luna - curl/.github/workflows/http3-linux.yml

  1# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  2#
  3# SPDX-License-Identifier: curl
  4
  5name: 'Linux HTTP/3'
  6
  7'on':
  8  push:
  9    branches:
 10      - master
 11      - '*/ci'
 12    paths-ignore:
 13      - '**/*.md'
 14      - '.circleci/**'
 15      - 'appveyor.*'
 16      - 'Dockerfile'
 17      - 'projects/**'
 18  pull_request:
 19    branches:
 20      - master
 21    paths-ignore:
 22      - '**/*.md'
 23      - '.circleci/**'
 24      - 'appveyor.*'
 25      - 'Dockerfile'
 26      - 'projects/**'
 27
 28concurrency:
 29  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
 30  cancel-in-progress: true
 31
 32permissions: {}
 33
 34env:
 35  MAKEFLAGS: -j 5
 36  CURL_CI: github
 37  CURL_TEST_MIN: 1850
 38  DO_NOT_TRACK: '1'
 39  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
 40  AWSLC_VERSION: 1.73.0
 41  # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
 42  BORINGSSL_VERSION: 0.20260508.0
 43  # renovate: datasource=github-tags depName=gnutls/nettle versioning=semver registryUrl=https://github.com
 44  NETTLE_VERSION: 3.10.2
 45  # renovate: datasource=github-tags depName=gnutls/gnutls versioning=semver extractVersion=^nettle_?(?<version>.+)_release_.+$ registryUrl=https://github.com
 46  GNUTLS_VERSION: 3.8.11
 47  # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
 48  LIBRESSL_VERSION: 4.3.1
 49  # renovate: datasource=github-releases depName=openssl/openssl versioning=semver extractVersion=^openssl-(?<version>.+)$ registryUrl=https://github.com
 50  OPENSSL_VERSION: 4.0.0
 51  # manually bumped
 52  OPENSSL_PREV_VERSION: 3.6.2
 53  OPENSSL_PREV_SHA256: aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f
 54  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
 55  QUICHE_VERSION: 0.24.7
 56  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
 57  WOLFSSL_VERSION: 5.9.1
 58  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
 59  NGHTTP3_VERSION: 1.15.0
 60  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
 61  NGTCP2_VERSION: 1.22.1
 62  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
 63  NGHTTP2_VERSION: 1.69.0
 64
 65jobs:
 66  build-cache:
 67    name: 'Build caches'
 68    runs-on: ubuntu-latest
 69
 70    steps:
 71      - name: 'cache awslc'
 72        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
 73        id: cache-awslc
 74        env:
 75          cache-name: cache-awslc
 76        with:
 77          path: ~/awslc/build
 78          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
 79
 80      - name: 'cache boringssl'
 81        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
 82        id: cache-boringssl
 83        env:
 84          cache-name: cache-boringssl
 85        with:
 86          path: ~/boringssl/build
 87          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
 88
 89      - name: 'cache nettle'
 90        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
 91        id: cache-nettle
 92        env:
 93          cache-name: cache-nettle
 94        with:
 95          path: ~/nettle/build
 96          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
 97
 98      - name: 'cache gnutls'
 99        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
100        id: cache-gnutls
101        env:
102          cache-name: cache-gnutls
103        with:
104          path: ~/gnutls/build
105          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
106
107      - name: 'cache libressl'
108        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
109        id: cache-libressl
110        env:
111          cache-name: cache-libressl
112        with:
113          path: ~/libressl/build
114          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
115
116      - name: 'cache openssl'
117        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
118        id: cache-openssl-http3-no-deprecated
119        env:
120          cache-name: cache-openssl-http3-no-deprecated
121        with:
122          path: ~/openssl/build
123          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
124
125      - name: 'cache openssl-prev'
126        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
127        id: cache-openssl-prev-http3-no-deprecated
128        env:
129          cache-name: cache-openssl-prev-http3-no-deprecated
130        with:
131          path: ~/openssl-prev/build
132          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
133
134      - name: 'cache wolfssl'
135        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
136        id: cache-wolfssl
137        env:
138          cache-name: cache-wolfssl
139        with:
140          path: ~/wolfssl/build
