.github - zygaena/hammerhead

root / base / usr / src / contrib / openssh / .github
.github Plain Text 1783 lines 59.2 KB
master :
[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg)](../../../actions/workflows/c-cpp.yml?query=branch:master)
[![VM CI](../../../actions/workflows/vm.yml/badge.svg)](../../../actions/workflows/vm.yml?query=branch:master)
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:master)
[![Upstream self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml/badge.svg)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/upstream.yml?query=branch:master)
[![CIFuzz](../../../actions/workflows/cifuzz.yml/badge.svg)](../../../actions/workflows/cifuzz.yml)
[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://issues.oss-fuzz.com/issues?q="Project:+openssh"+is:open)
[![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
<br>

10.1 :
[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_1)
[![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/vm.yml?query=branch:V_10_1)
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_1)

10.0 :
[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_0)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_0)
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_0)

9.9 :
[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_9_9)](../../../actions/workflows/c-cpp.yml?query=branch:V_9_9)
[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_9)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_9)
#!/bin/sh
#
# usage: configs vmname test_config (or '' for default)
#
# Sets the following variables:
# CONFIGFLAGS           options to ./configure
# SSHD_CONFOPTS         sshd_config options
# TEST_TARGET           make target used when testing.  defaults to "tests".
# LTESTS

config=$1
if [ "$config" = "" ]; then
	config="default"
fi

if [ ! -z "${LTESTS}" ]; then
	OVERRIDE_LTESTS="${LTESTS}"
fi

unset CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO

TEST_TARGET="tests compat-tests"
LTESTS=""
SKIP_LTESTS=""
SUDO=sudo	# run with sudo by default
TEST_SSH_UNSAFE_PERMISSIONS=1
# Stop on first test failure to minimize logs
TEST_SSH_FAIL_FATAL=yes

CONFIGFLAGS=""
LIBCRYPTOFLAGS=""

case "$config" in
    default|sol64)
	;;
    c89)
	# If we don't have LLONG_MAX, configure will figure out that it can
	# get it by setting -std=gnu99, at which point we won't be testing
	# C89 any more.  To avoid this, feed it in via CFLAGS.
	llong_max=`gcc -E -dM - </dev/null | \
	    awk '$2=="__LONG_LONG_MAX__"{print $3}'`
	CPPFLAGS="-DLLONG_MAX=${llong_max}"

	CC="gcc"
	CFLAGS="-Wall -std=c89 -pedantic -Werror=vla"
	CONFIGFLAGS="--without-zlib"
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET=t-exec
	;;
    cygwin-release)
	# See https://cygwin.com/git/?p=git/cygwin-packages/openssh.git;a=blob;f=openssh.cygport;hb=HEAD
	CONFIGFLAGS="--with-xauth=/usr/bin/xauth --with-security-key-builtin"
	CONFIGFLAGS="$CONFIGFLAGS --with-kerberos5=/usr --with-libedit --disable-strip"
	;;
   clang-12-Werror)
	CC="clang-12"
	# clang's implicit-fallthrough requires that the code be annotated with
	# __attribute__((fallthrough)) and does not understand /* FALLTHROUGH */
	CFLAGS="-Wall -Wextra -O2 -Wno-error=implicit-fallthrough -Wno-error=unused-parameter"
	CONFIGFLAGS="--with-pam --with-Werror"
	;;
    *-sanitize-*)
	case "$config" in
	gcc-*)
		CC=gcc
		;;
	clang-*)
		# Find the newest available version of clang
		for i in `seq 10 99`; do
		    clang="`which clang-$i 2>/dev/null`"
		    [ -x "$clang" ] && CC="$clang"
		done
		;;
	esac
	# Put Sanitizer logs in regress dir.
	SANLOGS=`pwd`/regress
	# - We replace chroot with chdir so that the sanitizer in the preauth
	#   privsep process can read /proc.
	# - clang does not recognizes explicit_bzero so we use bzero
	#   (see https://github.com/google/sanitizers/issues/1507
	# - openssl and zlib trip ASAN.
	# - sp_pwdp returned by getspnam trips ASAN, hence disabling shadow.
	case "$config" in
	*-sanitize-address)
	    CFLAGS="-fsanitize=address -fno-omit-frame-pointer"
	    LDFLAGS="-fsanitize=address"
	    CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -D_FORTIFY_SOURCE=0 -DASAN_OPTIONS=\"detect_leaks=0:log_path='$SANLOGS'/asan.log\"'
	    CONFIGFLAGS=""
	    TEST_TARGET="t-exec"
	    ;;
	clang-sanitize-memory)
	    CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer"
	    LDFLAGS="-fsanitize=memory"
	    CPPFLAGS='-Dchroot=chdir -Dexplicit_bzero=bzero -DMSAN_OPTIONS=\"log_path='$SANLOGS'/msan.log\"'
	    CONFIGFLAGS="--without-zlib --without-shadow"
	    LIBCRYPTOFLAGS="--without-openssl"
	    TEST_TARGET="t-exec"
	    ;;
	*-sanitize-undefined)
	    CFLAGS="-fsanitize=undefined"
	    LDFLAGS="-fsanitize=undefined"
	    ;;
	*)
	     echo unknown sanitize option;
	     exit 1;;
	esac
	features="--disable-security-key --disable-pkcs11"
	hardening="--without-sandbox --without-hardening --without-stackprotect"
	privsep="--with-privsep-user=root"
	CONFIGFLAGS="$CONFIGFLAGS $features $hardening $privsep"
	# Because we hobble chroot we can't test it.
	SKIP_LTESTS=sftp-chroot
	;;
    gcc-11-Werror)
	CC="gcc-11"
	# -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled
	# -Wunused-result ignores (void) so is not useful.  See
	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425
	CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result"
	CONFIGFLAGS="--with-pam --with-Werror"
	;;
    gcc-12-Werror)
	CC="gcc-12"
	# -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled
	# -Wunused-result ignores (void) so is not useful.  See
	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425
	CFLAGS="-O2 -Wno-format-truncation -Wimplicit-fallthrough=4 -Wno-unused-parameter -Wno-unused-result"
	CONFIGFLAGS="--with-pam --with-Werror"
	;;
    clang*|gcc*)
	CC="$config"
	;;
    kitchensink)
	CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam"
	CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux"
	CONFIGFLAGS="${CONFIGFLAGS} --with-linux-memlock-onfault"
	CFLAGS="-DSK_DEBUG -DSANDBOX_SECCOMP_FILTER_DEBUG"
	;;
    hardenedmalloc)
	CONFIGFLAGS="--with-ldflags=-lhardened_malloc"
	;;
    tcmalloc)
	CONFIGFLAGS="--with-ldflags=-ltcmalloc"
	# tcmalloc may, depending on the stacktrace generator it uses, create
	# pipe(2) fds during shared library initialisation. These will later
	# get clobbered by ssh/sshd calling closefrom() and chaos will ensue.
	# Tell tcmalloc to use an unwinder that doesn't pull this stuff.
	TCMALLOC_STACKTRACE_METHOD=generic_fp
	TEST_SSH_SSHD_ENV="TCMALLOC_STACKTRACE_METHOD=generic_fp"
	export TCMALLOC_STACKTRACE_METHOD TEST_SSH_SSHD_ENV

