linux.yml

# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# SPDX-License-Identifier: curl

name: 'Linux'

'on':
  push:
    branches:
      - master
      - 'curl-*'
      - '*/ci'
    paths-ignore:
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'
  pull_request:
    branches:
      - master
      - 'curl-*'
    paths-ignore:
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions: {}
cache-mode: write

env:
  MAKEFLAGS: -j 5
  CURL_CI: github
  CURL_TEST_MIN: 1800
  DO_NOT_TRACK: '1'
  # renovate: datasource=github-tags depName=awslabs/aws-lc
  AWSLC_VERSION: 5.11.0
  # renovate: datasource=github-tags depName=google/boringssl
  BORINGSSL_VERSION: 0.20260929.0
  # renovate: datasource=github-releases depName=pizlonator/fil-c versioning=semver-coerced
  FIL_C_VERSION: 0.686
  # renovate: datasource=github-tags depName=libressl/portable
  LIBRESSL_VERSION: 4.3.3
  # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls
  MBEDTLS_VERSION: 4.2.0
  # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls extractVersion=^v?(?<version>3\..+)$
  MBEDTLS_PREV_VERSION: 3.6.7
  # renovate: datasource=github-tags depName=nghttp2/nghttp2
  NGHTTP2_VERSION: 1.70.0
  # renovate: datasource=github-tags depName=openldap/openldap versioning=regex:^(?<major>\d+)_(?<minor>\d+)_(?<patch>\d+)$ extractVersion=^OPENLDAP_REL_ENG_(?<version>.+)$
  OPENLDAP_VERSION: 2_7_1
  # renovate: datasource=github-releases depName=openssl/openssl extractVersion=^openssl-(?<version>.+)$
  OPENSSL_VERSION: 4.0.3
  # renovate: datasource=github-tags depName=rustls/rustls-ffi
  RUSTLS_VERSION: 0.15.4
  # renovate: datasource=github-tags depName=wolfSSL/wolfssl extractVersion=^v?(?<version>.+)-stable$
  WOLFSSL_VERSION: 5.9.4

jobs:
  linux:
    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
    runs-on: ${{ matrix.build.image || 'ubuntu-latest' }}
    container: ${{ matrix.build.container }}
    timeout-minutes: 15
    env:
      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
    strategy:
      fail-fast: false
      matrix:
        build:
          - name: 'awslc'
            install_steps: awslc pytest test-linter
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/awslc/lib
            configure: --with-openssl=/home/runner/pkg/awslc --enable-ech --enable-ntlm

          - name: 'awslc'
            install_packages: libidn2-dev
            install_steps: awslc clean
            generate: -DOPENSSL_ROOT_DIR=/home/runner/pkg/awslc -DUSE_ECH=ON -DCMAKE_UNITY_BUILD=OFF -DCURL_DROP_UNUSED=ON -DCURL_PATCHSTAMP=test-patch -DCURL_ENABLE_NTLM=ON

          - name: 'boringssl'
            install_steps: boringssl pytest
            generate: -DOPENSSL_ROOT_DIR=/home/runner/pkg/boringssl -DOPENSSL_USE_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON

          - name: 'libressl krb5'
            image: ubuntu-24.04-arm
            install_packages: libidn2-dev libnghttp2-dev libldap-dev libkrb5-dev
            install_steps: libressl-c pytest codeset-test1
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/libressl/lib
            configure: --with-openssl=/home/runner/pkg/libressl --with-gssapi --enable-debug

          - name: 'libressl krb5 valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libldap-dev libkrb5-dev valgrind
            install_steps: libressl-c
            tflags: '--subset=0/2'
            generate: -DOPENSSL_ROOT_DIR=/home/runner/pkg/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON -DCURL_ENABLE_NTLM=ON

          - name: 'libressl krb5 valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libldap-dev libkrb5-dev valgrind
            install_steps: libressl-c
            tflags: '--subset=1/2'
            generate: -DOPENSSL_ROOT_DIR=/home/runner/pkg/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON -DCURL_ENABLE_NTLM=ON