141          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
142
143      - name: 'cache nghttp3'
144        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
145        id: cache-nghttp3
146        env:
147          cache-name: cache-nghttp3
148        with:
149          path: ~/nghttp3/build
150          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
151
152      - name: 'cache ngtcp2'
153        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
154        id: cache-ngtcp2
155        env:
156          cache-name: cache-ngtcp2
157        with:
158          path: ~/ngtcp2/build
159          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
160            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
161
162      - name: 'cache ngtcp2 boringssl'
163        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
164        id: cache-ngtcp2-boringssl
165        env:
166          cache-name: cache-ngtcp2-boringssl
167        with:
168          path: ~/ngtcp2-boringssl/build
169          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
170
171      - name: 'cache ngtcp2 openssl-prev'
172        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
173        id: cache-ngtcp2-openssl-prev
174        env:
175          cache-name: cache-ngtcp2-openssl-prev
176        with:
177          path: ~/ngtcp2-openssl-prev/build
178          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
179
180      - name: 'cache nghttp2'
181        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
182        id: cache-nghttp2
183        env:
184          cache-name: cache-nghttp2
185        with:
186          path: ~/nghttp2/build
187          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
188            ${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}"
189
190      - id: settings
191        if: >-
192          ${{ steps.cache-awslc.outputs.cache-hit != 'true' ||
193              steps.cache-boringssl.outputs.cache-hit != 'true' ||
194              steps.cache-nettle.outputs.cache-hit != 'true' ||
195              steps.cache-gnutls.outputs.cache-hit != 'true' ||
196              steps.cache-libressl.outputs.cache-hit != 'true' ||
197              steps.cache-openssl-http3-no-deprecated.outputs.cache-hit != 'true' ||
198              steps.cache-openssl-prev-http3-no-deprecated.outputs.cache-hit != 'true' ||
199              steps.cache-wolfssl.outputs.cache-hit != 'true' ||
200              steps.cache-nghttp3.outputs.cache-hit != 'true' ||
201              steps.cache-ngtcp2-boringssl.outputs.cache-hit != 'true' ||
202              steps.cache-ngtcp2-openssl-prev.outputs.cache-hit != 'true' ||
203              steps.cache-ngtcp2.outputs.cache-hit != 'true' ||
204              steps.cache-nghttp2.outputs.cache-hit != 'true' }}
205
206        run: echo 'needs-build=true' >> "$GITHUB_OUTPUT"
207
208      - name: 'install build prereqs'
209        if: ${{ steps.settings.outputs.needs-build == 'true' }}
210        timeout-minutes: 2
211        run: |
212          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
213          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
214          sudo apt-get -o Dpkg::Use-Pty=0 update
215          sudo apt-get -o Dpkg::Use-Pty=0 install \
216            libtool autoconf automake pkgconf \
217            libbrotli-dev libzstd-dev zlib1g-dev \
218            libev-dev \
219            libc-ares-dev \
220            libp11-kit-dev autopoint bison gperf gtk-doc-tools libtasn1-bin  # for GnuTLS
221          echo 'CC=gcc-12' >> "$GITHUB_ENV"
222          echo 'CXX=g++-12' >> "$GITHUB_ENV"
223
224      - name: 'build awslc'
225        if: ${{ steps.cache-awslc.outputs.cache-hit != 'true' }}
226        run: |
227          cd ~
228          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
229            --location "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
230          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
231          cd "aws-lc-${AWSLC_VERSION}"
232          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/awslc/build
233          cmake --build .
234          cmake --install .
235
236      - name: 'build boringssl'
237        if: ${{ steps.cache-boringssl.outputs.cache-hit != 'true' }}
238        run: |
239          mkdir boringssl-src
240          cd boringssl-src
241          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
242            "https://boringssl.googlesource.com/boringssl/+archive/${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
243          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
244          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/boringssl/build
245          cmake --build .
246          cmake --install .