	SKIP_LTESTS="agent-restrict"
	;;
    krb5|heimdal)
	CONFIGFLAGS="--with-kerberos5"
	;;
    libedit)
	CONFIGFLAGS="--with-libedit"
	;;
    musl)
	CC="musl-gcc"
	CONFIGFLAGS="--without-zlib"
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET="t-exec"
	;;
    pam-krb5)
	CONFIGFLAGS="--with-pam --with-kerberos5"
	SSHD_CONFOPTS="UsePam yes"
	;;
    *pam)
	CONFIGFLAGS="--with-pam"
	SSHD_CONFOPTS="UsePam yes"
	;;
    boringssl)
	CONFIGFLAGS="--disable-pkcs11"
	LIBCRYPTOFLAGS="--with-ssl-dir=/opt/boringssl --with-rpath=-Wl,-rpath,"
	;;
	aws-lc)
	LIBCRYPTOFLAGS="--with-ssl-dir=/opt/aws-lc --with-rpath=-Wl,-rpath,"
	;;
    libressl-*)
	LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath,"
	;;
    putty-*)
	CONFIGFLAGS="--with-plink=/usr/local/bin/plink --with-puttygen=/usr/local/bin/puttygen"
	# We don't need to rerun the regular tests, just the interop ones.
	TEST_TARGET=interop-tests
	;;
    openssl-*)
	LIBCRYPTOFLAGS="--with-ssl-dir=/opt/openssl --with-rpath=-Wl,-rpath,"
	# OpenSSL 1.1.1 specifically has a bug in its RNG that breaks reexec
	# fallback.  See https://bugzilla.mindrot.org/show_bug.cgi?id=3483
	if [ "$config" = "openssl-1.1.1" ]; then
		SKIP_LTESTS="reexec"
	fi
	;;
    selinux)
	CONFIGFLAGS="--with-selinux"
	;;
    sk)
	CONFIGFLAGS="--with-security-key-builtin --with-security-key-standalone"
        ;;
    without-openssl)
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET=t-exec
	;;
    valgrind-[1-4]|valgrind-unit)
	# rlimit sandbox and FORTIFY_SOURCE confuse Valgrind.
	CONFIGFLAGS="--without-sandbox --without-hardening"
	CONFIGFLAGS="$CONFIGFLAGS --with-cppflags=-D_FORTIFY_SOURCE=0"
	TEST_TARGET="t-exec USE_VALGRIND=1"
	TEST_SSH_ELAPSED_TIMES=1
	export TEST_SSH_ELAPSED_TIMES
	# Valgrind slows things down enough that the agent timeout test
	# won't reliably pass, and the unit tests run longer than allowed
	# by github so split into separate tests.
	tests2="integrity try-ciphers rekey"
	tests3="krl forward-control sshsig agent-restrict kextype sftp"
	tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent"
	case "$config" in
	    valgrind-1)
		# All tests except agent-timeout (which is flaky under valgrind),
		# connection-timeout (which doesn't work since it's so slow)
		# and hostbased (since valgrind won't let ssh exec keysign).
		# Slow ones are run separately to increase parallelism.
		SKIP_LTESTS="agent-timeout connection-timeout hostbased"
		SKIP_LTESTS="$SKIP_LTESTS penalty-expire"
		SKIP_LTESTS="$SKIP_LTESTS ${tests2} ${tests3} ${tests4} ${tests5}"
		;;
	    valgrind-2)
		LTESTS="${tests2}"
		;;
	    valgrind-3)
		LTESTS="${tests3}"
		;;
	    valgrind-4)
		LTESTS="${tests4}"
		;;
	    valgrind-unit)
		TEST_TARGET="unit USE_VALGRIND=1"
		;;
	esac
	;;
    zlib-develop)
	INSTALL_ZLIB=develop
	CONFIGFLAGS="--with-zlib=/opt/zlib --with-rpath=-Wl,-rpath,"
	;;
    *)
	echo "Unknown configuration $config"
	exit 1
	;;
esac

# The Solaris 64bit targets are special since they need a non-flag arg.
case "$config" in
    sol64*)
	CONFIGFLAGS="--target=x86_64 --with-cflags=-m64 --with-ldflags=-m64 ${CONFIGFLAGS}"
	LIBCRYPTOFLAGS="--with-ssl-dir=/usr/local/ssl64 --with-rpath=-Wl,-rpath,"
	;;
esac

case "${TARGET_HOST}" in
    aix*)
	CONFIGFLAGS="--disable-security-key"
	LIBCRYPTOFLAGS="--without-openssl"
	# These are slow real or virtual machines so skip the slowest tests
	# (which tend to be thw ones that transfer lots of data) so that the
	# test run does not time out.
	# The agent-restrict test fails due to some quoting issue when run
	# with sh or ksh so specify bash for now.
	TEST_TARGET="t-exec unit TEST_SHELL=bash"
	SKIP_LTESTS="rekey sftp"
	;;
    debian-riscv64)
	# This machine is fairly slow, so skip the unit tests.
	TEST_TARGET="t-exec"
	;;
    dfly58*|dfly60*)
	# scp 3-way connection hangs on these so skip until sorted.
	SKIP_LTESTS=scp3
	;;
    fbsd6)
	# Native linker is not great with PIC so OpenSSL is built w/out.
	CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key"
	;;
    fbsd14-ppc64|nbsd-arm64be)
	# Disable security key tests for bigendian interop test.
	CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key"
	;;
    hurd)
	SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace"
	;;
    minix3)
	CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key"
	# Unix domain sockets don't work quite like we expect, so also
	# disable FD passing (and thus multiplexing).
	CONFIGFLAGS="${CONFIGFLAGS} --disable-fd-passing"
	LIBCRYPTOFLAGS="--without-openssl"

	# Minix does not have a loopback interface so we have to skip any
	# test that relies on one.
	# Also, Minix seems to be very limited in the number of select()
	# calls that can be operating concurrently, so prune additional tests for that.
	T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse
	    connect connect-uri dynamic-forward exit-status forwarding
	    forward-control
	    hostkey-agent key-options keyscan knownhosts-command login-timeout
	    reconfigure reexec rekey scp scp-uri scp3 sftp sftp-badcmds
	    sftp-batch sftp-cmds sftp-glob sftp-perm sftp-uri stderr-data
	    transfer penalty penalty-expire"
	SKIP_LTESTS="$(echo $T)"
	TEST_TARGET=t-exec
	SUDO=""
	;;
    nbsd4)
	# System compiler will ICE on some files with fstack-protector
	# SHA256 functions in sha2.h conflict with OpenSSL's breaking sk-dummy
	CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key"
	;;
    openwrt-mipsel)
	# Test most of the flags that OpenWRT sets for their package build.
	# We only do this on one OpenWRT target for better coverage.
	# The installed shared libraries installed by default are stripped and
	# can't be linked to on the target systems.
	OPENWRT_FLAGS="--disable-strip --disable-lastlog
	   --disable-utmp --disable-utmpx --disable-wtmp --disable-wtmpx
	   --with-stackprotect --with-cflags-after=-fzero-call-used-regs=skip"
	CONFIGFLAGS="${CONFIGFLAGS} $(echo ${OPENWRT_FLAGS}) --without-zlib --disable-security-key"
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET="t-exec"
	;;
    openwrt-*)
	CONFIGFLAGS="${CONFIGFLAGS} --without-zlib --disable-security-key"
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET="t-exec"
	;;
    sol10|sol11)
	# sol10 VM is 32bit and the unit tests are slow.
	# sol11 has 4 test configs so skip unit tests to speed up.
	TEST_TARGET="tests SKIP_UNIT=1"
	;;
    win10)
	# No sudo on Windows.
	SUDO=""
	;;
esac

host=`./config.guess`
case "$host" in
*cygwin)
	SUDO=""
	# Don't run compat tests on cygwin as they don't currently compile.
	TEST_TARGET="tests"
	;;
*-darwin*)
	# Unless specified otherwise, build without OpenSSL on Mac OS since
	# modern versions don't ship with libcrypto.
	LIBCRYPTOFLAGS="--without-openssl"
	TEST_TARGET=t-exec

