| # Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved. |
| # |
| # Licensed under the Apache License 2.0 (the "License"). You may not use |
| # this file except in compliance with the License. You can obtain a copy |
| # in the file LICENSE in the source distribution or at |
| # https://www.openssl.org/source/license.html |
| |
| name: Windows GitHub CI |
| |
| on: |
| pull_request: |
| paths-ignore: |
| - 'doc/**' |
| - '*.md' |
| - '*.pod' |
| - 'README*' |
| - 'funding.json' |
| - 'LICENSE.txt' |
| - 'VERSION.dat' |
| push: |
| paths-ignore: |
| - 'doc/**' |
| - '*.md' |
| - '*.pod' |
| - 'README*' |
| - 'funding.json' |
| - 'LICENSE.txt' |
| - 'VERSION.dat' |
| |
| |
| permissions: |
| contents: read |
| |
| jobs: |
| shared: |
| # Run a job for each of the specified target architectures: |
| strategy: |
| matrix: |
| platform: |
| - arch: amd64 |
| os: windows-2022 |
| config: enable-lms enable-fips |
| vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat |
| - arch: amd64 |
| os: windows-2025 |
| config: enable-lms enable-fips no-thread-pool no-quic |
| vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat |
| - arch: x86 |
| os: windows-2022 |
| config: no-fips enable-lms |
| vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars32.bat |
| runs-on: ${{ matrix.platform.os }} |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: checkout fuzz/corpora submodule |
| run: git submodule update --init --depth 1 fuzz/corpora |
| - name: install nasm |
| if: github.repository == 'openssl/openssl' |
| run: | |
| $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe" |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer |
| $actual = (Get-FileHash $installer -Algorithm SHA256).Hash |
| if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" } |
| Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait |
| "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install nasm (forks) |
| if: github.repository != 'openssl/openssl' |
| run: | |
| $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe" |
| Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win${{ matrix.platform.arch == 'x86' && '32' || '64' }}/$installer" -OutFile $installer |
| Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait |
| "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install jom |
| if: github.repository == 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install jom (forks) |
| if: github.repository != 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip |
| Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: prepare the build directory |
| run: mkdir _build |
| - name: config |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "${{ matrix.platform.vcvars }}" |
| perl ..\Configure --banner=Configured --strict-warnings no-makedepend -DOSSL_WINCTX=openssl ${{ matrix.platform.config }} |
| perl configdata.pm --dump |
| - name: build |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "${{ matrix.platform.vcvars }}" |
| jom /j4 /S |
| - name: download coreinfo |
| run: | |
| mkdir _build\coreinfo |
| Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip" |
| - name: Gather openssl version info |
| working-directory: _build |
| run: | |
| apps/openssl.exe version -v |
| apps/openssl.exe version -v | %{($_ -split '\s+')[1]} |
| apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'} |
| echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append |
| echo "OSSL_MAJOR=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+)\.[0-9]+(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append |
| - name: Set registry keys |
| working-directory: _build |
| run: | |
| echo ${Env:OSSL_VERSION} |
| reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 |
| reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 |
| reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 |
| - name: get cpu info |
| working-directory: _build |
| continue-on-error: true |
| run: | |
| 7z.exe x coreinfo/Coreinfo.zip |
| ./Coreinfo64.exe -accepteula -f |
| ./apps/openssl.exe version -c |
| - name: Check platform symbol usage |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "${{ matrix.platform.vcvars }}" |
