ci.yml

# Copyright (C) The libssh2 project and its contributors.
#
# SPDX-License-Identifier: BSD-3-Clause
#
name: 'CI'

'on':
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions: {}

env:
  MAKEFLAGS: -j 5

jobs:
  check_style:
    name: 'style-check'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: 'checksrc'
        run: ci/checksrc-all.pl

  linters:
    name: 'linters'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'install prereqs'
        run: |
          /home/linuxbrew/.linuxbrew/bin/brew install actionlint shellcheck zizmor
          python3 -m venv ~/venv
          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r .github/workflows/requirements.txt

      - name: 'REUSE check'
        run: |
          source ~/venv/bin/activate
          reuse lint

      - name: 'zizmor GHA'
        env:
          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          zizmor --pedantic .github/workflows/*.yml .github/dependabot.yml

      - name: 'actionlint'
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          actionlint --version
          export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
          actionlint .github/workflows/*.yml

      - name: 'shellcheck GHA'
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          shellcheck --version
          export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
          git ls-files '.github/workflows/*.yml' | while read -r f; do
            echo "Verifying ${f}..."
            {
              echo '#!/usr/bin/env bash'
              echo 'set -eu'
              yq eval '.. | select(has("run") and (.run | type == "!!str")) | .run + "\ntrue\n"' "${f}"
            } | sed -E 's|\$\{\{ .+ \}\}|GHA_EXPRESSION|g' | shellcheck -
          done

      - name: 'shellcheck'
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          shellcheck --version
          ci/shellcheck.sh

      - name: 'spacecheck'
        run: ci/spacecheck.pl

      - name: 'cmakelint'
        run: |
          source ~/venv/bin/activate
          ci/cmakelint.sh

      - name: 'spellcheck'
        run: |
          source ~/venv/bin/activate
          ci/spellcheck.sh

  build_integration:
    name: 'CM integration ${{ matrix.image }}'
    runs-on: ${{ matrix.image }}
    timeout-minutes: 5
    defaults:
      run:
        shell: ${{ contains(matrix.image, 'windows') && 'msys2 {0}' || 'bash' }}
    env:
      CC: ${{ !contains(matrix.image, 'windows') && 'clang' || '' }}
      MATRIX_IMAGE: '${{ matrix.image }}'
      OLD_CMAKE_VERSION: 3.19.8
      OLD_CMAKE_SHA256_LINUX_ARM: 807f5afb2a560e00af9640e496d5673afefc2888bf0ed076412884a5ebb547a1
      OLD_CMAKE_SHA256_MACOS_UNI: 0976d23d982af05dcbfb3aa34fcb62ead43bea27f0e3bb95222f2a78161423f2
      OLD_CMAKE_SHA256_WIN_INTEL: 2a30877a3d6b50da305b289f4d1c03befdfaeb2edba02a563c681e883d810380
    strategy:
      fail-fast: false
      matrix:
        image: [ubuntu-24.04-arm, macos-latest, windows-2022]
    steps:
      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0
        if: ${{ contains(matrix.image, 'windows') }}
        with:
          msystem: mingw64
          release: false
          update: false
          cache: false
          path-type: inherit
          install: >-
            mingw-w64-x86_64-zlib mingw-w64-x86_64-libgcrypt mingw-w64-x86_64-openssl mingw-w64-x86_64-mbedtls

      - name: 'install packages'
        run: |
          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
            cd ~
            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
              --location "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-win64-x64.zip" --output pkg.bin
            sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OLD_CMAKE_SHA256_WIN_INTEL}" && unzip -q pkg.bin && rm -f pkg.bin
            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-win64-x64/bin/cmake.exe > ~/old-cmake-path.txt
          elif [[ "${MATRIX_IMAGE}" = *'ubuntu'* ]]; then
            sudo apt-get -o Dpkg::Use-Pty=0 install libgcrypt-dev libssl-dev libwolfssl-dev
            /home/linuxbrew/.linuxbrew/bin/brew install mbedtls@3
            cd ~
            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
              --location "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-Linux-aarch64.tar.gz" --output pkg.bin
            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_LINUX_ARM}" && tar -xzf pkg.bin && rm -f pkg.bin
            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-Linux-aarch64/bin/cmake > ~/old-cmake-path.txt
          else
            brew install libgcrypt openssl mbedtls@3 wolfssl
            cd ~
            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
              --location "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-macos-universal.tar.gz" --output pkg.bin
            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_MACOS_UNI}" && tar -xzf pkg.bin && rm -f pkg.bin
            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-macos-universal/CMake.app/Contents/bin/cmake > ~/old-cmake-path.txt
          fi

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'via ExternalProject'
        if: ${{ !contains(matrix.image, 'ubuntu') }}
        run: ./tests/cmake/test.sh ExternalProject
      - name: 'via FetchContent'
        run: ./tests/cmake/test.sh FetchContent
      - name: 'via add_subdirectory OpenSSL'
        run: ./tests/cmake/test.sh add_subdirectory -DCRYPTO_BACKEND=OpenSSL
      - name: 'via add_subdirectory Libgcrypt'
        run: ./tests/cmake/test.sh add_subdirectory -DCRYPTO_BACKEND=Libgcrypt
      - name: 'via find_package OpenSSL'
        run: ./tests/cmake/test.sh find_package -DCRYPTO_BACKEND=OpenSSL
      - name: 'via find_package Libgcrypt'
        run: ./tests/cmake/test.sh find_package -DCRYPTO_BACKEND=Libgcrypt
      - name: 'via find_package mbedTLS'
        run: |
          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
            export PKG_CONFIG_PATH; PKG_CONFIG_PATH="$(brew --prefix mbedtls@3)"/lib/pkgconfig
          elif [[ "${MATRIX_IMAGE}" = *'ubuntu'* ]]; then
            eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
            export PKG_CONFIG_PATH; PKG_CONFIG_PATH="$(brew --prefix mbedtls@3)/lib/pkgconfig"
            export LDFLAGS; LDFLAGS="-Wl,-rpath,$(brew --prefix mbedtls@3)/lib"
          fi
          ./tests/cmake/test.sh find_package -DCRYPTO_BACKEND=mbedTLS