	# On some OS X runners we can't write to /var/empty.
	CONFIGFLAGS="${CONFIGFLAGS} --with-privsep-path=/usr/local/empty"

	case "$host" in
	*-darwin22.*)
		# sudo -S nobody doesn't work on macos 13 for some reason.
		SKIP_LTESTS="agent-getpeereid" ;;
	esac
	;;
esac

# Unless specifically configured, search for a suitable version of OpenSSL,
# otherwise build without it.
if [ -z "${LIBCRYPTOFLAGS}" ]; then
	LIBCRYPTOFLAGS="--without-openssl"
	# last-match
	for i in /usr /usr/local /usr/local/ssl /usr/local/opt/openssl; do
		ver="none"
		if [ -x ${i}/bin/openssl ]; then
			ver="$(${i}/bin/openssl version)"
		fi
		case "$ver" in
			none) ;;
			"OpenSSL 0."*|"OpenSSL 1.0."*|"OpenSSL 1.1.0"*) ;;
			"LibreSSL 2."*|"LibreSSL 3.0."*) ;;
			*) LIBCRYPTOFLAGS="--with-ssl-dir=${i}" ;;
		esac
	done
	if [ "${LIBCRYPTOFLAGS}" = "--without-openssl" ]; then
		TEST_TARGET="t-exec"
	fi
fi

CONFIGFLAGS="${CONFIGFLAGS} ${LIBCRYPTOFLAGS}"

if [ -x "$(which plink 2>/dev/null)" ]; then
	REGRESS_INTEROP_PUTTY=yes
	export REGRESS_INTEROP_PUTTY
fi

if [ ! -z "${OVERRIDE_LTESTS}" ]; then
	echo >&2 "Overriding LTESTS, was '${LTESTS}', now '${OVERRIDE_LTESTS}'"
	LTESTS="${OVERRIDE_LTESTS}"
fi

export CC CFLAGS CPPFLAGS LDFLAGS LTESTS SUDO
export TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS TEST_SSH_FAIL_FATAL
#!/bin/sh

. .github/configs $1

printf "$ "

if [ "x$CC" != "x" ]; then
	printf "CC='$CC' "
fi
if [ "x$CFLAGS" != "x" ]; then
	printf "CFLAGS='$CFLAGS' "
fi
if [ "x$CPPFLAGS" != "x" ]; then
	printf "CPPFLAGS='$CPPFLAGS' "
fi
if [ "x$LDFLAGS" != "x" ]; then
	printf "LDFLAGS='$LDFLAGS' "
fi

echo ./configure ${CONFIGFLAGS}
./configure ${CONFIGFLAGS} 2>&1
#!/bin/sh
#
# Install specified libcrypto.
#  -a : install version for ABI compatibility test.
#  -n : dry run, don't actually build and install.
#
# Usage: $0 [-a] [-n] openssl-$branch/tag destdir [config options]

set -e

bincompat_test=""
dryrun=""
while [ "$1" = "-a" ] || [ "$1" = "-n" ]; do
	if [ "$1" = "-a" ]; then
		abi_compat_test=y
	elif [ "$1" = "-n" ]; then
		dryrun="echo dryrun:"
	fi
	shift
done

ver="$1"
destdir="$2"
opts="$3"

if [ -z "${ver}" ] || [ -z "${destdir}" ]; then
	echo tag/branch and destdir required
	exit 1
fi

set -x

if [ ! -d ${HOME}/openssl ]; then
	cd ${HOME}
	git clone https://github.com/openssl/openssl.git
	cd ${HOME}/openssl
	git fetch --all
fi
cd ${HOME}/openssl

if [ "${abi_compat_test}" = "y" ]; then
	echo selecting ABI test release/branch for ${ver}
	case "${ver}" in
	openssl-3.6)
		ver=openssl-3.0.0
		echo "selecting older release ${ver}"
		;;
	openssl-3.[012345])
		major=$(echo ${ver} | cut -f1 -d.)
		minor=$(echo ${ver} | cut -f2 -d.)
		ver="${major}.$((${minor} + 1))"
		echo selecting next release branch ${ver}
		;;
	openssl-3.*.*)
		major=$(echo ${ver} | cut -f1 -d.)
		minor=$(echo ${ver} | cut -f2 -d.)
		patch=$(echo ${ver} | cut -f3 -d.)
		ver="${major}.${minor}.$((${patch} + 1))"
		echo checking for release tag ${ver}
		if git tag | grep -q "^${ver}\$"; then
			echo selected next patch release ${ver}
		else
			ver="${major}.${minor}"
			echo not found, selecting release branch ${ver}
		fi
		;;
	esac
fi

git checkout ${ver}
make clean >/dev/null 2>&1 || true
${dryrun} ./config no-threads shared ${opts} --prefix=${destdir} \
    -Wl,-rpath,${destdir}/lib64
${dryrun} make -j4
${dryrun} sudo make install_sw
#!/bin/sh

ver="$1"

echo
echo --------------------------------------
echo Installing PuTTY version ${ver}
echo --------------------------------------

cd /tmp

case "${ver}" in
snapshot)
	tarball=putty.tar.gz
	url=https://tartarus.org/~simon/putty-snapshots/${tarball}
	;;
*)
	tarball=putty-${ver}.tar.gz
	url=https://the.earth.li/~sgtatham/putty/${ver}/${tarball}
	;;
esac

if [ ! -f ${tarball} ]; then
	wget -q ${url}
fi

mkdir -p /tmp/puttybuild
cd /tmp/puttybuild

tar xfz /tmp/${tarball} && cd putty-*
if [ -f CMakeLists.txt ]; then
	cmake . && cmake --build . -j4 && sudo cmake --build . --target install
else
	./configure && make -j4 && sudo make install
fi
sudo rm -rf /tmp/puttybuild
/usr/local/bin/plink -V
#!/bin/sh

