Skip to content

Commit eba2aa9

Browse files
etretr
committed
FEATURE-ci-v3-integration: repair platform setup and replay assertions
1 parent 63ffaa2 commit eba2aa9

20 files changed

Lines changed: 568 additions & 136 deletions

‎.github/workflows/v3-native.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ jobs:
3838
export V3_TLS_CFLAGS="-I$RUNNER_TEMP/prerequisites/provider/include"
3939
export V3_TLS_LIBS="-L$RUNNER_TEMP/prerequisites/provider/lib -lssl -lcrypto"
4040
export LD_LIBRARY_PATH="$RUNNER_TEMP/prerequisites/provider/lib"
41+
export V3_OPENSSL="$RUNNER_TEMP/prerequisites/provider/bin/openssl"
42+
"$V3_OPENSSL" version -a > openssl-provenance.log
43+
ldd "$V3_OPENSSL" >> openssl-provenance.log
4144
fi
4245
CXX=clang++ CC=clang "$GITHUB_WORKSPACE/configure" --enable-v3-tls="$TLS_MODE"
4346
make -j2
@@ -70,19 +73,21 @@ jobs:
7073
if: matrix.target == 'quic_tls_callbacks'
7174
run: python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/prerequisites"
7275
- name: Configure genuine native sources
76+
shell: bash
7377
env:
7478
TARGET: ${{ matrix.target }}
7579
run: |
76-
./bootstrap
7780
mkdir "$RUNNER_TEMP/native"
81+
./bootstrap 2>&1 | tee "$RUNNER_TEMP/native/bootstrap.log"
7882
cd "$RUNNER_TEMP/native"
7983
mode=no
8084
if [ "$TARGET" = quic_tls_callbacks ]; then
8185
mode=yes
8286
export V3_TLS_CFLAGS="-I$RUNNER_TEMP/prerequisites/provider/include"
8387
export V3_TLS_LIBS="-L$RUNNER_TEMP/prerequisites/provider/lib -lssl -lcrypto"
88+
export LD_LIBRARY_PATH="$RUNNER_TEMP/prerequisites/provider/lib"
8489
fi
85-
CXX=clang++ CC=clang "$GITHUB_WORKSPACE/configure" --enable-v3-tls="$mode" --disable-examples
90+
CXX=clang++ CC=clang "$GITHUB_WORKSPACE/configure" --enable-v3-tls="$mode" --disable-examples 2>&1 | tee "$RUNNER_TEMP/native/configure-output.log"
8691
- uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684
8792
with:
8893
path: ${{ runner.temp }}/corpus
@@ -113,6 +118,7 @@ jobs:
113118
name: fuzz-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }}
114119
path: |
115120
${{ runner.temp }}/fuzz
121+
${{ runner.temp }}/native
116122
${{ runner.temp }}/prerequisites/preparation.json
117123
${{ runner.temp }}/prerequisites/*.log
118124
retention-days: 30