      - name: 'via find_package wolfSSL'
        if: ${{ !contains(matrix.image, 'windows') }}  # MSYS2 wolfSSL package not built with the OpenSSL compatibility option
        run: ./tests/cmake/test.sh find_package -DCRYPTO_BACKEND=wolfSSL

      - name: 'via ExternalProject (old cmake)'
        if: ${{ contains(matrix.image, 'ubuntu') }}
        run: |
          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
            export CFLAGS='-arch arm64'
          fi
          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc'
          fi
          ./tests/cmake/test.sh ExternalProject

      - name: 'via add_subdirectory OpenSSL (old cmake)'
        run: |
          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
          [[ "${MATRIX_IMAGE}" = *'macos'* ]] && export CFLAGS='-arch arm64'
          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
          fi
          ./tests/cmake/test.sh add_subdirectory -DCRYPTO_BACKEND=OpenSSL

      - name: 'via find_package OpenSSL (old cmake)'
        run: |
          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
          [[ "${MATRIX_IMAGE}" = *'macos'* ]] && export CFLAGS='-arch arm64'
          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
          fi
          ./tests/cmake/test.sh find_package -DCRYPTO_BACKEND=OpenSSL

  build_linux:
    name: 'linux'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        compiler: [gcc, clang, clang-tidy]
        arch: [amd64]
        crypto: [OpenSSL, Libgcrypt, mbedTLS-prev, wolfSSL]
        build: [cmake]
        zlib: ['OFF', 'ON']
        exclude:
          - { compiler: clang-tidy, zlib: 'OFF' }
        include:
          - compiler: gcc
            arch: amd64
            crypto: OpenSSL
            build: autotools
            zlib: 'OFF'
          - compiler: clang
            arch: amd64
            crypto: OpenSSL
            build: autotools
            zlib: 'OFF'
          - compiler: clang
            arch: amd64
            crypto: OpenSSL
            build: autotools
            zlib: 'ON'
            target: 'distcheck'
          - compiler: clang
            arch: amd64
            crypto: OpenSSL
            build: autotools
            zlib: 'ON'
            target: 'maketgz'
          - compiler: gcc
            arch: amd64
            crypto: OpenSSL-3-no-deprecated
            build: cmake
            zlib: 'ON'
          - compiler: gcc
            arch: amd64
            crypto: OpenSSL-111-from-source
            build: cmake
            zlib: 'ON'
          - compiler: gcc
            arch: amd64
            crypto: BoringSSL
            build: cmake
            zlib: 'ON'
          - compiler: gcc
            arch: amd64
            crypto: AWS-LC
            build: cmake
            zlib: 'ON'
          - compiler: gcc
            arch: amd64
            crypto: LibreSSL
            build: cmake
            zlib: 'ON'
          - compiler: gcc
            arch: i386
            crypto: mbedTLS-from-source
            build: cmake
            zlib: 'ON'
          - compiler: clang
            arch: amd64
            crypto: wolfSSL-from-source
            build: cmake
            zlib: 'ON'
          - compiler: clang
            arch: amd64
            crypto: wolfSSL-from-source-prev
            build: cmake
            zlib: 'ON'
    env:
      CC: ${{ matrix.compiler == 'clang-tidy' && 'clang' || matrix.compiler }}
      MATRIX_ARCH: '${{ matrix.arch }}'
      MATRIX_BUILD: '${{ matrix.build }}'
      MATRIX_COMPILER: '${{ matrix.compiler }}'
      MATRIX_CRYPTO: '${{ matrix.crypto }}'
      MATRIX_ZLIB: '${{ matrix.zlib }}'
      FIXTURE_TRACE_ALL_CONNECT: 0
      MBEDTLS_VERSION: 3.6.6
      MBEDTLS_SHA256: 8fb65fae8dcae5840f793c0a334860a411f884cc537ea290ce1c52bb64ca007a
      MBEDTLS_VERSION_PREV: 3.1.0
      MBEDTLS_SHA256_PREV: b02df6f68dd1537e115a8497d5c173dc71edc55ad084756e57a30f951b725acd
      WOLFSSL_VERSION: 5.9.0
      WOLFSSL_SHA256: 6efc62b86f145a5c52bfd62294ca66c20ce85b54e9033f5d7e0ee73eb30306c1
      WOLFSSL_VERSION_PREV: 5.5.4
      WOLFSSL_SHA256_PREV: b7ee150e49def77c765bc02aac92ddeb0bebefd4cb12aa263d8f95e405221fb8
      BORINGSSL_VERSION: 0.20251002.0
      BORINGSSL_SHA256: f96733fc3df03d4195db656d1b7b8c174c33f95d052f811f0ecc8f4e4e3db332
      AWSLC_VERSION: 1.69.0
      AWSLC_SHA256: cdaa8dcd5f4ead8c82646fabef3c811381c4c7906de4489415e3fdf2558922f8
      LIBRESSL_VERSION: 4.2.1
      LIBRESSL_SHA256: 6d5c2f58583588ea791f4c8645004071d00dfa554a5bf788a006ca1eb5abd70b
      OPENSSL_VERSION: 3.6.2
      OPENSSL_SHA256: aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f
      OPENSSL111_VERSION: 1.1.1w
      OPENSSL111_SHA256: cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8
    steps:
      - name: 'install architecture'
        if: ${{ matrix.arch != 'amd64' }}
        run: |
          sudo dpkg --add-architecture "${MATRIX_ARCH}"
          sudo rm -f /etc/apt/sources.list.d/{azure-cli.sources,microsoft-prod.list,ondrej-ubuntu-php-noble.sources}
          sudo apt-get -o Dpkg::Use-Pty=0 update
          sudo apt-get -o Dpkg::Use-Pty=0 install gcc-multilib build-essential zlib1g-dev:"${MATRIX_ARCH}"

