1# For testing, you can set variables in your repo (Repo -> Settings -> 2# Security -> Actions -> Variables) to restrict the tests that are run 3# The supported variables are: 4# 5# RUN_ONLY_PLATFORM: run only tests on specified platform. 6 7name: CI VM 8on: 9 push: 10 paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ] 11 pull_request: 12 paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', '.github/configs', '.github/workflows/vm.yml' ] 13 14jobs: 15 dragonflybsd: 16 name: "dragonflybsd-${{ matrix.target }}" 17 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'dragonflybsd') 18 strategy: 19 fail-fast: false 20 matrix: 21 target: 22 - "6.4.2" 23 config: [default] 24 runs-on: ubuntu-latest 25 steps: 26 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 27 - name: autoreconf 28 run: sh -c autoreconf 29 30 - name: start DragonFlyBSD ${{ matrix.target }} VM 31 uses: vmactions/dragonflybsd-vm@4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1 32 with: 33 release: ${{ matrix.target }} 34 usesh: true 35 prepare: | 36 timeout 600 pkg install -y sudo || pkg install -y sudo 37 pw useradd builder -m 38 echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers 39 mkdir -p /var/empty /usr/local/etc 40 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 41 42 - name: set file perms 43 shell: dragonflybsd {0} 44 run: cd $GITHUB_WORKSPACE && chown -R builder . 45 - name: configure 46 shell: dragonflybsd {0} 47 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local 48 - name: make clean 49 shell: dragonflybsd {0} 50 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 51 - name: make 52 shell: dragonflybsd {0} 53 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 54 - name: make tests 55 shell: dragonflybsd {0} 56 run: | 57 cd $GITHUB_WORKSPACE 58 sudo -u builder env SUDO=sudo make tests 59 60 - name: "PAM: configure" 61 shell: dragonflybsd {0} 62 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-ssl-dir=/usr/local --with-pam 63 - name: "PAM: make clean" 64 shell: dragonflybsd {0} 65 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 66 - name: "PAM: make" 67 shell: dragonflybsd {0} 68 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 69 - name: "PAM: make t-exec" 70 shell: dragonflybsd {0} 71 run: | 72 cd $GITHUB_WORKSPACE 73 sudo -u builder env SUDO=sudo SSHD_CONFOPTS="UsePam yes" make t-exec 74 75 freebsd: 76 name: "freebsd-${{ matrix.target }}" 77 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'freebsd') 78 strategy: 79 fail-fast: false 80 matrix: 81 target: 82 - "12.4" 83 - "13.5" 84 - "14.4" 85 - "15.0" 86 config: [default] 87 runs-on: ubuntu-latest 88 steps: 89 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 90 - name: autoreconf 91 run: sh -c autoreconf 92 93 - name: start FreeBSD ${{ matrix.target }} VM 94 uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1 95 with: 96 release: ${{ matrix.target }} 97 usesh: true 98 prepare: | 99 case $(uname -r) in 100 12.*) 101 timeout 600 ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz || \ 102 ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz 103 tar xfz sudo-1.8.32.tar.gz 104 (cd sudo-1.8.32 && ./configure --sysconfdir=/usr/local/etc && make && make install) 105 ;; 106 *) 107 timeout 600 pkg install -y sudo || pkg install -y sudo 108 ;; 109 esac 110 openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password 111 pw useradd builder -m -h0 <$GITHUB_WORKSPACE/regress/password 112 chown builder $GITHUB_WORKSPACE/regress/password 113 echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers 114 mkdir -p /var/empty /usr/local/etc 115 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 116 117 - name: set file perms 118 shell: freebsd {0} 119 run: cd $GITHUB_WORKSPACE && chown -R builder . 