openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-15 12:08:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use OpenSSL 3.6.4 for musl builds (#45149)

Browse Source 
## Why

The latest `openssl-src` 300.x crate still bundles OpenSSL 3.6.3. Build the 3.6.4 security release directly while preserving the existing 3.x ABI.

## What changed

- Build static OpenSSL libraries with the musl compiler for `x86_64` and `aarch64`, verifying the source archive's SHA-256 checksum.
- Set target-specific OpenSSL overrides to bypass vendored builds without affecting host build dependencies.
- Add `perl` and `make` to the musl build prerequisites and reuse completed OpenSSL installations.

GitOrigin-RevId: 4276c7d6cf30c31c8554246cea2f406dfbf7568b
This commit is contained in:
zm-oai
2026-09-13 01:09:03 +00:00
committed by copyberry
parent 7efa9d96fb
commit a592c38c16
2 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.github/scripts/install-musl-build-tools.sh vendored
View File

@@ -17,7 +17,7 @@ if [[ -n "${APT_INSTALL_ARGS:-}" ]]; then
fi
sudo apt-get update "${apt_update_args[@]}"
sudo apt-get install -y "${apt_install_args[@]}" ca-certificates curl musl-tools pkg-config libcap-dev g++ clang libc++-dev libc++abi-dev lld xz-utils
sudo apt-get install -y "${apt_install_args[@]}" ca-certificates curl musl-tools pkg-config libcap-dev g++ clang libc++-dev libc++abi-dev lld xz-utils perl make
case "${TARGET}" in
x86_64-unknown-linux-musl)
@@ -47,6 +47,8 @@ else
exit 1
fi
OPENSSL_CC="${musl_linker}" bash "$(dirname "${BASH_SOURCE[0]}")/install-musl-openssl.sh"
zig_target="${TARGET/-unknown-linux-musl/-linux-musl}"
runner_temp="${RUNNER_TEMP:-/tmp}"
tool_root="${runner_temp}/codex-musl-tools-${TARGET}"

51
.github/scripts/install-musl-openssl.sh vendored Normal file
View File

@@ -0,0 +1,51 @@
#!/usr/bin/env bash
set -euo pipefail
: "${TARGET:?TARGET environment variable is required}"
: "${GITHUB_ENV:?GITHUB_ENV environment variable is required}"
: "${OPENSSL_CC:?OPENSSL_CC must name the target musl compiler}"
case "${TARGET}" in
x86_64-unknown-linux-musl) openssl_target="linux-x86_64" ;;
aarch64-unknown-linux-musl) openssl_target="linux-aarch64" ;;
*) echo "Unexpected musl target: ${TARGET}" >&2; exit 1 ;;
esac
# openssl-src's latest 300.x crate still contains 3.6.3. Build the upstream
# security release until that crate catches up, keeping the existing 3.x ABI.
openssl_version="3.6.4"
openssl_sha256="9bffaa1ad1e07b354c21bd3324ec02fa15579f45a7d0494b3e74bc449b7333ef"
openssl_root="${RUNNER_TEMP:-/tmp}/codex-musl-tools-${TARGET}/openssl-${openssl_version}"
openssl_prefix="${openssl_root}/prefix"
if [[ ! -f "${openssl_prefix}/.complete" ]]; then
mkdir -p "${openssl_root}"
archive="${openssl_root}/openssl-${openssl_version}.tar.gz"
curl -fsSL "https://github.com/openssl/openssl/releases/download/openssl-${openssl_version}/openssl-${openssl_version}.tar.gz" -o "${archive}"
echo "${openssl_sha256} ${archive}" | sha256sum -c -
tar -xzf "${archive}" -C "${openssl_root}"
(
cd "${openssl_root}/openssl-${openssl_version}"
# Match openssl-src's default/legacy configuration for musl, including
# disabling shared libraries, zlib, engines, and unsupported async APIs.
CC="${OPENSSL_CC}" perl ./Configure "${openssl_target}" \
"--prefix=${openssl_prefix}" --openssldir=/usr/local/ssl --libdir=lib \
no-shared no-module no-tests no-comp no-zlib no-zlib-dynamic \
no-ssl3 no-md2 no-rc5 no-weak-ssl-ciphers no-camellia no-idea no-seed \
no-engine no-async -DOPENSSL_NO_SECURE_MEMORY
make -j"${OPENSSL_BUILD_JOBS:-$(nproc)}" build_libs
make install_dev
)
touch "${openssl_prefix}/.complete"
fi
# Scope these overrides to the target so host build dependencies are unaffected.
# openssl-sys honors OPENSSL_NO_VENDOR even when Cargo enables `vendored`.
target_env="${TARGET^^}"
target_env="${target_env//-/_}"
{
echo "${target_env}_OPENSSL_DIR=${openssl_prefix}"
echo "${target_env}_OPENSSL_NO_VENDOR=1"
echo "${target_env}_OPENSSL_STATIC=1"
} >> "${GITHUB_ENV}"