1#!/bin/sh 2 3config="$1" 4target="$2" 5 6PACKAGES="tmux" 7 8echo Running as: 9id 10 11echo Saving environment to runner-env.txt 12set >runner-env.txt 13 14 . .github/configs ${config} 15 16host=`./config.guess` 17echo "config.guess: $host" 18case "$host" in 19*cygwin) 20 PACKAGER=setup 21 echo Setting CYGWIN system environment variable. 22 setx CYGWIN "winsymlinks:native" 23 echo Removing extended ACLs on regress so umask works as expected. 24 echo "Original ACLs" 25 icacls regress 26 setfacl -b regress 27 icacls regress /c /t /q /grant 'BUILTIN\Administrators:(RX)' 28 echo "Modifiled ACLs" 29 icacls regress 30 31 echo Enabling OpenSSL rh-allow-sha1-signatures for unit tests. 32 cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak 33 cat >>/etc/pki/tls/openssl.cnf <<EOD 34[openssl_init] 35alg_section = evp_properties 36 37[evp_properties] 38rh-allow-sha1-signatures = yes 39EOD 40 openssl list -providers -provider legacy 41 printf "Test openssl signing with RSA+SHA1: " 42 openssl genpkey -quiet -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048 43 openssl pkey -in private_key.pem -pubout -out public_key.pem 44 if ! openssl dgst -sha1 -sign private_key.pem -out signature.sig public_key.pem; then 45 echo fail 46 echo "openssl could not sign with RSA+SHA1." 47 cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak regress/ 48 exit 1 49 else 50 echo success 51 fi 52 53 PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core" 54 PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel" 55 ;; 56*-darwin*) 57 PACKAGER=brew 58 PACKAGES="automake" 59 ;; 60*) 61 PACKAGER=apt 62esac 63 64TARGETS=${config} 65 66INSTALL_FIDO_PPA="no" 67export DEBIAN_FRONTEND=noninteractive 68 69set -e 70 71if [ -x "`which lsb_release 2>&1`" ]; then 72 lsb_release -a 73fi 74 75if [ ! -z "$SUDO" ]; then 76 # Ubuntu 22.04 defaults to private home dirs which prevent the 77 # agent-getpeerid test from running ssh-add as nobody. See 78 # https://github.com/actions/runner-images/issues/6106 79 if ! "$SUDO" -u nobody test -x ~; then 80 echo ~ is not executable by nobody, adding perms. 81 chmod go+x ~ 82 fi 83 # Some of the Mac OS X runners don't have a nopasswd sudo rule. Regular 84 # sudo still works, but sudo -u doesn't. Restore the sudo rule. 85 if ! "$SUDO" grep -E 'runner.*NOPASSWD' /etc/passwd >/dev/null; then 86 echo "Restoring runner nopasswd rule to sudoers." 87 echo 'runner ALL=(ALL) NOPASSWD: ALL' |$SUDO tee -a /etc/sudoers 88 fi 89 if ! "$SUDO" -u nobody -S test -x ~ </dev/null; then 90 echo "Still can't sudo to nobody." 91 exit 1 92 fi 93fi 94 95if [ "${TARGETS}" = "kitchensink" ]; then 96 TARGETS="krb5 libedit pam sk selinux" 97fi 98 99for flag in $CONFIGFLAGS; do 100 case "$flag" in 101 --with-pam) TARGETS="${TARGETS} pam" ;; 102 --with-libedit) TARGETS="${TARGETS} libedit" ;; 103 esac 104done 105 106echo "Setting up for '$TARGETS'" 107for TARGET in $TARGETS; do 108 case $TARGET in 109 default|without-openssl|without-zlib|c89) 110 # nothing to do 111 ;; 112 clang-sanitize*) 113 PACKAGES="$PACKAGES clang-12" 114 ;; 115 cygwin-release) 