. .github/configs $1

[ -z "${SUDO}" ] || ${SUDO} mkdir -p /var/empty

set -ex

# If we want to test hostbased auth, set up the host for it.
if [ ! -z "$SUDO" ] && [ ! -z "$TEST_SSH_HOSTBASED_AUTH" ]; then
    sshconf=/usr/local/etc
    $SUDO mkdir -p "${sshconf}"
    hostname | $SUDO tee $sshconf/shosts.equiv >/dev/null
    echo "EnableSSHKeysign yes" | $SUDO tee $sshconf/ssh_config >/dev/null
    $SUDO mkdir -p $sshconf
    $SUDO make install
    for key in $sshconf/ssh_host*key*.pub; do
        echo `hostname` `cat $key` | \
            $SUDO tee -a $sshconf/ssh_known_hosts >/dev/null
    done
fi

env=""
if [ ! -z "${SUDO}" ]; then
    env="${env} SUDO=${SUDO}"
fi
if [ ! -z "${TCMALLOC_STACKTRACE_METHOD}" ]; then
    env="${env} TCMALLOC_STACKTRACE_METHOD=${TCMALLOC_STACKTRACE_METHOD}"
fi
if [ ! -z "${TEST_SSH_SSHD_ENV}" ]; then
    env="${env} TEST_SSH_SSHD_ENV=${TEST_SSH_SSHD_ENV}"
fi
if [ ! -z "${env}" ]; then
    env="env${env}"
fi

if [ "$1" = "putty-versions" ]; then
	for ver in 0.71 0.72 0.73 0.74 0.75 0.76 0.77 0.78 0.79 0.80 \
	    0.81 0.82 0.83 snapshot; do
		.github/install_putty.sh "${ver}"
		${env} make ${TEST_TARGET} \
		    SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}"
	done

	exit 0
fi

if [ -z "${LTESTS}" ]; then
    ${env} make ${TEST_TARGET} SKIP_LTESTS="${SKIP_LTESTS}"
else
    ${env} make ${TEST_TARGET} SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}"
fi

if [ ! -z "${SSHD_CONFOPTS}" ]; then
    echo "rerunning t-exec with TEST_SSH_SSHD_CONFOPTS='${SSHD_CONFOPTS}'"
    if [ -z "${LTESTS}" ]; then
        ${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
    else
        ${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
    fi
fi
#!/bin/sh

config="$1"
target="$2"

PACKAGES=""

echo Running as:
id

echo Environment:
set

 . .github/configs ${config}

host=`./config.guess`
echo "config.guess: $host"
case "$host" in
*cygwin)
	PACKAGER=setup
	echo Setting CYGWIN system environment variable.
	setx CYGWIN "winsymlinks:native"
	echo Removing extended ACLs so umask works as expected.
	set -x
	setfacl -b . regress
	icacls regress /c /t /q /Inheritance:d
	icacls regress /c /t /q /Grant ${USERNAME}:F
	icacls regress /c /t /q /Remove:g "Authenticated Users" \
	     BUILTIN\\Administrators BUILTIN Everyone System Users
	takeown /F regress
	icacls regress
	set +x
	PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
	PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel"
	;;
*-darwin*)
	PACKAGER=brew
	PACKAGES="automake"
	;;
*)
	PACKAGER=apt
esac

TARGETS=${config}

INSTALL_FIDO_PPA="no"
export DEBIAN_FRONTEND=noninteractive

set -e

if [ -x "`which lsb_release 2>&1`" ]; then
	lsb_release -a
fi

if [ ! -z "$SUDO" ]; then
	# Ubuntu 22.04 defaults to private home dirs which prevent the
	# agent-getpeerid test from running ssh-add as nobody.  See
	# https://github.com/actions/runner-images/issues/6106
	if ! "$SUDO" -u nobody test -x ~; then
		echo ~ is not executable by nobody, adding perms.
		chmod go+x ~
	fi
	# Some of the Mac OS X runners don't have a nopasswd sudo rule. Regular
	# sudo still works, but sudo -u doesn't.  Restore the sudo rule.
	if ! "$SUDO" grep  -E 'runner.*NOPASSWD' /etc/passwd >/dev/null; then
		echo "Restoring runner nopasswd rule to sudoers."
		echo 'runner ALL=(ALL) NOPASSWD: ALL' |$SUDO tee -a /etc/sudoers
	fi
	if ! "$SUDO" -u nobody -S test -x ~ </dev/null; then
		echo "Still can't sudo to nobody."
		exit 1
	fi
fi

if [ "${TARGETS}" = "kitchensink" ]; then
	TARGETS="krb5 libedit pam sk selinux"
fi

for flag in $CONFIGFLAGS; do
    case "$flag" in
    --with-pam)		TARGETS="${TARGETS} pam" ;;
    --with-libedit)	TARGETS="${TARGETS} libedit" ;;
    esac
done

echo "Setting up for '$TARGETS'"
for TARGET in $TARGETS; do
    case $TARGET in
    default|without-openssl|without-zlib|c89)
        # nothing to do
        ;;
    clang-sanitize*)
        PACKAGES="$PACKAGES clang-12"
        ;;
    cygwin-release)
        PACKAGES="$PACKAGES libcrypt-devel libfido2-devel libkrb5-devel"
        ;;
    gcc-sanitize*)
        ;;
    clang-*|gcc-*)
        compiler=$(echo $TARGET | sed 's/-Werror//')
        PACKAGES="$PACKAGES $compiler"
        ;;
    krb5)
        PACKAGES="$PACKAGES libkrb5-dev"
	;;
    heimdal)
        PACKAGES="$PACKAGES heimdal-dev"
        ;;
    libedit)
	case "$PACKAGER" in
	setup)	PACKAGES="$PACKAGES libedit-devel" ;;
	apt)	PACKAGES="$PACKAGES libedit-dev" ;;
	esac
        ;;
    *pam)
	case "$PACKAGER" in
	apt)	PACKAGES="$PACKAGES libpam0g-dev" ;;
	esac
        ;;
    sk)
        INSTALL_FIDO_PPA="yes"
        PACKAGES="$PACKAGES libfido2-dev libu2f-host-dev libcbor-dev"
        ;;
    selinux)
        PACKAGES="$PACKAGES libselinux1-dev selinux-policy-dev"
        ;;
    hardenedmalloc)
        INSTALL_HARDENED_MALLOC=yes
        ;;
    musl)
	PACKAGES="$PACKAGES musl-tools"
	;;
    tcmalloc)
        PACKAGES="$PACKAGES libgoogle-perftools-dev"
        ;;
    openssl-noec)
	INSTALL_OPENSSL=OpenSSL_1_1_1k
	SSLCONFOPTS="no-ec"
	;;
    openssl-*)
        INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-)
        case ${INSTALL_OPENSSL} in
          1.1.1_stable)	INSTALL_OPENSSL="OpenSSL_1_1_1-stable" ;;
          1.*)	INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;;
          3.*)	INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;;
        esac
        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
       ;;
    libressl-*)
        INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-)
        case ${INSTALL_LIBRESSL} in
          master) ;;
          *) INSTALL_LIBRESSL="$(echo ${TARGET} | cut -f2 -d-)" ;;
        esac
        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
       ;;
    boringssl)
        INSTALL_BORINGSSL=1
        PACKAGES="${PACKAGES} cmake ninja-build"
       ;;
    aws-lc)
        INSTALL_AWSLC=1
        PACKAGES="${PACKAGES} cmake ninja-build"
        ;;
    putty-*)
	INSTALL_PUTTY=0.83
	PACKAGES="${PACKAGES} cmake"
	;;
    valgrind*)
       PACKAGES="$PACKAGES valgrind"
       ;;
    zlib-*)
       ;;
    *) echo "Invalid option '${TARGET}'"
        exit 1
        ;;
    esac
done

