All combinations

.clang-format

@@ -16,6 +16,19 @@ PointerAlignment: Right
 # of a comment block to protect comments as
 # per STYLE.md
 CommentPragmas:  '(^ IWYU pragma:|^\*$|^-$)'
+ForEachMacros:
+  - "OSSL_LIST_FOREACH"
+  - "OSSL_LIST_FOREACH_FROM"
+  - "OSSL_LIST_FOREACH_REV"
+  - "OSSL_LIST_FOREACH_REV_FROM"
+  - "OSSL_LIST_FOREACH_DELSAFE"
+  - "OSSL_LIST_FOREACH_DELSAFE_FROM"
+  - "OSSL_LIST_FOREACH_REV_DELSAFE"
+  - "OSSL_LIST_FOREACH_REV_DELSAFE_FROM"
+  - "OSSL_RBT_FOREACH"
+  - "OSSL_RBT_FOREACH_SAFE"
+  - "OSSL_RBT_FOREACH_REVERSE"
+  - "OSSL_RBT_FOREACH_REVERSE_SAFE"
 # OpenSSL uses typedefs extensively. Tell clang-format about them.
 TypeNames:
   - "ACCESS_DESCRIPTION"
@@ -1129,7 +1142,14 @@ TypeNames:
   - "HASH_LONG"
   - "MD32_REG_T"
 # OpenSSL uses macros extensively. Tell clang-format about them.
-TypenameMacros: ['LHASH_OF', 'STACK_OF']
+TypenameMacros:
+  - "LHASH_OF"
+  - "OSSL_LIST"
+  - "OSSL_RBT_ENTRY"
+  - "OSSL_RBT_HEAD"
+  - "PRIORITY_QUEUE_OF"
+  - "SPARSE_ARRAY_OF"
+  - "STACK_OF"
 StatementMacros:
   - "BLOCK_CIPHER_aead"
   - "BLOCK_CIPHER_generic"
@@ -1365,6 +1385,7 @@ StatementMacros:
   - "ASN1_SEQUENCE_END_enc"
   - "ASN1_SEQUENCE_END_name"
   - "ASN1_SEQUENCE_END_ref"
+  - "k2d_NOCTX"
   - "make_dh"
   - "make_dh_bn"
   - "static_ASN1_CHOICE_END"

.codespellrc

@@ -258,6 +258,7 @@ ignore-words-list =
     requestor,
     Requestor,
     requestors,
+    REQUIREDs,
     rewinded,
     roperties,
     sav,

.github/workflows/aarch64-more-cross-compiles.yml

@@ -14,19 +14,54 @@ on:
   schedule:
     - cron: '05 03 * * *'
   workflow_dispatch:
+    inputs:
+      pr:
+        description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.'
+        required: false
+        type: string
+      head_sha:
+        description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.'
+        required: false
+        type: string
+      check_run_id:
+        description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.'
+        required: false
+        type: string
+
+# Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics
+# collector that attributes CI load by parsing this same string. Both break silently.
+run-name: >-
+  ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
+  # Only a dispatch carries inputs, so this is skipped on every other trigger.
+  validate-dispatch-inputs:
+    if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != ''
+    uses: ./.github/workflows/validate-dispatch-inputs.yml
+    with:
+      pr: ${{ inputs.pr }}
+      head_sha: ${{ inputs.head_sha }}
+      check_run_id: ${{ inputs.check_run_id }}
+
   cross-compilation-aarch64:
     # pull request title contains 'aarch64'
     # pull request title contains 'arm64'
     # pull request body contains '[aarch64 ci]'
     # push event commit message contains '[aarch64 ci]'
     # cron job
     # manual dispatch
-    if: contains(github.event.pull_request.title, 'aarch64') || contains(github.event.pull_request.title, 'AArch64') || contains(github.event.pull_request.title, 'arm64') || contains(github.event.pull_request.body, '[aarch64 ci]') || contains(github.event.head_commit.message, '[aarch64 ci]') || (github.event_name == 'schedule' && github.repository == 'openssl/openssl') || github.event_name == 'workflow_dispatch'
+    needs: [validate-dispatch-inputs]
+    if: >-
+      (contains(github.event.pull_request.title, 'aarch64') || contains(github.event.pull_request.title, 'AArch64') || contains(github.event.pull_request.title, 'arm64') || contains(github.event.pull_request.body, '[aarch64 ci]') || contains(github.event.head_commit.message, '[aarch64 ci]') || (github.event_name == 'schedule' && github.repository == 'openssl/openssl') || github.event_name == 'workflow_dispatch') &&
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
     strategy:
       fail-fast: false
       matrix:
@@ -134,6 +169,7 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
+        ref: ${{ github.event.inputs.head_sha || github.sha }}
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
 