247
248      - name: 'build nettle'
249        if: ${{ steps.cache-nettle.outputs.cache-hit != 'true' }}
250        run: |
251          cd ~
252          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
253            --location "https://ftpmirror.gnu.org/nettle/nettle-${NETTLE_VERSION}.tar.gz" --output pkg.bin
254          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
255          cd "nettle-${NETTLE_VERSION}"
256          autoreconf -fi
257          ./configure --disable-dependency-tracking --prefix=/home/runner/nettle/build \
258            --disable-static --disable-openssl --disable-documentation
259          make install
260
261      - name: 'build gnutls'
262        if: ${{ steps.cache-gnutls.outputs.cache-hit != 'true' }}
263        run: |
264          cd ~
265          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
266            "https://www.gnupg.org/ftp/gcrypt/gnutls/v${GNUTLS_VERSION%.*}/gnutls-${GNUTLS_VERSION}.tar.xz" --output pkg.bin
267          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
268          cd "gnutls-${GNUTLS_VERSION}"
269          autoreconf -fi
270          # required: libp11-kit-dev libev-dev autopoint bison gperf gtk-doc-tools libtasn1-bin
271          ./configure --disable-dependency-tracking --prefix=/home/runner/gnutls/build \
272            PKG_CONFIG_PATH=/home/runner/nettle/build/lib64/pkgconfig \
273            LDFLAGS=-Wl,-rpath,/home/runner/nettle/build/lib64 \
274            --with-included-libtasn1 --with-included-unistring \
275            --disable-guile --disable-doc --disable-tests --disable-tools
276          make install
277
278      - name: 'build libressl'
279        if: ${{ steps.cache-libressl.outputs.cache-hit != 'true' }}
280        run: |
281          cd ~
282          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
283            --location "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
284          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
285          cd "libressl-${LIBRESSL_VERSION}"
286          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/libressl/build
287          cmake --build .
288          cmake --install .
289
290      - name: 'build openssl'
291        if: ${{ steps.cache-openssl-http3-no-deprecated.outputs.cache-hit != 'true' }}
292        run: |
293          cd ~
294          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
295          cd openssl
296          ./config --prefix="$PWD"/build --libdir=lib no-makedepend no-apps no-docs no-tests no-deprecated
297          make
298          make -j1 install_sw
299
300      - name: 'build openssl-prev'
301        if: ${{ steps.cache-openssl-prev-http3-no-deprecated.outputs.cache-hit != 'true' }}
302        run: |
303          cd ~
304          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
305            --location "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_PREV_VERSION}/openssl-${OPENSSL_PREV_VERSION}.tar.gz" --output pkg.bin
306          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OPENSSL_PREV_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
307          cd "openssl-${OPENSSL_PREV_VERSION}"
308          ./config --prefix=/home/runner/openssl-prev/build --libdir=lib no-makedepend no-apps no-docs no-tests no-deprecated
309          make
310          make -j1 install_sw
311
312      - name: 'build wolfssl'
313        if: ${{ steps.cache-wolfssl.outputs.cache-hit != 'true' }}
314        run: |
315          cd ~
316          git clone --quiet --depth 1 --branch "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl
317          cd wolfssl
318          ./autogen.sh
319          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-all --enable-quic \
320            --disable-benchmark --disable-crypttests --disable-examples
321          make
322          make install
323
324      - name: 'build nghttp3'
325        if: ${{ steps.cache-nghttp3.outputs.cache-hit != 'true' }}
326        run: |
327          cd ~
328          git clone --quiet --depth 1 --branch "v${NGHTTP3_VERSION}" https://github.com/ngtcp2/nghttp3
329          cd nghttp3
330          git submodule update --init --depth 1
331          autoreconf -fi
332          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only
333          make
334          make install
335
336      - name: 'build ngtcp2'
337        if: ${{ steps.cache-ngtcp2.outputs.cache-hit != 'true' }}
338        # building twice to get crypto libs for ossl, libressl and awslc installed
339        run: |
340          cd ~
341          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2
342          cd ngtcp2
343          autoreconf -fi
344          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
345            PKG_CONFIG_PATH=/home/runner/libressl/build/lib/pkgconfig \
346            --with-openssl
347          make install
348          make clean
349          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
350          PKG_CONFIG_PATH+=:/home/runner/nettle/build/lib64/pkgconfig
351          PKG_CONFIG_PATH+=:/home/runner/gnutls/build/lib/pkgconfig
352          PKG_CONFIG_PATH+=:/home/runner/wolfssl/build/lib/pkgconfig
353          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
354            --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
355            BORINGSSL_LIBS='-L/home/runner/awslc/build/lib -lssl -lcrypto' \
356            BORINGSSL_CFLAGS='-I/home/runner/awslc/build/include'
357          make install
358
359      - name: 'build ngtcp2 openssl-prev'
360        if: ${{ steps.cache-ngtcp2-openssl-prev.outputs.cache-hit != 'true' }}
