Repository navigation
Test Installer #159
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Installer | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 4 * * *' | |
| workflow_dispatch: | |
| env: | |
| # VS 2022 Enterprise and Strawberry Perl are preinstalled on windows-2025. | |
| VCVARS: 'C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat' | |
| # The NIST-validated FIPS module is built once from this ref (VC-WIN64A) and | |
| # shared by every installer flavor via the `fips` job's artifact. | |
| FIPS_REF: openssl-3.1.2 | |
| jobs: | |
| fips: | |
| name: Build FIPS module | |
| runs-on: windows-2025 | |
| steps: | |
| - name: Checkout installer | |
| uses: actions/checkout@v7 | |
| - name: Restore FIPS build cache | |
| id: fips_cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: openssl-fips | |
| key: openssl-fips-${{ runner.os }}-${{ env.FIPS_REF }}-v1 | |
| - name: Checkout OpenSSL for FIPS (${{ env.FIPS_REF }}) | |
| if: steps.fips_cache.outputs.cache-hit != 'true' | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: openssl/openssl | |
| ref: ${{ env.FIPS_REF }} | |
| path: openssl-fips | |
| - name: Apply Windows build patches to FIPS source | |
| if: steps.fips_cache.outputs.cache-hit != 'true' && env.FIPS_REF == 'openssl-3.1.2' | |
| shell: pwsh | |
| working-directory: openssl-fips | |
| run: | | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0001-win-Fix-warning-build-issue.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "patch 0001 failed" } | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0002-windows-makefile-libdir-absolute.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "patch 0002 failed" } | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0001-3.1-Windows-Use-Z7-compiler-flag-to-enable-parallel-.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "jom patch failed" } | |
| - name: install nasm | |
| if: steps.fips_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| run: | | |
| $installer = "nasm-3.01-installer-x64.exe" | |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer | |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer | |
| $actual = (Get-FileHash $installer -Algorithm SHA256).Hash | |
| if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" } | |
| Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait | |
| "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append | |
| - name: install jom | |
| if: steps.fips_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| run: | | |
| mkdir C:\jom | |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe | |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' | |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash | |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } | |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append | |
| - name: Build FIPS module (VC-WIN64A) | |
| if: steps.fips_cache.outputs.cache-hit != 'true' | |
| shell: cmd | |
| working-directory: openssl-fips | |
| run: | | |
| call "%VCVARS%" | |
| perl Configure VC-WIN64A enable-fips no-makedepend | |
| jom /j4 /S | |
| - name: Upload FIPS providers | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: openssl-fips-providers | |
| path: | | |
| openssl-fips/providers/fips.dll | |
| openssl-fips/providers/fips.lib | |
| openssl-fips/providers/fips.pdb | |
| if-no-files-found: error | |
| build: | |
| name: Build ${{ matrix.crt.flavor }} installers (${{ matrix.openssl-ref }}) | |
| needs: fips | |
| runs-on: windows-2025 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| openssl-ref: [openssl-4.0] | |
| crt: | |
| - { flavor: vs, target: VC-WIN64A, exe_build: ExeBuild, msi_build: MsiBuild, keep: OpenSSL-x64-VS-* } | |
| - { flavor: hybrid, target: VC-WIN64A-HYBRIDCRT, exe_build: ExeBuild_hybrid, msi_build: MsiBuild_hybrid, keep: OpenSSL-x64-hybridCRT-* } | |
| steps: | |
| - name: Checkout installer | |
| uses: actions/checkout@v7 | |
| - name: Checkout OpenSSL (${{ matrix.openssl-ref }}) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: openssl/openssl | |
| ref: ${{ matrix.openssl-ref }} | |
| path: openssl | |
| fetch-tags: true | |
| - name: Detect OpenSSL version from latest tag | |
| id: openssl_version | |
| shell: pwsh | |
| working-directory: openssl | |
| run: | | |
| # Pick the highest patch-version tag in this branch's family. | |
| $pattern = '${{ matrix.openssl-ref }}.*' | |
| $tag = git tag --list $pattern --sort=-version:refname | Select-Object -First 1 | |
| if (-not $tag) { | |
| throw "no tags matching '$pattern' found in the openssl checkout" | |
| } | |
| $version = $tag -replace '^openssl-', '' | |
| # Remove "-beta1", "-dev" and such | |
| $version = $version.Split('-')[0] | |
| $parts = $version.Split('.') | |
| if ($parts.Count -lt 3) { throw "unexpected tag format: $tag" } | |
| Write-Host "detected version: $version (from tag $tag)" | |
| "version=$version" >> $env:GITHUB_OUTPUT | |
