xref: /freebsd/crypto/openssh/.github/setup_ci.sh (revision 2574974648c68c738aec3ff96644d888d7913a37) 
1#!/bin/sh
2
3config="$1"
4target="$2"
5
6PACKAGES="tmux"
7
8echo Running as:
9id
10
11echo Environment:
12set
13
14 . .github/configs ${config}
15
16host=`./config.guess`
17echo "config.guess: $host"
18case "$host" in
19*cygwin)
20	PACKAGER=setup
21	echo Setting CYGWIN system environment variable.
22	setx CYGWIN "winsymlinks:native"
23	echo Removing extended ACLs so umask works as expected.
24	set -x
25	setfacl -b . regress
26	icacls regress /c /t /q /Inheritance:d
27	icacls regress /c /t /q /Grant ${USERNAME}:F
28	icacls regress /c /t /q /Remove:g "Authenticated Users" \
29	     BUILTIN\\Administrators BUILTIN Everyone System Users
30	takeown /F regress
31	icacls regress
32	set +x
33	PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
34	PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel"
35	;;
36*-darwin*)
37	PACKAGER=brew
38	PACKAGES="automake"
39	;;
40*)
41	PACKAGER=apt
42esac
43
44TARGETS=${config}
45
46INSTALL_FIDO_PPA="no"
47export DEBIAN_FRONTEND=noninteractive
48
49set -e
50
51if [ -x "`which lsb_release 2>&1`" ]; then
52	lsb_release -a
53fi
54
55if [ ! -z "$SUDO" ]; then
56	# Ubuntu 22.04 defaults to private home dirs which prevent the
57	# agent-getpeerid test from running ssh-add as nobody.  See
58	# https://github.com/actions/runner-images/issues/6106
59	if ! "$SUDO" -u nobody test -x ~; then
60		echo ~ is not executable by nobody, adding perms.
61		chmod go+x ~
62	fi
63	# Some of the Mac OS X runners don't have a nopasswd sudo rule. Regular
64	# sudo still works, but sudo -u doesn't.  Restore the sudo rule.
65	if ! "$SUDO" grep  -E 'runner.*NOPASSWD' /etc/passwd >/dev/null; then
66		echo "Restoring runner nopasswd rule to sudoers."
67		echo 'runner ALL=(ALL) NOPASSWD: ALL' |$SUDO tee -a /etc/sudoers
68	fi
69	if ! "$SUDO" -u nobody -S test -x ~ </dev/null; then
70		echo "Still can't sudo to nobody."
71		exit 1
72	fi
73fi
74
75if [ "${TARGETS}" = "kitchensink" ]; then
76	TARGETS="krb5 libedit pam sk selinux"
77fi
78
79for flag in $CONFIGFLAGS; do
80    case "$flag" in
81    --with-pam)		TARGETS="${TARGETS} pam" ;;
82    --with-libedit)	TARGETS="${TARGETS} libedit" ;;
83    esac
84done
85
86echo "Setting up for '$TARGETS'"
87for TARGET in $TARGETS; do
88    case $TARGET in
89    default|without-openssl|without-zlib|c89)
90        # nothing to do
91        ;;
92    clang-sanitize*)
93        PACKAGES="$PACKAGES clang-12"
94        ;;
95    cygwin-release)
96        PACKAGES="$PACKAGES libcrypt-devel libfido2-devel libkrb5-devel"
97        ;;
98    gcc-sanitize*)
99        ;;
100    clang-*|gcc-*)
101        compiler=$(echo $TARGET | sed 's/-Werror//')
102        PACKAGES="$PACKAGES $compiler"
103        ;;
104    krb5)
105        PACKAGES="$PACKAGES libkrb5-dev libnss-wrapper krb5-admin-server"
106	;;
107    heimdal)
108        PACKAGES="$PACKAGES heimdal-dev libnss-wrapper krb5-admin-server"
109        ;;
110    libedit)
111	case "$PACKAGER" in
112	setup)	PACKAGES="$PACKAGES libedit-devel" ;;
113	apt)	PACKAGES="$PACKAGES libedit-dev" ;;
114	esac
115        ;;
116    *pam)
117	case "$PACKAGER" in
118	apt)	PACKAGES="$PACKAGES libpam0g-dev" ;;
119	esac
120        ;;
121    sk)
122        INSTALL_FIDO_PPA="yes"
123        PACKAGES="$PACKAGES libfido2-dev libu2f-host-dev libcbor-dev"
124        ;;
125    selinux)
126        PACKAGES="$PACKAGES libselinux1-dev selinux-policy-dev libaudit-dev"
127        ;;
128    hardenedmalloc)
129        INSTALL_HARDENED_MALLOC=yes
130        ;;
131    musl)
132	PACKAGES="$PACKAGES musl-tools"
133	;;
134    tcmalloc)
135        PACKAGES="$PACKAGES libgoogle-perftools-dev"
136        ;;
137    openssl-noec)
138	INSTALL_OPENSSL=OpenSSL_1_1_1k
139	SSLCONFOPTS="no-ec"
140	;;
141    openssl-*)
142        INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-)
143        case ${INSTALL_OPENSSL} in
144          1.1.1_stable)	INSTALL_OPENSSL="OpenSSL_1_1_1-stable" ;;
145          1.*)	INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;;
146          3.*)	INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;;
147        esac
148        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
149       ;;
150    libressl-*)
151        INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-)
152        case ${INSTALL_LIBRESSL} in
153          master) ;;
154          *) INSTALL_LIBRESSL="$(echo ${TARGET} | cut -f2 -d-)" ;;
155        esac
156        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
157       ;;
158    boringssl)
159        INSTALL_BORINGSSL=1
160        PACKAGES="${PACKAGES} cmake ninja-build"
161       ;;
162    aws-lc)
163        INSTALL_AWSLC=1
164        PACKAGES="${PACKAGES} cmake ninja-build"
165        ;;
166    putty-*)
167	INSTALL_PUTTY=0.83
168	PACKAGES="${PACKAGES} cmake"
169	;;
170    valgrind*)
171       PACKAGES="$PACKAGES valgrind"
172       ;;
173    zlib-*)
174       ;;
175    *) echo "Invalid option '${TARGET}'"
176        exit 1
177        ;;
178    esac
179done
180
181if [ "yes" = "$INSTALL_FIDO_PPA" ]; then
182    sudo apt update -qq
183    sudo apt install -qy software-properties-common
184    sudo apt-add-repository -y ppa:yubico/stable
185fi
186
187tries=3
188while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do
189    case "$PACKAGER" in
190    apt)
191	sudo apt update -qq
192	if sudo apt install -qy $PACKAGES; then
193		PACKAGES=""
194	fi
195	;;
196    brew)
197	if [ ! -z "PACKAGES" ]; then
198		if brew install $PACKAGES; then
199			PACKAGES=""
200		fi
201	fi
202	;;
203    setup)
204	setup="/cygdrive/$(echo "${CYGWIN_SETUP}" | tr -d : | tr '\' '/')"
205	if "${setup}" -q -P `echo "$PACKAGES" | tr ' ' ,`; then
206		PACKAGES=""
207	fi
208	;;
209    esac
210    if [ ! -z "$PACKAGES" ]; then
211	sleep 90
212    fi
213    tries=$(($tries - 1))
214done
215if [ ! -z "$PACKAGES" ]; then
216	echo "Package installation failed."
217	exit 1
218fi
219
220if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then
221    (cd ${HOME} &&
222     git clone https://github.com/GrapheneOS/hardened_malloc.git &&
223     cd ${HOME}/hardened_malloc &&
224     make && sudo cp out/libhardened_malloc.so /usr/lib/)
225fi
226
227if [ ! -z "${INSTALL_OPENSSL}" ]; then
228	.github/install_libcrypto.sh \
229	    "${INSTALL_OPENSSL}" /opt/openssl "${SSLCONFOPTS}"
230fi
231
232if [ ! -z "${INSTALL_LIBRESSL}" ]; then
233    if [ "${INSTALL_LIBRESSL}" = "master" ]; then
234        (mkdir -p ${HOME}/libressl && cd ${HOME}/libressl &&
235         git clone https://github.com/libressl-portable/portable.git &&
236         cd ${HOME}/libressl/portable &&
237         git checkout ${INSTALL_LIBRESSL} &&
238         sh update.sh && sh autogen.sh &&
239         ./configure --prefix=/opt/libressl &&
240         make && sudo make install)
241    else
242        LIBRESSL_URLBASE=https://cdn.openbsd.org/pub/OpenBSD/LibreSSL
243        (cd ${HOME} &&
244         wget ${LIBRESSL_URLBASE}/libressl-${INSTALL_LIBRESSL}.tar.gz &&
245         tar xfz libressl-${INSTALL_LIBRESSL}.tar.gz &&
246         cd libressl-${INSTALL_LIBRESSL} &&
247         ./configure --prefix=/opt/libressl && make && sudo make install)
248    fi
249fi
250
251if [ ! -z "${INSTALL_BORINGSSL}" ]; then
252    (cd ${HOME} && git clone https://boringssl.googlesource.com/boringssl &&
253     cd ${HOME}/boringssl && mkdir build && cd build &&
254     cmake -GNinja  -DCMAKE_POSITION_INDEPENDENT_CODE=ON .. && ninja &&
255     mkdir -p /opt/boringssl/lib &&
256     cp ${HOME}/boringssl/build/libcrypto.a /opt/boringssl/lib &&
257     cp -r ${HOME}/boringssl/include /opt/boringssl)
258fi
259
260if [ ! -z "${INSTALL_AWSLC}" ]; then
261    (cd ${HOME} && git clone --depth 1 --branch v1.46.1 https://github.com/aws/aws-lc.git &&
262     cd ${HOME}/aws-lc && mkdir build && cd build &&
263     cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF .. && ninja &&
264     mkdir -p /opt/aws-lc/lib &&
265     cp ${HOME}/aws-lc/build/crypto/libcrypto.a /opt/aws-lc/lib &&
266     cp -r ${HOME}/aws-lc/include /opt/aws-lc)
267fi
268
269if [ ! -z "${INSTALL_ZLIB}" ]; then
270    (cd ${HOME} && git clone https://github.com/madler/zlib.git &&
271     cd ${HOME}/zlib && ./configure && make &&
272     sudo make install prefix=/opt/zlib)
273fi
274
275if [ ! -z "${INSTALL_PUTTY}" ]; then
276	.github/install_putty.sh "${INSTALL_PUTTY}"
277fi
278
279# If we're running on an ephemeral VM, set a random password and set
280# up to run the password auth test.
281if [ ! -z "${EPHEMERAL_VM}" ]; then
282
283    # This is the github "target" as specified in the yml file.
284    # In particular, ubuntu-latest sets the password field to the locked
285    # value, so unless we reset it here most of the tests will fail.
286    case "${target}" in
287    ubuntu-*)
288	echo ${target} target: setting random password.
289	openssl rand -base64 9 >regress/password
290	pw=$(tr -d '\n' <regress/password | openssl passwd -6 -stdin)
291	sudo usermod --password "${pw}" runner
292	sudo usermod --unlock runner
293	;;
294    esac
295fi
296