Skip to content

gh-136728: Combine OpenSSL and AWS-LC CI configurations#144805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hugovk merged 9 commits into from
Mar 1, 2026
Merged

gh-136728: Combine OpenSSL and AWS-LC CI configurations #144805

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
61c8ef3
gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 13, 2026
3809ebb
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 13, 2026
402c06d
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 13, 2026
4676575
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 16, 2026
2543718
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 16, 2026
8f9044b
Revert "fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations"
zware Feb 28, 2026
0b98838
Merge remote-tracking branch 'origin/main' into bump_multissl_awslc
zware Feb 28, 2026
4b33b4e
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 28, 2026
4a81ca2
fixup! gh-136728: Combine OpenSSL and AWS-LC CI configurations
zware Feb 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 35 additions & 81 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -253,8 +253,8 @@ jobs:
os: ${{ matrix.os }}
test-opts: ${{ matrix.test-opts || '' }}

build-ubuntu-ssltests-openssl:
name: 'Ubuntu SSL tests with OpenSSL'
build-ubuntu-ssltests:
name: 'Ubuntu SSL tests'
runs-on: ${{ matrix.os }}
timeout-minutes: 60
needs: build-context
Expand All@@ -263,16 +263,25 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-24.04]
# Keep 1.1.1w in our list despite it being upstream EOL and otherwise
# unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
# supported by important vendors such as AWS-LC.
openssl_ver: [1.1.1w, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1]
# See Tools/ssl/make_ssl_data.py for notes on adding a new version
ssllib:
# See Tools/ssl/make_ssl_data.py for notes on adding a new version
## OpenSSL
# Keep 1.1.1w in our list despite it being upstream EOL and otherwise
# unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
# supported by important vendors such as AWS-LC.
- { name: openssl, version: 1.1.1w }
- { name: openssl, version: 3.0.19 }

@webknjazwebknjazFeb 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nested objects in the matrix generally cause difficulties. So yes, that other PR solves this bit better. I understand the desire to couple libs with their versions and it might be reasonable to just use strings like openssl == 3.0.19 and split them where necessary.

@zwarezwareFeb 17, 2026

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What difficulties?

- { name: openssl, version: 3.3.6 }
- { name: openssl, version: 3.4.4 }
- { name: openssl, version: 3.5.5 }
- { name: openssl, version: 3.6.1 }
## AWS-LC
- { name: aws-lc, version: 1.68.0 }
env:
OPENSSL_VER: ${{ matrix.openssl_ver }}
SSLLIB_VER: ${{ matrix.ssllib.version }}
MULTISSL_DIR: ${{ github.workspace }}/multissl
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
SSLLIB_DIR: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib
steps:
- uses: actions/checkout@v6
with:
Expand All@@ -283,89 +292,37 @@ jobs:
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
- name: Install dependencies
run: sudo ./.github/workflows/posix-deps-apt.sh
- name: Configure OpenSSL env vars
run: |
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
- name: 'Restore OpenSSL build'
id: cache-openssl
uses: actions/cache@v5
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
- name: Install OpenSSL
if: steps.cache-openssl.outputs.cache-hit != 'true'
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory "$MULTISSL_DIR" --openssl "$OPENSSL_VER" --system Linux
- name: Configure CPython
run: ./configure CFLAGS="-fdiagnostics-format=json" --config-cache --enable-slower-safety --with-pydebug --with-openssl="$OPENSSL_DIR"
- name: Build CPython
run: make -j4
- name: Display build info
run: make pythoninfo
- name: SSL tests
run: ./python Lib/test/ssltests.py