| "major=$($parts[0])" >> $env:GITHUB_OUTPUT | |
| "minor=$($parts[1])" >> $env:GITHUB_OUTPUT | |
| "winctx=$($parts[0]).$($parts[1])-OpenSSLProject" >> $env:GITHUB_OUTPUT | |
| - name: Check out detected tag | |
| shell: cmd | |
| working-directory: openssl | |
| run: git -c advice.detachedHead=false checkout tags/openssl-${{ steps.openssl_version.outputs.version }} | |
| - name: Restore OpenSSL build cache | |
| id: openssl_cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: openssl | |
| key: openssl-build-${{ runner.os }}-${{ matrix.crt.flavor }}-${{ matrix.openssl-ref }}-${{ steps.openssl_version.outputs.version }}-v1 | |
| - name: install nasm | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| run: | | |
| $installer = "nasm-3.01-installer-x64.exe" | |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer | |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer | |
| $actual = (Get-FileHash $installer -Algorithm SHA256).Hash | |
| if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" } | |
| Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait | |
| "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append | |
| - name: install jom | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| run: | | |
| mkdir C:\jom | |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe | |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' | |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash | |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } | |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append | |
| - name: Apply jom build patches to older than 4.1 | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: pwsh | |
| working-directory: openssl | |
| run: | | |
| git apply --verbose "$env:GITHUB_WORKSPACE\windows-installer\0001-Windows-Use-Z7-compiler-flag-to-enable-parallel-buil.patch" | |
| if ($LASTEXITCODE -ne 0) { throw "jom patch failed" } | |
| - name: Build OpenSSL (${{ matrix.crt.target }}) | |
| if: steps.openssl_cache.outputs.cache-hit != 'true' | |
| shell: cmd | |
| working-directory: openssl | |
| run: | | |
| call "%VCVARS%" | |
| perl Configure ${{ matrix.crt.target }} enable-fips no-makedepend -DOSSL_WINCTX=OpenSSLProject | |
| jom /j4 /S | |
| jom build_docs | |
| - name: Download FIPS providers | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: openssl-fips-providers | |
| path: openssl-fips/providers | |
| - name: Build installers | |
| uses: caphyon/advinst-github-action@7edde34c6ff935e53e3de72a5699efcfceb5f6c6 # v2.0.3 (current main HEAD) | |
| with: | |
| advinst-version: '23.8' | |
| advinst-license: ${{ secrets.ADVINST_LICENSE_KEY }} | |
| advinst-enable-automation: 'true' | |
| aip-path: ${{ github.workspace }}\windows-installer\openssl.aip | |
| aip-build-name: ${{ matrix.crt.msi_build }} | |
| aip-commands: | | |
| ResetSig | |
| SetVersion ${{ steps.openssl_version.outputs.version }} | |
| SetProperty VERSION_MAJOR=${{ steps.openssl_version.outputs.major }} | |
| SetProperty VERSION_MINOR=${{ steps.openssl_version.outputs.minor }} | |
| SetProperty VERSION_REGISTRY=${{ steps.openssl_version.outputs.winctx }} | |
| Build -buildslist ${{ matrix.crt.exe_build }} | |
| - name: Upload installers | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: installers-${{ matrix.crt.flavor }}-${{ matrix.openssl-ref }} | |
| path: | | |
| build-target/Installer64/${{ matrix.crt.keep }}.exe | |
| build-target/Installer64/${{ matrix.crt.keep }}.msi | |
| if-no-files-found: error | |
| test: | |
| name: Test ${{ matrix.installer }} on ${{ matrix.os }} | |
| needs: build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [windows-2022, windows-2025] | |
| openssl-ref: [openssl-4.0] | |
| installer: | |
| - OpenSSL-x64-VS-*.exe | |
| - OpenSSL-x64-VS-*.msi | |
| - OpenSSL-x64-hybridCRT-*.exe | |
| - OpenSSL-x64-hybridCRT-*.msi | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Download installers | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: installers-*-${{ matrix.openssl-ref }} | |
| path: build | |
| merge-multiple: true | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 (= release v3.2.4) | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "" # disables lockfile requirement | |
| - name: Install Python deps | |
| run: uv sync --frozen || uv sync | |
| - name: Select installer under test | |
| id: installer | |
| shell: pwsh | |
| run: | | |
| $pattern = '${{ matrix.installer }}' | |
| $file = Get-ChildItem build -Recurse -File | | |
| Where-Object { $_.Name -like $pattern } | | |
| Select-Object -First 1 | |
| if (-not $file) { throw "No installer matching '$pattern' found in build/" } | |
| $mb = [math]::Round($file.Length / 1MB, 2) | |
| Write-Host "Testing installer: $($file.Name) ($mb MB)" | |
| "path=$($file.FullName)" >> $env:GITHUB_OUTPUT | |
| - name: Run pytest | |
| run: uv run pytest tests --installer "${{ steps.installer.outputs.path }}" -v |