          - name: 'libressl clang'
            image: ubuntu-24.04-arm
            install_packages: clang
            install_steps: libressl-c
            CC: clang
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/libressl/lib
            configure: --with-openssl=/home/runner/pkg/libressl --enable-debug

          - name: 'libressl Fil-C'
            install_steps: filc libressl-filc nghttp2-filc pytest
            tflags: '!776'  # adds 1-9 minutes to the test run step, and fails consistently
            CC: /home/runner/filc/build/bin/filcc
            PKG_CONFIG_PATH: /home/runner/pkg/nghttp2/lib/pkgconfig
            generate: >-
              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_UNITY_BUILD=OFF -DCURL_DISABLE_TYPECHECK=ON
              -DOPENSSL_ROOT_DIR=/home/runner/pkg/libressl -DCURL_USE_LIBPSL=OFF
              -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
              -DCURL_DISABLE_LDAP=ON -DUSE_LIBIDN2=OFF -DCURL_USE_LIBSSH2=OFF
              -DCURL_ENABLE_NTLM=ON

          - name: 'mbedtls gss valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libidn2-dev libldap-dev libgss-dev valgrind
            install_steps: mbedtls-latest
            tflags: '--subset=0/2'
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/mbedtls/lib
            PKG_CONFIG_PATH: /home/runner/pkg/mbedtls/lib/pkgconfig
            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_GSSAPI=ON -DCURL_DROP_UNUSED=ON

          - name: 'mbedtls gss valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libidn2-dev libldap-dev libgss-dev valgrind
            install_steps: mbedtls-latest
            tflags: '--subset=1/2'
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/mbedtls/lib
            PKG_CONFIG_PATH: /home/runner/pkg/mbedtls/lib/pkgconfig
            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_GSSAPI=ON

          - name: 'mbedtls clang'
            install_packages: libssh-dev libnghttp2-dev libldap-dev clang
            install_steps: mbedtls-latest pytest
            CC: clang
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/mbedtls/lib
            configure: --with-mbedtls=/home/runner/pkg/mbedtls --with-libssh --enable-debug --with-fish-functions-dir --with-zsh-functions-dir

          - name: 'mbedtls-prev'
            install_packages: libssh2-1-dev libnghttp2-dev libuv1-dev
            install_steps: mbedtls-prev pytest
            PKG_CONFIG_PATH: /home/runner/pkg/mbedtls-prev/lib/pkgconfig  # Requires v3.6.0
            generate: -DCURL_USE_MBEDTLS=ON -DCURL_USE_LIBUV=ON -DENABLE_DEBUG=ON

          - name: 'mbedtls-pkg MultiSSL !pc'
            install_packages: libnghttp2-dev libmbedtls-dev
            install_steps: mbedtls-latest skipall
            generate: >-
              -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_DEFAULT_SSL_BACKEND=mbedtls
              -DMBEDTLS_INCLUDE_DIR=/home/runner/pkg/mbedtls/include
              -DMBEDTLS_LIBRARY=/home/runner/pkg/mbedtls/lib/libmbedtls.a
              -DMBEDX509_LIBRARY=/home/runner/pkg/mbedtls/lib/libmbedx509.a
              -DMBEDCRYPTO_LIBRARY=/home/runner/pkg/mbedtls/lib/libmbedcrypto.a
              -DCURL_USE_PKGCONFIG=OFF -DCURL_USE_OPENSSL=ON
              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
              -DCURL_COMPLETION_FISH=ON -DCURL_COMPLETION_ZSH=ON

          - name: 'rustls valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libldap-dev valgrind
            install_steps: rust rustls
            PKG_CONFIG_PATH: /home/runner/rustls/lib/pkgconfig
            tflags: '--subset=0/2'
            generate: -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DENABLE_DEBUG=ON

          - name: 'rustls valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: libnghttp2-dev libldap-dev valgrind
            install_steps: rust rustls
            PKG_CONFIG_PATH: /home/runner/rustls/lib/pkgconfig
            tflags: '--subset=1/2'
            generate: -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DENABLE_DEBUG=ON