if [ "yes" = "$INSTALL_FIDO_PPA" ]; then
    sudo apt update -qq
    sudo apt install -qy software-properties-common
    sudo apt-add-repository -y ppa:yubico/stable
fi

tries=3
while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do
    case "$PACKAGER" in
    apt)
	sudo apt update -qq
	if sudo apt install -qy $PACKAGES; then
		PACKAGES=""
	fi
	;;
    brew)
	if [ ! -z "PACKAGES" ]; then
		if brew install $PACKAGES; then
			PACKAGES=""
		fi
	fi
	;;
    setup)
	setup="/cygdrive/$(echo "${CYGWIN_SETUP}" | tr -d : | tr '\' '/')"
	if "${setup}" -q -P `echo "$PACKAGES" | tr ' ' ,`; then
		PACKAGES=""
	fi
	;;
    esac
    if [ ! -z "$PACKAGES" ]; then
	sleep 90
    fi
    tries=$(($tries - 1))
done
if [ ! -z "$PACKAGES" ]; then
	echo "Package installation failed."
	exit 1
fi

if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then
    (cd ${HOME} &&
     git clone https://github.com/GrapheneOS/hardened_malloc.git &&
     cd ${HOME}/hardened_malloc &&
     make && sudo cp out/libhardened_malloc.so /usr/lib/)
fi

if [ ! -z "${INSTALL_OPENSSL}" ]; then
	.github/install_libcrypto.sh \
	    "${INSTALL_OPENSSL}" /opt/openssl "${SSLCONFOPTS}"
fi

if [ ! -z "${INSTALL_LIBRESSL}" ]; then
    if [ "${INSTALL_LIBRESSL}" = "master" ]; then
        (mkdir -p ${HOME}/libressl && cd ${HOME}/libressl &&
         git clone https://github.com/libressl-portable/portable.git &&
         cd ${HOME}/libressl/portable &&
         git checkout ${INSTALL_LIBRESSL} &&
         sh update.sh && sh autogen.sh &&
         ./configure --prefix=/opt/libressl &&
         make && sudo make install)
    else
        LIBRESSL_URLBASE=https://cdn.openbsd.org/pub/OpenBSD/LibreSSL
        (cd ${HOME} &&
         wget ${LIBRESSL_URLBASE}/libressl-${INSTALL_LIBRESSL}.tar.gz &&
         tar xfz libressl-${INSTALL_LIBRESSL}.tar.gz &&
         cd libressl-${INSTALL_LIBRESSL} &&
         ./configure --prefix=/opt/libressl && make && sudo make install)
    fi
fi

if [ ! -z "${INSTALL_BORINGSSL}" ]; then
    (cd ${HOME} && git clone https://boringssl.googlesource.com/boringssl &&
     cd ${HOME}/boringssl && mkdir build && cd build &&
     cmake -GNinja  -DCMAKE_POSITION_INDEPENDENT_CODE=ON .. && ninja &&
     mkdir -p /opt/boringssl/lib &&
     cp ${HOME}/boringssl/build/libcrypto.a /opt/boringssl/lib &&
     cp -r ${HOME}/boringssl/include /opt/boringssl)
fi

if [ ! -z "${INSTALL_AWSLC}" ]; then
    (cd ${HOME} && git clone --depth 1 --branch v1.46.1 https://github.com/aws/aws-lc.git &&
     cd ${HOME}/aws-lc && mkdir build && cd build &&
     cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF .. && ninja &&
     mkdir -p /opt/aws-lc/lib &&
     cp ${HOME}/aws-lc/build/crypto/libcrypto.a /opt/aws-lc/lib &&
     cp -r ${HOME}/aws-lc/include /opt/aws-lc)
fi

if [ ! -z "${INSTALL_ZLIB}" ]; then
    (cd ${HOME} && git clone https://github.com/madler/zlib.git &&
     cd ${HOME}/zlib && ./configure && make &&
     sudo make install prefix=/opt/zlib)
fi

if [ ! -z "${INSTALL_PUTTY}" ]; then
	.github/install_putty.sh "${INSTALL_PUTTY}"
fi

# If we're running on an ephemeral VM, set a random password and set
# up to run the password auth test.
if [ ! -z "${EPHEMERAL_VM}" ]; then

    # This is the github "target" as specified in the yml file.
    # In particular, ubuntu-latest sets the password field to the locked
    # value, so unless we reset it here most of the tests will fail.
    case "${target}" in
    ubuntu-*)
	echo ${target} target: setting random password.
	openssl rand -base64 9 >regress/password
	pw=$(tr -d '\n' <regress/password | openssl passwd -6 -stdin)
	sudo usermod --password "${pw}" runner
	sudo usermod --unlock runner
	;;
    esac
fi
name: CI

# For testing, you can set variables in your repo (Repo -> Settings ->
# Security -> Actions -> Variables) to restrict the tests that are run.
# The supported variables are:
#
# RUN_ONLY_TARGET_CONFIG: Run only the single matching target and config,
#   separated by spaces, eg "ubuntu-latest default".  All other tests will
#   fail immediately.
#
# LTESTS: Override the set of tests run.

on:
  push:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/*.sh', '.github/workflows/c-cpp.yml' ]
  pull_request:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/*.sh', '.github/workflows/c-cpp.yml' ]

