MidnightBSD's `mport install` is prone to return a non-zero exit code on
success (hence the need to use `|| true`; also unrelated to the `grep`
filtering, needed to avoid log noise for no built-in option for this).
Work around by verifying success explicitly, so that a truly failed
install command fails in the 'install prereqs' step, instead of raising
a confusing error (e.g. "cmake: not found") in the step after.
Follow-up to b7f4e55c8f#2120
Follow-up to e4f700e934#1948Closes#2663
Also:
- enable MSYS2 cache for both curl tests.
- inherit pre-installed MSYS2 in the ARM64 curl job.
- bump integration tests from mingw64 to ucrt64 env.
- switch deprecated mingw64 jobs to ucrt64/clang64.
(Keep one mingw64 and one mingw32 job.)
- silence mingw64/mingw32 deprecation warning.
Closes#2638
For slightly better performance, and better efficiency.
Saving over 1 minute. The clang-tidy build is 2x fast.
Also:
- GHA/windows: fix `windres` command-line for non-intel machines.
Closes#2637
- update `docker/build-push-action` from 7.3.0 to 7.4.0
- update `github/codeql-action/analyze` from 4.37.8 to 4.38.2
- update `github/codeql-action/init` from 4.37.8 to 4.38.2
Closes#2634
In favor of direct execution or `docker login` and `docker logout`.
Also to limit the logged-in time to the steps the require it, and to
avoid passing a secret via the command-line.
Closes#2616
To reflect the support for multiple container engines, and to make
terminology more consistent and implementation-agnostic.
Also:
- add FIXME for `docker-machine ip` command that has been dropped
upstream.
Follow-up to 9bd1f16dc2#2605Closes#2609
- add `FIXTURE_CONTAINER_CMD` to the container command. Supported:
`podman`, `container`, `docker` (default).
- deprecate `OPENSSH_NO_DOCKER` env. Replaced by setting
`FIXTURE_CONTAINER_CMD` to an empty string.
- GHA: replace Docker with `podman` in a some Linux jobs.
- openssh_fixture: fixup `inspect` commands to be compatible with both
docker and podman.
- openssh_fixture: add `inspect` fallback for podman, which does not
support `HostIp` before 6.1.0.
Ref: https://github.com/podman-container-tools/podman/issues/29164
- openssh_fixture: add Apple container alternatives for `pull` and
`tag`.
- openssh_fixture: fix `run` command to suppress progress output when
using Apple container.
- openssh_fixture: if `OPENSSH_SERVER_PORT` is set, omit querying
the port number via the container tool.
`podman` seems to be a tiny bit slower than Docker in CI.
Requirements for Apple container:
- Apple container 0.8.0+ (2026-01-02). Tested with 1.4.1.
- `jq` installed in PATH.
- setting the sshd port manually on the host via `OPENSSH_SERVER_PORT`
(`container` cannot automatically assign one).
- physical macOS machine.
Example to run conainerized tests on macOS:
```sh
brew install container jq
container system start --disable-kernel-install
container system kernel set --recommended
export FIXTURE_CONTAINER_CMD=container
export OPENSSH_SERVER_PORT=<free-port-number>
export OPENSSH_SERVER_IMAGE; OPENSSH_SERVER_IMAGE=ghcr.io/libssh2/ci_tests_openssh_server:$(git rev-parse --short=20 HEAD:tests/openssh_server)
ctest -VV
```
Also tried:
- using Apple container in CI. Does not work because nested
virtualization is not supported in GHA runners.
- installing WSL on Windows. Failed with cryptic error upon
`wsl --install --distribution Debian`.
Closes#2605
To enable testing on arm64 Linux and possibly also on macOS, and
possibly possibly on arm64 Windows.
Also:
- switch to debian:testing to trigger a container rebuild.
- Dockerfile: install `adduser` explicitly. Required for debian:forky.
- Dockerfile: stop installing suggested/recommended packages.
Ref: https://github.com/docker/build-push-actionCloses#2606
The WinCNG backend has been missing runtime tests for a while. To
restore some level of testing, this PR make use of curl's regression
test suite (`runtests`) to run SCP/SFTP-specific tests with the
master/PR libssh2 revision at hand. Some tests need to be disabled when
using the built-in Windows OpenSSH server.
The current CI jobs reproduce the long-running WinCNG flaky failure
reported in #804 reliability.
Note, if these CI jobs make libssh2 CI a pain to use, they will be
removed. This has a reasonably fair chance to happen, based on the
experience with curl CI with Windows.
Also:
- test both ECDH and non-ECDH builds.
- test build on x64 and ARM64.
- test with both Windows built-in OpenSSH port and MSYS2's sshd.
- enable debug logging in libssh2 while running the tests.
- for extra stress, run each of the 56-57 tests 6 times.
This may be lowered in a future commit to avoid flakiness and reduce
CI load and job times.
Caveats:
- as seen in curl CI, runtests may result in hangs due to broken pipes
and error 2304 for undiscovered reasons.
Discussion: https://github.com/curl/curl/discussions/14854
- MSBuild has an undisablable "smart" feature that sometimes marks a
successful run a failure.
Refs:
a477789c43https://github.com/curl/curl/pull/18301
- these tests are different in scope than libssh2's own.