          - name: 'rustls'
            install_packages: libnghttp2-dev libldap-dev
            install_steps: rust rustls skiprun pytest
            LDFLAGS: -Wl,-rpath,/home/runner/rustls/lib
            PKG_CONFIG_PATH: /home/runner/rustls/lib/pkgconfig
            configure: --with-rustls --enable-ech --enable-debug

          - name: 'wolfssl-all'
            image: ubuntu-26.04-arm
            install_steps: wolfssl-all
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/wolfssl-all/lib
            configure: --with-wolfssl=/home/runner/pkg/wolfssl-all --enable-ech --enable-debug

          - name: 'wolfssl-opensslextra valgrind 1'
            image: ubuntu-26.04-arm
            install_packages: valgrind
            install_steps: wolfssl-opensslextra
            tflags: '--subset=0/2'
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/wolfssl-opensslextra/lib
            configure: --with-wolfssl=/home/runner/pkg/wolfssl-opensslextra --enable-ech --enable-debug --enable-httpsig

          - name: 'wolfssl-opensslextra valgrind 2'
            image: ubuntu-26.04-arm
            install_packages: valgrind
            install_steps: wolfssl-opensslextra
            tflags: '--subset=1/2'
            LDFLAGS: -Wl,-rpath,/home/runner/pkg/wolfssl-opensslextra/lib
            configure: --with-wolfssl=/home/runner/pkg/wolfssl-opensslextra --enable-ech --enable-debug --enable-httpsig

          - name: 'openssl default'
            image: ubuntu-24.04
            install_steps: pytest
            configure: --with-openssl --enable-debug --disable-unity

          - name: 'openssl libssh2 sync-resolver valgrind 1'
            image: ubuntu-26.04-arm
            install_packages: gcc-16 libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev valgrind
            CC: gcc-16
            tflags: '--subset=0/2'
            generate: -DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_ENABLE_NTLM=ON

          - name: 'openssl libssh2 sync-resolver valgrind 2 +analyzer'
            image: ubuntu-26.04-arm
            install_packages: gcc-16 libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev valgrind
            CC: gcc-16
            tflags: '--subset=1/2'
            generate: -DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_ENABLE_NTLM=ON -DCURL_GCC_ANALYZER=ON

          - name: 'openssl intel C89'
            image: ubuntu-24.04
            install_packages: libssh-dev
            install_steps: pytest
            configure: CFLAGS=-std=gnu89 --with-openssl --with-libssh --enable-debug

          - name: 'openssl arm C89'
            image: ubuntu-24.04-arm
            install_packages: libssh2-1-dev
            install_steps: pytest
            configure: CFLAGS=-std=gnu89 --with-openssl --with-libssh2 --enable-debug --disable-verbose

          - name: 'openssl -O3 libssh valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: libssh-dev valgrind
            CFLAGS: -O3
            tflags: '--subset=0/2'
            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=50 -DCURL_ENABLE_NTLM=ON

          - name: 'openssl -O3 libssh valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: libssh-dev valgrind
            CFLAGS: -O3
            tflags: '--subset=1/2'
            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=50 -DCURL_ENABLE_NTLM=ON

          - name: 'openssl clang krb5 openldap static'
            image: ubuntu-24.04
            install_steps: openldap-static
            install_packages: libidn2-dev libkrb5-dev clang libssl-dev
            CC: clang
            configure: >-
              --enable-static --disable-shared --with-openssl --with-gssapi --enable-debug --disable-docs
              --disable-manual --with-ldap=/home/runner/pkg/openldap-static --with-ldap-lib=ldap --with-lber-lib=lber

          - name: 'openssl clang krb5 LTO'
            image: ubuntu-24.04-arm
            install_packages: libssh2-1-dev libkrb5-dev clang
            install_steps: skiprun pytest
            CC: clang
            generate: -DCURL_USE_OPENSSL=ON -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LTO=ON

          - name: 'openssl !ipv6 !--libcurl !--digest-auth'
            image: ubuntu-24.04-arm
            configure: --with-openssl --disable-ipv6 --enable-debug --disable-unity --disable-libcurl-option --disable-digest-auth --enable-ntlm

