Fix bug in OpenSSLAeadCipher with empty plaintext. #2961
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Continuous integration | |
| on: | |
| push: | |
| pull_request: | |
| schedule: | |
| # Run every day at midnight UTC | |
| - cron: '0 0 * * *' | |
| jobs: | |
| boringssl_clone: | |
| # This step ensures that all builders have the same version of BoringSSL | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Clone BoringSSL repo | |
| run: | | |
| git clone --depth 1 --filter=blob:none --no-checkout https://github.com/google/boringssl.git "${{ runner.temp }}/boringssl" | |
| echo Using BoringSSL commit: $(cd "${{ runner.temp }}/boringssl"; git rev-parse HEAD) | |
| - name: Archive BoringSSL source | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: boringssl-source | |
| path: ${{ runner.temp }}/boringssl | |
| retention-days: 1 | |
| include-hidden-files: true | |
| if-no-files-found: error | |
| clang_format_check: | |
| # Only run on pull requests. | |
| if: ${{ startsWith(github.ref, 'refs/pull/') }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Get git-clang-format | |
| # Uses the most recent clang-format on Ubuntu. | |
| run: | | |
| sudo apt-get -qq update | |
| sudo apt-get -qq install -y --no-install-recommends clang-format | |
| - name: Run git-clang-format against source branch | |
| run: | | |
| git clang-format --style=file --diff origin/$GITHUB_BASE_REF '*.c' '*.h' '*.cc' '*.cpp' '*.java' | |
| build: | |
| needs: boringssl_clone | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [ubuntu-latest, macos-latest, windows-latest] | |
| include: | |
| - platform: ubuntu-latest | |
| tools_url: https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip | |
| - platform: macos-latest | |
| tools_url: https://dl.google.com/android/repository/commandlinetools-mac-9477386_latest.zip | |
| - platform: windows-latest | |
| tools_url: https://dl.google.com/android/repository/commandlinetools-win-9477386_latest.zip | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Set up JDK 11 for toolchains | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'zulu' | |
| java-version: 11 | |
| - name: Set runner-specific environment variables | |
| shell: bash | |
| run: | | |
| echo "ANDROID_HOME=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV | |
| echo "ANDROID_SDK_ROOT=${{ runner.temp }}/android-sdk" >> $GITHUB_ENV | |
| echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV | |
| echo "SDKMANAGER=${{ runner.temp }}/android-sdk/cmdline-tools/bin/sdkmanager" >> $GITHUB_ENV | |
| echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV | |
| - uses: actions/checkout@v4 | |
| - name: Setup Linux environment | |
| if: runner.os == 'Linux' | |
| run: | | |
| echo "CC=clang" >> $GITHUB_ENV | |
| echo "CXX=clang++" >> $GITHUB_ENV | |
| sudo dpkg --add-architecture i386 | |
| sudo add-apt-repository ppa:openjdk-r/ppa | |
| sudo apt-get -qq update | |
| sudo apt-get -qq install -y --no-install-recommends \ | |
| gcc-multilib \ | |
| g++-multilib \ | |
| ninja-build \ | |
| openjdk-11-jre-headless | |
| - name: Setup macOS environment | |
| if: runner.os == 'macOS' | |
| run: | | |
| brew update || echo update failed | |
| brew install ninja || echo update failed | |
| - name: Setup Windows environment | |
| if: runner.os == 'Windows' | |
| run: | | |
| choco install nasm -y | |
| choco install ninja -y | |
| - name: Fetch BoringSSL source | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: boringssl-source | |
| path: ${{ runner.temp }}/boringssl | |
| - name: Checkout BoringSSL master branch | |
| shell: bash | |
| run: | | |
| cd "$BORINGSSL_HOME" | |
| git checkout --progress --force -B master | |
| - name: Build BoringSSL x86 and ARM MacOS | |
| if: runner.os == 'macOS' | |
| env: | |
| # For compatibility, but 10.15 target requires 16-byte stack alignment. | |
| MACOSX_DEPLOYMENT_TARGET: 10.13 | |
| run: | | |