@@ -165,8 +201,8 @@ jobs:
 
     - name: Set OpenSSL caps environment
       if: matrix.platform.opensslcapsname != ''
-      run: echo "OPENSSL_${{ matrix.platform.opensslcapsname }}=\
-                 ${{ matrix.platform.opensslcaps }}" >> $GITHUB_ENV
+      run: |
+        echo "OPENSSL_${{ matrix.platform.opensslcapsname }}=${{ matrix.platform.opensslcaps }}" >> "$GITHUB_ENV"
 
     - name: get cpu info
       run: cat /proc/cpuinfo
@@ -175,20 +211,24 @@ jobs:
       if: matrix.platform.tests != 'none'
       run: QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} ./util/opensslwrap.sh info -cpusettings
 
+    # A dispatched run, and a pull request that opts in with `[aarch64 ci]` in its body, take the
+    # push tier: both exist to run pre-merge what otherwise only runs post-merge, and evp-only
+    # is the weaker signal. A pull request that only matches on its title keeps the evp tier.
+    # Legs setting `tests: none` stay build-only on every trigger, by design.
     - name: make all tests
-      if: github.event_name == 'push' && matrix.platform.tests == ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[aarch64 ci]')) && matrix.platform.tests == ''
       run: |
         .github/workflows/make-test \
                   TESTS="-test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make some tests
-      if: github.event_name == 'push' && matrix.platform.tests != 'none' && matrix.platform.tests != ''
+      if: (github.event_name == 'push' || inputs.pr != '' || contains(github.event.pull_request.body, '[aarch64 ci]')) && matrix.platform.tests != 'none' && matrix.platform.tests != ''
       run: |
         .github/workflows/make-test \
                   TESTS="${{ matrix.platform.tests }} -test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make evp tests
-      if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
+      if: github.event_name == 'pull_request' && !contains(github.event.pull_request.body, '[aarch64 ci]') && matrix.platform.tests != 'none'
       run: |
         .github/workflows/make-test \
                   TESTS="test_evp*" \
@@ -200,3 +240,35 @@ jobs:
         name: "cross-compiles-aarch64@${{ matrix.platform.capslabel }}"
         path: artifacts.tar.gz
         if-no-files-found: ignore
+
+  gcs-validation-aarch64:
+    # pull request title contains 'aarch64'
+    # pull request title contains 'arm64'
+    # pull request body contains '[aarch64 ci]'
+    # push event commit message contains '[aarch64 ci]'
+    # cron job
+    # manual dispatch
+    needs: [validate-dispatch-inputs]
+    if: >-
+      (contains(github.event.pull_request.title, 'aarch64') || contains(github.event.pull_request.title, 'AArch64') || contains(github.event.pull_request.title, 'arm64') || contains(github.event.pull_request.body, '[aarch64 ci]') || contains(github.event.head_commit.message, '[aarch64 ci]') || (github.event_name == 'schedule' && github.repository == 'openssl/openssl') || github.event_name == 'workflow_dispatch') &&
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
+    runs-on: ubuntu-26.04-arm
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+        ref: ${{ github.event.inputs.head_sha || github.sha }}
+    - name: print tool versions
+      run: |
+        gcc --version
+        ld --version
+    - name: config
+      run: |
+        CFLAGS='-mbranch-protection=standard' \
+        LDFLAGS='-Wl,-z,gcs=always -Wl,-z,gcs-report=error' \
+        ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace --banner=Configured
+    - name: config dump
+      run: ./configdata.pm --dump
+    - name: make
+      run: make -j4

