From 1f8f719c7175b1a86bb830bdde60f8183e1d8956 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Tue, 13 Oct 2026 20:47:56 +0200 Subject: [PATCH 1/4] tools: reenable openssl 1.1.x and 3.0.x on `test-shared.yml` Signed-off-by: Antoine du Hamel --- tools/dep_updaters/update-nixpkgs-pin.sh | 4 ++-- tools/nix/openssl-matrix.nix | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh index 32900b4a705e..c24fd7b63aea 100755 --- a/tools/dep_updaters/update-nixpkgs-pin.sh +++ b/tools/dep_updaters/update-nixpkgs-pin.sh @@ -50,7 +50,7 @@ update_pkgs_file "$NIXPKGS_COMPAT_PIN_FILE" "$COMPAT_VERSION_SHA1" "$COMPAT_UPST OPENSSL_MAJOR=$(awk -F= '/^MAJOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat") OPENSSL_MINOR=$(awk -F= '/^MINOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat") -nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E " +nix-instantiate -I "nixpkgs=$NIXPKGS_COMPAT_PIN_FILE" --eval --strict --json -E " let pkgs = import {}; opensslAttrs = builtins.filter @@ -80,7 +80,7 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E " ); } " | jq -r '"{ - pkgs ? import ./pkgs.nix { + pkgs ? import ./pkgs-26.05.nix { config.permittedInsecurePackages = [ \(.permittedInsecurePackages | if length > 0 then "\(map(@json) | join(" ")) " else "" end)]; }, }: diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix index 6e86f3c51050..80839284330a 100644 --- a/tools/nix/openssl-matrix.nix +++ b/tools/nix/openssl-matrix.nix @@ -1,6 +1,6 @@ { - pkgs ? import ./pkgs.nix { - config.permittedInsecurePackages = [ ]; + pkgs ? import ./pkgs-26.05.nix { + config.permittedInsecurePackages = [ "openssl-1.1.1w" "openssl-3.0.22" ]; }, }: @@ -11,6 +11,8 @@ # Other OpenSSL variants we want to test for: inherit (pkgs) boringssl + openssl_1_1 + openssl_3 openssl_3_6 openssl_4_0 ; From ad0e4648b912069b7112f4f1db79a96b6dac9f8c Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Tue, 13 Oct 2026 21:05:00 +0200 Subject: [PATCH 2/4] fixup! tools: reenable openssl 1.1.x and 3.0.x on `test-shared.yml` --- tools/dep_updaters/update-nixpkgs-pin.sh | 2 +- tools/nix/openssl-matrix.nix | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh index c24fd7b63aea..ae5513538847 100755 --- a/tools/dep_updaters/update-nixpkgs-pin.sh +++ b/tools/dep_updaters/update-nixpkgs-pin.sh @@ -81,7 +81,7 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_COMPAT_PIN_FILE" --eval --strict --json -E } " | jq -r '"{ pkgs ? import ./pkgs-26.05.nix { - config.permittedInsecurePackages = [ \(.permittedInsecurePackages | if length > 0 then "\(map(@json) | join(" ")) " else "" end)]; + config.permittedInsecurePackages = [\(.permittedInsecurePackages | if length > 0 then "\n \(map(@json) | join("\n "))\n " else "" end)]; }, }: diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix index 80839284330a..690da4e17886 100644 --- a/tools/nix/openssl-matrix.nix +++ b/tools/nix/openssl-matrix.nix @@ -1,6 +1,9 @@ { pkgs ? import ./pkgs-26.05.nix { - config.permittedInsecurePackages = [ "openssl-1.1.1w" "openssl-3.0.22" ]; + config.permittedInsecurePackages = [ + "openssl-1.1.1w" + "openssl-3.0.22" + ]; }, }: From 2d33019b259ff2480e7825d3dbc70cff508d2fc5 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 14 Oct 2026 11:19:12 +0200 Subject: [PATCH 3/4] fixup! tools: reenable openssl 1.1.x and 3.0.x on `test-shared.yml` --- tools/dep_updaters/update-nixpkgs-pin.sh | 14 +++++++++++--- tools/nix/openssl-matrix.nix | 2 +- tools/nix/pkgs.nix | 6 ++++++ 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh index ae5513538847..5e10ade16b98 100755 --- a/tools/dep_updaters/update-nixpkgs-pin.sh +++ b/tools/dep_updaters/update-nixpkgs-pin.sh @@ -50,7 +50,7 @@ update_pkgs_file "$NIXPKGS_COMPAT_PIN_FILE" "$COMPAT_VERSION_SHA1" "$COMPAT_UPST OPENSSL_MAJOR=$(awk -F= '/^MAJOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat") OPENSSL_MINOR=$(awk -F= '/^MINOR=[0-9]+$/ { print $2; exit }' "$BASE_DIR/deps/openssl/openssl/VERSION.dat") -nix-instantiate -I "nixpkgs=$NIXPKGS_COMPAT_PIN_FILE" --eval --strict --json -E " +nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E " let pkgs = import {}; opensslAttrs = builtins.filter @@ -80,8 +80,16 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_COMPAT_PIN_FILE" --eval --strict --json -E ); } " | jq -r '"{ - pkgs ? import ./pkgs-26.05.nix { - config.permittedInsecurePackages = [\(.permittedInsecurePackages | if length > 0 then "\n \(map(@json) | join("\n "))\n " else "" end)]; + pkgs ? import ./pkgs.nix { + config.permittedInsecurePackages = [\( + .permittedInsecurePackages | + if length == 0 then + " " + elif length == 1 then + " \(first | @json) " + else + "\n \(map(@json) | join("\n "))\n " + end)]; }, }: diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix index 690da4e17886..7187d707281d 100644 --- a/tools/nix/openssl-matrix.nix +++ b/tools/nix/openssl-matrix.nix @@ -1,5 +1,5 @@ { - pkgs ? import ./pkgs-26.05.nix { + pkgs ? import ./pkgs.nix { config.permittedInsecurePackages = [ "openssl-1.1.1w" "openssl-3.0.22" diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix index 52ef60358b58..ef4dce6fd26b 100644 --- a/tools/nix/pkgs.nix +++ b/tools/nix/pkgs.nix @@ -15,6 +15,12 @@ if builtins.currentSystem == "x86_64-darwin" then else nixpkgs // { + # OpenSSL 1.1.x and 3.0.x were removed from unstable, we want to keep testing with it + inherit (import ./pkgs-26.05.nix arg) + openssl_1_1 + openssl_3 + ; + # TODO: remove pin once https://github.com/mozilla/sccache/issues/2869 is resolved sccache = nixpkgs.callPackage (builtins.fetchurl { url = "${repo}/raw/aff8a0b28396750446e5537a96461bc4facdb287/pkgs/by-name/sc/sccache/package.nix"; From b71d598805a3a1937145a0edf60011f43de83fdc Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 14 Oct 2026 11:25:17 +0200 Subject: [PATCH 4/4] fixup! fixup! tools: reenable openssl 1.1.x and 3.0.x on `test-shared.yml` --- tools/dep_updaters/update-nixpkgs-pin.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh index 5e10ade16b98..2128742ac029 100755 --- a/tools/dep_updaters/update-nixpkgs-pin.sh +++ b/tools/dep_updaters/update-nixpkgs-pin.sh @@ -89,7 +89,8 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E " " \(first | @json) " else "\n \(map(@json) | join("\n "))\n " - end)]; + end + )]; }, }: