Skip to content

gh-143750: Compile OpenSSL with TSan for TSan CI #143752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
colesbury wants to merge 2 commits into
base: main
Choose a base branch
from
+38 −11
Draft

gh-143750: Compile OpenSSL with TSan for TSan CI #143752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a166f95
gh-143750: Compile OpenSSL with TSan for TSan CI
colesbury Jan 12, 2026
4ea7a62
Move and adjust check to satisfy lint
colesbury Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 30 additions & 11 deletions .github/workflows/reusable-san.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,17 @@ jobs:
&& ' (free-threading)'
|| ''
}}
Comment on lines 23 to 25
Copy link
Member

@webknjaz webknjaz Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will also need to interpolate new matrix factors since the job names will be confusing if there's ever more than one job.

runs-on: ubuntu-24.04
strategy:
fail-fast: false
matrix:
os: [ubuntu-24.04]
openssl_ver: [3.5.4]
runs-on: ${{ matrix.os }}
Comment on lines +26 to +31
Copy link
Member

@webknjaz webknjaz Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Plz move these to inputs: and host the matrix on the calling side (in build.yml). This is the separation I was going for when I first introduced the reusable-*.yml module pattern — no matrices in modules.

timeout-minutes: 60
env:
OPENSSL_VER: ${{ matrix.openssl_ver }}
MULTISSL_DIR: ${{ github.workspace }}/multissl
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -37,21 +46,20 @@ jobs:
# Install clang
wget https://apt.llvm.org/llvm.sh
chmod +x llvm.sh
sudo ./llvm.sh 20
sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-20 100
sudo update-alternatives --set clang /usr/bin/clang-20
sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-20 100
sudo update-alternatives --set clang++ /usr/bin/clang++-20
sudo update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer /usr/bin/llvm-symbolizer-20 100
sudo update-alternatives --set llvm-symbolizer /usr/bin/llvm-symbolizer-20

- name: Sanitizer option setup
run: |
if [ "${SANITIZER}" = "TSan" ]; then
Comment on lines +58 to 59
Copy link
Member

@webknjaz webknjaz Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can move this conditional to the GHA step so that skipping is more prominent.

Suggested change
run: |
if [ "${SANITIZER}" = "TSan" ]; then
if: inputs.sanitizer == 'TSan'
run: |

Also drop fi and the second conditional block below too.

sudo ./llvm.sh 17 # gh-121946: llvm-18 package is temporarily broken
sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-17 100
sudo update-alternatives --set clang /usr/bin/clang-17
sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-17 100
sudo update-alternatives --set clang++ /usr/bin/clang++-17
# Reduce ASLR to avoid TSan crashing
sudo sysctl -w vm.mmap_rnd_bits=28
else
sudo ./llvm.sh 20
fi

- name: Sanitizer option setup
run: |
if [ "${SANITIZER}" = "TSan" ]; then
echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${{
fromJSON(inputs.free-threading)
Expand All @@ -69,6 +77,16 @@ jobs:
- name: Add ccache to PATH
run: |
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: 'Restore OpenSSL build (TSan)'
id: cache-openssl
uses: actions/cache@v4
if: inputs.sanitizer == 'TSan'
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ matrix.os }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
- name: Install OpenSSL (TSan)
if: steps.cache-openssl.outputs.cache-hit != 'true' && inputs.sanitizer == 'TSan'
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux --tsan
- name: Configure CPython
run: >-
./configure
Expand All @@ -79,6 +97,7 @@ jobs:
|| '--with-undefined-behavior-sanitizer'
}}
--with-pydebug
${{ inputs.sanitizer == 'TSan' && ' --with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
Copy link
Member

@webknjaz webknjaz Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(nit) no need for the whitespace since >- in YAML already adds whitespaces when it joins the lines on parsing.

Suggested change
${{ inputs.sanitizer == 'TSan' && ' --with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}

${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
- name: Build CPython
run: make -j4
Expand Down
8 changes: 8 additions & 0 deletions Tools/ssl/multissltests.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,12 @@
dest='keep_sources',
help="Keep original sources for debugging."
)
parser.add_argument(
'--tsan',
action='store_true',
dest='tsan',
help="Build with thread sanitizer. (Disables fips in OpenSSL 3.x)."
)


class AbstractBuilder(object):
Expand Down Expand Up @@ -312,6 +318,8 @@ def _build_src(self, config_args=()):
"""Now build openssl"""
log.info("Running build in {}".format(self.build_dir))
cwd = self.build_dir
if self.args.tsan:
config_args += ("-fsanitize=thread",)
cmd = [
"./config", *config_args,
"shared", "--debug",
Expand Down
Loading