      - name: 'install packages'
        run: |
          pkgs=''
          [ "${MATRIX_COMPILER}" = 'clang-tidy' ] && pkgs+=' clang-20 clang-tidy-20'
          [ "${MATRIX_CRYPTO}" = 'OpenSSL' ] && pkgs+=" libssl-dev:${MATRIX_ARCH}"
          [ "${MATRIX_CRYPTO}" = 'Libgcrypt' ] && pkgs+=" libgcrypt-dev:${MATRIX_ARCH}"
          [ "${MATRIX_CRYPTO}" = 'wolfSSL' ] && pkgs+=" libwolfssl-dev:${MATRIX_ARCH}"
          if [ -n "${pkgs}" ]; then
            sudo apt-get -o Dpkg::Use-Pty=0 install ${pkgs}
          fi

      - name: 'cache mbedTLS'
        if: ${{ matrix.crypto == 'mbedTLS-from-source' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-mbedtls
        with:
          path: ~/usr
          key: ${{ runner.os }}-mbedtls-${{ env.MBEDTLS_VERSION }}-${{ matrix.arch }}

      - name: 'install mbedTLS from source'
        if: ${{ matrix.crypto == 'mbedTLS-from-source' && !steps.cache-mbedtls.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${MBEDTLS_SHA256}" && tar -xjf pkg.bin && rm -f pkg.bin
          cd "mbedtls-${MBEDTLS_VERSION}"
          if [ "${MATRIX_ARCH}" = 'i386' ]; then
            options="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_SYSTEM_VERSION=1 -DCMAKE_SYSTEM_PROCESSOR=${MATRIX_ARCH}"
            cflags='-m32 -mpclmul -msse2 -maes'
          fi
          cmake -B . -G Ninja ${options} \
            -DCMAKE_C_FLAGS="${cflags}" \
            -DENABLE_PROGRAMS=OFF \
            -DENABLE_TESTING=OFF \
            -DUSE_STATIC_MBEDTLS_LIBRARY=OFF \
            -DUSE_SHARED_MBEDTLS_LIBRARY=ON \
            -DCMAKE_INSTALL_PREFIX="$HOME"/usr
          cmake --build .
          cmake --install .

      - name: 'cache mbedTLS (prev)'
        if: ${{ matrix.crypto == 'mbedTLS-prev' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-mbedtls-prev
        with:
          path: ~/usr
          key: ${{ runner.os }}-mbedtls-${{ env.MBEDTLS_VERSION_PREV }}-${{ matrix.arch }}

      - name: 'install mbedTLS (prev) from source'
        if: ${{ matrix.crypto == 'mbedTLS-prev' && !steps.cache-mbedtls-prev.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/v${MBEDTLS_VERSION_PREV}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${MBEDTLS_SHA256_PREV}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "mbedtls-${MBEDTLS_VERSION_PREV}"
          export CC=gcc  # compiler warning promoted to error when using clang (as tested with 3.0.0/3.1.0)
          cmake -B . -G Ninja \
            -DENABLE_PROGRAMS=OFF \
            -DENABLE_TESTING=OFF \
            -DUSE_STATIC_MBEDTLS_LIBRARY=OFF \
            -DUSE_SHARED_MBEDTLS_LIBRARY=ON \
            -DCMAKE_INSTALL_PREFIX="$HOME"/usr
          cmake --build .
          cmake --install .

      - name: 'install wolfSSL from source'
        if: ${{ startsWith(matrix.crypto, 'wolfSSL-from-source') }}
        run: |
          if [ "${MATRIX_CRYPTO}" != 'wolfSSL-from-source' ]; then
            WOLFSSL_VERSION="${WOLFSSL_VERSION_PREV}"
            WOLFSSL_SHA256="${WOLFSSL_SHA256_PREV}"
            options='-DWOLFSSL_OPENSSLEXTRA=ON'
          fi
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${WOLFSSL_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          cmake -B bld -G Ninja ${options} \
            -DWOLFSSL_LIBSSH2=ON \
            -DBUILD_SELFTEST=OFF \
            -DWOLFSSL_OPENSSLALL=ON \
            -DWOLFSSL_EXAMPLES=OFF \
            -DWOLFSSL_CRYPT_TESTS=OFF \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_C_FLAGS='-DWOLFSSL_AESGCM_STREAM' \
            -DCMAKE_INSTALL_PREFIX="$HOME"/usr
          cmake --build bld
          cmake --install bld
          cd ..