361        run: |
362          cd ~
363          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl-prev
364          cd ngtcp2-openssl-prev
365          autoreconf -fi
366          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
367            PKG_CONFIG_PATH=/home/runner/openssl-prev/build/lib/pkgconfig \
368            --with-openssl
369          make install
370
371      - name: 'build ngtcp2 boringssl'
372        if: ${{ steps.cache-ngtcp2-boringssl.outputs.cache-hit != 'true' }}
373        run: |
374          cd ~
375          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-boringssl
376          cd ngtcp2-boringssl
377          autoreconf -fi
378          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
379            --with-openssl=no --with-boringssl \
380            BORINGSSL_LIBS='-L/home/runner/boringssl/build/lib -lssl -lcrypto' \
381            BORINGSSL_CFLAGS='-I/home/runner/boringssl/build/include'
382          make install
383
384      - name: 'build nghttp2'
385        if: ${{ steps.cache-nghttp2.outputs.cache-hit != 'true' }}
386        run: |
387          cd ~
388          git clone --quiet --depth 1 --branch "v${NGHTTP2_VERSION}" https://github.com/nghttp2/nghttp2
389          cd nghttp2
390          git submodule update --init --depth 1
391          autoreconf -fi
392          # required (for nghttpx application): libc-ares-dev libev-dev zlib1g-dev
393          # optional (for nghttpx application): libbrotli-dev
394          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
395          PKG_CONFIG_PATH+=:/home/runner/nghttp3/build/lib/pkgconfig
396          PKG_CONFIG_PATH+=:/home/runner/ngtcp2/build/lib/pkgconfig
397          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-app --enable-http3 \
398            LDFLAGS=-Wl,-rpath,/home/runner/openssl/build/lib \
399            --with-libbrotlienc --with-libbrotlidec
400          make install
401
402  linux:
403    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
404    needs: build-cache
405    runs-on: ubuntu-latest
406    timeout-minutes: 10
407    env:
408      CURL_TRACE_PKG_CONFIG: '1'
409      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
410      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
411    strategy:
412      fail-fast: false
413      matrix:
414        build:
415          - name: 'awslc'
416            install_steps: skipall
417            LDFLAGS: -Wl,-rpath,/home/runner/awslc/build/lib
418            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
419            # Intentionally using bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' to test this way of configuration, in addition to '--with-ngtcp2=<path>' in other jobs.
420            configure: >-
421              --with-openssl=/home/runner/awslc/build --with-ngtcp2 --enable-ssls-export
422
423          - name: 'awslc'
424            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
425            generate: >-
426              -DOPENSSL_ROOT_DIR=/home/runner/awslc/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
427              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON
428
429          - name: 'boringssl'
430            install_steps: skipall
431            LDFLAGS: -Wl,-rpath,/home/runner/boringssl/build/lib
432            PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
433            configure: >-
434              --with-openssl=/home/runner/boringssl/build --with-ngtcp2=/home/runner/ngtcp2-boringssl/build --enable-ssls-export
435
436          - name: 'boringssl'
437            PKG_CONFIG_PATH: "\
438              /home/runner/boringssl/build/lib/pkgconfig:\
439              /home/runner/nghttp3/build/lib/pkgconfig:\
440              /home/runner/ngtcp2-boringssl/build/lib/pkgconfig:\
441              /home/runner/nghttp2/build/lib/pkgconfig"
442            generate: >-
443              -DOPENSSL_ROOT_DIR=/home/runner/boringssl/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
444              -DCMAKE_UNITY_BUILD=ON
445
446          - name: 'gnutls'
447            install_packages: libp11-kit-dev libssh-dev
448            install_steps: skipall
449            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib -Wl,-rpath,/home/runner/nettle/build/lib64 -Wl,-rpath,/home/runner/ngtcp2/build/lib
450            PKG_CONFIG_PATH: /home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
451            configure: >-
452              --with-gnutls=/home/runner/gnutls/build --with-ngtcp2=/home/runner/ngtcp2/build --with-libssh --enable-ssls-export
453
454          - name: 'gnutls'
455            install_packages: libp11-kit-dev libssh-dev
456            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib
457            PKG_CONFIG_PATH: "\
458              /home/runner/nettle/build/lib64/pkgconfig:\
459              /home/runner/gnutls/build/lib/pkgconfig:\
460              /home/runner/nghttp3/build/lib/pkgconfig:\
461              /home/runner/ngtcp2/build/lib/pkgconfig:\
462              /home/runner/nghttp2/build/lib/pkgconfig"
463            generate: >-
464              -DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH=ON
465              -DCMAKE_UNITY_BUILD=ON
466
467          - name: 'libressl'
468            install_steps: skipall
469            LDFLAGS: -Wl,-rpath,/home/runner/libressl/build/lib
470            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
471            # Intentionally using '--with-ngtcp2=<path>' to test this way of configuration, in addition to bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' in other jobs.