‎.github/workflows/v3-package-validation.yml‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,14 @@ jobs:
4444
retention-days: 14
4545
if-no-files-found: error
4646
macos:
47-
runs-on: macos-14
47+
runs-on: macos-15
4848
timeout-minutes: 90
4949
steps:
5050
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
5151
- name: Prerequisites
52-
run: brew install autoconf automake libtool pkg-config python curl
52+
run: brew install autoconf automake libtool pkg-config python curl llvm
53+
- name: Select complete C++20 compiler and runtime
54+
run: bash scripts/ci-macos-toolchain.sh
5355
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
5456
with:
5557
node-version: '24.15.0'
@@ -70,12 +72,20 @@ jobs:
7072
if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then
7173
prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD")
7274
fi
73-
"${prefix[@]}" python3 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --client-python "$RUNNER_TEMP/package-evidence/clients/bin/python" --node node --compiler clang++ --cc clang --jobs 2
75+
"${prefix[@]}" python3 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" --provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" --pkg-config-dir "$(brew --prefix)/share/pkgconfig" --client-python "$RUNNER_TEMP/package-evidence/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --jobs 2
76+
- name: Make privileged proof readable by artifact upload
77+
if: always()
78+
run: |
79+
if [ -d "$RUNNER_TEMP/package-evidence" ]; then
80+
sudo chown -R "$(id -u):$(id -g)" "$RUNNER_TEMP/package-evidence"
81+
fi
7482
- if: always()
7583
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
7684
with:
7785
name: v3-package-macos-${{ github.sha }}
78-
path: ${{ runner.temp }}/package-evidence
86+
path: |
87+
${{ runner.temp }}/package-evidence
88+
${{ runner.temp }}/v3-toolchain
7989
retention-days: 14
8090
if-no-files-found: error
8191
mingw64:
@@ -92,6 +102,7 @@ jobs:
92102
- uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c
93103
with:
94104
msystem: MINGW64
105+
path-type: inherit
95106
update: true
96107
install: >-
97108
autotools base-devel perl git
@@ -107,7 +118,7 @@ jobs:
107118
export PATH="/c/Program Files/Git/cmd:$PATH"
108119
/mingw64/bin/python -c 'import subprocess; subprocess.run(["git", "--version"], check=True)'
109120
/mingw64/bin/python -m venv "$RUNNER_TEMP/package-evidence/clients"
110-
"$(cygpath -m "$RUNNER_TEMP/package-evidence/clients/Scripts/python.exe")" -m pip install -r test/integ/http2-client-requirements.txt
121+
"$(cygpath -m "$RUNNER_TEMP/package-evidence/clients/bin/python.exe")" -m pip install -r test/integ/http2-client-requirements.txt
111122
- name: Build selected prerequisites
112123
run: /mingw64/bin/python scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/package-evidence/prerequisites"
113124
- name: Bootstrap
@@ -116,7 +127,7 @@ jobs:
116127
run: >-
117128
/mingw64/bin/python scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix"
118129
--provider-prefix "$(cygpath -m "$RUNNER_TEMP/package-evidence/prerequisites/provider")" --toolchain-prefix "$(cygpath -m /mingw64)"
119-
--client-python "$(cygpath -m "$RUNNER_TEMP/package-evidence/clients/Scripts/python.exe")" --node node --compiler clang++ --cc clang --jobs 2
130+
--client-python "$(cygpath -m "$RUNNER_TEMP/package-evidence/clients/bin/python.exe")" --node node --compiler clang++ --cc clang --jobs 2
120131
- if: always()
121132
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
122133
with:
@@ -135,7 +146,7 @@ jobs:
135146
release: '14.3'
136147
mem: 8192
137148
cpu: 2
138-
prepare: pkg install -y bash autoconf automake libtool pkgconf python311 gmake curl binutils perl5 llvm git py311-pip py311-virtualenv node24
149+
prepare: pkg install -y bash autoconf automake libtool pkgconf python3 gmake curl binutils perl5 llvm git node24
139150
run: |
140151
export RUNNER_TEMP=/tmp/v3-package-${{ github.run_id }}-${{ github.run_attempt }}
141152
mkdir -p "$RUNNER_TEMP/package-evidence"
@@ -154,12 +165,12 @@ jobs:
154165
export PATH="$RUNNER_TEMP/node/bin:$PATH"
155166
fi
156167
test "$(node --version)" = v24.15.0
157-
python3.11 -c 'import subprocess; subprocess.run(["git", "--version"], check=True)'
158-
python3.11 -m venv "$RUNNER_TEMP/package-evidence/clients"
168+
python3 -c 'import subprocess; subprocess.run(["git", "--version"], check=True)'
169+
python3 -m venv "$RUNNER_TEMP/package-evidence/clients"
159170
"$RUNNER_TEMP/package-evidence/clients/bin/python" -m pip install -r test/integ/http2-client-requirements.txt
160-
python3.11 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/package-evidence/prerequisites" --make gmake
171+
python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/package-evidence/prerequisites" --make gmake
161172
./bootstrap
162-
python3.11 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" \
173+
python3 scripts/check-v3-installed-consumer.py --output "$RUNNER_TEMP/package-evidence/matrix" \
163174
--provider-prefix "$RUNNER_TEMP/package-evidence/prerequisites/provider" \
164175
--client-python "$RUNNER_TEMP/package-evidence/clients/bin/python" --node node --pkg-config-dir /usr/local/share/pkgconfig --compiler clang++ --cc clang --make gmake --jobs 2
165176
- if: always()

