gbucchino/openssh-portable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
01404fa5da11ed08c6ebecd09aaa3ebfbd79f206
openssh-portable/.github/workflows/vm.yml
T
Darren Tucker 01404fa5da Add script to lookup and pin Actions to hashes. 
Update recently changed Cygwin Actions and pin remaining unpinned ones.
2026-06-22 19:32:25 +10:00

518 lines
18 KiB
YAML
Raw Blame History

# For testing, you can set variables in your repo (Repo -> Settings ->
# Security -> Actions -> Variables) to restrict the tests that are run
# The supported variables are:
#
# RUN_ONLY_PLATFORM: run only tests on specified platform.
name: CI VM
on:
push:
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]
pull_request:
paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ]
jobs:
dragonflybsd:
name: "dragonflybsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'dragonflybsd')
strategy:
fail-fast: false
matrix:
target:
- "6.4.2"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start DragonFlyBSD ${{ matrix.target }} VM
uses: vmactions/dragonflybsd-vm@4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
timeout 600 pkg install -y sudo || pkg install -y sudo
pw useradd builder -m
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local
- name: make clean
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: dragonflybsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local --with-pam
- name: "PAM: make clean"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: dragonflybsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec"
shell: dragonflybsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make t-exec
freebsd:
name: "freebsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'freebsd')
strategy:
fail-fast: false
matrix:
target:
- "12.4"
- "13.5"
- "14.4"
- "15.0"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start FreeBSD ${{ matrix.target }} VM
uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
case $(uname -r) in
12.*)
timeout 600 ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz || \
ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz
tar xfz sudo-1.8.32.tar.gz
(cd sudo-1.8.32 && ./configure --sysconfdir=/usr/local/etc && make && make install)
;;
*)
timeout 600 pkg install -y sudo || pkg install -y sudo
;;
esac
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
pw useradd builder -m -h0 <$GITHUB_WORKSPACE/regress/password
chown builder $GITHUB_WORKSPACE/regress/password
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests SKIP_LTESTS=scp3
- name: "PAM: configure"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam --with-audit=bsm
- name: "PAM: make clean"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: freebsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec UsePAM=no"
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec SKIP_LTESTS=scp3
- name: "PAM: make t-exec UsePAM=yes"
shell: freebsd {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec SKIP_LTESTS=scp3
netbsd:
name: "netbsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'netbsd')
strategy:
fail-fast: false
matrix:
target:
- "9.0"
- "9.4"
- "10.0"
- "10.1"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start NetBSD ${{ matrix.target }} VM
uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1
with:
release: ${{ matrix.target }}
usesh: true
sync: scp
copyback: false
prepare: |
case "$(uname -r)" in
9.*) export PKG_PATH="ftp://ftp.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/9.0_2026Q1/All" ;;
esac
timeout 600 /usr/sbin/pkg_add sudo || /usr/sbin/pkg_add sudo
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | pwhash)
/usr/sbin/useradd -m -p "${pw}" builder
echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && /sbin/chown -R builder .
- name: configure
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: make tests
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
- name: "PAM: make clean"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: netbsd {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
- name: "PAM: make t-exec UsePAM=no"
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec
- name: "PAM: make t-exec UsePAM=yes"
shell: netbsd {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec
omnios:
name: "omnios-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'omnios')
strategy:
fail-fast: false
matrix:
target:
- "r151056-build"
- "r151058-build"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OmniOS ${{ matrix.target }} VM
uses: vmactions/omnios-vm@7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
set -x
if [ ! -x $(which gcc 2>/dev/null) ]; then
timeout 900 pfexec pkg refresh || pfexec pkg refresh
timeout 900 pfexec pkg install build-essential || pfexec pkg install build-essential
fi
useradd -m builder
sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
mv /tmp/sudoers /etc/sudoers
echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: omnios {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: make tests
shell: omnios {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder make tests
openbsd:
name: "openbsd-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd')
strategy:
fail-fast: false
matrix:
target:
- "7.3"
- "7.5"
- "7.6"
- "7.7"
- "7.8"
- "7.9"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OpenBSD ${{ matrix.target }} VM
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
useradd -m builder
echo "permit nopass keepenv root" >/etc/doas.conf
echo "permit nopass keepenv builder" >>/etc/doas.conf
ls -l /etc/doas.conf
chown root:wheel /etc/doas.conf
chmod 644 /etc/doas.conf
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
- name: make clean
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder make clean
- name: make
shell: openbsd {0}
run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
- name: make tests
shell: openbsd {0}
run: |
cd $GITHUB_WORKSPACE
doas -u builder env SUDO=doas make tests
openbsd-current-upstream:
