[pull] master from libressl-portable:master

.github/renovate.json5

@@ -0,0 +1,32 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:best-practices',
+    ':configMigration',
+    ':pinVersions',
+    ':rebaseStalePrs',
+    'schedule:weekends',
+    'customManagers:githubActionsVersions',
+    'helpers:pinGitHubActionDigests',
+  ],
+  commitMessagePrefix: 'ci:',
+  commitMessageAction: 'update',
+  commitMessageTopic: '{{depName}}',
+  labels: [
+    'dependencies',
+  ],
+  minimumReleaseAge: '3 days',
+  packageRules: [
+    {
+      matchUpdateTypes: ['pin', 'pinDigest'],
+      commitMessageAction: 'pin',
+    },
+  ],
+  osvVulnerabilityAlerts: true,
+  vulnerabilityAlerts: {
+    enabled: true,
+    addLabels: [
+      'security',
+    ],
+  },
+}

.github/scripts/changelog.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+# Copyright (c) 2023 Joshua Sing <joshua@hypera.dev>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+#
+# Usage: changelog.sh <version>
+#  Reads the changelog for the specified version from the changelog file.
+#  The output will be reformatted for use in GitHub releases.
+#
+#  The changelog file defaults to "ChangeLog", but can be changed by setting
+#  the environment variable $CHANGELOG_FILE
+#
+
+set -e
+
+# Check if the version argument is provided
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <version>" 1>&2
+    exit 1
+fi
+
+version="${1#v}"
+changelog_file="${CHANGELOG_FILE:-ChangeLog}"
+found_version=false
+changelog=""
+
+# Check if the specified changelog file exists
+if [ ! -f "$changelog_file" ]; then
+    echo "Error: Changelog file '$changelog_file' not found" 1>&2
+    exit 1
+fi
+
+# Read the changelog file line by line
+while IFS= read -r line; do
+    # Check for the version line
+    if echo "$line" | grep -Eq "^${version} - "; then
+      found_version=true
+      continue
+    fi
+
+    # Continue reading the changelog until the next version or end of file,
+    # skipping empty lines
+    if $found_version; then
+      echo "$line" | grep -Eq "^\s*$" && continue
+      echo "$line" | grep -Eq "^[0-9]+\.[0-9]+\.[0-9]+ - " && break
+      changelog="${changelog}${line}\n"
+    fi
+done < "$changelog_file"
+
+# If the specified version was not found, print an error
+if ! $found_version; then
+    echo "Error: Version $version was not found in changelog" 1>&2
+    exit 1
+fi
+
+# Tidy up the changelog for displaying on GitHub
+changelog=$(echo "$changelog" | sed -e 's/^\t\*/###/' -e 's/^\t//')
+
+# Print the changelog for the specified version
+echo "$changelog"
+echo
+echo "Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog"
+exit 0

.github/workflows/android.yml

@@ -0,0 +1,42 @@
+# GitHub Actions workflow to run tests on Android.
+name: "Android"
+
+on: [push, pull_request]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: "Test ${{ matrix.name }}"
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: "Android 8-9"
+            min-nal: 26
+            max-nal: 28
+          - name: "Android 10-11"
+            min-nal: 29
+            max-nal: 30
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Install build dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake ninja-build
+
+      - name: "Run CI script"
+        run: ./scripts/test
+        env:
+          ARCH: "android"
+          MIN_NAL: "${{ matrix.min-nal }}"
+          MAX_NAL: "${{ matrix.max-nal }}"

.github/workflows/cifuzz.yml

@@ -0,0 +1,46 @@
+name: "CIFuzz"
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: "Fuzz"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      security-events: write
+    steps:
+      - name: "Build Fuzzers"
+        id: build
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@1b73904cfccf3addafb6d599b8e0f32e710790cc
+        with:
+          oss-fuzz-project-name: 'libressl'
+          dry-run: false
+          language: c++
+
+      - name: "Run Fuzzers"
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@1b73904cfccf3addafb6d599b8e0f32e710790cc
+        with:
+          oss-fuzz-project-name: 'libressl'
+          fuzz-seconds: 300
+          dry-run: false
+          language: c++
+          output-sarif: true
+
+      - name: "Upload Crash"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: failure() && steps.build.outcome == 'success'
+        with:
+          name: "artifacts"
+          path: "./out/artifacts"
+
+      - name: "Upload SARIF"
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        if: always() && steps.build.outcome == 'success'
+        with:
+          sarif_file: "cifuzz-sarif/results.sarif"
+          category: "cifuzz-sarif"

.github/workflows/cmake-config.yml

@@ -0,0 +1,100 @@
+# GitHub Actions workflow to check CMake config.
+name: "CMake Check"
+
+on:
+  push: {}
+  pull_request: {}
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: "${{ matrix.os }}"
+    runs-on: "${{ matrix.os }}"
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ "windows-2022", "macos-14", "ubuntu-24.04" ]
+    defaults:
+      run:
+        shell: "bash"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Setup Windows dependencies"
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+
+      - name: "Setup macOS dependencies"
+        if: runner.os == 'macOS'
+        run: brew install automake libtool
+
+      - name: "Prepare source tree for build (Windows)"
+        if: runner.os == 'Windows'
+        shell: "msys2 {0}"
+        run: ./autogen.sh
+
+      - name: "Prepare source tree for build (Unix)"
+        if: runner.os != 'Windows'
+        run: ./autogen.sh
+
+      - name: "Configure"
+        run: |
+          cmake -S . \
+            -B build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
+
+      - name: "Build"
+        run: cmake --build build --config Release --verbose
+
+      - name: "Install"
+        run: cmake --install build --config Release
+
+      - name: "Consume from the build directory - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
+
+      - name: "Consume from the build directory - Build"
+        run: cmake --build consumer-build --config Release --verbose
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-prefix \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Build"
+        run: cmake --build consumer-install-prefix --config Release --verbose
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-dir \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Build"
+        run: cmake --build consumer-install-dir --config Release --verbose