347yFXswgN5xIeNjQaxdwxva5xzQ8vfBbUe6c+s4w7+cIO7H7fzoAjvbpO6S42O9XD8=@openvpn.net X-Google-Smtp-Source: AGHT+IHRIfI/lRqAZKYbkpMVEBZuMIZvmCSG6JuC02BSuTbyC/SpZOeqBPFDRpu/dlCH0R/JL8Vn X-Received: by 2002:a05:6808:3095:b0:3f3:c3d1:7ba0 with SMTP id 5614622812f47-3f3d8dccd1fmr501192b6e.10.1739397174815; Wed, 12 Feb 2025 13:52:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1739397174; cv=none; d=google.com; s=arc-20240605; b=fnzKxU5hs0nft0nLP36OD/mNtV9wVm53+Rk5WyHXnLTBINqEUzpOiXlofUT0VydrEb qEIj8JfGLNnfNetUFJouB2klr6i8EB5fC2tMuAeJZ429KVV7Tv9XHrSmfil1U8HoTQvK a24I7oHONiCA3XZU5vRpAOKLO4b/pJ0+m5reYtqB4bDA279BxstUAH5knZbnB9rao0IZ mUkjW8JfP+HclPUwXO36+OOa8NIleAaHDMHkc7T3bOuT0SmXDrxnCkBufDiNKXVawvBB qY3DMuzKaWaetO9d6hiXaopdFpDwqw3qb/8du549dd94NIPeeSgNcNWkfTvHfmp4dAeb 23rA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature; bh=lzbX9BbuiWd2A9rHuuVgGYLXk6dBDmDdeB0dA1MLG/I=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=Oznb78hQgA/FD+GJNcZBXRqiyRJTJGQexG0da4IyXfSN5zyLdj6HCTExJn7xre5qBk oWrEbfAEcRiXaUeQH7ass4Na8FOkhbJ8duWvOfLFQgI7nPNzB3Szeo9IO8HnzmOBdORe Sr/eeD3SiYLiytm7/vpT+nw9GI7MbT1SwtMNTAxLjhmFFxEElOoE6fH7bx2WBYy9QOTt LEF7bQTc4bSIjp7tc2ATvzLvMgQJRO2+RNGblkUyzD+F2nmbt0VfiLJMGvaCV0YuTHcQ 9pljeyzn593DSSB9Z3msjuXGU9gLcBS3WPmlyach1DnYV6OTrvegKbHpJaDUPPsrTXCQ VRMQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=A+9Mn4AY; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YGJJtZcd; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-5fcb163be04si63215eaf.32.2025.02.12.13.52.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 12 Feb 2025 13:52:54 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=A+9Mn4AY; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=YGJJtZcd; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1tiKf1-0004Q0-LI; Wed, 12 Feb 2025 21:52:48 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1tiKez-0004Pj-Rh for openvpn-devel@lists.sourceforge.net; Wed, 12 Feb 2025 21:52:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=OdRaOEUgad3sQfDsh0j/6jzLs1Lv67RCU1ehtHlHXxU=; b=A+9Mn4AYtHcU+GWi2FGuqxfMLz msUoE0GRLwXqqvgvGV72Hvlrzf6BpRxP383MSEmUwv3KCle7RI+bTQzUMAd2yFX7RejUQSguMLUdU +jQ4fSA3O7z0F4l3+FtCyuHWq+6oZc7O2hUSo1f56nlvyzyx9tDC1QkTlSbHSLE9ntJU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=OdRaOEUgad3sQfDsh0j/6jzLs1Lv67RCU1ehtHlHXxU=; b=YGJJtZcdQ8EbeMKVuQ/Jak/0cL 0nzKDaEXFscKQRczVFM6MZWhY6EnKalbwxOa7EiYbcuORtO+8CxLNb4sw8jjPRuTK0nY6mVwKAHM2 8fD5RlmfSUJQ8Yh9MxmiA5+y4+tkOWU9ai+vhLKkBo/AMUJTGuvWsE/OuRJ2umYDZ90A=; Received: from dhcp-174.greenie.muc.de ([193.149.48.174] helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1tiKez-0003rj-6d for openvpn-devel@lists.sourceforge.net; Wed, 12 Feb 2025 21:52:46 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.17.1.9/8.17.1.9) with ESMTP id 51CLqXEl001050 for ; Wed, 12 Feb 2025 22:52:33 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.17.1.9/8.17.1.9/Submit) id 51CLqXHo001049 for openvpn-devel@lists.sourceforge.net; Wed, 12 Feb 2025 22:52:33 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 12 Feb 2025 22:52:32 +0100 Message-ID: <20250212215232.998-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.45.2 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Frank Lichtenheld - Drop Ubuntu 20.04 GHA runners will go away in April 2025 - Change ubuntu-latest to ubuntu-24.04 to make sure we are not surprised by future changes. - Update vcpkg digest to latest 33e9c99 - Update [...] Content analysis details: (0.0 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [193.149.48.174 listed in bl.score.senderscore.com] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [193.149.48.174 listed in sa-trusted.bondedsender.