Skip to contentSkip to conversation

travis-ci: libressl support for osx

PATCH In review Ilya Shipitsin 3 participants 4 messages Aug 13, 2017 – Aug 19, 2017

lore
Share & tools
lore
#0 lore raw

cover travis-ci: libressl support for osx

Tunnelblick ships openvpn binary built with libressl (see https://github.com/Tunnelblick/Tunnelblick/issues/317 )

Ilya Shipitsin (1):
travis-ci: add libressl build for osx

 .travis.yml            |  5 +++++
 .travis/build-check.sh |  4 ++++
 .travis/build-deps.sh  | 31 +++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+)
Signature · 1 line
2.13.3
#1 lore raw

PATCH 1/1 travis-ci: add libressl build for osx

---
 .travis.yml            |  5 +++++
 .travis/build-check.sh |  4 ++++
 .travis/build-deps.sh  | 31 +++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+)
.travis.yml +5 -0
index 0b531529..4f5661d6 100644
@@ -21,6 +21,7 @@ env:
     - OPENSSL_VERSION="1.0.2l"
     - OPENSSL_CFLAGS="-I${PREFIX}/include"
     - OPENSSL_LIBS="-L${PREFIX}/lib -lssl -lcrypto"
+    - LIBRESSL_VERSION="2.5.5"
 
 matrix:
   include:
@@ -55,6 +56,10 @@ matrix:
       os: osx
       osx_image: xcode7.3
       compiler: clang
+    - env: SSLLIB="libressl"
+      os: osx
+      osx_image: xcode7.3
+      compiler: clang
     - env: SSLLIB="mbedtls"
       os: osx
       osx_image: xcode7.3
.travis/build-check.sh +4 -0
index 74f3ae10..790af83e 100755
@@ -9,6 +9,10 @@ if [ "${TRAVIS_OS_NAME}" = "osx"   ]; then
 	export DYLD_LIBRARY_PATH="${PREFIX}/lib:${DYLD_LIBRARY_PATH:-}"
 fi
 
+if [ "${SSLLIB}" = "libressl"   ]; then
+        export SSLLIB="openssl"
+fi
+
 autoreconf -vi
 
 if [ -z ${CHOST+x} ]; then
.travis/build-deps.sh +31 -0
index e787abab..07c846d2 100755
@@ -76,6 +76,34 @@ build_mbedtls () {
     fi
 }
 
+download_libressl () {
+    if [ ! -f "download-cache/libressl-${LIBRESSL_VERSION}.tar.gz" ]; then
+        wget -P download-cache/ \
+            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz"
+    fi
+}
+
+build_libressl_osx () {
+    (
+        cd "libressl-${LIBRESSL_VERSION}/"
+        ./configure --prefix="${PREFIX}" --with-openssldir="${PREFIX}"
+        make all install
+    )
+}
+
+build_libressl () {
+    if [ "$(cat ${PREFIX}/.libressl-version)" != "${LIBRESSL_VERSION}" ]; then
+        tar zxf "download-cache/libressl-${LIBRESSL_VERSION}.tar.gz"
+        if [ "${TRAVIS_OS_NAME}" = "osx" ]; then
+            build_openssl_osx
+        else
+            echo "Not supported configuration"
+            exit 1
+        fi
+        echo "${LIBRESSL_VERSION}" > "${PREFIX}/.libressl-version"
+    fi
+}
+
 download_openssl () {
     if [ ! -f "download-cache/openssl-${OPENSSL_VERSION}.tar.gz" ]; then
         wget -P download-cache/ \
@@ -153,6 +181,9 @@ fi
 if [ "${SSLLIB}" = "openssl" ]; then
     download_openssl
     build_openssl
+elif [ "${SSLLIB}" = "libressl" ]; then
+    download_libressl
+    build_libressl
 elif [ "${SSLLIB}" = "mbedtls" ]; then
     download_mbedtls
     build_mbedtls
Signature · 1 line
2.13.3
#2 lore raw

Re: [Openvpn-devel] [PATCH 1/1] travis-ci: add libressl build for osx

Hi,

Quoted 2 lines · Ilya Shipitsin

Tunnelblick ships openvpn binary built with libressl (see https://github.com/Tunnelblick/Tunnelblick/issues/317 )

I'm a bit on the fence about this one. We do not support libressl, while including a libressl build in travis creates an image as if we do.
On the other hand, it is useful to know when libressl builds break.
I'm leaning towards a NAK, to be perfectly clear about the state of our libressl support: "we do not support it, we do not test it, using it is completely at your own risk".

-Steffan

#3 lore raw

Re: [Openvpn-devel] [PATCH 1/1] travis-ci: add libressl build for osx

Quoted 6 lines · Steffan Karger

Hi,

Quoted 2 lines · Ilya Shipitsin

Tunnelblick ships openvpn binary built with libressl (see https://github.com/Tunnelblick/Tunnelblick/issues/317 )

Quoted 6 lines

I'm a bit on the fence about this one. We do not support libressl, while including a libressl build in travis creates an image as if we do.
On the other hand, it is useful to know when libressl builds break.
I'm leaning towards a NAK, to be perfectly clear about the state of our libressl support: "we do not support it, we do not test it, using it is completely at your own risk".

I agree with Steffan. That is pretty clean; officially we only support OpenSSL and mbed TLS.

The Tunnelblick project can easily enough re-use our Travis setup and slightly modify it to add libressl to run those tests for their userbase as well. But that's their decision how they want to test their stuff.

Signature · 4 lines
kind regards,

David Sommerseth
OpenVPN Technologies, Inc