Repository navigation
Restore the OpenSSL 1.1.x build and test against every supported OpenSSL release series - #170
Merged
Merged
Conversation
The build sets OPENSSL_API_COMPAT=0x10100000L. Under that level OpenSSL 1.1.x no longer provides the pre-1.1.0 compatibility names EVP_CIPHER_CTX_init, ERR_load_crypto_strings, OpenSSL_add_all_algorithms, EVP_cleanup and ERR_free_strings, which 1.0.x implements as functions and 3.x still defines as macros, so the library and the test harness failed to compile with implicit function declarations. jws.c also relied on a transitive <openssl/bn.h> include that went away when the public headers stopped including OpenSSL headers (cisco#166); 1.0.x and 3.x happen to pull it in through <openssl/rsa.h>. Drop the EVP_CIPHER_CTX_init calls, which are redundant right after EVP_CIPHER_CTX_new on every release, include bn.h where the BIGNUM functions are used, and confine the explicit initialisation and cleanup in the test harness to OpenSSL before 1.1.0, which initialises itself. README.md promises OpenSSL 1.0.1h or newer; the OpenSSL workflow that follows builds against the last release of every series to keep it that way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
The Build and Archs workflows test against the OpenSSL that the platform packages provide, which is a recent release, so behaviour that only differs in another release goes unnoticed, and README.md promises OpenSSL 1.0.1h or newer. Add an OpenSSL workflow that builds the last release of every series from 1.0.1 to 4.0 from the GitHub release tarball (sha256 pinned, cached across runs), configures cjose with OPENSSL_ROOT_DIR pointing at it, checks with ldd that check_cjose loads that library rather than the system one, and runs the tests. 3.0.7 is in the matrix as well: it is the release RHEL 9 is based on and the last 3.0.x whose EdDSA signing dereferences a missing private key instead of failing; 3.0.8 added the guard. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
actions/cache@v4 targets Node.js 20, which GitHub has deprecated on its runners: every run carries a "Node.js 20 is deprecated ... forced to run on Node.js 24: actions/cache@v4" annotation. v5 moved the action to Node.js 24 with unchanged inputs and v6 is the current major. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
This was referenced Sep 11, 2026
TheStormN
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Linux, macOS, Windows and qemu jobs test against the OpenSSL that the platform packages provide, which is a recent release (3.0.13 on ubuntu-latest, 3.5 on macOS and vcpkg). Behaviour that only differs in another release goes unnoticed: the review of #169 found that signing with a public-only Ed25519 key crashes inside OpenSSL on a machine with an older 3.0.x while CI was green, and it turns out master does not even compile against OpenSSL 1.1.x although README.md promises 1.0.1h or newer.
Three commits:
Restore the build against OpenSSL 1.1.0 and 1.1.1. Under
OPENSSL_API_COMPAT=0x10100000L, 1.1.x no longer provides the pre-1.1.0 compatibility names (EVP_CIPHER_CTX_init,ERR_load_crypto_strings,OpenSSL_add_all_algorithms,EVP_cleanup,ERR_free_strings), which 1.0.x implements as functions and 3.x still defines as macros, andjws.crelied on a transitive<openssl/bn.h>include that went away with #166 (1.0.x and 3.x pull it in through<openssl/rsa.h>). TheEVP_CIPHER_CTX_initcalls right afterEVP_CIPHER_CTX_neware redundant on every release and are dropped;bn.his included where the BIGNUM functions are used; the explicit initialisation and cleanup in the test harness is confined to OpenSSL before 1.1.0.A separate
OpenSSLworkflow (.github/workflows/openssl.yml) that builds the last release of every series from 1.0.1 to 4.0 from the GitHub release tarball (sha256 pinned, cached withactions/cache, so later runs skip the build), plus 3.0.7: the release RHEL 9 is based on and the last 3.0.x whoseed25519_digest_sign/ed448_digest_signdereference a missing private key instead of failing (3.0.8 added thePROV_R_NOT_A_PRIVATE_KEYguard). Each entry configures cjose withOPENSSL_ROOT_DIR, checks withlddthatcheck_cjoseloads that library rather than the system one, and runs the tests.actions/cache@v6 in the new workflow and in the Windows job of build.yml: v4 targets Node.js 20, which GitHub has deprecated on its runners, so every run carried a "Node.js 20 is deprecated ... forced to run on Node.js 24: actions/cache@v4" annotation; v5 moved the action to Node.js 24 with unchanged inputs and v6 is the current major.
Matrix: 1.0.1u, 1.0.2u, 1.1.0l, 1.1.1w, 3.0.7, 3.0.22, 3.1.8, 3.2.6, 3.3.7, 3.4.7, 3.5.8, 3.6.4, 4.0.2.
Validated in the fork: OpenIDC#37 (this branch on master) and OpenIDC#38 (this branch on top of #169, where the 1.1.1w and 3.0.7 entries fail with the SEGFAULT the review reported, and every other entry passes).
🤖 Generated with Claude Code