| perl ../util/checkplatformsyms.pl ../util/platform_symbols/windows-symbols.txt libcrypto-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll ./libssl-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll |
| - name: test |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "${{ matrix.platform.vcvars }}" |
| jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4 |
| - name: install |
| # Run on 64 bit only as 32 bit is slow enough already |
| if: ${{ matrix.platform.arch == 'amd64' }} |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "${{ matrix.platform.vcvars }}" |
| mkdir _dest |
| jom /j4 install DESTDIR=_dest |
| |
| plain: |
| runs-on: windows-2022 |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: checkout fuzz/corpora submodule |
| run: git submodule update --init --depth 1 fuzz/corpora |
| - name: prepare the build directory |
| run: mkdir _build |
| - name: install jom |
| if: github.repository == 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install jom (forks) |
| if: github.repository != 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip |
| Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: config |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug -DOSSL_WINCTX=openssl VC-WIN64A-masm |
| perl configdata.pm --dump |
| - name: build |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| jom /j4 /S |
| - name: download coreinfo |
| run: | |
| mkdir _build\coreinfo |
| Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip" |
| - name: get cpu info |
| working-directory: _build |
| continue-on-error: true |
| run: | |
| 7z.exe x coreinfo/Coreinfo.zip |
| ./Coreinfo64.exe -accepteula -f |
| ./apps/openssl.exe version -c |
| - name: test |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4 |
| |
| unit-tests: |
| runs-on: windows-2022 |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: checkout fuzz/corpora submodule |
| run: git submodule update --init --depth 1 fuzz/corpora |
| - name: install jom |
| if: github.repository == 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install jom (forks) |
| if: github.repository != 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip |
| Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install cmocka and detours via vcpkg |
| shell: pwsh |
| run: | |
| & "$env:VCPKG_INSTALLATION_ROOT\vcpkg.exe" install cmocka:x64-windows-static-md detours:x64-windows-static-md |
| "VCPKG_INST=$env:VCPKG_INSTALLATION_ROOT\installed\x64-windows-static-md" | Out-File -FilePath $env:GITHUB_ENV -Append |
| - name: prepare the build directory |
| run: mkdir _build |
| - name: config |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| perl ..\Configure VC-WIN64A --banner=Configured --strict-warnings no-makedepend no-asm enable-unit-tests ^ |
| --with-cmocka-include=%VCPKG_INST%\include --with-cmocka-lib=%VCPKG_INST%\lib ^ |
| --with-detours-include=%VCPKG_INST%\include --with-detours-lib=%VCPKG_INST%\lib |
| perl configdata.pm --dump |
| - name: build |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| jom /j4 /S |
| - name: test |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| jom test VERBOSE=1 TESTS=test_unit |
| |
| minimal: |
| runs-on: windows-2022 |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: checkout fuzz/corpora submodule |
| run: git submodule update --init --depth 1 fuzz/corpora |
| - name: prepare the build directory |
| run: mkdir _build |
| - name: install jom |
| if: github.repository == 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe |
| $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe' |
| $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash |
| if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" } |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: install jom (forks) |
| if: github.repository != 'openssl/openssl' |
| run: | |
| mkdir C:\jom |
| Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip |
| Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom |
| "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append |
| - name: config |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-bulk no-deprecated no-fips no-asm no-threads -DOPENSSL_SMALL_FOOTPRINT -DOSSL_WINCTX=openssl |
| perl configdata.pm --dump |
| - name: build |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| jom /j4 /S |
| - name: download coreinfo |
| run: | |