          - name: 'curl_global_init_mem debug valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: valgrind
            tflags: '--subset=0/2'
            configure: --enable-init-mem-debug --with-openssl --disable-debug --enable-ntlm

          - name: 'curl_global_init_mem debug valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: valgrind
            tflags: '--subset=1/2'
            configure: --enable-init-mem-debug --with-openssl --disable-debug --enable-ntlm

          - name: 'openssl https-only'
            image: ubuntu-24.04-arm
            tflags: '--min=1360'
            configure: >-
              --with-openssl --enable-debug --disable-unity
              --disable-dict --disable-gopher --disable-ldap --disable-telnet
              --disable-imap --disable-pop3 --disable-smtp
              --disable-rtsp
              --without-libssh2 --without-libssh
              --disable-tftp --disable-ftp --disable-file
              --enable-ntlm

          - name: 'openssl torture 1'
            install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
            tflags: '-t --shallow=25 --subset=0/2'
            torture: true
            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'openssl torture 2'
            install_packages: libnghttp2-dev libssh2-1-dev libc-ares-dev
            tflags: '-t --shallow=25 --subset=1/2'
            torture: true
            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON -DCURL_DISABLE_HTTPSIG=OFF

          - name: 'openssl i686'
            image: ubuntu-24.04
            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
            CC: i686-linux-gnu-gcc-14
            LDFLAGS: -L/usr/lib/i386-linux-gnu
            PKG_CONFIG_PATH: /usr/lib/i386-linux-gnu/pkgconfig
            configure: >-
              CPPFLAGS=-I/usr/include/i386-linux-gnu
              --host=i686-linux-gnu
              --with-openssl --with-libssh2 --with-libidn2 --enable-ares --enable-debug

          - name: '!ssl !http !smtp !imap'
            image: ubuntu-26.04-arm
            tflags: '--min=520'
            configure: --without-ssl --enable-debug --disable-http --disable-smtp --disable-imap --disable-unity --enable-httpsig

          - name: 'clang-tidy'
            image: ubuntu-26.04-arm
            install_packages: clang-22 clang-tidy-22 libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev
            install_steps: skiprun mbedtls-latest rustls wolfssl-opensslextra
            install_steps_brew: openssl@4 gsasl
            CC: clang-22
            CFLAGS: -Wunused-macros
            LDFLAGS: >-
              -Wl,-rpath,/home/runner/pkg/wolfssl-opensslextra/lib
              -Wl,-rpath,/home/runner/pkg/mbedtls/lib
              -Wl,-rpath,/home/runner/rustls/lib
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl@4/lib
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/gsasl/lib

            PKG_CONFIG_PATH: "\
              /home/runner/pkg/wolfssl-opensslextra/lib/pkgconfig:\
              /home/runner/pkg/mbedtls/lib/pkgconfig:\
              /home/runner/rustls/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/gsasl/lib/pkgconfig"
            generate: >-
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4
              -DCURL_USE_WOLFSSL=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON
              -DCURL_USE_GSASL=ON
              -DUSE_ECH=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DCURL_DISABLE_HTTPSIG=OFF
              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-22

          - name: 'clang-tidy H3 c-ares !examples'
            image: ubuntu-26.04-arm
            install_packages: clang-22 clang-tidy-22 libidn2-dev libssh-dev libnghttp2-dev
            install_steps: skiprun
            install_steps_brew: libngtcp2 libnghttp3 c-ares
            CC: clang-22
            CFLAGS: -Wunused-macros
            LDFLAGS: >-
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl/lib
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libngtcp2/lib
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib

            PKG_CONFIG_PATH: "\
              /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig"
            generate: >-
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON
              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_HTTPSRR=ON -DENABLE_ARES=ON -DUSE_PROXY_HTTP3=ON
              -DCURL_DISABLE_VERBOSE_STRINGS=ON
              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-22

          - name: 'address-sanitizer'
            image: ubuntu-26.04
            install_packages: clang-22 libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
            install_steps: pytest randcurl
            install_steps_brew: openssl@4
            CC: clang-22
            CFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined
              -fPIC

            LDFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined -ldl -lubsan

            generate: -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_USE_LIBSSH=ON

          - name: 'address-sanitizer H3 c-ares'
            image: ubuntu-26.04
            install_packages: clang-22 libubsan1 libasan8 libtsan2
            install_steps: pytest
            install_steps_brew: openssl libssh2 libngtcp2 libnghttp3 c-ares
            tflags: '!664 !665'  # MD5 support is disabled in Homebrew since libssh2 1.11.1_6
            CC: clang-22
            CFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined

            LDFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined -ldl -lubsan
              -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib

            PKG_CONFIG_PATH: "\
              /home/linuxbrew/.linuxbrew/opt/libssh2/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:\
              /home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig"
            generate: >-
              -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON
              -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON -DUSE_PROXY_HTTP3=ON

          - name: 'thread-sanitizer'
            image: ubuntu-26.04
            install_packages: clang-22 libtsan2
            install_steps: pytest openssl-tsan
            CC: clang-22
            CFLAGS: -fsanitize=thread
            LDFLAGS: -fsanitize=thread
            generate: -DCMAKE_BUILD_TYPE=Debug -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/home/runner/pkg/openssl -DUSE_ECH=ON

          - name: 'memory-sanitizer'
            image: ubuntu-26.04
            install_packages: clang-22
            install_steps: randcurl
            CC: clang-22
            CFLAGS: -fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds
            LDFLAGS: -fsanitize=memory
            LIBS: -ldl
            configure: --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
            tflags: '--min=1640'

          - name: 'event-based'
            image: ubuntu-24.04
            install_packages: libssh-dev
            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-openssl --enable-ntlm
            tflags: '-n --test-event --min=1520'

          - name: 'duphandle'
            image: ubuntu-26.04-arm
            install_packages: libssh-dev
            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
            tflags: '-n --test-duphandle'

          - name: 'IntelC openssl'
            install_packages: libssl-dev libssh2-1-dev libnghttp2-dev libidn2-dev libldap-dev libkrb5-dev
            install_steps: intelc
            CC: icc
            configure: --enable-debug --with-openssl --with-libssh2 --with-gssapi --enable-httpsig

          - name: 'Slackware GnuTLS gssapi gcc'
            # Flags used to build the curl Slackware package:
            # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
            # Current curl no longer supports OpenSSL 1.1.0, thus build with GnuTLS instead:
            configure: --enable-debug --with-gnutls --with-libssh2 --with-gssapi --enable-ares --without-ca-bundle --with-ca-path=/etc/ssl/certs
            # Docker Hub image that `container-job` executes in
            container: andy5995/slackware-build-essential:15.0@sha256:c5aeede463b4a52b5f4650078418718f2447bdb23f9a4cac0d5fb262e7b8dc84  # manually bumped

          - name: 'Alpine MUSL https-rr'
            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --enable-threaded-resolver
            container: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 # 3.24.2 (manually bumped)

          - name: 'Alpine MUSL https-rr c-ares'
            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --disable-threaded-resolver
            container: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc # 3.20.10 (manually bumped, a previous minor version)

    steps:
      - name: 'install prereqs'
        if: ${{ matrix.build.container == null && !contains(matrix.build.name, 'i686') }}
        timeout-minutes: 3
        uses: $/.github/actions/pkg-install
        with:
          brew: ${{ matrix.build.install_steps_brew }}
          apt: >-
            libtool autoconf automake pkgconf
            libpsl-dev zlib1g-dev libbrotli-dev libzstd-dev
            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4' || '' }}
            ${{ contains(matrix.build.install_steps, 'pytest') && 'apache2 apache2-dev libnghttp2-dev vsftpd dante-server' || '' }}
            ${{ matrix.build.install_packages }}

      - name: 'install prereqs (i686)'
        if: ${{ contains(matrix.build.name, 'i686') }}
        timeout-minutes: 2
        uses: $/.github/actions/pkg-install
        with:
          apt: >-
            libtool autoconf automake pkgconf stunnel4
            libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386
            ${{ matrix.build.install_packages }}

