windows.yml

# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

name: Windows GitHub CI

on: [pull_request, push]

permissions:
  contents: read

jobs:
  shared:
    # Run a job for each of the specified target architectures:
    strategy:
      matrix:
        platform:
          - arch: amd64
            os: windows-2022
            config: enable-lms enable-fips
            vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
          - arch: amd64
            os: windows-2025
            config: enable-lms enable-fips no-thread-pool no-quic
            vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat
          - arch: x86
            os: windows-2022
            config: no-fips enable-lms
            vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars32.bat
    runs-on: ${{ matrix.platform.os }}
    steps:
    - uses: actions/checkout@v6
      with:
        persist-credentials: false
    - name: checkout fuzz/corpora submodule
      run: git submodule update --init --depth 1 fuzz/corpora
    - name: install nasm
      if: github.repository == 'openssl/openssl'
      run: |
        $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe"
        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
        "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: install nasm (forks)
      if: github.repository != 'openssl/openssl'
      run: |
        $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe"
        Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win${{ matrix.platform.arch == 'x86' && '32' || '64' }}/$installer" -OutFile $installer
        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
        "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: install jom
      if: github.repository == 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: install jom (forks)
      if: github.repository != 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: prepare the build directory
      run: mkdir _build
    - name: config
      working-directory: _build
      shell: cmd
      run: |
        call "${{ matrix.platform.vcvars }}"
        perl ..\Configure --banner=Configured --strict-warnings no-makedepend -DOSSL_WINCTX=openssl ${{ matrix.platform.config }}
        perl configdata.pm --dump
    - name: build
      working-directory: _build
      shell: cmd
      run: |
        call "${{ matrix.platform.vcvars }}"
        jom /j4 /S
    - name: download coreinfo
      run: |
        mkdir _build\coreinfo
        Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip"
    - name: Gather openssl version info
      working-directory: _build
      run: |
        apps/openssl.exe version -v
        apps/openssl.exe version -v | %{($_ -split '\s+')[1]}
        apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'}
        echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
        echo "OSSL_MAJOR=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+)\.[0-9]+(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
    - name: Set registry keys
      working-directory: _build
      run: |
        echo ${Env:OSSL_VERSION}
        reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
        reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
        reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
    - name: get cpu info
      working-directory: _build
      continue-on-error: true
      run: |
        7z.exe x coreinfo/Coreinfo.zip
        ./Coreinfo64.exe -accepteula -f
        ./apps/openssl.exe version -c
    - name: Check platform symbol usage
      working-directory: _build
      shell: cmd
      run: |
        call "${{ matrix.platform.vcvars }}"
        perl ../util/checkplatformsyms.pl ../util/platform_symbols/windows-symbols.txt libcrypto-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll ./libssl-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll
    - name: test
      working-directory: _build
      shell: cmd
      run: |
        call "${{ matrix.platform.vcvars }}"
        jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
    - name: install
      # Run on 64 bit only as 32 bit is slow enough already
      if: ${{ matrix.platform.arch == 'amd64' }}
      working-directory: _build
      shell: cmd
      run: |
        call "${{ matrix.platform.vcvars }}"
        mkdir _dest
        jom /j4 install DESTDIR=_dest

  plain:
    runs-on: windows-2022
    steps:
    - uses: actions/checkout@v6
      with:
        persist-credentials: false
    - name: checkout fuzz/corpora submodule
      run: git submodule update --init --depth 1 fuzz/corpora
    - name: prepare the build directory
      run: mkdir _build
    - name: install jom
      if: github.repository == 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: install jom (forks)
      if: github.repository != 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: config
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug -DOSSL_WINCTX=openssl VC-WIN64A-masm
        perl configdata.pm --dump
    - name: build
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        jom /j4 /S
    - name: download coreinfo
      run: |
        mkdir _build\coreinfo
        Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip"
    - name: get cpu info
      working-directory: _build
      continue-on-error: true
      run: |
        7z.exe x coreinfo/Coreinfo.zip
        ./Coreinfo64.exe -accepteula -f
        ./apps/openssl.exe version -c
    - name: test
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4

  minimal:
    runs-on: windows-2022
    steps:
    - uses: actions/checkout@v6
      with:
        persist-credentials: false
    - name: checkout fuzz/corpora submodule
      run: git submodule update --init --depth 1 fuzz/corpora
    - name: prepare the build directory
      run: mkdir _build
    - name: install jom
      if: github.repository == 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: install jom (forks)
      if: github.repository != 'openssl/openssl'
      run: |
        mkdir C:\jom
        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
    - name: config
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-bulk no-deprecated no-fips no-asm no-threads -DOPENSSL_SMALL_FOOTPRINT -DOSSL_WINCTX=openssl
        perl configdata.pm --dump
    - name: build
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        jom /j4 /S
    - name: download coreinfo
      run: |
        mkdir _build\coreinfo
        Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Coreinfo.zip" -outfile "_build\coreinfo\Coreinfo.zip"
    - name: get cpu info
      working-directory: _build
      continue-on-error: true
      run: |
        7z.exe x coreinfo/Coreinfo.zip
        ./Coreinfo64.exe -accepteula -f
        ./apps/openssl.exe version -c
    - name: test
      working-directory: _build
      shell: cmd
      run: |
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
        jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4