472            configure: >-
473              --with-openssl=/home/runner/libressl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ssls-export
474              --enable-unity
475
476          - name: 'libressl'
477            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
478            generate: >-
479              -DOPENSSL_ROOT_DIR=/home/runner/libressl/build -DUSE_NGTCP2=ON
480
481          - name: 'openssl'
482            tflags: '--min=1700'
483            LDFLAGS: -Wl,-rpath,/home/runner/openssl/build/lib
484            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
485            configure: >-
486              --with-openssl=/home/runner/openssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --enable-ssls-export
487
488          - name: 'openssl'
489            install_steps: skipall
490            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
491            generate: >-
492              -DOPENSSL_ROOT_DIR=/home/runner/openssl/build -DUSE_NGTCP2=ON
493              -DCURL_DISABLE_LDAP=ON
494              -DUSE_ECH=ON
495              -DCMAKE_UNITY_BUILD=ON
496
497          - name: 'openssl-prev'
498            install_steps: skipall
499            LDFLAGS: -Wl,-rpath,/home/runner/openssl-prev/build/lib
500            PKG_CONFIG_PATH: "\
501              /home/runner/openssl-prev/build/lib/pkgconfig:\
502              /home/runner/nghttp3/build/lib/pkgconfig:\
503              /home/runner/nghttp2-openssl-prev/build/lib/pkgconfig"
504            configure: >-
505              --with-openssl=/home/runner/openssl-prev/build --with-ngtcp2=/home/runner/ngtcp2-openssl-prev/build --enable-ssls-export
506
507          - name: 'openssl-prev'
508            tflags: '--min=1700'
509            PKG_CONFIG_PATH: "\
510              /home/runner/openssl-prev/build/lib/pkgconfig:\
511              /home/runner/nghttp3/build/lib/pkgconfig:\
512              /home/runner/ngtcp2-openssl-prev/build/lib/pkgconfig:\
513              /home/runner/nghttp2/build/lib/pkgconfig"
514            generate: >-
515              -DOPENSSL_ROOT_DIR=/home/runner/openssl-prev/build -DUSE_NGTCP2=ON
516              -DCURL_DISABLE_LDAP=ON
517
518          - name: 'quiche'
519            install_steps: skipall
520            LDFLAGS: -Wl,-rpath,/home/runner/quiche/target/release
521            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig
522            configure: >-
523              --with-openssl=/home/runner/quiche/quiche/deps/boringssl/src
524              --with-quiche=/home/runner/quiche/target/release
525              --with-ca-fallback
526              --enable-unity
527
528          - name: 'quiche'
529            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig:/home/runner/quiche/target/release
530            generate: >-
531              -DOPENSSL_ROOT_DIR=/home/runner/quiche/quiche/deps/boringssl/src
532              -DUSE_QUICHE=ON
533              -DCURL_CA_FALLBACK=ON
534
535          - name: 'wolfssl'
536            install_packages: libssh2-1-dev
537            install_steps: skipall
538            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl/build/lib
539            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
540            configure: >-
541              --with-wolfssl=/home/runner/wolfssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --with-libssh2 --enable-ssls-export
542              --enable-unity
543
544          - name: 'wolfssl'
545            install_packages: libssh2-1-dev
546            tflags: '--min=1900'
547            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
548            generate: >-
549              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
550              -DUSE_ECH=ON
551
552    steps:
553      - name: 'install prereqs'
554        timeout-minutes: 2
555        env:
556          INSTALL_PACKAGES: >-
557            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4 ' || '' }}
558            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') &&
559              'apache2 apache2-dev libnghttp2-dev vsftpd dante-server libev-dev' || '' }}
560
561        run: |
562          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
563          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
564          sudo apt-get -o Dpkg::Use-Pty=0 update
565          sudo apt-get -o Dpkg::Use-Pty=0 install \
566            libtool autoconf automake pkgconf \
567            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libidn2-0-dev libldap-dev libuv1-dev valgrind \
568            ${INSTALL_PACKAGES} \
569            ${MATRIX_INSTALL_PACKAGES}
570          echo 'CC=gcc-12' >> "$GITHUB_ENV"
571          echo 'CXX=g++-12' >> "$GITHUB_ENV"
572
573      - name: 'cache awslc'
574        if: ${{ contains(matrix.build.name, 'awslc') }}
575        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
576        id: cache-awslc
577        env:
578          cache-name: cache-awslc
579        with:
580          path: ~/awslc/build
581          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
582          fail-on-cache-miss: true
583
584      - name: 'cache boringssl'
585        if: ${{ contains(matrix.build.name, 'boringssl') }}
586        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
587        id: cache-boringssl
588        env:
589          cache-name: cache-boringssl
590        with:
591          path: ~/boringssl/build
592          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