      - name: 'cache BoringSSL'
        if: ${{ matrix.crypto == 'BoringSSL' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-boringssl
        with:
          path: ~/usr
          key: ${{ runner.os }}-boringssl-${{ env.BORINGSSL_VERSION }}-${{ matrix.arch }}

      - name: 'install BoringSSL from source'
        if: ${{ matrix.crypto == 'BoringSSL' && !steps.cache-boringssl.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/google/boringssl/releases/download/${BORINGSSL_VERSION}/boringssl-${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${BORINGSSL_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "boringssl-${BORINGSSL_VERSION}"
          cmake -B . -G Ninja \
            -DBUILD_TESTING=OFF \
            -DOPENSSL_SMALL=ON \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_INSTALL_PREFIX="$HOME"/usr
          cmake --build .
          cmake --install .

      - name: 'cache AWS-LC'
        if: ${{ matrix.crypto == 'AWS-LC' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-aws-lc
        with:
          path: ~/usr
          key: ${{ runner.os }}-aws-lc-${{ env.AWSLC_VERSION }}-${{ matrix.arch }}

      - name: 'install AWS-LC from source'
        if: ${{ matrix.crypto == 'AWS-LC' && !steps.cache-aws-lc.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${AWSLC_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "aws-lc-${AWSLC_VERSION}"
          cmake -B . -G Ninja -DCMAKE_INSTALL_PREFIX="$HOME"/usr -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF
          cmake --build .
          cmake --install .

      - name: 'cache LibreSSL'
        if: ${{ matrix.crypto == 'LibreSSL' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-libressl
        with:
          path: ~/usr
          key: ${{ runner.os }}-libressl-${{ env.LIBRESSL_VERSION }}-${{ matrix.arch }}

      - name: 'install LibreSSL from source'
        if: ${{ matrix.crypto == 'LibreSSL' && !steps.cache-libressl.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${LIBRESSL_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "libressl-${LIBRESSL_VERSION}"
          cmake -B . -G Ninja \
            -DLIBRESSL_APPS=OFF \
            -DLIBRESSL_TESTS=OFF \
            -DCMAKE_INSTALL_PREFIX="$HOME"/usr
          cmake --build .
          cmake --install .

      - name: 'cache OpenSSL'
        if: ${{ matrix.crypto == 'OpenSSL-3-no-deprecated' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-openssl
        with:
          path: ~/usr
          key: ${{ runner.os }}-openssl-${{ env.OPENSSL_VERSION }}-${{ matrix.arch }}

      - name: 'install OpenSSL from source'
        if: ${{ matrix.crypto == 'OpenSSL-3-no-deprecated' && !steps.cache-openssl.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OPENSSL_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "openssl-${OPENSSL_VERSION}"
          ./Configure no-deprecated \
            no-apps no-docs no-tests no-makedepend \
            no-comp no-quic no-legacy --prefix="$HOME"/usr
          make install_sw

      - name: 'cache OpenSSL 1.1.1'
        if: ${{ matrix.crypto == 'OpenSSL-111-from-source' }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-openssl111
        with:
          path: ~/usr
          key: ${{ runner.os }}-openssl-${{ env.OPENSSL111_VERSION }}-${{ matrix.arch }}

      - name: 'install OpenSSL 1.1.1 from source'
        if: ${{ matrix.crypto == 'OpenSSL-111-from-source' && !steps.cache-openssl111.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/openssl/openssl/releases/download/OpenSSL_1_1_1w/openssl-${OPENSSL111_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OPENSSL111_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
          cd "openssl-${OPENSSL111_VERSION}"
          ./config no-unit-test no-makedepend --prefix="$HOME"/usr no-tests
          make
          make -j1 install_sw

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autotools autoreconf'
        if: ${{ matrix.build == 'autotools' }}
        run: autoreconf -fi

      - name: 'configure'
        if: ${{ matrix.target != 'maketgz' }}
        env:
          MATRIX_COMPILER: '${{ matrix.compiler }}'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [ "${MATRIX_CRYPTO}" = 'BoringSSL' ] || \
               [ "${MATRIX_CRYPTO}" = 'AWS-LC' ] || \
               [ "${MATRIX_CRYPTO}" = 'LibreSSL' ] || \
               [[ "${MATRIX_CRYPTO}" = 'OpenSSL-'* ]]; then
              crypto='OpenSSL'
            elif [[ "${MATRIX_CRYPTO}" = 'mbedTLS-'* ]]; then
              crypto='mbedTLS'
            elif [[ "${MATRIX_CRYPTO}" = 'wolfSSL-'* ]]; then
              crypto='wolfSSL'
            else
              crypto="${MATRIX_CRYPTO}"
            fi
            [ -d "$HOME"/usr ] && options+=" -DCMAKE_PREFIX_PATH=$HOME/usr"
            if [ "${MATRIX_ARCH}" = 'i386' ]; then
              options+=" -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_SYSTEM_VERSION=1 -DCMAKE_SYSTEM_PROCESSOR=${MATRIX_ARCH}"
              cflags+=' -m32'
            fi
            if [ "${MATRIX_COMPILER}" = 'clang-tidy' ]; then
              options+=' -DLIBSSH2_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20'
              options+=' -DCMAKE_C_COMPILER=clang-20'
            fi
            if [[ "${MATRIX_CRYPTO}" =~ ^(OpenSSL|Libgcrypt|mbedTLS|wolfSSL)$ && "${MATRIX_COMPILER}" != 'clang-tidy' && "${MATRIX_ZLIB}" = 'ON' ]]; then
              options+=' -DCMAKE_C_STANDARD=90'
              cflags+=' -D_DEFAULT_SOURCE'  # for glibc ISO mode, in tests: popen(), pclose(), in examples: fileno(), tcsetattr()
            fi
            cmake -B bld -G Ninja ${options} $TOOLCHAIN_OPTION \
              -DCMAKE_C_FLAGS="${cflags}" \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DCRYPTO_BACKEND=${crypto} \
              -DENABLE_ZLIB_COMPRESSION="${MATRIX_ZLIB}"
          else
            if [ "${MATRIX_ARCH}" = 'i386' ]; then
              options='--host=i686-pc-linux-gnu'
              export CFLAGS=-m32
            fi
            mkdir bld && cd bld
            if [ "${MATRIX_ZLIB}" = 'OFF' ]; then
              options+=' --with-libz=no'
            else
              options+=' --with-libz'
            fi
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              ${options} \
              --disable-dependency-tracking
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        if: ${{ !matrix.target }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --target package
          else
            make -C bld
          fi