  cygwin:
    # Run a job for each of the specified target architectures:
    strategy:
      matrix:
        os:
          - windows-2022
        platform:
          - arch: win64
            config: -DCMAKE_C_COMPILER=gcc --strict-warnings enable-demos no-fips
# are we really learning sth new from win32? So let's save some CO2 for now disabling this
#          - arch: win32
#            config: -DCMAKE_C_COMPILER=gcc --strict-warnings no-fips
    runs-on: ${{ matrix.os }}
    env:
      CYGWIN_NOWINPATH: 1
      SHELLOPTS: igncr
# Don't overwhelm github CI VMs:
      MAKE_PARAMS: -j 4
    steps:
# Checkout before cygwin can mess with PATH...
    - uses: actions/checkout@v6
      with:
        persist-credentials: false
    - uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d #v6
      with:
         packages: perl git make gcc-core
    - name: Check repo
      run: cygcheck -V
    - name: Full cygcheck status
      run: cygcheck -s -v -r -h
# Activate this if checkout action fails:
#    - name: Clone repo
#      run: bash -c "pwd && git clone --branch ${{ github.ref_name }} --depth 1 https://github.com/${{ github.repository }}.git"
    - name: Full build
      shell: bash
      run: |
        gcc --version
        ./config ${{ matrix.platform.config }}
        make $MAKE_PARAMS
# Disable testing for now. TBD: Need local cygwin installation to debug .
#    - name: Run openssl tests
#      run: bash -c "cd openssl && make V=1 test"

  mingw64:
    strategy:
      matrix:
        platform:
          - arch: mingw64
            target: x86_64
            #  Avoid MINGW bug in headers. Remove when CI is upgraded.
            config: enable-demos -Wno-array-bounds
          - arch: mingw
            target: i686
            config: -Wno-array-bounds -Wno-stringop-overflow
    runs-on: ubuntu-latest
    env:
      CC: ${{ matrix.platform.target }}-w64-mingw32-gcc
      CXX: ${{ matrix.platform.target }}-w64-mingw32-g++
      AR: ${{ matrix.platform.target }}-w64-mingw32-ar
      RANLIB: ${{ matrix.platform.target }}-w64-mingw32-ranlib
      RC: ${{ matrix.platform.target }}-w64-mingw32-windres
    steps:
    - uses: actions/checkout@v6
      with:
        persist-credentials: false
    - name: install MINGW64
      run: sudo apt-get install -y mingw-w64
    - name: config
      run: ./config ${{ matrix.platform.arch }}  --strict-warnings --banner=Configured ${{ matrix.platform.config }}
    - name: make
      run: make -j4 -s

  msys2-mingw64:
    strategy:
      matrix:
        platform:
          - arch: UCRT64
            cc: gcc
            pkgs:  mingw-w64-ucrt-x86_64-gcc
            config: mingw64 enable-demos
          - arch: CLANG64
            cc: clang
            pkgs: mingw-w64-clang-x86_64-clang
            config: mingw64
    runs-on: windows-latest
    env:
      CC: ${{ matrix.platform.cc }}
      MSYSTEM: ${{ matrix.platform.arch }}
      CHERE_INVOKING: 'yes'
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: install MSYS2
        run: |
          $url = 'https://github.com/msys2/msys2-installer/releases/download/nightly-x86_64/msys2-base-x86_64-latest.sfx.exe'
          (New-Object System.Net.WebClient).DownloadFile($url, 'msys2.exe')
          # Remove preinstalled MSYS2
          if (Test-Path C:\msys64) { Remove-Item -Recurse -Force C:\msys64 }
          .\msys2.exe -y -oC:\
          Remove-Item msys2.exe

      - name: update MSYS2
        run: |
          C:\msys64\usr\bin\bash.exe -lc ' '
          # Update core and then normal update
          C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'
          C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'

      - name: install dependencies
        run: C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -S --needed perl git make ${{ matrix.platform.pkgs }}'

      - name: config
        run: C:\msys64\usr\bin\bash.exe -lc './config --strict-warnings --banner=Configured ${{ matrix.platform.config }}'

      - name: make
        run: C:\msys64\usr\bin\bash.exe -lc 'make -j4 -s'
# Tests are broken for now
#      - name: test
#        run: C:\msys64\usr\bin\bash.exe -lc 'make test'