593          fail-on-cache-miss: true
594
595      - name: 'cache nettle'
596        if: ${{ contains(matrix.build.name, 'gnutls') }}
597        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
598        id: cache-nettle
599        env:
600          cache-name: cache-nettle
601        with:
602          path: ~/nettle/build
603          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
604          fail-on-cache-miss: true
605
606      - name: 'cache gnutls'
607        if: ${{ contains(matrix.build.name, 'gnutls') }}
608        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
609        id: cache-gnutls
610        env:
611          cache-name: cache-gnutls
612        with:
613          path: ~/gnutls/build
614          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
615          fail-on-cache-miss: true
616
617      - name: 'cache libressl'
618        if: ${{ contains(matrix.build.name, 'libressl') }}
619        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
620        id: cache-libressl
621        env:
622          cache-name: cache-libressl
623        with:
624          path: ~/libressl/build
625          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
626          fail-on-cache-miss: true
627
628      - name: 'cache openssl'
629        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
630        id: cache-openssl-http3-no-deprecated
631        env:
632          cache-name: cache-openssl-http3-no-deprecated
633        with:
634          path: ~/openssl/build
635          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
636          fail-on-cache-miss: true
637
638      - name: 'cache openssl-prev'
639        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
640        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
641        id: cache-openssl-prev-http3-no-deprecated
642        env:
643          cache-name: cache-openssl-prev-http3-no-deprecated
644        with:
645          path: ~/openssl-prev/build
646          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
647          fail-on-cache-miss: true
648
649      - name: 'cache wolfssl'
650        if: ${{ contains(matrix.build.name, 'wolfssl') }}
651        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
652        id: cache-wolfssl
653        env:
654          cache-name: cache-wolfssl
655        with:
656          path: ~/wolfssl/build
657          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
658          fail-on-cache-miss: true
659
660      - name: 'cache nghttp3'
661        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
662        id: cache-nghttp3
663        env:
664          cache-name: cache-nghttp3
665        with:
666          path: ~/nghttp3/build
667          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
668          fail-on-cache-miss: true
669
670      - name: 'cache ngtcp2'
671        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
672        id: cache-ngtcp2
673        env:
674          cache-name: cache-ngtcp2
675        with:
676          path: ~/ngtcp2/build
677          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
678            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
679          fail-on-cache-miss: true
680
681      - name: 'cache ngtcp2 boringssl'
682        if: ${{ contains(matrix.build.name, 'boringssl') }}
683        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
684        id: cache-ngtcp2-boringssl
685        env:
686          cache-name: cache-ngtcp2-boringssl
687        with:
688          path: ~/ngtcp2-boringssl/build
689          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
690          fail-on-cache-miss: true
691
692      - name: 'cache ngtcp2 openssl-prev'
693        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
694        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
695        id: cache-ngtcp2-openssl-prev
696        env:
697          cache-name: cache-ngtcp2-openssl-prev
698        with:
699          path: ~/ngtcp2-openssl-prev/build
700          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
701          fail-on-cache-miss: true
702
703      - name: 'cache nghttp2'
704        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
705        id: cache-nghttp2
706        env:
707          cache-name: cache-nghttp2
708        with:
709          path: ~/nghttp2/build
710          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}
711          fail-on-cache-miss: true
712
713      - name: 'cache quiche'
714        if: ${{ contains(matrix.build.name, 'quiche') }}
715        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
716        id: cache-quiche
717        env:
718          cache-name: cache-quiche
719        with:
720          path: ~/quiche
721          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.QUICHE_VERSION }}
722
723      - name: 'build quiche and boringssl'
724        if: ${{ contains(matrix.build.name, 'quiche') && steps.cache-quiche.outputs.cache-hit != 'true' }}
725        run: |
726          cd ~
727          git clone --quiet --depth 1 --branch "${QUICHE_VERSION}" --recursive https://github.com/cloudflare/quiche
728          cd quiche
729          #### Work-around https://github.com/curl/curl/issues/7927 #######
730          #### See https://github.com/alexcrichton/cmake-rs/issues/131 ####
731          sed -i -e 's/cmake = "0.1"/cmake = "=0.1.45"/' quiche/Cargo.toml