‎.github/workflows/v3-release-acceptance.yml‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ jobs:
8585
retention-days: 30
8686
if-no-files-found: warn
8787
darwin:
88-
runs-on: macos-14
88+
runs-on: macos-15
8989
needs: prepare
9090
timeout-minutes: 180
9191
outputs:
@@ -100,7 +100,9 @@ jobs:
100100
with:
101101
ref: ${{ needs.prepare.outputs.commit }}
102102
persist-credentials: false
103-
- run: brew install autoconf automake libtool pkg-config python curl
103+
- run: brew install autoconf automake libtool pkg-config python curl llvm
104+
- name: Select complete C++20 compiler and runtime
105+
run: bash scripts/ci-macos-toolchain.sh
104106
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
105107
with:
106108
node-version: 24.15.0
@@ -120,7 +122,13 @@ jobs:
120122
if ! python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",443)); s.close()'; then
121123
prefix=(sudo env "PATH=$PATH" GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory "GIT_CONFIG_VALUE_0=$PWD")
122124
fi
123-
"${prefix[@]}" python3 scripts/run-v3-release-ci.py platform --selection "$RUNNER_TEMP/selected/selected.json" --archive "$RUNNER_TEMP/selected/"libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --output "$RUNNER_TEMP/platform" --pkg-config-dir "$(brew --prefix)/share/pkgconfig"
125+
"${prefix[@]}" python3 scripts/run-v3-release-ci.py platform --selection "$RUNNER_TEMP/selected/selected.json" --archive "$RUNNER_TEMP/selected/"libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --compiler "$V3_CXX" --cc "$V3_CC" --output "$RUNNER_TEMP/platform" --pkg-config-dir "$(brew --prefix)/share/pkgconfig"
126+
- name: Make privileged proof readable by artifact upload
127+
if: always()
128+
run: |
129+
if [ -d "$RUNNER_TEMP/platform" ]; then
130+
sudo chown -R "$(id -u):$(id -g)" "$RUNNER_TEMP/platform"
131+
fi
124132
- id: proof
125133
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
126134
with:
@@ -134,6 +142,7 @@ jobs:
134142
name: platform-Darwin-failure-evidence
135143
path: |-
136144
${{ runner.temp }}/platform
145+
${{ runner.temp }}/v3-toolchain
137146
${{ runner.temp }}/prerequisites/preparation.json
138147
${{ runner.temp }}/prerequisites/*.log
139148
${{ runner.temp }}/prerequisites-ci.log
@@ -162,6 +171,7 @@ jobs:
162171
- uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c
163172
with:
164173
msystem: MINGW64
174+
path-type: inherit
165175
update: true
166176
install: autotools base-devel perl git mingw-w64-x86_64-clang mingw-w64-x86_64-gcc mingw-w64-x86_64-binutils mingw-w64-x86_64-python
167177
mingw-w64-x86_64-pkgconf mingw-w64-x86_64-libtool mingw-w64-x86_64-curl mingw-w64-x86_64-libsystre
@@ -178,10 +188,10 @@ jobs:
178188
exec > >(tee "$RUNNER_TEMP/prerequisites-ci.log") 2>&1
179189
/mingw64/bin/python scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/prerequisites"