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 SPF_HELO_PASS SPF: HELO matches SPF record X-Headers-End: 1tiKez-0003rj-6d Subject: [Openvpn-devel] [PATCH v1] GHA: Drop Ubuntu 20.04 and other maintenance (2.6) X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1823890132206470173?= X-GMAIL-MSGID: =?utf-8?q?1823890132206470173?= From: Frank Lichtenheld - Drop Ubuntu 20.04 GHA runners will go away in April 2025 - Change ubuntu-latest to ubuntu-24.04 to make sure we are not surprised by future changes. - Update vcpkg digest to latest 33e9c99 - Update github actions to latest Backport changes: Sync 2.6 GHA with master GHA by - pinning action references - adding Ubuntu 24.04 builds - updating libressl - updating ASAN builds to include "undefined" checker Change-Id: I29b68675143988c3304395d9d5ec62289cf519a7 Signed-off-by: Frank Lichtenheld Acked-by: Yuriy Darnobyt (cherry picked from commit c26b2e2c5581ad4e14b737df9178a03d6403a5f7) --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to release/2.6. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/893 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Yuriy Darnobyt diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index d930197..5b1c797 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -13,7 +13,7 @@ - name: Install dependencies run: sudo apt update && sudo apt install -y uncrustify - name: Checkout OpenVPN - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: path: openvpn - name: Show uncrustify version @@ -27,7 +27,7 @@ - name: Show changes on standard output run: git diff working-directory: openvpn - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: uncrustify-changes.patch path: 'openvpn/uncrustify-changes.patch' @@ -42,29 +42,29 @@ arch: [x86, x64] name: "gcc-mingw - ${{ matrix.arch }} - OSSL" - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 env: VCPKG_ROOT: ${{ github.workspace }}/vcpkg steps: - name: Install dependencies run: sudo apt update && sudo apt install -y mingw-w64 unzip cmake ninja-build build-essential wget python3-docutils man2html-base - name: Checkout OpenVPN - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Restore from cache and install vcpkg - uses: lukka/run-vcpkg@v11 + uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5 with: - vcpkgGitCommitId: 8d3649ba34aab36914ddd897958599aa0a91b08e + vcpkgGitCommitId: 33e9c99208736b713cabe4490e15235f62f893d4 vcpkgJsonGlob: '**/mingw/vcpkg.json' - name: Run CMake with vcpkg.json manifest - uses: lukka/run-cmake@v10 + uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8 with: configurePreset: mingw-${{ matrix.arch }} buildPreset: mingw-${{ matrix.arch }} buildPresetAdditionalArgs: "['--config Debug']" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: openvpn-mingw-${{ matrix.arch }} path: | @@ -72,7 +72,7 @@ ${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/*.dll !${{ github.workspace }}/out/build/mingw/${{ matrix.arch }}/Debug/test_*.exe - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: | @@ -91,7 +91,7 @@ name: "mingw unittest ${{ matrix.test }} - ${{ matrix.arch }} - OSSL" steps: - name: Retrieve mingw unittest - uses: actions/download-artifact@v4 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: name: openvpn-mingw-${{ matrix.arch }}-tests path: unittests @@ -102,56 +102,35 @@ strategy: fail-fast: false matrix: - os: [ubuntu-20.04, ubuntu-22.04] - sslpkg: [libmbedtls-dev] - ssllib: [mbedtls] - libname: [mbed TLS] - include: - - os: ubuntu-20.04 - sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 - ssllib: openssl + - os: ubuntu-22.04 + sslpkg: libmbedtls-dev + ssllib: mbedtls + libname: mbed TLS 2.28.0 - os: ubuntu-22.04 sslpkg: "libssl-dev" libname: OpenSSL 3.0.2 ssllib: openssl - - os: ubuntu-20.04 + pkcs11pkg: "libpkcs11-helper1-dev softhsm2 gnutls-bin" + extraconf: --enable-pkcs11 + - os: ubuntu-24.04 sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 + libname: OpenSSL 3.0.13 ssllib: openssl - extraconf: "--enable-iproute2" - - os: ubuntu-20.04 - sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 - ssllib: openssl - extraconf: "--enable-async-push" - - os: ubuntu-20.04 - sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 - ssllib: openssl - extraconf: "--disable-management" - - os: ubuntu-20.04 - sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 - ssllib: openssl - extraconf: "--enable-small" - - os: ubuntu-20.04 - sslpkg: "libssl-dev" - libname: OpenSSL 1.1.1 - ssllib: openssl - extraconf: "--disable-lzo --disable-lz4" + pkcs11pkg: "libpkcs11-helper1-dev softhsm2 gnutls-bin" + extraconf: --enable-pkcs11 name: "gcc - ${{matrix.os}} - ${{matrix.libname}} ${{matrix.extraconf}}" env: SSLPKG: "${{matrix.sslpkg}}" + PKCS11PKG: "${{matrix.pkcs11pkg}}" runs-on: ${{matrix.os}} steps: - name: Install dependencies - run: sudo apt update && sudo apt install -y liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev libnl-genl-3-dev linux-libc-dev man2html libcmocka-dev python3-docutils libtool automake autoconf ${SSLPKG} + run: sudo apt update && sudo apt install -y liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev libnl-genl-3-dev linux-libc-dev man2html libcmocka-dev python3-docutils libtool automake autoconf ${SSLPKG} ${PKCS11PKG} - name: Checkout OpenVPN - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: autoconf run: autoreconf -fvi - name: configure @@ -165,7 +144,7 @@ strategy: fail-fast: false matrix: - os: [ubuntu-20.04] + os: [ubuntu-22.04, ubuntu-24.04] ssllib: [mbedtls, openssl] name: "clang-asan - ${{matrix.os}} - ${{matrix.ssllib}}" @@ -178,11 +157,11 @@ - name: Install dependencies run: sudo apt update && sudo apt install -y liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev libnl-genl-3-dev linux-libc-dev man2html clang libcmocka-dev python3-docutils libtool automake autoconf libmbedtls-dev - name: Checkout OpenVPN - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: autoconf run: autoreconf -fvi - name: configure - run: CFLAGS="-fsanitize=address -fno-omit-frame-pointer -O2" CC=clang ./configure --with-crypto-library=${{matrix.ssllib}} + run: CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer -O2" CC=clang ./configure --with-crypto-library=${{matrix.ssllib}} - name: make all run: make -j3 - name: make check @@ -197,8 +176,8 @@ os: [macos-13, macos-14, macos-15] include: - build: asan - cflags: "-fsanitize=address -fno-optimize-sibling-calls -fsanitize-address-use-after-scope -fno-omit-frame-pointer -g -O1" - ldflags: -fsanitize=address + cflags: "-fsanitize=address,undefined -fno-sanitize-recover=all -fno-optimize-sibling-calls -fsanitize-address-use-after-scope -fno-omit-frame-pointer -g -O1" + ldflags: -fsanitize=address,undefined -fno-sanitize-recover=all # Our build system ignores LDFLAGS for plugins configureflags: --disable-plugin-auth-pam --disable-plugin-down-root - build: normal @@ -216,7 +195,7 @@ - name: Install dependencies run: brew install ${{matrix.ssllib}} lzo lz4 man2html cmocka libtool automake autoconf - name: Checkout OpenVPN - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set environment run: | cat >>$GITHUB_ENV <