      - name: 'install prereqs (alpine)'
        if: ${{ startsWith(matrix.build.container, 'alpine') }}
        run: |
          apk add --no-cache build-base autoconf automake libtool perl openssl-dev \
            libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
            krb5-dev libpsl-dev c-ares-dev \
            perl-time-hires openssh stunnel sudo git openssl

      - name: 'install Fil-C'
        if: ${{ contains(matrix.build.install_steps, 'filc') }}
        run: |
          cd /home/runner
          arch="$(uname -m)"
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/pizlonator/fil-c/releases/download/v${FIL_C_VERSION}/filc-${FIL_C_VERSION}-linux-${arch}.tar.xz" --output pkg.bin
          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin && mv "filc-${FIL_C_VERSION}-linux-${arch}" filc
          cd filc
          ./setup.sh

      - name: 'cache libressl (c)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-c') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-libressl-c
        env:
          cache-name: cache1-libressl-c
        with:
          path: ~/pkg/libressl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}-${{ runner.arch }}

      - name: 'build libressl (c)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-c') && !steps.cache1-libressl-c.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "libressl-${LIBRESSL_VERSION}"
          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/libressl
          cmake --build .
          cmake --install .

      - name: 'cache libressl (filc)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-filc') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-libressl-filc
        env:
          cache-name: cache1-libressl-filc
        with:
          path: ~/pkg/libressl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}-${{ env.FIL_C_VERSION }}-${{ runner.arch }}

      - name: 'build libressl (filc)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-filc') && !steps.cache1-libressl-filc.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "libressl-${LIBRESSL_VERSION}"
          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/libressl \
            -DCMAKE_C_COMPILER=/home/runner/filc/build/bin/filcc -DENABLE_ASM=OFF
          cmake --build .
          cmake --install .

      - name: 'cache nghttp2 (filc)'
        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-nghttp2-filc
        env:
          cache-name: cache1-nghttp2-filc
        with:
          path: ~/pkg/nghttp2
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.FIL_C_VERSION }}-${{ runner.arch }}

      - name: 'build nghttp2 (filc)'
        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') && !steps.cache1-nghttp2-filc.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/nghttp2/nghttp2/releases/download/v${NGHTTP2_VERSION}/nghttp2-${NGHTTP2_VERSION}.tar.xz" --output pkg.bin
          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
          cd "nghttp2-${NGHTTP2_VERSION}"
          cmake -B . -G Ninja -DENABLE_LIB_ONLY=ON -DBUILD_TESTING=OFF -DENABLE_DOC=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/nghttp2 \
            -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF \
            -DCMAKE_C_COMPILER=/home/runner/filc/build/bin/filcc
          cmake --build .
          cmake --install .

      - name: 'cache wolfssl (all)'
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-wolfssl-all
        env:
          cache-name: cache1-wolfssl-all
        with:
          path: ~/pkg/wolfssl-all
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}

      - name: 'build wolfssl (all)'  # does not support `OPENSSL_COEXIST`
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all') && !steps.cache1-wolfssl-all.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          ./autogen.sh
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/wolfssl-all \
            --enable-tls13 --enable-harden --enable-all \
            --disable-benchmark --disable-crypttests --disable-examples
          make install

      - name: 'cache wolfssl (opensslextra)'  # does support `OPENSSL_COEXIST`
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-wolfssl-opensslextra
        env:
          cache-name: cache1-wolfssl-opensslextra
        with:
          path: ~/pkg/wolfssl-opensslextra
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}-${{ runner.arch }}

      - name: 'build wolfssl (opensslextra)'
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') && !steps.cache1-wolfssl-opensslextra.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          ./autogen.sh
          ./configure --disable-dependency-tracking --prefix=/home/runner/pkg/wolfssl-opensslextra \
            --enable-tls13 --enable-harden --enable-ech --enable-ed25519 --enable-opensslextra \
            --disable-benchmark --disable-crypttests --disable-examples
          make install

      - name: 'cache mbedtls (latest)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-mbedtls-latest
        env:
          cache-name: cache1-mbedtls-latest
        with:
          path: ~/pkg/mbedtls
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_VERSION }}-${{ runner.arch }}

      - name: 'build mbedtls (latest)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest') && !steps.cache1-mbedtls-latest.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2" --output pkg.bin
          sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
          cd "mbedtls-${MBEDTLS_VERSION}"
          ./scripts/config.py set MBEDTLS_THREADING_C
          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/mbedtls \
            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
          cmake --build .
          cmake --install .