180190
/mingw64/bin/python -m venv "$RUNNER_TEMP/clients"
181-
"$(cygpath -m "$RUNNER_TEMP/clients/Scripts/python.exe")" -m pip install -r test/integ/http2-client-requirements.txt
191+
"$(cygpath -m "$RUNNER_TEMP/clients/bin/python.exe")" -m pip install -r test/integ/http2-client-requirements.txt
182192
- name: Complete native and installed TLS off/on proof
183193
run: /mingw64/bin/python scripts/run-v3-release-ci.py platform --selection "$RUNNER_TEMP/selected/selected.json" --archive "$RUNNER_TEMP/selected/"libhttpserver-*.tar.gz
184-
--provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$(cygpath -m "$RUNNER_TEMP/clients/Scripts/python.exe")"
194+
--provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$(cygpath -m "$RUNNER_TEMP/clients/bin/python.exe")"
185195
--node node --output "$RUNNER_TEMP/platform" --toolchain-prefix "$(cygpath -m /mingw64)"
186196
- id: proof
187197
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
@@ -231,7 +241,7 @@ jobs:
231241
release: '14.3'
232242
mem: 8192
233243
cpu: 2
234-
prepare: pkg install -y bash autoconf automake libtool pkgconf python311 gmake curl binutils perl5 llvm git py311-pip py311-virtualenv
244+
prepare: pkg install -y bash autoconf automake libtool pkgconf python3 gmake curl binutils perl5 llvm git
235245
node24
236246
run: |-
237247
set -eu
@@ -252,11 +262,11 @@ jobs:
252262
export PATH="$RUNNER_TEMP/node/bin:$PATH"
253263
fi
254264
test "$(node --version)" = v24.15.0
255-
python3.11 -c 'import subprocess; subprocess.run(["git","--version"],check=True)'
256-
python3.11 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/prerequisites" --make gmake
257-
python3.11 -m venv "$RUNNER_TEMP/clients"
265+
python3 -c 'import subprocess; subprocess.run(["git","--version"],check=True)'
266+
python3 scripts/prepare-v3-package-ci.py --output "$RUNNER_TEMP/prerequisites" --make gmake
267+
python3 -m venv "$RUNNER_TEMP/clients"
258268
"$RUNNER_TEMP/clients/bin/python" -m pip install -r test/integ/http2-client-requirements.txt
259-
python3.11 scripts/run-v3-release-ci.py platform --selection build/ci-selected-input/selected.json --archive build/ci-selected-input/libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --make gmake --pkg-config-dir /usr/local/share/pkgconfig --output "$RUNNER_TEMP/platform"
269+
python3 scripts/run-v3-release-ci.py platform --selection build/ci-selected-input/selected.json --archive build/ci-selected-input/libhttpserver-*.tar.gz --provider-prefix "$RUNNER_TEMP/prerequisites/provider" --client-python "$RUNNER_TEMP/clients/bin/python" --node node --make gmake --pkg-config-dir /usr/local/share/pkgconfig --output "$RUNNER_TEMP/platform"
260270
- id: proof
261271
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
262272
with:

