From 492bbe03dc14a642ca291e330c87d2641b362390 Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Thu, 5 Nov 2026 13:52:53 +0100 Subject: [PATCH] ci: build the release tarballs with rustls The tarballs compiled in OpenSSL through openssl-src, which is stuck on 3.6.3 because openssl-sys only accepts its 300.x series. OpenSSL lists 24 CVEs fixed since, and the advisory databases this project scans do not cover them. rustls is the default feature, static as well, and the aarch64 binary goes from 6.67 MB to 3.15 MB. vendored-openssl goes. OpenWrt keeps linking its own libopenssl. A tag now also stops on a known advisory in its lock file, because advisories in rustls reach the tarballs from now on. CI starts each cross-built binary with --help under the QEMU runner of its image, without network, and the cross job gets a cache per matrix entry, because entries restoring each other's build fail with E0463. --- .github/ISSUE_TEMPLATE/bug_report.yml | 1 - .github/workflows/ci.yml | 22 ++++++++++++++++------ .github/workflows/release.yml | 23 +++++++++++++++++++---- Cargo.lock | 10 ---------- Cargo.toml | 3 --- README.md | 5 ++--- deny.toml | 1 + 7 files changed, 38 insertions(+), 27 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index bc0133f..fb5944c 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -32,7 +32,6 @@ body: options: - rustls-tls (default) - native-tls (system OpenSSL) - - vendored-openssl - not sure validations: required: true diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc1fe92..d5a9d95 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -160,14 +160,14 @@ jobs: - aarch64-unknown-linux-musl - armv7-unknown-linux-musleabihf - x86_64-unknown-linux-musl + - arm-unknown-linux-musleabi tls: [rustls-tls] include: - # Proves the OpenSSL backend cross-builds, the configuration targets - # without ring support (such as PowerPC) have to use. Vendored here - # because the cross image has no OpenSSL for the target; OpenWrt - # builds use plain `native-tls` against the SDK's libopenssl. + # Proves the OpenSSL backend cross-builds, the configuration OpenWrt + # uses. OpenSSL is compiled in here only because the cross image has + # none for the target; OpenWrt builds link the SDK's libopenssl. - target: aarch64-unknown-linux-musl - tls: vendored-openssl + tls: native-tls steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -176,8 +176,18 @@ jobs: with: toolchain: stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + # One cache per matrix entry. The key otherwise names only the job, + # so an entry restores whatever another one built. + key: ${{ matrix.target }}-${{ matrix.tls }} - run: cargo install cross@0.2.5 --locked - - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }} + - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }} + # A binary that links can still fail to start, so run it under the image's + # QEMU runner. --help because cross keeps --version for itself, and without + # network so that a dropped argument cannot start a real speed test. + - run: cross run --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }} -- --help | grep '^Usage:' + env: + CROSS_CONTAINER_OPTS: --network=none - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: librespeed-cli-${{ matrix.target }}-${{ matrix.tls }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fd29a21..09a3a45 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,12 +60,26 @@ jobs: with: ref: ${{ needs.resolve.outputs.source }} + # What a tag publishes cannot be taken back, so a known advisory in its lock + # file stops it here. README's release policy says how to decide on one. + advisories: + name: Advisories + needs: resolve + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ needs.resolve.outputs.source }} + - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 + with: + command: check advisories + # The canonical crate is assembled once, here, and this job also fixes # which commit the rest of the run is about. The publish job reproduces # the crate and compares the bytes before uploading anything. prepare: name: Package the crate - needs: [resolve, validate] + needs: [resolve, validate, advisories] runs-on: ubuntu-latest outputs: version: ${{ steps.guard.outputs.version }} @@ -137,10 +151,11 @@ jobs: # this installs, and cross is part of what builds the binaries. - run: cargo install cross@0.2.5 --locked - # OpenSSL is vendored so the published binaries are self-contained; - # OpenWrt packages build against the SDK's libopenssl instead. + # rustls, so the published binaries are self-contained and carry no OpenSSL + # of their own to keep up to date. OpenWrt packages build against the SDK's + # libopenssl instead. - name: Build - run: cross build --release --target ${{ matrix.target }} --no-default-features --features vendored-openssl + run: cross build --release --locked --target ${{ matrix.target }} - name: Package run: | diff --git a/Cargo.lock b/Cargo.lock index 61f5eeb..c009534 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -855,15 +855,6 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" -[[package]] -name = "openssl-src" -version = "300.6.1+3.6.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846" -dependencies = [ - "cc", -] - [[package]] name = "openssl-sys" version = "0.9.117" @@ -872,7 +863,6 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" dependencies = [ "cc", "libc", - "openssl-src", "pkg-config", "vcpkg", ] diff --git a/Cargo.toml b/Cargo.toml index 9455537..4a9d454 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -55,9 +55,6 @@ rustls-tls = [ # support, such as the 32-bit PowerPC e500v2 in Turris 1.x routers. This is what # OpenWrt packaging wants: it reuses the libopenssl already in the image. native-tls = ["dep:hyper-tls", "dep:native-tls", "dep:tokio-native-tls"] -# As above, but builds OpenSSL from source and links it statically, for -# cross-compiling without the target's OpenSSL headers at hand. -vendored-openssl = ["native-tls", "native-tls/vendored"] [dependencies] anyhow = "1" diff --git a/README.md b/README.md index 69bc6ef..8e4a2e4 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,6 @@ a reproducible build date in `--version`. | --- | --- | --- | --- | | `rustls-tls` (default) | rustls + ring | none, statically linked | anything | | `native-tls` | system OpenSSL | libopenssl | anything OpenSSL builds for | -| `vendored-openssl` | OpenSSL built from source | none, statically linked | anything OpenSSL builds for | `ring` builds everywhere, falling back to portable C where it has no hand-written assembly, which is everything outside x86, x86_64, aarch64 and @@ -291,8 +290,8 @@ one chain and stops at the first step that fails: 2. **Checks** run [ci.yml](.github/workflows/ci.yml) against that commit: tests on three platforms, both TLS backends, the minimum supported Rust version, lint, the fuzz targets, the differential test against the Go - client and `cargo package`. Nothing is built or published until they - pass. + client and `cargo package`, and a tag with a known advisory in its + `Cargo.lock` stops too. Nothing is built or published until they pass. 3. **Package the crate** verifies the tag against `version` in `Cargo.toml` and builds the `.crate` once, recording its SHA-256. A tag that disagrees stops the run here, before a release exists to leave behind. diff --git a/deny.toml b/deny.toml index e3808c9..548223d 100644 --- a/deny.toml +++ b/deny.toml @@ -5,6 +5,7 @@ targets = [ "x86_64-unknown-linux-musl", "aarch64-unknown-linux-musl", "armv7-unknown-linux-musleabihf", + "arm-unknown-linux-musleabi", "powerpc-unknown-linux-musl", "x86_64-apple-darwin", "x86_64-pc-windows-msvc",