.github/workflows/avx512-sde.yml

@@ -22,6 +22,28 @@ on:
   schedule:
     - cron: '30 02 * * *'
   workflow_dispatch:
+    inputs:
+      pr:
+        description: 'Internal: openssl-ci-bot PR number. Leave empty for a normal manual run.'
+        required: false
+        type: string
+      head_sha:
+        description: 'Internal: openssl-ci-bot commit SHA. Leave empty for a normal manual run.'
+        required: false
+        type: string
+      check_run_id:
+        description: 'Internal: openssl-ci-bot check-run ID. Leave empty for a normal manual run.'
+        required: false
+        type: string
+
+# Keep in sync with openssl-ci-bot's run-name parser, and with the Actions statistics
+# collector that attributes CI load by parsing this same string. Both break silently.
+run-name: >-
+  ${{ github.event.inputs.pr && format('ci-dispatch pr={0} head={1} check_run_id={2}', github.event.inputs.pr, github.event.inputs.head_sha, github.event.inputs.check_run_id) || github.workflow }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.inputs.pr || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -32,12 +54,26 @@ env:
   SDE_MIRROR_ID: 915934
 
 jobs:
+  # Only a dispatch carries inputs, so this is skipped on the nightly cron.
+  validate-dispatch-inputs:
+    if: inputs.pr != '' || inputs.head_sha != '' || inputs.check_run_id != ''
+    uses: ./.github/workflows/validate-dispatch-inputs.yml
+    with:
+      pr: ${{ inputs.pr }}
+      head_sha: ${{ inputs.head_sha }}
+      check_run_id: ${{ inputs.check_run_id }}
+
   linux:
+    needs: [validate-dispatch-inputs]
+    if: |
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
+          ref: ${{ github.event.inputs.head_sha || github.sha }}
 
       - name: install NASM
         run: sudo apt-get install -y nasm
@@ -71,17 +107,25 @@ jobs:
       - name: sha3_x4_internal_test (AVX512 via SDE)
         run: sde64 -icx -- ./test/sha3_x4_internal_test
 
+      - name: evp_extra_test (AVX512 via SDE)
+        run: sde64 -icx -- ./test/evp_extra_test
+
       - name: fipsinstall (FIPS KAT via SDE)
         run: sde64 -icx -- ./apps/openssl fipsinstall -module ./providers/fips.so -out /tmp/fipsmodule.cnf -provider_name fips
 
   windows:
+    needs: [validate-dispatch-inputs]
+    if: |
+      !cancelled() &&
+      (needs.validate-dispatch-inputs.result == 'success' || needs.validate-dispatch-inputs.result == 'skipped')
     runs-on: windows-2022
     env:
       VCVARS: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
     steps:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
+          ref: ${{ github.event.inputs.head_sha || github.sha }}
 
       - name: install nasm
         if: github.repository == 'openssl/openssl'
@@ -161,6 +205,11 @@ jobs:
         shell: cmd
         run: sde -icx -- test\sha3_x4_internal_test.exe
 
+      - name: evp_extra_test (AVX512 via SDE)
+        working-directory: _build
+        shell: cmd
+        run: sde -icx -- test\evp_extra_test.exe
+
       - name: fipsinstall (FIPS KAT via SDE)
         working-directory: _build
         shell: cmd

.github/workflows/backport.yml

@@ -7,18 +7,27 @@
 
 name: Backports CI
 
-on: [pull_request]
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
   contents: read
 
+concurrency:
+  group: backports-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   check_backports:
     strategy:
       fail-fast: false
       matrix:
         release: [
           {
+            branch: '4.1',
+            cppflags: ''
+          }, {
             branch: '4.0',
             cppflags: ''
           }, {
@@ -30,9 +39,6 @@ jobs:
           }, {
             branch: '3.4',
             cppflags: 'CPPFLAGS=-ansi'
-          }, {
-            branch: '3.0',
-            cppflags: 'CPPFLAGS=-ansi'
           }
         ]
     runs-on: ubuntu-latest