- tests sometime fail flaky with:
```
Failure Event: -43 - Failed getting banner
```
Ref: https://github.com/libssh2/libssh2/actions/runs/34134974899/job/101783681252?pr=2590
- running on modern runner machines, the Win10-introduced DH algo is
always enabled.
Ref: https://github.com/libssh2/libssh2/discussions/2049
Ref: #2583Closes#2590
- update `docker/login-action` from 4.5.1 to 4.6.0
- update `github/codeql-action/analyze` from 4.37.3 to 4.37.8
- update `github/codeql-action/init` from 4.37.3 to 4.37.8
Closes#2570
Also:
- GHA: build test WinCNG with legacy options enabled with both mingw-w64
and MSVC.
- add `ssh2_zero_free()` to clear memory and free using `SSH2_FREE()`.
- openssl, wincng: use `ssh2_zero_free()`.
- replace bare allocators with SSH2 ones in places where `session` was
already available.
Closes#2544
This API returns `uint32_t` with these two forks, and `unsigned long`
elsewhere.
```
src/openssl.c: In function ‘ssh2_ed25519_verify’:
src/openssl.c:3291:19: error: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 5 has type ‘uint32_t’ {aka ‘unsigned int’} [-Werror=format=]
3291 | "ssh2_ed25519_verify(): EVP_DigestVerify()->%d (ossl: %lu)",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3292 | ret, ret ? ERR_peek_last_error() : 0));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| uint32_t {aka unsigned int}
src/libssh2_priv.h:1112:34: note: in definition of macro ‘ssh2_deb’
```
Ref: https://github.com/libssh2/libssh2/actions/runs/30837337514/job/91765629453?pr=2503#step:24:105
Also:
- GHA: test the build combination in CI, with BoringSSL.
Closes#2503
They are `ssh-rsa` and `ssh-rsa-cert-v01@openssh.com`, and insecure due
to their reliance on SHA1 hashes.
Also:
- hostkey: fix to accept all RSA hostkey methods in common
`hostkey_method_ssh_rsa_init()`.
- mbedtls: add missing RSA SHA1/SHA2 guards.
- mbedtls: cleanup on error in `mbed_pub_priv_key()`.
- os400qc3: add missing RSA SHA1/SHA2 guards. (untested)
- wincng: add missing RSA SHA1/SHA2 guards.
- crypto.h: add missing `#endif` comments.
- GHA: move stray `-DLIBSSH2_DSA_ENABLE` to its place.
Follow-up to b7ab0faa70#1435
- tests: fix to guard RSA tests with `LIBSSH2_RSA`, replacing
`LIBSSH2_RSA_SHA1` to keep test coverage. Keep using the latter for
testing SHA1-based signatures in `test_auth_pubkey_ok_rsa_signed`.
Follow-up to 3e14d67d26#2444
Follow-up to 99f935358d#2443Closes#2501
via new env `FIXTURE_TRACE_NO_DEBUGDUMP`.
Also:
- CI: set `FIXTURE_TRACE_NO_DEBUGDUMP` to make detailed logs (much)
shorter and more readable for the common debug use-case.
- GHA: enable debug trace for clang-tidy OpenSSL jobs and simplify
configuration.
Cherry-picked from #2485Closes#2487
Turns out this was the root cause of CI failures seen earlier, and then
worked around by reverting to older versions Docker and runner machines.
Replace/revert those workarounds by enabling the necessary legacy bits
in the test OpenSSH server configuration.
Follow-up to 8be5716437#2174
Follow-up to 51f6259d18#1720Closes#2484
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `docker/build-push-action` from 7.2.0 to 7.3.0
- update `docker/login-action` from 4.2.0 to 4.5.1
- update `docker/metadata-action` from 6.1.0 to 6.2.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
Closes#2477
To also check for the prototype, avoiding mis-detection e.g. in C89
(non-GNU) mode with Apple targets, and syncing this detection with
CMake.
Also: test C89 macOS builds in CI with both autotools and cmake.
Follow-up to 833b48519c#2456
Ref: 6f0dcc3e66#2455Closes#2457
Also:
- RELEASE-NOTES: announce removal after next release.
- allow build-time macro to enable in the meantime.
- skip in tests if disabled.
- keep testing in CI with other legacy options.
- workaround oss-fuzzer hang and timeout after 10 minutes by keeping
SHA1-based MACs enabled in the fuzzer build.
Ref: https://github.com/libssh2/libssh2/pull/2444#issuecomment-5110853610
Follow-up to 99f935358d#2443Closes#2444
Also:
- RELEASE-NOTES: announce removal after next release.
- allow build-time macro to enable in the meantime.
- keep testing in CI with other legacy options.
Closes#2443
Also:
- reflow an `include` section to be more compact and readable.
- enable verbose build for Linux jobs to confirm build options.
- keep DSA disabled because it fails test `test_auth_pubkey_ok_dsa`, due
to lack of server support.
Follow-up to b89858b83d#1531Closes#2439
autotools: `--enable-windows-unicode`.
cmake: `-DENABLE_UNICODE=ON`.
Also:
- automatically enable in UWP builds.
- test in CI, with both autotools and cmake and both mingw-w64 and MSVC.
Closes#2321