| mkdir _build\coreinfo |
| Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip" |
| - name: get cpu info |
| working-directory: _build |
| continue-on-error: true |
| run: | |
| 7z.exe x coreinfo/Coreinfo.zip |
| ./Coreinfo64.exe -accepteula -f |
| ./apps/openssl.exe version -c |
| - name: test |
| working-directory: _build |
| shell: cmd |
| run: | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat" |
| jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4 |
| |
| cygwin: |
| # Run a job for each of the specified target architectures: |
| strategy: |
| matrix: |
| os: |
| - windows-2022 |
| platform: |
| - arch: win64 |
| config: -DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips |
| # are we really learning sth new from win32? So let's save some CO2 for now disabling this |
| # - arch: win32 |
| # config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips |
| runs-on: ${{ matrix.os }} |
| env: |
| CYGWIN_NOWINPATH: 1 |
| SHELLOPTS: igncr |
| # Don't overwhelm github CI VMs: |
| MAKE_PARAMS: -j 4 |
| steps: |
| # Checkout before cygwin can mess with PATH... |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d #v6 |
| with: |
| packages: perl git make gcc-core |
| - name: Check repo |
| run: cygcheck -V |
| - name: Full cygcheck status |
| run: cygcheck -s -v -r -h |
| # Activate this if checkout action fails: |
| # - name: Clone repo |
| # run: bash -c "pwd && git clone --branch ${{ github.ref_name }} --depth 1 https://github.com/${{ github.repository }}.git" |
| - name: Full build |
| shell: bash |
| run: | |
| gcc --version |
| ./config ${{ matrix.platform.config }} |
| make $MAKE_PARAMS |
| # Disable testing for now. TBD: Need local cygwin installation to debug . |
| # - name: Run openssl tests |
| # run: bash -c "cd openssl && make V=1 test" |
| |
| mingw64: |
| strategy: |
| matrix: |
| platform: |
| - arch: mingw64 |
| target: x86_64 |
| # Avoid MINGW bug in headers. Remove when CI is upgraded. |
| config: enable-demos -Wno-array-bounds |
| - arch: mingw |
| target: i686 |
| config: -Wno-array-bounds -Wno-stringop-overflow |
| runs-on: ubuntu-latest |
| env: |
| CC: ${{ matrix.platform.target }}-w64-mingw32-gcc |
| CXX: ${{ matrix.platform.target }}-w64-mingw32-g++ |
| AR: ${{ matrix.platform.target }}-w64-mingw32-ar |
| RANLIB: ${{ matrix.platform.target }}-w64-mingw32-ranlib |
| RC: ${{ matrix.platform.target }}-w64-mingw32-windres |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: install MINGW64 |
| run: sudo apt-get install -y mingw-w64 |
| - name: config |
| run: ./config ${{ matrix.platform.arch }} --strict-warnings --banner=Configured ${{ matrix.platform.config }} |
| - name: make |
| run: make -j4 -s |
| |
| msys2-mingw64: |
| strategy: |
| matrix: |
| platform: |
| - arch: UCRT64 |
| cc: gcc |
| pkgs: mingw-w64-ucrt-x86_64-gcc |
| config: mingw64 enable-demos |
| - arch: CLANG64 |
| cc: clang |
| pkgs: mingw-w64-clang-x86_64-clang |
| config: mingw64 |
| runs-on: windows-latest |
| env: |
| CC: ${{ matrix.platform.cc }} |
| MSYSTEM: ${{ matrix.platform.arch }} |
| CHERE_INVOKING: 'yes' |
| steps: |
| - uses: actions/checkout@v6 |
| with: |
| persist-credentials: false |
| - name: install MSYS2 |
| run: | |
| $url = 'https://github.com/msys2/msys2-installer/releases/download/nightly-x86_64/msys2-base-x86_64-latest.sfx.exe' |
| (New-Object System.Net.WebClient).DownloadFile($url, 'msys2.exe') |
| # Remove preinstalled MSYS2 |
| if (Test-Path C:\msys64) { Remove-Item -Recurse -Force C:\msys64 } |
| .\msys2.exe -y -oC:\ |
| Remove-Item msys2.exe |
| |
| - name: update MSYS2 |
| run: | |
| C:\msys64\usr\bin\bash.exe -lc ' ' |
| # Update core and then normal update |
| C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu' |
| C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu' |
| |
| - name: install dependencies |
| run: C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -S --needed perl git make ${{ matrix.platform.pkgs }}' |
| |
| - name: config |
| run: C:\msys64\usr\bin\bash.exe -lc './config --strict-warnings --banner=Configured ${{ matrix.platform.config }}' |
| |
| - name: make |
| run: C:\msys64\usr\bin\bash.exe -lc 'make -j4 -s' |
| # Tests are broken for now |
| # - name: test |
| # run: C:\msys64\usr\bin\bash.exe -lc 'make test' |