120 - name: configure 121 shell: freebsd {0} 122 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure 123 - name: make clean 124 shell: freebsd {0} 125 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 126 - name: make 127 shell: freebsd {0} 128 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 129 - name: make tests 130 shell: freebsd {0} 131 run: | 132 cd $GITHUB_WORKSPACE 133 sudo -u builder env SUDO=sudo make tests SKIP_LTESTS=scp3 134 135 - name: "PAM: configure" 136 shell: freebsd {0} 137 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam --with-audit=bsm 138 - name: "PAM: make clean" 139 shell: freebsd {0} 140 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 141 - name: "PAM: make" 142 shell: freebsd {0} 143 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 144 - name: "PAM: make t-exec UsePAM=no" 145 shell: freebsd {0} 146 run: | 147 cd $GITHUB_WORKSPACE 148 sudo -u builder env SUDO=sudo make t-exec SKIP_LTESTS=scp3 149 - name: "PAM: make t-exec UsePAM=yes" 150 shell: freebsd {0} 151 run: | 152 cd $GITHUB_WORKSPACE 153 cp regress/password regress/kbdintpw 154 sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec SKIP_LTESTS=scp3 155 156 157 netbsd: 158 name: "netbsd-${{ matrix.target }}" 159 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'netbsd') 160 strategy: 161 fail-fast: false 162 matrix: 163 target: 164 - "9.0" 165 - "9.4" 166 - "10.0" 167 - "10.1" 168 config: [default] 169 runs-on: ubuntu-latest 170 steps: 171 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 172 - name: autoreconf 173 run: sh -c autoreconf 174 175 - name: start NetBSD ${{ matrix.target }} VM 176 uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1 177 with: 178 release: ${{ matrix.target }} 179 usesh: true 180 sync: scp 181 copyback: false 182 prepare: | 183 case "$(uname -r)" in 184 9.*) export PKG_PATH="ftp://ftp.NetBSD.org/pub/pkgsrc/packages/NetBSD/$(uname -p)/9.0_2026Q1/All" ;; 185 esac 186 timeout 600 /usr/sbin/pkg_add sudo || /usr/sbin/pkg_add sudo 187 openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password 188 pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | pwhash) 189 /usr/sbin/useradd -m -p "${pw}" builder 190 echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers 191 mkdir -p /var/empty /usr/local/etc 192 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 193 194 - name: set file perms 195 shell: netbsd {0} 196 run: cd $GITHUB_WORKSPACE && /sbin/chown -R builder . 197 - name: configure 198 shell: netbsd {0} 199 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure 200 - name: make clean 201 shell: netbsd {0} 202 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 203 - name: make 204 shell: netbsd {0} 205 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 206 - name: make tests 207 shell: netbsd {0} 208 run: | 209 cd $GITHUB_WORKSPACE 210 sudo -u builder env SUDO=sudo make tests 211 212 - name: "PAM: configure" 213 shell: netbsd {0} 214 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam 215 - name: "PAM: make clean" 216 shell: netbsd {0} 217 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 218 - name: "PAM: make" 219 shell: netbsd {0} 220 run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4 221 - name: "PAM: make t-exec UsePAM=no" 222 shell: netbsd {0} 223 run: | 224 cd $GITHUB_WORKSPACE 225 sudo -u builder env SUDO=sudo make t-exec 226 - name: "PAM: make t-exec UsePAM=yes" 227 shell: netbsd {0} 228 run: | 229 cd $GITHUB_WORKSPACE 230 cp regress/password regress/kbdintpw 231 sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec 232 233 234 omnios: 235 name: "omnios-${{ matrix.target }}" 236 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'omnios') 237 strategy: 238 fail-fast: false 239 matrix: 240 target: 241 - "r151056-build" 242 - "r151058-build" 243 config: [default] 244 runs-on: ubuntu-latest 245 steps: 246 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 247 - name: autoreconf 248 run: sh -c autoreconf 249 250 - name: start OmniOS ${{ matrix.target }} VM 251 uses: vmactions/omnios-vm@7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1 252 with: 253 release: ${{ matrix.target }} 254 usesh: true 255 prepare: | 256 set -x 257 if [ ! -x $(which gcc 2>/dev/null) ]; then 258 timeout 900 pfexec pkg refresh || pfexec pkg refresh 259 timeout 900 pfexec pkg install build-essential || pfexec pkg install build-essential 260 fi 261 useradd -m builder 262 sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers 263 mv /tmp/sudoers /etc/sudoers 264 echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers 265 mkdir -p /var/empty /usr/local/etc 266 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 267 268 - name: set file perms 269 shell: omnios {0} 270 run: cd $GITHUB_WORKSPACE && chown -R builder . 