      - name: 'tests'
        if: ${{ !matrix.target && matrix.crypto != 'Libgcrypt' }}
        timeout-minutes: 10
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            export OPENSSH_SERVER_IMAGE; OPENSSH_SERVER_IMAGE=ghcr.io/libssh2/ci_tests_openssh_server:$(git rev-parse --short=20 HEAD:tests/openssh_server)
            [ -d "$HOME"/usr ] && export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$HOME/usr/lib"
            cd bld && ctest -VV --output-on-failure
          else
            make -C bld check V=1 || { cat bld/tests/*.log; false; }
          fi

      - name: 'autotools distcheck'
        if: ${{ matrix.target == 'distcheck' }}
        timeout-minutes: 5
        run: make -C bld distcheck

      - name: 'autotools maketgz'
        if: ${{ matrix.target == 'maketgz' }}
        timeout-minutes: 5
        run: |
          export SOURCE_DATE_EPOCH=1711526400
          ./configure --enable-werror --disable-debug \
            --disable-dependency-tracking
          ./maketgz 99.98.97
          # Test reproducibility
          mkdir run1; mv ./libssh2-99.98.97.* run1/
          make clean
          ./maketgz 99.98.97
          mkdir run2; cp -p ./libssh2-99.98.97.* run2/
          diff run1 run2
          # Test build from tarball
          tar -xvf libssh2-99.98.97.tar.gz
          cd libssh2-99.98.97
          ./configure --enable-option-checking=fatal --enable-werror --enable-debug --prefix="$HOME"/temp \
            --disable-dependency-tracking
          make install
          cd ..
          # Verify install
          diff -u <(find libssh2-99.98.97/docs    -name '*.3' -printf '%f\n' | sort) <(find "$HOME"/temp/share/man/man3 -name '*.3' -printf '%f\n' | sort)
          diff -u <(find libssh2-99.98.97/include -name '*.h' -printf '%f\n' | sort) <(find "$HOME"/temp/include        -name '*.h' -printf '%f\n' | sort)
          rm -rf libssh2-99.98.97

  build_linux_cross_mingw64:
    name: "linux -> mingw-w64, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }}"
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - { build: 'autotools', compiler: 'gcc' }
          - { build: 'cmake'    , compiler: 'gcc' }
          - { build: 'cmake'    , compiler: 'clang-tidy' }
    env:
      MATRIX_BUILD: '${{ matrix.build }}'
      TRIPLET: 'x86_64-w64-mingw32'
    steps:
      - name: 'install packages'
        env:
          INSTALL_PACKAGES: ${{ matrix.compiler == 'clang-tidy' && 'clang-20 clang-tidy-20' || '' }}
        run: sudo apt-get -o Dpkg::Use-Pty=0 install mingw-w64 ${INSTALL_PACKAGES}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autotools autoreconf'
        if: ${{ matrix.build == 'autotools' }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          MATRIX_COMPILER: '${{ matrix.compiler }}'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [ "${MATRIX_COMPILER}" = 'clang-tidy' ]; then
              options+=' -DLIBSSH2_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20'
              options+=' -DCMAKE_C_COMPILER=clang-20'
              options+=" -DCMAKE_RC_COMPILER=llvm-windres-$(clang-20 -dumpversion | cut -d '.' -f 1)"
            else
              options+=" -DCMAKE_C_COMPILER=${TRIPLET}-gcc"
            fi
            cmake -B bld -G Ninja \
              -DCMAKE_SYSTEM_NAME=Windows \
              -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              ${options}
          else
            mkdir bld && cd bld
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              --host="${TRIPLET}" \
              --disable-dependency-tracking
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld
          else
            make -C bld
          fi

  build_cygwin:
    name: 'cygwin'
    runs-on: windows-2022
    timeout-minutes: 10
    defaults:
      run:
        shell: D:\cygwin\bin\bash.exe '{0}'  # zizmor: ignore[misfeature]
    env:
      MATRIX_BUILD: '${{ matrix.build }}'
      SHELLOPTS: 'igncr'
    strategy:
      fail-fast: false
      matrix:
        include:
          - { build: 'autotools', platform: 'x86_64', compiler: 'gcc' }
          - { build: 'cmake'    , platform: 'x86_64', compiler: 'gcc' }
    steps:
      - uses: cygwin/cygwin-install-action@711d29f3da23c9f4a1798e369a6f01198c13b11a # v6.1
        with:
          platform: ${{ matrix.platform }}
          packages: ${{ matrix.build == 'autotools' && 'autoconf automake libtool make' || 'cmake ninja' }} gcc-core gcc-g++ binutils libssl-devel zlib-devel
          site: https://mirrors.kernel.org/sourceware/cygwin/
          work-vol: 'D:'

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autotools autoreconf'
        if: ${{ matrix.build == 'autotools' }}
        run: autoreconf -fi