jobs:
  ci:
    name: "${{ matrix.target }} ${{ matrix.config }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - ubuntu-22.04
          - ubuntu-latest
          - ubuntu-22.04-arm
          - ubuntu-24.04-arm
          - macos-13
          - macos-14
          - macos-15
          - windows-2022
          - windows-2025
        config: [default]
        # Then we include any extra configs we want to test for specific VMs.
        # Valgrind slows things down quite a bit, so start them first.
        include:
          - { target: windows-2022, config: cygwin-release }
          - { target: windows-2025, config: cygwin-release }
          - { target: ubuntu-22.04, config: c89 }
          - { target: ubuntu-22.04, config: clang-11 }
          - { target: ubuntu-22.04, config: clang-12-Werror }
          - { target: ubuntu-22.04, config: clang-14 }
          - { target: ubuntu-22.04, config: clang-sanitize-address }
          - { target: ubuntu-22.04, config: clang-sanitize-undefined }
          - { target: ubuntu-22.04, config: gcc-9 }
          - { target: ubuntu-22.04, config: gcc-11-Werror }
          - { target: ubuntu-22.04, config: gcc-12-Werror }
          - { target: ubuntu-22.04, config: gcc-sanitize-address }
          - { target: ubuntu-22.04, config: gcc-sanitize-undefined }
          - { target: ubuntu-22.04, config: hardenedmalloc }
          - { target: ubuntu-22.04, config: heimdal }
          - { target: ubuntu-22.04, config: kitchensink }
          - { target: ubuntu-22.04, config: krb5 }
          - { target: ubuntu-22.04, config: libedit }
          - { target: ubuntu-22.04, config: pam }
          - { target: ubuntu-22.04, config: selinux }
          - { target: ubuntu-22.04, config: sk }
          - { target: ubuntu-22.04, config: valgrind-1 }
          - { target: ubuntu-22.04, config: valgrind-2 }
          - { target: ubuntu-22.04, config: valgrind-3 }
          - { target: ubuntu-22.04, config: valgrind-4 }
          - { target: ubuntu-22.04, config: valgrind-unit }
          - { target: ubuntu-22.04, config: without-openssl }
          - { target: ubuntu-latest, config: gcc-14 }
          - { target: ubuntu-latest, config: clang-15 }
          - { target: ubuntu-latest, config: clang-19 }
          - { target: ubuntu-latest, config: boringssl }
          - { target: ubuntu-latest, config: aws-lc }
          - { target: ubuntu-latest, config: libressl-master }
          - { target: ubuntu-latest, config: libressl-3.2.7 }
          - { target: ubuntu-latest, config: libressl-3.3.6 }
          - { target: ubuntu-latest, config: libressl-3.4.3 }
          - { target: ubuntu-latest, config: libressl-3.5.4 }
          - { target: ubuntu-latest, config: libressl-3.6.3 }
          - { target: ubuntu-latest, config: libressl-3.7.3 }
          - { target: ubuntu-latest, config: libressl-3.8.4 }
          - { target: ubuntu-latest, config: libressl-3.9.2 }
          - { target: ubuntu-latest, config: libressl-4.0.0 }
          - { target: ubuntu-latest, config: libressl-4.1.0 }
          - { target: ubuntu-latest, config: openssl-master }
          - { target: ubuntu-latest, config: openssl-noec }
          - { target: ubuntu-latest, config: openssl-1.1.1 }
          - { target: ubuntu-latest, config: openssl-1.1.1t }
          - { target: ubuntu-latest, config: openssl-1.1.1w }
          - { target: ubuntu-latest, config: openssl-3.0.0 }
          - { target: ubuntu-latest, config: openssl-3.0.18 }
          - { target: ubuntu-latest, config: openssl-3.1.0 }
          - { target: ubuntu-latest, config: openssl-3.1.8 }
          - { target: ubuntu-latest, config: openssl-3.2.6 }
          - { target: ubuntu-latest, config: openssl-3.3.5 }
          - { target: ubuntu-latest, config: openssl-3.4.0 }
          - { target: ubuntu-latest, config: openssl-3.4.3 }
          - { target: ubuntu-latest, config: openssl-3.5.0 }
          - { target: ubuntu-latest, config: openssl-3.5.3 }  # keep
          - { target: ubuntu-latest, config: openssl-3.5.4 }
          - { target: ubuntu-latest, config: openssl-1.1.1_stable }
          - { target: ubuntu-latest, config: openssl-3.0 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.1 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.2 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.3 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.4 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.5 }  # stable branch
          - { target: ubuntu-latest, config: openssl-3.6 }  # stable branch
          - { target: ubuntu-latest, config: putty-versions }
          - { target: ubuntu-latest, config: zlib-develop }
          - { target: ubuntu-latest, config: tcmalloc }
          - { target: ubuntu-latest, config: musl }
          - { target: ubuntu-22.04-arm, config: kitchensink }
          - { target: ubuntu-24.04-arm, config: kitchensink }
          - { target: macos-13, config: pam }
          - { target: macos-14, config: pam }
          - { target: macos-15, config: pam }
    runs-on: ${{ matrix.target }}
    env:
      EPHEMERAL_VM: yes
    steps:
    - name: check RUN_ONLY_TARGET_CONFIG
      if: vars.RUN_ONLY_TARGET_CONFIG != ''
      run: sh -c 'if [ "${{ vars.RUN_ONLY_TARGET_CONFIG }}" != "${{ matrix.target }} ${{matrix.config }}" ]; then exit 1; else exit 0; fi'
    - name: set cygwin git params
      if: ${{ startsWith(matrix.target, 'windows') }}
      run: git config --global core.autocrlf input
    - name: install cygwin
      id: cygwin_install
      if: ${{ startsWith(matrix.target, 'windows') }}
      uses: cygwin/cygwin-install-action@master
      env:
        CYGWIN: "winsymlinks:native"
    - uses: actions/checkout@main
    - name: setup CI system
      run: sh ./.github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}
      env:
        CYGWIN_SETUP: ${{ steps.cygwin_install.outputs.setup }}
    - name: autoreconf
      run: sh -c autoreconf
    - name: configure
      run: sh ./.github/configure.sh ${{ matrix.config }}
    - name: save config
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-config
        path: config.h
    - name: make clean
      run: make clean
    - name: make
      run: make
    - name: make tests
      run: sh ./.github/run_test.sh ${{ matrix.config }}
      env:
        TEST_SSH_UNSAFE_PERMISSIONS: 1
        TEST_SSH_HOSTBASED_AUTH: yes
        LTESTS: ${{ vars.LTESTS }}
    - name: test OpenSSL3 ABI compatibility
      if: ${{ startsWith(matrix.config, 'openssl-3') }}
      run: |
       sh .github/install_libcrypto.sh -a ${{ matrix.config }} /opt/openssl
       sh .github/run_test.sh ${{ matrix.config }}
    - name: show logs
      if: failure()
      run: for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done
    - name: chown logs
      if: failure()
      run: test -x "$(which sudo 2>&1)" && sudo chown -R "${LOGNAME}" regress
    - name: save logs
      if: failure()
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-logs
        path: |
          config.h
          config.log
          regress/
name: CIFuzz
on:
  push:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/cifuzz.yml' ]
  pull_request:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/cifuzz.yml' ]

jobs:
  Fuzzing:
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    runs-on: ubuntu-latest
    steps:
    - name: Build Fuzzers
      id: build
      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
      with:
        oss-fuzz-project-name: 'openssh'
        dry-run: false
        language: c++
    - name: Run Fuzzers
      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
      with:
        oss-fuzz-project-name: 'openssh'
        fuzz-seconds: 600
        dry-run: false
        language: c++
    - name: Upload Crash
      uses: actions/upload-artifact@main
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts
        path: ./out/artifacts
name: CI self-hosted

on:
  push:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/run_tests.sh', '.github/workflows/selfhosted.yml' ]