build-ubuntu-ssltests-awslc:
name: 'Ubuntu SSL tests with AWS-LC'
runs-on: ${{ matrix.os }}
timeout-minutes: 60
needs: build-context
if: needs.build-context.outputs.run-ubuntu == 'true'
strategy:
fail-fast: false
matrix:
os: [ubuntu-24.04]
awslc_ver: [1.55.0]
env:
AWSLC_VER: ${{ matrix.awslc_ver}}
MULTISSL_DIR: ${{ github.workspace }}/multissl
OPENSSL_DIR: ${{ github.workspace }}/multissl/aws-lc/${{ matrix.awslc_ver }}
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/aws-lc/${{ matrix.awslc_ver }}/lib
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Register gcc problem matcher
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
- name: Install dependencies
run: sudo ./.github/workflows/posix-deps-apt.sh
- name: Configure SSL lib env vars
run: |
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/aws-lc/${AWSLC_VER}" >> "$GITHUB_ENV"
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/aws-lc/${AWSLC_VER}/lib" >> "$GITHUB_ENV"
- name: 'Restore AWS-LC build'
id: cache-aws-lc
- name: 'Restore SSL library build'
id: cache-ssl-lib
uses: actions/cache@v5
with:
path: ./multissl/aws-lc/${{ matrix.awslc_ver }}
key: ${{ matrix.os }}-multissl-aws-lc-${{ matrix.awslc_ver }}
- name: Install AWS-LC
if: steps.cache-aws-lc.outputs.cache-hit != 'true'
path: ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
key: ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }}
- name: Install SSL Library
if: steps.cache-ssl-lib.outputs.cache-hit != 'true'
run: |
python3 Tools/ssl/multissltests.py \
--steps=library \
--base-directory "$MULTISSL_DIR" \
--awslc ${{ matrix.awslc_ver }} \
'--${{ matrix.ssllib.name }}' '${{ matrix.ssllib.version }}' \
--system Linux
- name: Configure CPython
run: |
./configure CFLAGS="-fdiagnostics-format=json" \
--config-cache \
--enable-slower-safety \
--with-pydebug \
--with-openssl="$OPENSSL_DIR" \
--with-openssl="$SSLLIB_DIR" \
--with-builtin-hashlib-hashes=blake2 \
--with-ssl-default-suites=openssl
- name: Build CPython
run: make -j
run: make -j4
- name: Display build info
run: make pythoninfo
- name: Verify python is linked to AWS-LC
run: ./python -c 'import ssl; print(ssl.OPENSSL_VERSION)' | grep AWS-LC
- name: Verify python is linked to the right lib
run: |
./python -c 'import ssl; print(ssl.OPENSSL_VERSION)' \
| grep -iE '${{ matrix.ssllib.name }}.*${{ matrix.ssllib.version }}'
- name: SSL tests
run: ./python Lib/test/ssltests.py

Expand DownExpand Up@@ -691,8 +648,7 @@ jobs:
- build-windows-msi
- build-macos
- build-ubuntu
- build-ubuntu-ssltests-awslc
- build-ubuntu-ssltests-openssl
- build-ubuntu-ssltests
- build-ios
- build-wasi
- test-hypothesis
Expand All@@ -709,8 +665,7 @@ jobs:
allowed-failures: >-
build-android,
build-windows-msi,
build-ubuntu-ssltests-awslc,
build-ubuntu-ssltests-openssl,
build-ubuntu-ssltests,
test-hypothesis,
cifuzz,
allowed-skips: >-
Expand DownExpand Up@@ -741,8 +696,7 @@ jobs:
!fromJSON(needs.build-context.outputs.run-ubuntu)
&& '
build-ubuntu,
build-ubuntu-ssltests-awslc,
build-ubuntu-ssltests-openssl,
build-ubuntu-ssltests,
test-hypothesis,
build-asan,
build-san,
Expand Down
5 changes: 4 additions & 1 deletion Tools/ssl/multissltests.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -64,7 +64,7 @@
]

AWSLC_RECENT_VERSIONS = [
"1.55.0",
"1.68.0",
]
Comment thread
zware marked this conversation as resolved.

# store files in ../multissl
Expand DownExpand Up@@ -108,7 +108,10 @@
).format(LIBRESSL_RECENT_VERSIONS, LIBRESSL_OLD_VERSIONS)
)
parser.add_argument(
'--aws-lc',
# Soft-deprecated alias
'--awslc',
dest='awslc',
nargs='+',
default=(),
help=(
Expand Down
Loading