      - name: 'configure'
        timeout-minutes: 2
        run: |
          PATH="/usr/bin:$(cygpath ${SYSTEMROOT})/System32"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake -B bld -G Ninja \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DENABLE_DEBUG_LOGGING=ON \
              -DCRYPTO_BACKEND=OpenSSL \
              -DOPENSSL_ROOT_DIR=/usr/lib \
              -DENABLE_ZLIB_COMPRESSION=ON \
              -DBUILD_OSSFUZZ=ON \
              -DRUN_DOCKER_TESTS=OFF \
              -DRUN_SSHD_TESTS=OFF
          else
            mkdir bld && cd bld
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              --with-crypto=openssl \
              --disable-docker-tests \
              --disable-dependency-tracking
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        timeout-minutes: 5
        run: |
          PATH="/usr/bin:$(cygpath ${SYSTEMROOT})/System32"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld
          else
            make -C bld
          fi

      - name: 'tests'
        timeout-minutes: 5
        run: |
          PATH="/usr/bin:$(cygpath ${SYSTEMROOT})/System32"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cd bld && ctest -VV --output-on-failure
          else
            make -C bld check V=1 || { cat bld/tests/*.log; false; }
          fi

  build_msys2:
    name: 'msys2'
    runs-on: windows-2022
    timeout-minutes: 10
    defaults:
      run:
        shell: msys2 {0}  # zizmor: ignore[misfeature]
    env:
      MATRIX_BUILD: '${{ matrix.build }}'
      MATRIX_CRYPTO: '${{ matrix.crypto }}'
      MATRIX_ENV: '${{ matrix.env }}'
      MATRIX_TEST: '${{ matrix.test }}'
    strategy:
      fail-fast: false
      matrix:
        include:
          - { build: 'autotools', sys: msys   , crypto: openssl, env: x86_64 }
          - { build: 'cmake'    , sys: msys   , crypto: OpenSSL, env: x86_64 }
          - { build: 'autotools', sys: mingw64, crypto: wincng , env: x86_64 }
          - { build: 'autotools', sys: mingw64, crypto: openssl, env: x86_64 }
          - { build: 'autotools', sys: mingw32, crypto: openssl, env: i686 }
          - { build: 'autotools', sys: ucrt64 , crypto: openssl, env: ucrt-x86_64 }
          - { build: 'autotools', sys: clang64, crypto: openssl, env: clang-x86_64 }
          - { build: 'autotools', sys: clang64, crypto: wincng , env: clang-x86_64 }
          - { build: 'cmake'    , sys: ucrt64 , crypto: OpenSSL, env: ucrt-x86_64 }
          - { build: 'cmake'    , sys: clang64, crypto: OpenSSL, env: clang-x86_64 }
          - { build: 'cmake'    , sys: mingw64, crypto: OpenSSL, env: x86_64, test: 'uwp' }
          - { build: 'cmake'    , sys: mingw64, crypto: OpenSSL, env: x86_64, test: 'no-options' }
    steps:
      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0
        if: ${{ matrix.sys == 'msys' }}
        with:
          msystem: ${{ matrix.sys }}
          install: gcc ${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || 'ninja' }} openssl-devel zlib-devel
      - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0
        if: ${{ matrix.sys != 'msys' }}
        with:
          msystem: ${{ matrix.sys }}
          install: >-
            mingw-w64-${{ matrix.env }}-cc
            mingw-w64-${{ matrix.env }}-${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || '' }}
            mingw-w64-${{ matrix.env }}-openssl

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autotools autoreconf'
        if: ${{ matrix.build == 'autotools' }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          SSHD: 'C:/Program Files/Git/usr/bin/sshd.exe'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [[ "${MATRIX_ENV}" = 'clang'* ]]; then
              options='-DCMAKE_C_COMPILER=clang'
            else
              options='-DCMAKE_C_COMPILER=gcc'
            fi
            cflags=''
            if [ "${MATRIX_TEST}" = 'uwp' ]; then
              options+=' -DCMAKE_SYSTEM_NAME=WindowsStore -DCMAKE_SYSTEM_VERSION=10.0'
              pacman --noconfirm --ask 20 --noprogressbar --sync --needed "mingw-w64-${MATRIX_ENV}-winstorecompat-git"
              specs="$(realpath gcc-specs-uwp)"
              gcc -dumpspecs | sed -e 's/-lmingwex/-lwindowsapp -lmingwex -lwindowsapp -lwindowsappcompat/' -e 's/-lmsvcrt/-lmsvcr120_app/' > "${specs}"
              cflags+=" -specs=$(cygpath -w "${specs}") -DWINSTORECOMPAT -DWINAPI_FAMILY=WINAPI_FAMILY_APP"
            elif [ "${MATRIX_TEST}" = 'no-options' ]; then
              options+=' -DLIBSSH2_NO_DEPRECATED=ON'
              cflags+=' -DLIBSSH2_NO_MD5 -DLIBSSH2_NO_MD5_PEM -DLIBSSH2_NO_HMAC_RIPEMD -DLIBSSH2_DSA_ENABLE'
              cflags+=' -DLIBSSH2_NO_AES_CBC -DLIBSSH2_NO_AES_CTR -DLIBSSH2_NO_BLOWFISH -DLIBSSH2_NO_RC4 -DLIBSSH2_NO_CAST -DLIBSSH2_NO_3DES'
            fi
            cmake -B bld -G Ninja ${options} \
              -DCMAKE_C_FLAGS="${cflags}" \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DENABLE_DEBUG_LOGGING=ON \
              -DCRYPTO_BACKEND="${MATRIX_CRYPTO}" \
              -DENABLE_ZLIB_COMPRESSION=ON \
              -DRUN_DOCKER_TESTS=OFF \
              -DRUN_SSHD_TESTS=OFF \
              -DCMAKE_VERBOSE_MAKEFILE=ON
          else
            if [ "${MATRIX_CRYPTO}" = 'wincng' ] && [[ "${MATRIX_ENV}" = 'clang'* ]]; then
              options='--enable-ecdsa-wincng'
            fi
            # sshd tests sometimes hang
            mkdir bld && cd bld
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              --with-crypto="${MATRIX_CRYPTO}" \
              --disable-docker-tests \
              --disable-sshd-tests \
              ${options} \
              --disable-dependency-tracking
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld
          else
            make -C bld
          fi

