gh-143750: Compile OpenSSL with TSan for TSan CI

.github/workflows/reusable-san.yml

@@ -17,6 +17,7 @@ permissions:
 
 env:
  FORCE_COLOR: 1
+ OPENSSL_VER: 3.5.7
 
 jobs:
  build-san-reusable:
@@ -38,28 +39,55 @@ jobs:
  run: |
  sudo ./.github/workflows/posix-deps-apt.sh
  # On ubuntu-26.04 image, clang is clang-21 by default
-
- if [ "${SANITIZER}" = "TSan" ]; then
- # Reduce ASLR to avoid TSan crashing
- sudo sysctl -w vm.mmap_rnd_bits=28
- fi
-
- - name: Sanitizer option setup
- run: |
- if [ "${SANITIZER}" = "TSan" ]; then
- echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${{
- fromJSON(inputs.free-threading)
- && '_free_threading'
- || ''
- }}.txt handle_segv=0" >> "$GITHUB_ENV"
- else
- echo "UBSAN_OPTIONS=${SAN_LOG_OPTION} halt_on_error=1 suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt" >> "$GITHUB_ENV"
- fi
  echo "CC=clang" >> "$GITHUB_ENV"
  echo "CXX=clang++" >> "$GITHUB_ENV"
+ - name: TSan option setup
+ if: inputs.sanitizer == 'TSan'
+ run: |
+ sudo sysctl -w vm.mmap_rnd_bits=28 # Reduce ASLR to avoid TSan crashing
+
+ echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
+ echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
+ echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${SUPPRESSIONS_SUFFIX}.txt handle_segv=0" >> "$GITHUB_ENV"
  env:
- SANITIZER: ${{ inputs.sanitizer }}
  SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
+ SUPPRESSIONS_SUFFIX: >-
+ ${{
+ fromJSON(inputs.free-threading)
+ && '_free_threading'
+ || ''
+ }}
+ - name: UBSan option setup
+ if: inputs.sanitizer != 'TSan'
+ run: >-
+ echo
+ "UBSAN_OPTIONS=${SAN_LOG_OPTION}
+ halt_on_error=1
+ suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt"
+ >> "$GITHUB_ENV"
+ env:
+ SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
+ - name: Add ccache to PATH
+ run: |
+ echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
+ - name: 'Restore OpenSSL build (TSan)'
+ id: cache-openssl
+ if: inputs.sanitizer == 'TSan'
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+ with:
+ path: ./multissl/openssl/${{ env.OPENSSL_VER }}
+ key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
+ - name: Install OpenSSL (TSan)
+ if: >-
+ inputs.sanitizer == 'TSan'
+ && steps.cache-openssl.outputs.cache-hit != 'true'
+ run: >-
+ python3 Tools/ssl/multissltests.py
+ --steps=library
+ --base-directory="${MULTISSL_DIR}"
+ --openssl="${OPENSSL_VER}"
+ --system=Linux
+ --tsan
  - name: Configure CPython
  run: >-
  ./configure
@@ -70,6 +98,7 @@ jobs:
  || '--with-undefined-behavior-sanitizer --with-strict-overflow'
  }}
  --with-pydebug
+ ${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
  ${{ fromJSON(inputs.free-threading) && '--disable-gil' || '' }}
  - name: Build CPython
  run: make -j4

Tools/ssl/multissltests.py

@@ -163,6 +163,12 @@
  dest='keep_sources',
  help="Keep original sources for debugging."
 )
+parser.add_argument(
+ '--tsan',
+ action='store_true',
+ dest='tsan',
+ help="Build with thread sanitizer. (Disables fips in OpenSSL 3.x)."
+)
 
 
 class AbstractBuilder(object):
@@ -317,6 +323,8 @@ def _build_src(self, config_args=()):
  """Now build openssl"""
  log.info("Running build in {}".format(self.build_dir))
  cwd = self.build_dir
+ if self.args.tsan:
+ config_args += ("-fsanitize=thread",)
  cmd = [
  "./config", *config_args,
  "shared", "--debug",