jobs:
  selfhosted:
    name: "${{ matrix.target }} ${{ matrix.config }}"
    if: github.repository == 'openssh/openssh-portable-selfhosted'
    runs-on: ${{ matrix.host }}
    timeout-minutes: 600
    env:
      HOST: ${{ matrix.host }}
      TARGET_HOST: ${{ matrix.target }}
      TARGET_CONFIG: ${{ matrix.config }}
      TARGET_DOMAIN: ${{ startsWith(matrix.host, 'libvirt') && format('{0}-{1}-{2}', matrix.target, matrix.config, github.run_id) || matrix.target }}
      EPHEMERAL: ${{ startsWith(matrix.host, 'libvirt') }}
      PERSISTENT: ${{ startsWith(matrix.host, 'persist') }}
      REMOTE: ${{ startsWith(matrix.host, 'remote') }}
      VM: ${{ startsWith(matrix.host, 'libvirt') || startsWith(matrix.host, 'persist') }}
      SSHFS: ${{ startsWith(matrix.host, 'libvirt') || startsWith(matrix.host, 'persist') || startsWith(matrix.host, 'remote') }}
      BIGENDIAN: ${{ matrix.target == 'aix51' || matrix.target == 'nbsd-arm64be' || matrix.target == 'openwrt-mips' }}
    strategy:
      fail-fast: false
      # We use a matrix in two parts: firstly all of the VMs are tested with the
      # default config.  "target" corresponds to a label associated with the
      # worker.  The default is an ephemeral VM running under libvirt.
      matrix:
        target:
          - alpine
          - centos7
          - debian-i386
          - dfly30
          - dfly48
          - dfly60
          - dfly62
          - dfly64
          - fbsd10
          - fbsd12
          - fbsd13
          - fbsd14
          - nbsd3
          - nbsd4
          - nbsd8
          - nbsd9
          - nbsd10
          - obsd51
          - obsd67
          - obsd72
          - obsd74
          - obsd76
          - obsd77
          - obsdsnap
          - obsdsnap-i386
          - omnios
          - openindiana
          - ubuntu-2204
        config:
          - default
        host:
          - libvirt
        include:
          # Long-running/slow tests have access to high priority runners.
          - { target: aix51, config: default, host: libvirt-hipri }
          - { target: openindiana, config: pam, host: libvirt-hipri }
          - { target: sol10,  config: default, host: libvirt-hipri }
          - { target: sol10,  config: pam, host: libvirt-hipri }
          - { target: sol11,  config: default, host: libvirt-hipri }
          - { target: sol11,  config: pam-krb5, host: libvirt-hipri }
          - { target: sol11,  config: sol64, host: libvirt-hipri }
          # Then we include extra libvirt test configs.
          - { target: centos7, config: pam, host: libvirt }
          - { target: debian-i386, config: pam, host: libvirt }
          - { target: dfly30, config: without-openssl, host: libvirt}
          - { target: dfly48, config: pam ,host: libvirt }
          - { target: dfly58, config: pam, host: libvirt }
          - { target: dfly60, config: pam, host: libvirt }
          - { target: dfly62, config: pam, host: libvirt }
          - { target: dfly64, config: pam, host: libvirt }
          - { target: fbsd10, config: pam, host: libvirt }
          - { target: fbsd12, config: pam, host: libvirt }
          - { target: fbsd13, config: pam, host: libvirt }
          - { target: fbsd14, config: pam, host: libvirt }
          - { target: nbsd8,  config: pam, host: libvirt }
          - { target: nbsd9,  config: pam, host: libvirt }
          - { target: nbsd10, config: pam, host: libvirt }
          - { target: omnios, config: pam, host: libvirt }
          # ARM64 VMs
          - { target: obsd-arm64, config: default, host: libvirt-arm64 }
          # VMs with persistent disks that have their own runner.
          - { target: win10, config: default,        host: persist-win10 }
          - { target: win10, config: cygwin-release, host: persist-win10 }
          # Physical hosts with native runners.
          - { target: ARM, config: default, host: ARM }
          - { target: ARM64, config: default, host: ARM64 }
          - { target: ARM64, config: pam, host: ARM64 }
          # Physical hosts with remote runners.
          - { target: debian-riscv64, config: default, host: remote-debian-riscv64 }
          - { target: openwrt-mips, config: default, host: remote-openwrt-mips }
          - { target: openwrt-mipsel, config: default, host: remote-openwrt-mipsel }
          - { target: nbsd-arm64be, config: default, host: remote-nbsd-arm64be }
    steps:
    - name: shutdown VM if running
      if: env.VM == 'true'
      run: vmshutdown
    - uses: actions/checkout@main
    - name: autoreconf
      run: autoreconf
    - name: startup VM
      if: env.VM == 'true'
      run: vmstartup
      working-directory: ${{ runner.temp }}
    - name: copy and mount workspace
      if: env.SSHFS == 'true'
      run: sshfs_mount
      working-directory: ${{ runner.temp }}
    - name: configure
      run: vmrun ./.github/configure.sh ${{ matrix.config }}
#    - name: save config
#      uses: actions/upload-artifact@main
#      with:
#        name: ${{ matrix.target }}-${{ matrix.config }}-config
#        path: config.h
    - name: make clean
      run: vmrun make clean
    - name: make
      run: vmrun make
    - name: make tests
      run: vmrun ./.github/run_test.sh ${{ matrix.config }}
      timeout-minutes: 600
    - name: show logs
      if: failure()
      run: vmrun 'for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done'
    - name: save logs
      if: failure()
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-logs
        path: |
          config.h
          config.log
          regress/*.log
          regress/log/*
          regress/valgrind-out/
    - name: unmount workspace
      if: always() && env.SSHFS == 'true'
      run: fusermount -u ${GITHUB_WORKSPACE} || true
      working-directory: ${{ runner.temp }}

    - name: bigendian interop - mount regress
      if: env.SSHFS == 'true' && env.BIGENDIAN == 'true'
      run: |
        set -x
        vmrun sudo chown -R $LOGNAME ~/$(basename ${GITHUB_WORKSPACE}) || true
        vmrun "cd $(basename ${GITHUB_WORKSPACE}/regress) && sudo make clean"
        sshfs_mount regress
        vmrun "sudo mkdir -p $(dirname ${GITHUB_WORKSPACE})"
        vmrun "sudo ln -s ~/$(basename ${GITHUB_WORKSPACE}) ${GITHUB_WORKSPACE}"
      working-directory: ${{ runner.temp }}

    - name: bigendian interop - host build
      if: env.SSHFS == 'true' && env.BIGENDIAN == 'true'
      run: |
        set -x
        ./.github/configure.sh ${{ matrix.config }}
        pwd
        ls -ld regress || true
        ls -l regress/check-perm || true
        make clean
        make

    - name: bigendian interop - test
      if: env.SSHFS == 'true' && env.BIGENDIAN == 'true'
      env:
        TEST_SSH_UNSAFE_PERMISSIONS: 1
      run: |
        set -x
        echo "#!/bin/sh" >remote_sshd
        echo "exec /usr/bin/ssh ${TARGET_DOMAIN} exec /home/builder/$(basename ${GITHUB_WORKSPACE})/sshd "'$@' >>remote_sshd
        chmod 755 remote_sshd
        make t-exec TEST_SSH_SSHD=`pwd`/remote_sshd LTESTS="try-ciphers kextype keytype"

    - name: bigendian interop - save logs
      if: failure() && env.BIGENDIAN == 'true'
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-interop-logs
        path: |
          config.h
          config.log
          regress/*.log
          regress/log/*

    - name: bigendian interop - unmount regress
      if: always() && env.SSHFS == 'true' && env.BIGENDIAN == 'true'
      run: fusermount -z -u ${GITHUB_WORKSPACE}/regress || true
      working-directory: ${{ runner.temp }}