| mkdir -p "$BORINGSSL_HOME/build.x86" | |
| pushd "$BORINGSSL_HOME/build.x86" | |
| cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=x86_64 -GNinja .. | |
| ninja | |
| popd | |
| mkdir -p "$BORINGSSL_HOME/build.arm" | |
| pushd "$BORINGSSL_HOME/build.arm" | |
| cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=arm64 -GNinja .. | |
| ninja | |
| popd | |
| - name: Build BoringSSL 64-bit Linux | |
| if: runner.os == 'Linux' | |
| run: | | |
| mkdir -p "$BORINGSSL_HOME/build64" | |
| pushd "$BORINGSSL_HOME/build64" | |
| cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja .. | |
| ninja | |
| popd | |
| - name: Set up MSVC paths on Windows | |
| if: runner.os == 'Windows' | |
| uses: ilammy/msvc-dev-cmd@v1 | |
| with: | |
| arch: x64 | |
| - name: Build BoringSSL 64-bit Windows | |
| if: runner.os == 'Windows' | |
| run: | | |
| cd $Env:BORINGSSL_HOME | |
| mkdir build64 | |
| pushd build64 | |
| cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded -GNinja .. | |
| ninja | |
| popd | |
| - name: Setup Android environment | |
| shell: bash | |
| if: runner.os == 'Linux' | |
| run: | | |
| cd "${{ runner.temp }}" | |
| curl -L "${{ matrix.tools_url }}" -o android-tools.zip | |
| mkdir -p "$ANDROID_HOME" | |
| unzip -q android-tools.zip -d "$ANDROID_HOME" | |
| yes | "$SDKMANAGER" --sdk_root="$ANDROID_HOME" --licenses || true | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" tools | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" platform-tools | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'build-tools;30.0.3' | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'platforms;android-26' | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'extras;android;m2repository' | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'ndk;25.2.9519653' | |
| "$SDKMANAGER" --sdk_root="$ANDROID_HOME" 'cmake;3.22.1' | |
| - name: Build with Gradle | |
| shell: bash | |
| run: ./gradlew assemble -PcheckErrorQueue | |
| - name: Test with Gradle | |
| shell: bash | |
| timeout-minutes: 15 | |
| run: ./gradlew check -PcheckErrorQueue | |
| - name: Publish to local Maven repo | |
| shell: bash | |
| run: ./gradlew publishToMavenLocal -Dmaven.repo.local="$M2_REPO" | |
| - name: Upload Maven respository | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: m2repo-${{ runner.os }} | |
| path: ${{ runner.temp }}/m2 | |
| - name: Build test JAR with dependencies | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: ./gradlew :conscrypt-openjdk:testJar -PcheckErrorQueue | |
| - name: Upload test JAR with dependencies | |
| if: runner.os == 'Linux' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: testjar | |
| path: openjdk/build/libs/conscrypt-openjdk-*-tests.jar | |
| if-no-files-found: error | |
| uberjar: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Linux environment | |
| run: | | |
| echo "CC=clang" >> $GITHUB_ENV | |
| echo "CXX=clang++" >> $GITHUB_ENV | |
| sudo dpkg --add-architecture i386 | |
| sudo add-apt-repository ppa:openjdk-r/ppa | |
| sudo apt-get -qq update | |
| sudo apt-get -qq install -y --no-install-recommends \ | |
| gcc-multilib \ | |
| g++-multilib \ | |
| ninja-build \ | |
| openjdk-11-jre-headless | |
| - name: Set runner-specific environment variables | |
| shell: bash | |
| run: | | |
| echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV | |
| echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV | |
| - name: Fetch BoringSSL source | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: boringssl-source | |
| path: ${{ runner.temp }}/boringssl | |
| - name: Checkout BoringSSL master branch | |
| shell: bash | |
| run: | | |
| cd "$BORINGSSL_HOME" | |
| git checkout --progress --force -B master | |
| - name: Build BoringSSL 64-bit Linux | |
| run: | | |
| mkdir -p "$BORINGSSL_HOME/build64" | |
| pushd "$BORINGSSL_HOME/build64" | |
| cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja .. | |
| ninja | |
| popd | |
