CI update - #97
Closed
quarckster wants to merge 5 commits into
Closed
CI update#97quarckster wants to merge 5 commits into
quarckster wants to merge 5 commits into
Conversation
Debian 11 (bullseye) LTS ended on 2026-08-31 and the bullseye-security Release file on deb.debian.org expired on 2026-09-07, so "apt-get update" now fails with "Release file ... is expired" and every debian-11 job breaks at the "Install prerequisites" step. Switch to the snapshot.debian.org entries that the debian:11 image already ships commented out in /etc/apt/sources.list, disable the Valid-Until check since snapshots are frozen, and retry transient failures because snapshot.debian.org throttles clients. Assisted-by: Claude:claude-fable-5-1
OpenSSL 3.0, 3.2 and 3.3 have reached end of life, so stop testing against them. Add the openssl-4.0 and openssl-4.1 release branches, and bump OPENSSL_VERSION passed for master on Ubuntu 20.04 to 4.2 to match VERSION.dat. Assisted-by: Claude:claude-fable-5-1
v7.0.1 is the current release; v5 is two majors behind. Nothing in the v6 (credentials persisted to a separate file, Node.js 24) or v7 (fork PRs blocked for pull_request_target/workflow_run) changes affects this workflow, which only triggers on pull_request and workflow_dispatch. Assisted-by: Claude:claude-fable-5-1
Replace "choco install nasm" with the installer-download snippet used in the openssl/openssl Windows workflows: fetch nasm-3.01-installer-x64.exe from the openssl-library.org ci-deps mirror, verify its SHA256 against the value in openssl's .github/ci-deps.json (inlined here, as perftools has no such file), and run the installer silently. Forks fall back to downloading the same installer from nasm.us without the hash check, as in openssl/openssl. Assisted-by: Claude:claude-fable-5-1
Install jom the same way openssl/openssl does: download jom-1.1.7.exe from the openssl-library.org ci-deps mirror and verify its SHA256, with forks falling back to the jom_1_1_7.zip from download.qt.io. Copy .github/ci-deps.json verbatim from openssl/openssl so the NASM step can read its expected hash from there too, instead of the inlined value. The perftools checkout is moved to the front of the job so that the file (and the patch below) is available before the install steps. Build with "jom /j4 /S" for every branch. MSVC cannot be parallelised while /Zi routes debug info through shared .pdb files, which is what openssl/openssl#30703 fixed by switching to /Z7. That change is in master and openssl-4.1 only, so for openssl-3.4 through openssl-4.0 the backport used by the perf-test-automation playbooks in the ansible repo is applied to the OpenSSL tree with "git apply -C1" before configuring. The patch is copied verbatim into patches/ and selected per matrix entry via the new z7-patch key; it was checked to apply against the current heads of all four branches. Assisted-by: Claude:claude-fable-5-1
mattcaswell
approved these changes
Sep 10, 2026
t8m
pushed a commit
that referenced
this pull request
Sep 11, 2026
Debian 11 (bullseye) LTS ended on 2026-08-31 and the bullseye-security Release file on deb.debian.org expired on 2026-09-07, so "apt-get update" now fails with "Release file ... is expired" and every debian-11 job breaks at the "Install prerequisites" step. Switch to the snapshot.debian.org entries that the debian:11 image already ships commented out in /etc/apt/sources.list, disable the Valid-Until check since snapshots are frozen, and retry transient failures because snapshot.debian.org throttles clients. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Merge-date: Fri Sep 11 13:50:19 2026 Merged-from: #97
t8m
pushed a commit
that referenced
this pull request
Sep 11, 2026
OpenSSL 3.0, 3.2 and 3.3 have reached end of life, so stop testing against them. Add the openssl-4.0 and openssl-4.1 release branches, and bump OPENSSL_VERSION passed for master on Ubuntu 20.04 to 4.2 to match VERSION.dat. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Merge-date: Fri Sep 11 13:50:20 2026 Merged-from: #97
t8m
pushed a commit
that referenced
this pull request
Sep 11, 2026
v7.0.1 is the current release; v5 is two majors behind. Nothing in the v6 (credentials persisted to a separate file, Node.js 24) or v7 (fork PRs blocked for pull_request_target/workflow_run) changes affects this workflow, which only triggers on pull_request and workflow_dispatch. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Merge-date: Fri Sep 11 13:50:20 2026 Merged-from: #97
t8m
pushed a commit
that referenced
this pull request
Sep 11, 2026
Replace "choco install nasm" with the installer-download snippet used in the openssl/openssl Windows workflows: fetch nasm-3.01-installer-x64.exe from the openssl-library.org ci-deps mirror, verify its SHA256 against the value in openssl's .github/ci-deps.json (inlined here, as perftools has no such file), and run the installer silently. Forks fall back to downloading the same installer from nasm.us without the hash check, as in openssl/openssl. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Merge-date: Fri Sep 11 13:50:21 2026 Merged-from: #97
t8m
pushed a commit
that referenced
this pull request
Sep 11, 2026
Install jom the same way openssl/openssl does: download jom-1.1.7.exe from the openssl-library.org ci-deps mirror and verify its SHA256, with forks falling back to the jom_1_1_7.zip from download.qt.io. Copy .github/ci-deps.json verbatim from openssl/openssl so the NASM step can read its expected hash from there too, instead of the inlined value. The perftools checkout is moved to the front of the job so that the file (and the patch below) is available before the install steps. Build with "jom /j4 /S" for every branch. MSVC cannot be parallelised while /Zi routes debug info through shared .pdb files, which is what openssl/openssl#30703 fixed by switching to /Z7. That change is in master and openssl-4.1 only, so for openssl-3.4 through openssl-4.0 the backport used by the perf-test-automation playbooks in the ansible repo is applied to the OpenSSL tree with "git apply -C1" before configuring. The patch is copied verbatim into patches/ and selected per matrix entry via the new z7-patch key; it was checked to apply against the current heads of all four branches. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.foundation> Merge-date: Fri Sep 11 13:50:22 2026 Merged-from: #97
t8m
added
the
approval: ready to merge
Member
|
Merged. Thank you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates active branches, aligns nasm and jom installation with
openssl/openssland replacesnmakewithjom.