271 - name: configure 272 shell: omnios {0} 273 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure 274 - name: make clean 275 shell: omnios {0} 276 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 277 - name: make 278 shell: omnios {0} 279 run: cd $GITHUB_WORKSPACE && sudo -u builder make 280 - name: make tests 281 shell: omnios {0} 282 run: | 283 cd $GITHUB_WORKSPACE 284 sudo -u builder make tests 285 286 287 openbsd: 288 name: "openbsd-${{ matrix.target }}" 289 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd') 290 strategy: 291 fail-fast: false 292 matrix: 293 target: 294 - "7.3" 295 - "7.5" 296 - "7.6" 297 - "7.7" 298 - "7.8" 299 - "7.9" 300 config: [default] 301 runs-on: ubuntu-latest 302 steps: 303 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 304 - name: autoreconf 305 run: sh -c autoreconf 306 307 - name: start OpenBSD ${{ matrix.target }} VM 308 uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1 309 with: 310 release: ${{ matrix.target }} 311 usesh: true 312 prepare: | 313 useradd -m builder 314 echo "permit nopass keepenv root" >/etc/doas.conf 315 echo "permit nopass keepenv builder" >>/etc/doas.conf 316 ls -l /etc/doas.conf 317 chown root:wheel /etc/doas.conf 318 chmod 644 /etc/doas.conf 319 mkdir -p /var/empty /usr/local/etc 320 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 321 322 - name: set file perms 323 shell: openbsd {0} 324 run: cd $GITHUB_WORKSPACE && chown -R builder . 325 - name: configure 326 shell: openbsd {0} 327 run: cd $GITHUB_WORKSPACE && doas -u builder ./configure 328 - name: make clean 329 shell: openbsd {0} 330 run: cd $GITHUB_WORKSPACE && doas -u builder make clean 331 - name: make 332 shell: openbsd {0} 333 run: cd $GITHUB_WORKSPACE && doas -u builder make -j4 334 - name: make tests 335 shell: openbsd {0} 336 run: | 337 cd $GITHUB_WORKSPACE 338 doas -u builder env SUDO=doas make tests 339 340 341 openbsd-current-upstream: 342 # This job is special, and tests OpenBSD -current, both the underlying 343 # plaform (the latest snapshot) and most recent upstream code (or at least 344 # the most recent code in the github mirror) instead of OpenSSH Portable. 345 name: "openbsd-current-upstream" 346 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'openbsd') 347 strategy: 348 fail-fast: false 349 runs-on: ubuntu-latest 350 steps: 351 - name: start OpenBSD VM 352 uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1 353 with: 354 copyback: false 355 nat: | 356 "20022": "22" 357 usesh: true 358 prepare: | 359 timeout 600 pkg_add git || pkg_add git 360 useradd -g wobj -m builder 361 echo "permit nopass keepenv root" >/etc/doas.conf 362 echo "permit nopass keepenv builder" >>/etc/doas.conf 363 ls -l /etc/doas.conf 364 chown root:wheel /etc/doas.conf 365 chmod 644 /etc/doas.conf 366 touch /etc/ssh/ssh_known_hosts 367 368 - name: fetch sysupgrade version 369 run: | 370 ver=$(curl -s https://cdn.openbsd.org/pub/OpenBSD/snapshots/amd64/BUILDINFO) 371 echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV 372 - name: check for cached sysupgrade 373 id: cache-sysupgrade 374 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 375 with: 376 key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} 377 path: /tmp/_sysupgrade/ 378 - name: push sysupgrade from cache to VM 379 if: steps.cache-sysupgrade.outputs.cache-hit == 'true' 380 run: rsync -av /tmp/_sysupgrade/ openbsd:/home/_sysupgrade/ 381 - name: upgrade to latest snapshot 382 run: ssh -q openbsd sysupgrade -s -k || true 383 - name: wait for upgrade 384 run: | 385 SECONDS=0; sleep 10; while ! ssh -q -oConnectTimeout=1 openbsd true; do sleep 10; echo waited ${SECONDS}s; done 386 ssh -q openbsd uname -a 387 - name: retrieve sysupgrade from VM to cache 388 if: steps.cache-sysupgrade.outputs.cache-hit != 'true' 389 run: | 390 mkdir -p /tmp/_sysupgrade/ 391 rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/ 392 - name: save sysupgrade to cache 393 if: steps.cache-sysupgrade.outputs.cache-hit != 