| # TODO(prb) remove build dependency above and go back to this. | |
| # - name: Make fake BoringSSL directories | |
| # shell: bash | |
| # run: | | |
| # # TODO: remove this when the check is only performed when building. | |
| # # BoringSSL is not needed during the UberJAR build, but the | |
| # # assertion to check happens regardless of whether the project | |
| # # needs it. | |
| # mkdir -p "${{ runner.temp }}/boringssl/build64" | |
| # mkdir -p "${{ runner.temp }}/boringssl/include" | |
| - name: Download Maven repository for Linux | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: m2repo-Linux | |
| path: ${{ runner.temp }}/m2 | |
| - name: Download Maven repository for MacOS | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: m2repo-macOS | |
| path: ${{ runner.temp }}/m2 | |
| - name: Download Maven repository for Windows | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: m2repo-Windows | |
| path: ${{ runner.temp }}/m2 | |
| - name: Build UberJAR with Gradle | |
| shell: bash | |
| run: | | |
| ./gradlew :conscrypt-openjdk-uber:build -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO" | |
| - name: Publish UberJAR to Maven Local | |
| shell: bash | |
| run: | | |
| ./gradlew :conscrypt-openjdk-uber:publishToMavenLocal -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO" | |
| - name: Upload Maven respository | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: m2repo-uber | |
| path: ${{ runner.temp }}/m2 | |
| openjdk-test: | |
| needs: uberjar | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [ubuntu-latest, macos-13, macos-latest, windows-latest] | |
| java: [8, 11, 17, 21] | |
| dist: ['temurin', 'zulu'] | |
| include: | |
| - platform: ubuntu-latest | |
| separator: ':' | |
| - platform: macos-latest | |
| separator: ':' | |
| - platform: macos-13 | |
| separator: ':' | |
| - platform: windows-latest | |
| separator: ';' | |
| exclude: # Not available on Github runners | |
| - platform: macos-latest | |
| java: 8 | |
| dist: 'temurin' | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: ${{ matrix.dist }} | |
| java-version: ${{ matrix.java }} | |
| - name: Download UberJAR | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: m2repo-uber | |
| path: m2 | |
| - name: Download Test JAR with Dependencies | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: testjar | |
| path: testjar | |
| - name: Download JUnit runner | |
| shell: bash | |
| run: mvn org.apache.maven.plugins:maven-dependency-plugin:3.8.0:copy -Dartifact=org.junit.platform:junit-platform-console-standalone:1.11.2 -DoutputDirectory=. -Dmdep.stripVersion=true | |
| - name: Run JUnit tests | |
| timeout-minutes: 15 | |
| shell: bash | |
| run: | | |
| DIR="$(find m2/org/conscrypt/conscrypt-openjdk-uber -maxdepth 1 -mindepth 1 -type d -print)" | |
| VERSION="${DIR##*/}" | |
| TESTJAR="$(find testjar -name '*-tests.jar')" | |
| # SIGTERM handler, e.g. for when tests hang and time out. | |
| # Send SIGQUIT to test process to get thread dump, give it | |
| # a few seconds to complete and then kill it. | |
| dump_threads() { | |
| echo "Generating stack dump." | |
| ps -fp "$TESTPID" | |
| kill -QUIT "$TESTPID" | |
| sleep 3 | |
| kill -KILL "$TESTPID" | |
| exit 1 | |
| } | |
| java -jar junit-platform-console-standalone.jar execute -cp "$DIR/conscrypt-openjdk-uber-$VERSION.jar${{ matrix.separator }}$TESTJAR" -n='org.conscrypt.ConscryptOpenJdkSuite' --scan-classpath --reports-dir=results --fail-if-no-tests & | |
| case $(uname -s) in | |
| Darwin|Linux) | |
| trap dump_threads SIGTERM SIGINT | |
| ;; | |
| *) | |
| # TODO: Probably won't work on Windows but thread dumps | |
| # work there already. | |
| ;; | |
| esac | |
| TESTPID=$! | |
| wait "$TESTPID" | |
| - name: Archive test results | |
| if: ${{ always() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-results-${{ matrix.platform }}-${{ matrix.java }}-${{ matrix.dist }} | |
| path: results |