      - name: 'tests'
        timeout-minutes: 10
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [ "${MATRIX_TEST}" != 'uwp' ]; then  # UWP missing 'msvcr120_app.dll', fails with exit code 0xc0000135
              cd bld && ctest -VV --output-on-failure
            fi
          else
            make -C bld check V=1 || { cat bld/tests/*.log; false; }
          fi

  build_msvc:
    name: 'msvc'
    runs-on: windows-2022
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x64  , plat: windows, crypto: WinCNG , wincng_ecdsa: 'OFF', log: 'OFF', shared: 'OFF', zlib: 'OFF', unity: 'ON' }
          - { arch: x64  , plat: windows, crypto: WinCNG , wincng_ecdsa: 'ON' , log: 'ON' , shared: 'ON' , zlib: 'OFF', unity: 'ON' }
          - { arch: x64  , plat: windows, crypto: OpenSSL, wincng_ecdsa: 'OFF', log: 'OFF', shared: 'ON' , zlib: 'OFF', unity: 'ON' }
          - { arch: x64  , plat: uwp    , crypto: WinCNG , wincng_ecdsa: 'OFF', log: 'OFF', shared: 'ON' , zlib: 'OFF', unity: 'ON' }
          - { arch: arm64, plat: windows, crypto: WinCNG , wincng_ecdsa: 'ON' , log: 'OFF', shared: 'ON' , zlib: 'OFF', unity: 'ON' }
          - { arch: arm64, plat: uwp    , crypto: WinCNG , wincng_ecdsa: 'ON' , log: 'OFF', shared: 'ON' , zlib: 'OFF', unity: 'OFF' }
          - { arch: x86  , plat: windows, crypto: WinCNG , wincng_ecdsa: 'OFF', log: 'OFF', shared: 'ON' , zlib: 'OFF', unity: 'ON' }
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'configure'
        env:
          MATRIX_ARCH: '${{ matrix.arch }}'
          MATRIX_CRYPTO: '${{ matrix.crypto }}'
          MATRIX_PLAT: '${{ matrix.plat }}'
          MATRIX_WINCND_ECDSA: '${{ matrix.wincng_ecdsa }}'
          MATRIX_LOG: '${{ matrix.log }}'
          MATRIX_SHARED: '${{ matrix.shared }}'
          MATRIX_ZLIB: '${{ matrix.zlib }}'
          MATRIX_UNITY: '${{ matrix.unity }}'
        run: |
          options=''
          archgen="${MATRIX_ARCH}"; [ "${archgen}" = 'x86' ] && archgen='Win32'
          if [ "${MATRIX_PLAT}" = 'uwp' ]; then
            system='WindowsStore'
            options+=' -DCMAKE_SYSTEM_VERSION=10.0'
          else
            system='Windows'
          fi
          [ "${MATRIX_CRYPTO}" = 'WinCNG' ] && options+=" -DENABLE_ECDSA_WINCNG=${MATRIX_WINCND_ECDSA}"
          cmake -B bld ${options} \
            -DCMAKE_SYSTEM_NAME="${system}" \
            -DCMAKE_TOOLCHAIN_FILE=C:/vcpkg/scripts/buildsystems/vcpkg.cmake \
            -DCMAKE_GENERATOR_PLATFORM=${archgen} \
            -DVCPKG_TARGET_TRIPLET="${MATRIX_ARCH}-${MATRIX_PLAT}" \
            -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
            -DCMAKE_UNITY_BUILD="${MATRIX_UNITY}" \
            -DENABLE_WERROR=ON \
            -DENABLE_DEBUG_LOGGING="${MATRIX_LOG}" \
            -DBUILD_SHARED_LIBS="${MATRIX_SHARED}" \
            -DCRYPTO_BACKEND="${MATRIX_CRYPTO}" \
            -DENABLE_ZLIB_COMPRESSION="${MATRIX_ZLIB}" \
            -DRUN_DOCKER_TESTS=OFF \
            -DRUN_SSHD_TESTS=OFF

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        run: cmake --build bld --parallel 5 --target package --config Release

      - name: 'tests'
        # UWP binaries require a CRT DLL that is not found. Static CRT not supported.
        if: ${{ matrix.arch != 'arm64' && matrix.plat != 'uwp' }}
        timeout-minutes: 10
        run: cd bld && ctest -VV -C Release --output-on-failure