    - name: lazily unmount workspace
      if: always() && env.SSHFS == 'true'
      run: fusermount -z -u ${GITHUB_WORKSPACE} || true
      working-directory: ${{ runner.temp }}
    - name: shutdown VM
      if: always() && env.VM == 'true'
      run: vmshutdown
name: OpenBSD

on:
  push:
    branches: [ master ]
    paths: [ '**.c', '**.h', '**.sh', '.github/configs', '.github/workflows/upstream.yml' ]

jobs:
  selfhosted:
    name: "upstream ${{ matrix.target }} ${{ matrix.config }}"
    if: github.repository == 'openssh/openssh-portable-selfhosted'
    runs-on: ${{ matrix.host }}
    env:
      EPHEMERAL: true
      HOST:  ${{ matrix.host }}
      TARGET_HOST: ${{ matrix.target }}
      TARGET_CONFIG: ${{ matrix.config }}
      TARGET_DOMAIN: ${{ format('{0}-{1}-{2}', matrix.target, matrix.config, github.run_id) || matrix.target }}
    strategy:
      fail-fast: false
      matrix:
        host:
          - libvirt
        target: [ obsdsnap, obsdsnap-i386 ]
        config: [ default, without-openssl ]  # TODO: restore 'ubsan' once fixed
        include:
          - { host: libvirt-arm64, target: obsdsnap-arm64, config: default }
          - { host: libvirt-arm64, target: obsdsnap-arm64, config: without-openssl }
          # - { host: libvirt-arm64, target: obsdsnap-arm64, config: ubsan }
    steps:
    - name: unmount stale workspace
      run: fusermount -u ${GITHUB_WORKSPACE} || true
      working-directory: ${{ runner.temp }}
    - name: shutdown VM if running
      run: vmshutdown
      working-directory: ${{ runner.temp }}
    - uses: actions/checkout@main
    - name: startup VM
      run: vmstartup
      working-directory: ${{ runner.temp }}
    - name: copy and mount workspace
      run: sshfs_mount
      working-directory: ${{ runner.temp }}
    - name: update source
      run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
    - name: update netcat
      run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
    - name: make clean
      run: vmrun "cd /usr/src/usr.bin/ssh && make obj && make clean && cd /usr/src/regress/usr.bin/ssh && make obj && make clean && sudo chmod -R g-w /usr/src /usr/obj"
    - name: make
      run: vmrun "cd /usr/src/usr.bin/ssh && case ${{ matrix.config }} in without-openssl) make OPENSSL=no;; ubsan) make DEBUG='-fsanitize-minimal-runtime -fsanitize=undefined';; *) make; esac"
    - name: make install
      run: vmrun "cd /usr/src/usr.bin/ssh && sudo make install && sudo /etc/rc.d/sshd -f restart"
    - name: make tests`
      run: vmrun "cd /usr/src/regress/usr.bin/ssh && case ${{ matrix.config }} in without-openssl) make OPENSSL=no;; ubsan) make DEBUG='-fsanitize-minimal-runtime -fsanitize=undefined';; *) make; esac"
      env:
        SUDO: sudo
      timeout-minutes: 300
    - name: show logs
      if: failure()
      run: vmrun 'for i in /usr/src/regress/usr.bin/ssh/obj/*.log; do echo ====; echo logfile $i; echo =====; cat $i; done'
    - name: save logs
      if: failure()
      uses: actions/upload-artifact@main
      with:
        name: ${{ matrix.target }}-${{ matrix.config }}-logs
        path: |
          /usr/src/regress/usr.bin/ssh/obj/*.log
          /usr/src/regress/usr.bin/ssh/obj/log/*
    - name: unmount workspace
      if: always()
      run: |
        fusermount -u ${GITHUB_WORKSPACE} || true
        fusermount -z -u ${GITHUB_WORKSPACE} || true
      working-directory: ${{ runner.temp }}
    - name: shutdown VM
      if: always()
      run: vmshutdown
      working-directory: ${{ runner.temp }}
# For testing, you can set variables in your repo (Repo -> Settings ->
# Security -> Actions -> Variables) to restrict the tests that are run
# The supported variables are:
#
# RUN_ONLY_TARGET_CONFIG: Run only the single matching target and config,
#   separated by spaces, eg "ubuntu-latest default".  All other tests will
#   fail immediately.
#
# LTESTS: Override the set of tests run.

name: CI VM
on:
  push:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]
  pull_request:
    paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]

jobs:
  dragonflybsd:
    name: "dragonflybsd-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "6.4.2"
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start DragonFlyBSD ${{ matrix.target }} VM
      uses: vmactions/dragonflybsd-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          pkg install -y sudo
          pw useradd builder -m
          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local
    - name: make clean
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: make tests
      shell: dragonflybsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo make tests

    - name: "PAM: configure"
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local --with-pam
    - name: "PAM: make clean"
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: "PAM: make"
      shell: dragonflybsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: "PAM: make tests"
      shell: dragonflybsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests

  freebsd:
    name: "freebsd-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "13.5"
          - "14.3"
          # - "15.0" # "pkg" breaks with a libutil.so error...
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start FreeBSD ${{ matrix.target }} VM
      uses: vmactions/freebsd-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          pkg install -y sudo
          pw useradd builder -m
          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: make tests
      shell: freebsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo make tests

    - name: "PAM: configure"
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
    - name: "PAM: make clean"
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: "PAM: make"
      shell: freebsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: "PAM: make tests"
      shell: freebsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests


  netbsd:
    name: "netbsd-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "9.0"
          - "9.4"
          - "10.0"
          - "10.1"
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start NetBSD ${{ matrix.target }} VM
      uses: vmactions/netbsd-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          /usr/sbin/pkg_add sudo
          /usr/sbin/useradd -m builder
          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && /sbin/chown -R builder .
    - name: configure
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: make tests
      shell: netbsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo make tests

    - name: "PAM: configure"
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
    - name: "PAM: make clean"
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: "PAM: make"
      shell: netbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: "PAM: make tests"
      shell: netbsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make tests


  ominios:
    name: "omnios-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "r151054"
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start OmniOS ${{ matrix.target }} VM
      uses: vmactions/omnios-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          set -x
          pfexec pkg refresh
          pfexec pkg install build-essential
          useradd -m builder
          sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
          mv /tmp/sudoers /etc/sudoers
          echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: omnios {0}
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: omnios {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: omnios {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: omnios {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make
    - name: make tests
      shell: omnios {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder make tests


  openbsd:
    name: "openbsd-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "7.3"
          - "7.5"
          - "7.6"
          - "7.7"
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start OpenBSD ${{ matrix.target }} VM
      uses: vmactions/openbsd-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
          useradd -m builder
          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: openbsd {0}
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: openbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: openbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: openbsd {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: make tests
      shell: openbsd {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder env SUDO=sudo make tests


  solaris:
    name: "solaris-${{ matrix.target }}"
    if: github.repository != 'openssh/openssh-portable-selfhosted'
    strategy:
      fail-fast: false
      matrix:
        # First we test all OSes in the default configuration.
        target:
          - "11.4-gcc"
        config: [default]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@main
    - name: autoreconf
      run: sh -c autoreconf

    - name: start Solaris ${{ matrix.target }} VM
      uses: vmactions/solaris-vm@v1
      with:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
          set -x
          useradd -m builder
          sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
          mv /tmp/sudoers /etc/sudoers
          echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

    - name: set file perms
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make
    - name: make tests
      shell: solaris {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder make tests

    - name: "PAM: configure"
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
    - name: "PAM: make clean"
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: "PAM: make"
      shell: solaris {0}
      run: cd $GITHUB_WORKSPACE && sudo -u builder make
    - name: "PAM: make tests"
      shell: solaris {0}
      run: |
        cd $GITHUB_WORKSPACE
        sudo -u builder make tests