# This job is special, and tests OpenBSD -current, both the underlying
# plaform (the latest snapshot) and most recent upstream code (or at least
# the most recent code in the github mirror) instead of OpenSSH Portable.
name: "openbsd-current-upstream"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd')
strategy:
fail-fast: false
runs-on: ubuntu-latest
steps:
- name: start OpenBSD VM
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
copyback: false
nat: |
"20022": "22"
usesh: true
prepare: |
timeout 600 pkg_add git || pkg_add git
useradd -g wobj -m builder
echo "permit nopass keepenv root" >/etc/doas.conf
echo "permit nopass keepenv builder" >>/etc/doas.conf
ls -l /etc/doas.conf
chown root:wheel /etc/doas.conf
chmod 644 /etc/doas.conf
touch /etc/ssh/ssh_known_hosts
- name: fetch sysupgrade version
run: |
ver=$(curl -s https://cdn.openbsd.org/pub/OpenBSD/snapshots/amd64/BUILDINFO)
echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV
- name: check for cached sysupgrade
id: cache-sysupgrade
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
- name: push sysupgrade from cache to VM
if: steps.cache-sysupgrade.outputs.cache-hit == 'true'
run: rsync -av /tmp/_sysupgrade/ openbsd:/home/_sysupgrade/
- name: upgrade to latest snapshot
run: ssh -q openbsd sysupgrade -s -k || true
- name: wait for upgrade
run: |
SECONDS=0; sleep 10; while ! ssh -q -oConnectTimeout=1 openbsd true; do sleep 10; echo waited ${SECONDS}s; done
ssh -q openbsd uname -a
- name: retrieve sysupgrade from VM to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
run: |
mkdir -p /tmp/_sysupgrade/
rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/
- name: save sysupgrade to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
- name: checkout upstream source
shell: openbsd {0}
run: |
umask 022
cd /usr
rm -rf src/*
git clone --no-checkout --depth=1 --filter=tree:0 https://github.com/openbsd/src.git
cd /usr/src
git sparse-checkout set --no-cone Makefile usr.bin/Makefile usr.bin/Makefile.inc usr.bin/ssh usr.bin/nc regress/usr.bin/ssh
git checkout
git log -n1
chown -R builder /usr/src
chmod -R go-w /usr/src/ /usr/obj/
- name: make ssh
shell: openbsd {0}
run: |
cd /usr/src/usr.bin/ssh && make -j4 || make
make install
/etc/rc.d/sshd restart
- name: make nc
shell: openbsd {0}
run: cd /usr/src/usr.bin/nc && make && make install
- name: make tests
shell: openbsd {0}
run: |
cd /usr/src/regress/usr.bin/ssh
make obj
doas -u builder env SUDO=doas TEST_SSH_UNSAFE_PERMISSIONS=yes TEST_SSH_FAIL_FATAL=yes TEST_SSH_HOSTBASED_AUTH=setupandrun make
- name: retrieve logs
if: failure()
run: |
rsync -a openbsd:/usr/obj/regress/usr.bin/ssh/ regress-logs/
for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done
- name: save logs
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: openbsd-current-upstream-logs
path: regress-logs/*.log
solaris:
name: "solaris-${{ matrix.target }}"
if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'solaris')
strategy:
fail-fast: false
matrix:
target:
- "11.4-gcc"
- "11.4-clang-19"
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start Solaris ${{ matrix.target }} VM
uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1
with:
release: ${{ matrix.target }}
usesh: true
prepare: |
echo Setting up user builder.
useradd -m builder
openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password
chown builder $GITHUB_WORKSPACE/regress/password
pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | openssl passwd -6 -stdin)
passwd -p "$pw" builder
echo Setting up sudo.
sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers
mv /tmp/sudoers /etc/sudoers
echo "builder ALL=(ALL) NOPASSWD: ALL" >/etc/sudoers.d/builder
echo 'Testing sudo config for root->builder.'
sudo -u builder id
echo 'Testing sudo config for builder->root.'
sudo -u builder sudo id
echo Creating directories.
mkdir -p /var/empty /usr/local/etc
cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
- name: set file perms
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && chown -R builder .
- name: configure
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
- name: make clean
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: make
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: make tests
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make tests
- name: "PAM: configure"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam
- name: "PAM: make clean"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
- name: "PAM: make"
shell: solaris {0}
run: cd $GITHUB_WORKSPACE && sudo -u builder make
- name: "PAM: make t-exec UsePAM=no"
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
sudo -u builder env SUDO=sudo make t-exec
- name: "PAM: make t-exec UsePAM=yes"
shell: solaris {0}
run: |
cd $GITHUB_WORKSPACE
cp regress/password regress/kbdintpw
sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec
Reference in New Issue View Git Blame Copy Permalink