  build_macos:
    name: 'macOS (${{ matrix.build }}, ${{ matrix.crypto.name }})'
    runs-on: macos-latest
    timeout-minutes: 10
    env:
      MATRIX_BUILD: '${{ matrix.build }}'
      MATRIX_INSTALL: '${{ matrix.crypto.install }}'
    strategy:
      fail-fast: false
      matrix:
        build: [autotools, cmake]
        crypto:
          - name: 'OpenSSL 3'
            install: openssl
            configure: --with-crypto=openssl --with-libssl-prefix=/opt/homebrew/opt/openssl
            cmake: -DCRYPTO_BACKEND=OpenSSL -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl
          - name: 'OpenSSL 1.1'
            install: openssl@1.1
            configure: --with-crypto=openssl --with-libssl-prefix=/opt/homebrew/opt/openssl@1.1
            cmake: -DCRYPTO_BACKEND=OpenSSL -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@1.1
          - name: 'LibreSSL'
            install: libressl
            configure: --with-crypto=openssl --with-libssl-prefix=/opt/homebrew/opt/libressl
            cmake: -DCRYPTO_BACKEND=OpenSSL -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl
          - name: 'Libgcrypt'
            install: libgcrypt
            configure: --with-crypto=libgcrypt --with-libgcrypt-prefix=/opt/homebrew
            cmake: -DCRYPTO_BACKEND=Libgcrypt
          - name: 'mbedTLS'
            install: mbedtls@3
            configure: --with-crypto=mbedtls --with-libmbedcrypto-prefix=/opt/homebrew
            cmake: -DCRYPTO_BACKEND=mbedTLS
          - name: 'wolfSSL'
            install: wolfssl
            configure: --with-crypto=wolfssl --with-libwolfssl-prefix=/opt/homebrew
            cmake: -DCRYPTO_BACKEND=wolfSSL
    steps:
      - name: 'install packages'
        env:
          INSTALL_PACKAGES: ${{ matrix.build == 'autotools' && 'automake libtool' || '' }}
        run: brew install ${INSTALL_PACKAGES} ${MATRIX_INSTALL}
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autotools autoreconf'
        if: ${{ matrix.build == 'autotools' }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          MATRIX_CONFIGURE: '${{ matrix.crypto.configure }}'
          MATRIX_GENERATE: '${{ matrix.crypto.cmake }}'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [ "${MATRIX_INSTALL}" = 'mbedtls@3' ]; then
              export PKG_CONFIG_PATH; PKG_CONFIG_PATH="$(brew --prefix mbedtls@3)"/lib/pkgconfig
            fi
            cmake -B bld -G Ninja ${MATRIX_GENERATE} \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DENABLE_DEBUG_LOGGING=ON \
              -DENABLE_ZLIB_COMPRESSION=ON \
              -DRUN_DOCKER_TESTS=OFF \
              -DRUN_SSHD_TESTS=OFF
          else
            if [ "${MATRIX_INSTALL}" = 'mbedtls@3' ]; then
              export CPPFLAGS; CPPFLAGS=-I"$(brew --prefix mbedtls@3)"/include
              export LDFLAGS; LDFLAGS=-L"$(brew --prefix mbedtls@3)"/lib
            fi
            mkdir bld && cd bld
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              --with-libz ${MATRIX_CONFIGURE} \
              --disable-docker-tests \
              --disable-sshd-tests \
              --disable-dependency-tracking
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld
          else
            make -C bld -j4 V=1
          fi

      - name: 'tests'
        timeout-minutes: 10
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cd bld && ctest -VV --output-on-failure
          else
            make -C bld check V=1 || { cat bld/tests/*.log; false; }
          fi

  build_netbsd:
    name: 'NetBSD (cmake, openssl, clang)'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        arch: ['x86_64', 'arm64']
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: 'cmake'
        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
        with:
          operating_system: 'netbsd'
          version: '10.1'
          architecture: ${{ matrix.arch }}
          run: |
            # https://pkgsrc.se/
            sudo pkgin -y install cmake ninja-build
            cmake -B bld -G Ninja \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DENABLE_DEBUG_LOGGING=ON \
              -DCRYPTO_BACKEND=OpenSSL \
              -DBUILD_STATIC_LIBS=OFF \
              -DRUN_DOCKER_TESTS=OFF \
              -DRUN_SSHD_TESTS=OFF \
              || { cat bld/CMakeFiles/CMake*.yaml; false; }
            cmake --build bld

  build_openbsd:
    name: 'OpenBSD (cmake, libressl, clang)'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        arch: ['x86_64']
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: 'cmake'
        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
        with:
          operating_system: 'openbsd'
          version: '7.7'
          architecture: ${{ matrix.arch }}
          run: |
            # https://openbsd.app/
            sudo pkg_add cmake ninja
            pkg_info || true
            cmake -B bld -G Ninja \
              -DCMAKE_UNITY_BUILD=ON \
              -DENABLE_WERROR=ON \
              -DENABLE_DEBUG_LOGGING=ON \
              -DCRYPTO_BACKEND=OpenSSL \
              -DBUILD_STATIC_LIBS=OFF \
              -DRUN_DOCKER_TESTS=OFF \
              -DRUN_SSHD_TESTS=OFF \
              || { cat bld/CMakeFiles/CMake*.yaml; false; }
            cmake --build bld

  build_freebsd:
    name: 'FreeBSD (autotools, openssl, clang)'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      CC: clang
    strategy:
      fail-fast: false
      matrix:
        arch: ['x86_64']
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: 'autotools'
        uses: cross-platform-actions/action@492b0c80085400348c599edace11141a4ee73524 # v0.32.0
        with:
          operating_system: 'freebsd'
          version: '14.3'
          architecture: ${{ matrix.arch }}
          environment_variables: 'CC'
          run: |
            # https://ports.freebsd.org/
            sudo pkg install -y autoconf automake gettext libtool
            autoreconf -fi
            mkdir bld && cd bld
            ../configure --enable-option-checking=fatal --enable-werror --enable-debug \
              --with-crypto=openssl \
              --disable-docker-tests \
              --disable-dependency-tracking \
              || { tail -n 1000 config.log; false; }
            make -j3
            make check V=1 || { cat tests/*.log; false; }