116 PACKAGES="$PACKAGES libcrypt-devel libfido2-devel libkrb5-devel" 117 ;; 118 gcc-sanitize*) 119 ;; 120 clang-*|gcc-*) 121 compiler=$(echo $TARGET | sed 's/-Werror//') 122 PACKAGES="$PACKAGES $compiler" 123 ;; 124 krb5) 125 PACKAGES="$PACKAGES libkrb5-dev libnss-wrapper krb5-admin-server" 126 ;; 127 heimdal) 128 PACKAGES="$PACKAGES heimdal-dev libnss-wrapper krb5-admin-server" 129 ;; 130 libedit) 131 case "$PACKAGER" in 132 setup) PACKAGES="$PACKAGES libedit-devel" ;; 133 apt) PACKAGES="$PACKAGES libedit-dev" ;; 134 esac 135 ;; 136 *pam) 137 case "$PACKAGER" in 138 apt) PACKAGES="$PACKAGES libpam0g-dev" ;; 139 esac 140 ;; 141 sk) 142 INSTALL_FIDO_PPA="yes" 143 PACKAGES="$PACKAGES libfido2-dev libu2f-host-dev libcbor-dev" 144 ;; 145 selinux) 146 PACKAGES="$PACKAGES libselinux1-dev selinux-policy-dev libaudit-dev" 147 ;; 148 hardenedmalloc) 149 INSTALL_HARDENED_MALLOC=yes 150 # Need clang >= 19 for constexpr. 151 PACKAGES="$PACKAGES clang-19" 152 ;; 153 musl) 154 PACKAGES="$PACKAGES musl-tools" 155 ;; 156 tcmalloc) 157 PACKAGES="$PACKAGES libgoogle-perftools-dev" 158 ;; 159 openssl-noec) 160 INSTALL_OPENSSL=OpenSSL_1_1_1k 161 SSLCONFOPTS="no-ec" 162 ;; 163 openssl-*) 164 INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-) 165 case ${INSTALL_OPENSSL} in 166 1.1.1_stable) INSTALL_OPENSSL="OpenSSL_1_1_1-stable" ;; 167 1.*) INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;; 168 master) ;; 169 *) INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;; 170 esac 171 PACKAGES="${PACKAGES} putty-tools dropbear-bin" 172 ;; 173 libressl-*) 174 INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-) 175 case ${INSTALL_LIBRESSL} in 176 master) ;; 177 *) INSTALL_LIBRESSL="$(echo ${TARGET} | cut -f2 -d-)" ;; 178 esac 179 PACKAGES="${PACKAGES} putty-tools dropbear-bin" 180 ;; 181 boringssl) 182 INSTALL_BORINGSSL=1 183 PACKAGES="${PACKAGES} cmake ninja-build" 184 ;; 185 aws-lc) 186 INSTALL_AWSLC=1 187 PACKAGES="${PACKAGES} cmake ninja-build" 188 ;; 189 dropbear-versions) 190 INSTALL_DROPBEAR=main 191 ;; 192 putty-*) 193 INSTALL_PUTTY=0.83 194 PACKAGES="${PACKAGES} cmake" 195 ;; 196 valgrind*) 197 PACKAGES="$PACKAGES valgrind" 198 ;; 199 zlib-*) 200 ;; 201 *) echo "Invalid option '${TARGET}'" 202 exit 1 203 ;; 204 esac 205done 206 207if [ "yes" = "$INSTALL_FIDO_PPA" ]; then 208 sudo apt update -qq 209 sudo apt install -qy software-properties-common 210 sudo apt-add-repository -y ppa:yubico/stable 211fi 212 213tries=3 214while [ ! -z "$PACKAGES" ] && [ "$tries" -gt "0" ]; do 215 case "$PACKAGER" in 216 apt) 217 sudo apt update -qq 218 if sudo apt install -qy $PACKAGES; then 219 PACKAGES="" 220 fi 221 ;; 222 brew) 223 if [ ! -z "PACKAGES" ]; then 224 if brew install $PACKAGES; then 225 PACKAGES="" 226 fi 227 fi 228 ;; 229 setup) 230 setup="/cygdrive/$(echo "${CYGWIN_SETUP}" | tr -d : | tr '\' '/')" 231 if "${setup}" -q -P `echo "$PACKAGES" | tr ' ' ,`; then 232 PACKAGES="" 233 fi 234 ;; 235 esac 236 if [ ! -z "$PACKAGES" ]; then 237 sleep 90 238 fi 239 tries=$(($tries - 1)) 240done 241if [ ! -z "$PACKAGES" ]; then 242 echo "Package installation failed." 