'true' 394 uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 395 with: 396 key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }} 397 path: /tmp/_sysupgrade/ 398 399 - name: checkout upstream source 400 shell: openbsd {0} 401 run: | 402 umask 022 403 cd /usr 404 rm -rf src/* 405 git clone --no-checkout --depth=1 --filter=tree:0 https://github.com/openbsd/src.git 406 cd /usr/src 407 git sparse-checkout set --no-cone Makefile usr.bin/Makefile usr.bin/Makefile.inc usr.bin/ssh usr.bin/nc regress/usr.bin/ssh 408 git checkout 409 git log -n1 410 chown -R builder /usr/src 411 chmod -R go-w /usr/src/ /usr/obj/ 412 - name: make ssh 413 shell: openbsd {0} 414 run: | 415 cd /usr/src/usr.bin/ssh && make -j4 || make 416 make install 417 /etc/rc.d/sshd restart 418 - name: make nc 419 shell: openbsd {0} 420 run: cd /usr/src/usr.bin/nc && make && make install 421 - name: make tests 422 shell: openbsd {0} 423 run: | 424 cd /usr/src/regress/usr.bin/ssh 425 make obj 426 doas -u builder env SUDO=doas TEST_SSH_UNSAFE_PERMISSIONS=yes TEST_SSH_FAIL_FATAL=yes TEST_SSH_HOSTBASED_AUTH=setupandrun make 427 - name: retrieve logs 428 if: failure() 429 run: | 430 rsync -a openbsd:/usr/obj/regress/usr.bin/ssh/ regress-logs/ 431 for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done 432 - name: save logs 433 if: failure() 434 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main 435 with: 436 name: openbsd-current-upstream-logs 437 path: regress-logs/*.log 438 439 440 solaris: 441 name: "solaris-${{ matrix.target }}" 442 if: github.repository != 'openssh/openssh-portable-selfhosted' && (vars.RUN_ONLY_PLATFORM == '' || vars.RUN_ONLY_PLATFORM == 'solaris') 443 strategy: 444 fail-fast: false 445 matrix: 446 target: 447 - "11.4-gcc" 448 - "11.4-clang-19" 449 config: [default] 450 runs-on: ubuntu-latest 451 steps: 452 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main 453 - name: autoreconf 454 run: sh -c autoreconf 455 456 - name: start Solaris ${{ matrix.target }} VM 457 uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1 458 with: 459 release: ${{ matrix.target }} 460 usesh: true 461 prepare: | 462 echo Setting up user builder. 463 useradd -m builder 464 openssl rand -base64 9 >$GITHUB_WORKSPACE/regress/password 465 chown builder $GITHUB_WORKSPACE/regress/password 466 pw=$(tr -d '\n' <$GITHUB_WORKSPACE/regress/password | openssl passwd -6 -stdin) 467 passwd -p "$pw" builder 468 echo Setting up sudo. 469 sed -e "s/^root.*ALL$/root ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers >>/tmp/sudoers 470 mv /tmp/sudoers /etc/sudoers 471 echo "builder ALL=(ALL) NOPASSWD: ALL" >/etc/sudoers.d/builder 472 echo 'Testing sudo config for root->builder.' 473 sudo -u builder id 474 echo 'Testing sudo config for builder->root.' 475 sudo -u builder sudo id 476 echo Creating directories. 477 mkdir -p /var/empty /usr/local/etc 478 cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli 479 480 - name: set file perms 481 shell: solaris {0} 482 run: cd $GITHUB_WORKSPACE && chown -R builder . 483 - name: configure 484 shell: solaris {0} 485 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure 486 - name: make clean 487 shell: solaris {0} 488 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 489 - name: make 490 shell: solaris {0} 491 run: cd $GITHUB_WORKSPACE && sudo -u builder make 492 - name: make tests 493 shell: solaris {0} 494 run: | 495 cd $GITHUB_WORKSPACE 496 sudo -u builder env SUDO=sudo make tests 497 498 - name: "PAM: configure" 499 shell: solaris {0} 500 run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure --with-pam 501 - name: "PAM: make clean" 502 shell: solaris {0} 503 run: cd $GITHUB_WORKSPACE && sudo -u builder make clean 504 - name: "PAM: make" 505 shell: solaris {0} 506 run: cd $GITHUB_WORKSPACE && sudo -u builder make 507 - name: "PAM: make t-exec UsePAM=no" 508 shell: solaris {0} 509 run: | 510 cd $GITHUB_WORKSPACE 511 sudo -u builder env SUDO=sudo make t-exec 512 - name: "PAM: make t-exec UsePAM=yes" 513 shell: solaris {0} 514 run: | 515 cd $GITHUB_WORKSPACE 516 cp regress/password regress/kbdintpw 517 sudo -u builder env SUDO=sudo TEST_SSH_SSHD_CONFOPTS="UsePam yes" make t-exec 518