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,5 +173,6 @@ __pycache__/
173173
# v3 CI selected-archive publication and portable platform contracts.
174174
!scripts/run-v3-release-ci.py
175175
!scripts/test-v3-ci-workflows.py
176+
!scripts/test-v3-platform-ci.py
176177
!test/integ/release_ci_test.py
177178
!test/integ/release_platform_bundle_test.py

‎Makefile.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -627,3 +627,5 @@ EXTRA_DIST += .github/workflows/v3-native.yml .github/workflows/changelog-check.
627627
EXTRA_DIST += .github/workflows/codeql-analysis.yml .github/workflows/verify-build.yml .github/workflows/release.yml
628628

629629
EXTRA_DIST += docs/v3-ci.md
630+
631+
EXTRA_DIST += scripts/ci-macos-toolchain.sh scripts/test-v3-platform-ci.py

‎docs/v3-ci.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,18 @@ Git on Windows and FreeBSD. Selected clients are hyper-h2 4.4.1 and Node 24.15.0
1818
FreeBSD builds the checksummed Node source if its ports package differs. Linux
1919
and macOS package jobs probe actual loopback TCP443 binding for ACME witnesses;
2020
when privileges require it, they run the producer with sudo and an exact
21-
checkout-scoped Git ownership exception.
21+
checkout-scoped Git ownership exception. They restore artifact ownership before
22+
uploading privileged proof, including on failure.
23+
24+
macOS uses the bottled Homebrew LLVM toolchain on macOS 15. A generated compiler
25+
wrapper explicitly selects its matching libc++ library and runtime search path,
26+
so installed-consumer audit environments can continue removing ambient compiler
27+
flags. An actual C++20 cancellation/jthread compile-and-run probe gates the
28+
matrix. The wrapper, compiler version and probe source are retained. Windows
29+
inherits the host tool paths into MSYS2 for GitHub CLI and Node and uses the
30+
MSYS2 Python virtual environment's `bin/python.exe` layout. FreeBSD uses the
31+
Python package's bundled `ensurepip` through standard-library `venv`, without
32+
requiring retired version-specific pip or virtualenv ports.
2233

2334
## Fuzz smoke and campaigns
2435

‎scripts/ci-macos-toolchain.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/usr/bin/env bash
2+
# Keep the compiler and its C++20 runtime together through cleaned audit environments.
3+
set -euo pipefail
4+
llvm_prefix=$(brew --prefix llvm)
5+
toolchain_dir="$RUNNER_TEMP/v3-toolchain"
6+
mkdir -p "$toolchain_dir"
7+
{
8+
printf '#!/usr/bin/env bash\nexec '
9+
printf '%q ' "$llvm_prefix/bin/clang++" -stdlib=libc++ -D_LIBCPP_DISABLE_AVAILABILITY \
10+
"-L$llvm_prefix/lib/c++" "-Wl,-rpath,$llvm_prefix/lib/c++"
11+
printf '"$@"\n'
12+
} > "$toolchain_dir/clang++"
13+
chmod +x "$toolchain_dir/clang++"
14+
cat > "$toolchain_dir/cancellation.cpp" <<'CPP'
15+
#include <stop_token>
16+
#include <thread>
17+
int main() {
18+
std::stop_source source;
19+
bool called = false;
20+
std::stop_callback callback(source.get_token(), [&] { called = true; });
21+
source.request_stop();
22+
std::jthread worker([] {});
23+
return called ? 0 : 1;
24+
}
25+
CPP
26+
"$toolchain_dir/clang++" --version > "$toolchain_dir/compiler.log"
27+
"$toolchain_dir/clang++" -std=c++20 "$toolchain_dir/cancellation.cpp" -o "$toolchain_dir/cancellation"
28+
"$toolchain_dir/cancellation"
29+
printf 'V3_CXX=%s\nV3_CC=%s\n' "$toolchain_dir/clang++" "$llvm_prefix/bin/clang" >> "$GITHUB_ENV"

‎scripts/run-v3-release-ci.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ def platform_proof(args):
6363
env['LD_LIBRARY_PATH'] = str(args.provider_prefix / 'lib')
6464
env['DYLD_LIBRARY_PATH'] = str(args.provider_prefix / 'lib')
6565
env['PATH'] = str(args.provider_prefix / 'bin') + os.pathsep + env['PATH']
66+
env['V3_OPENSSL'] = str(args.provider_prefix / 'bin' / ('openssl.exe' if os.name == 'nt' else 'openssl'))
6667
cmd = Commands(args.output)
6768
package = args.output / 'matrix'
6869
argv = [sys.executable, source / 'scripts/check-v3-installed-consumer.py', '--output', package,

0 commit comments

Comments
 (0)