732
733          cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
734          ln -s libquiche.so target/release/libquiche.so.0
735          mkdir -v quiche/deps/boringssl/src/lib
736          find target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf -- '{}' quiche/deps/boringssl/src/lib \;
737
738          # include dir
739          # /home/runner/quiche/quiche/deps/boringssl/src/include
740          # lib dir
741          # /home/runner/quiche/quiche/deps/boringssl/src/lib
742
743      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
744        with:
745          persist-credentials: false
746
747      - name: 'autoreconf'
748        if: ${{ matrix.build.configure }}
749        run: autoreconf -fi
750
751      - name: 'configure'
752        env:
753          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
754          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
755          MATRIX_GENERATE: '${{ matrix.build.generate }}'
756          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
757        run: |
758          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
759          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
760            [[ "${MATRIX_GENERATE}" = *'boringssl'* ]] && options=" -DBORINGSSL_VERSION=${BORINGSSL_VERSION}"
761            cmake -B bld -G Ninja \
762              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-pc-linux-gnu" -DBUILD_STATIC_LIBS=ON \
763              -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
764              -DCURL_USE_LIBUV=ON -DCURL_ENABLE_NTLM=ON \
765              -DTEST_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
766              -DHTTPD_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
767              ${MATRIX_GENERATE} ${options}
768          else
769            [[ "${MATRIX_CONFIGURE}" = *'boringssl'* ]] && export CPPFLAGS="-DCURL_BORINGSSL_VERSION=\\\"${BORINGSSL_VERSION}\\\""
770            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror --enable-debug --disable-static \
771              --disable-dependency-tracking --enable-option-checking=fatal \
772              --with-libuv --enable-ntlm \
773              --with-test-nghttpx=/home/runner/nghttp2/build/bin/nghttpx \
774              ${MATRIX_CONFIGURE}
775          fi
776
777      - name: 'configure log'
778        if: ${{ !cancelled() }}
779        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
780
781      - name: 'curl_config.h'
782        run: |
783          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
784          grep -F '#define' bld/lib/curl_config.h | sort || true
785
786      - name: 'test configs'
787        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
788
789      - name: 'build'
790        run: |
791          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
792            cmake --build bld --verbose
793          else
794            make -C bld V=1
795          fi
796
797      - name: 'curl -V'
798        run: |
799          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
800          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
801          bld/src/curl --disable -V
802
803      - name: 'build tests'
804        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
805        run: |
806          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
807            cmake --build bld --verbose --target testdeps
808          else
809            make -C bld V=1 -C tests
810          fi
811
812      - name: 'install test prereqs'
813        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
814        run: |
815          python3 -m venv ~/venv
816          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
817            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
818          fi
819
820      - name: 'run tests'
821        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
822        env:
823          TFLAGS: '${{ matrix.build.tflags }}'
824        run: |
825          TFLAGS+=' -n'
826          source ~/venv/bin/activate
827          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
828            cmake --build bld --verbose --target test-ci
829          else
830            make -C bld V=1 test-ci
831          fi
832
833      - name: 'run tests (valgrind)'
834        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
835        run: |
836          export TFLAGS='-j6 --min=4 HTTP/3'
837          source ~/venv/bin/activate
838          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
839            cmake --build bld --verbose --target test-ci
840          else
841            make -C bld V=1 test-ci
842          fi
843
844      - name: 'install pytest prereqs'
845        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
846        run: |
847          [ -d ~/venv ] || python3 -m venv ~/venv
848          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
849
850      - name: 'run pytest (event based)'
851        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
852        env:
853          CURL_TEST_EVENT: 1
854          PYTEST_ADDOPTS: '--color=yes'
855          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
856        run: |
857          source ~/venv/bin/activate
858          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
859            cmake --build bld --verbose --target curl-pytest-ci
860          else
861            make -C bld V=1 pytest-ci
862          fi