243 exit 1 244fi 245 246if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then 247 (cd ${HOME} && 248 git clone https://github.com/GrapheneOS/hardened_malloc.git && 249 cd ${HOME}/hardened_malloc && 250 make CC=clang-19 && sudo cp out/libhardened_malloc.so /usr/lib/) 251fi 252 253if [ ! -z "${INSTALL_OPENSSL}" ]; then 254 .github/install_libcrypto.sh \ 255 "${INSTALL_OPENSSL}" /opt/openssl "${SSLCONFOPTS}" 256fi 257 258if [ ! -z "${INSTALL_LIBRESSL}" ]; then 259 if [ "${INSTALL_LIBRESSL}" = "master" ]; then 260 (mkdir -p ${HOME}/libressl && cd ${HOME}/libressl && 261 git clone https://github.com/libressl-portable/portable.git && 262 cd ${HOME}/libressl/portable && 263 git checkout ${INSTALL_LIBRESSL} && 264 sh update.sh && sh autogen.sh && 265 ./configure --prefix=/opt/libressl && 266 make && sudo make install) 267 else 268 LIBRESSL_URLBASE=https://cdn.openbsd.org/pub/OpenBSD/LibreSSL 269 (cd ${HOME} && 270 wget ${LIBRESSL_URLBASE}/libressl-${INSTALL_LIBRESSL}.tar.gz && 271 tar xfz libressl-${INSTALL_LIBRESSL}.tar.gz && 272 cd libressl-${INSTALL_LIBRESSL} && 273 ./configure --prefix=/opt/libressl && make && sudo make install) 274 fi 275fi 276 277if [ ! -z "${INSTALL_BORINGSSL}" ]; then 278 (cd ${HOME} && git clone https://boringssl.googlesource.com/boringssl && 279 cd ${HOME}/boringssl && mkdir build && cd build && 280 cmake -GNinja -DCMAKE_POSITION_INDEPENDENT_CODE=ON .. && ninja && 281 mkdir -p /opt/boringssl/lib && 282 cp ${HOME}/boringssl/build/libcrypto.a /opt/boringssl/lib && 283 cp -r ${HOME}/boringssl/include /opt/boringssl) 284fi 285 286if [ ! -z "${INSTALL_AWSLC}" ]; then 287 (cd ${HOME} && git clone --depth 1 --branch v1.46.1 https://github.com/aws/aws-lc.git && 288 cd ${HOME}/aws-lc && mkdir build && cd build && 289 cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF .. && ninja && 290 mkdir -p /opt/aws-lc/lib && 291 cp ${HOME}/aws-lc/build/crypto/libcrypto.a /opt/aws-lc/lib && 292 cp -r ${HOME}/aws-lc/include /opt/aws-lc) 293fi 294 295if [ ! -z "${INSTALL_ZLIB}" ]; then 296 (cd ${HOME} && git clone https://github.com/madler/zlib.git && 297 cd ${HOME}/zlib && ./configure && make && 298 sudo make install prefix=/opt/zlib) 299fi 300 301if [ ! -z "${INSTALL_DROPBEAR}" ]; then 302 .github/install_dropbear.sh "${INSTALL_DROPBEAR}" 303fi 304if [ ! -z "${INSTALL_PUTTY}" ]; then 305 .github/install_putty.sh "${INSTALL_PUTTY}" 306fi 307 308# If we're running on an ephemeral VM, set a random password and set 309# up to run the password auth test. 310if [ ! -z "${EPHEMERAL_VM}" ]; then 311 312 # This is the github "target" as specified in the yml file. 313 # In particular, ubuntu-latest sets the password field to the locked 314 # value, so unless we reset it here most of the tests will fail. 315 case "${target}" in 316 ubuntu-*) 317 echo ${target} target: setting random password. 318 openssl rand -base64 9 >regress/password 319 pw=$(tr -d '\n' <regress/password | openssl passwd -6 -stdin) 320 sudo usermod --password "${pw}" runner 321 sudo usermod --unlock runner 322 ;; 323 esac 324fi 325