      - name: 'cache mbedtls (prev)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-prev') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-mbedtls-prev
        env:
          cache-name: cache1-mbedtls-prev
        with:
          path: ~/pkg/mbedtls-prev
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_PREV_VERSION }}-${{ runner.arch }}

      - name: 'build mbedtls (prev)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-prev') && !steps.cache1-mbedtls-prev.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_PREV_VERSION}/mbedtls-${MBEDTLS_PREV_VERSION}.tar.bz2" --output pkg.bin
          sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
          cd "mbedtls-${MBEDTLS_PREV_VERSION}"
          ./scripts/config.py set MBEDTLS_THREADING_C
          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/mbedtls-prev \
            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
          cmake --build .
          cmake --install .

      - name: 'cache openldap (static)'
        if: ${{ contains(matrix.build.install_steps, 'openldap-static') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-openldap-static
        env:
          cache-name: cache1-openldap-static
        with:
          path: ~/pkg/openldap-static
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENLDAP_VERSION }}-${{ runner.arch }}

      - name: 'build openldap (static)'
        if: ${{ contains(matrix.build.install_steps, 'openldap-static') && !steps.cache1-openldap-static.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            "https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-${OPENLDAP_VERSION//_/.}.tgz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "openldap-${OPENLDAP_VERSION//_/.}"
          autoreconf -fi
          ./configure --prefix=/home/runner/pkg/openldap-static --enable-static --disable-shared --disable-slapd
          make install

      - name: 'cache openssl (thread sanitizer)'
        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-openssl-tsan
        env:
          cache-name: cache1-openssl-tsan
        with:
          path: ~/pkg/openssl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}-${{ runner.arch }}

      - name: 'build openssl (thread sanitizer)'
        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') && !steps.cache1-openssl-tsan.outputs.cache-hit }}
        run: |
          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
          cd openssl
          CC=clang CFLAGS='-fsanitize=thread' LDFLAGS='-fsanitize=thread' ./config --prefix=/home/runner/pkg/openssl --libdir=lib no-makedepend no-apps no-docs no-tests
          make
          make -j1 install_sw

      - name: 'cache awslc'
        if: ${{ contains(matrix.build.install_steps, 'awslc') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-awslc
        env:
          cache-name: cache1-awslc
        with:
          path: ~/pkg/awslc
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}-${{ runner.arch }}

      - name: 'build awslc'
        if: ${{ contains(matrix.build.install_steps, 'awslc') && !steps.cache1-awslc.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "aws-lc-${AWSLC_VERSION}"
          cmake -B . -G Ninja -DBUILD_TESTING=OFF -DBUILD_TOOL=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/awslc
          cmake --build .
          cmake --install .

      - name: 'cache boringssl'
        if: ${{ contains(matrix.build.install_steps, 'boringssl') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-boringssl
        env:
          cache-name: cache1-boringssl
        with:
          path: ~/pkg/boringssl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}-${{ runner.arch }}

      - name: 'build boringssl'
        if: ${{ contains(matrix.build.install_steps, 'boringssl') && !steps.cache1-boringssl.outputs.cache-hit }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/google/boringssl/releases/download/${BORINGSSL_VERSION}/boringssl-${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
          cd "boringssl-${BORINGSSL_VERSION}"
          cmake -B . -G Ninja -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/pkg/boringssl
          cmake --build .
          cmake --install .

      - name: 'cache rustls'
        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        id: cache1-rustls
        env:
          cache-name: cache1-rustls
        with:
          path: ~/rustls
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.RUSTLS_VERSION }}-${{ runner.arch }}

      - name: 'install rustls'
        if: ${{ contains(matrix.build.install_steps, 'rustls') && !steps.cache1-rustls.outputs.cache-hit }}
        run: |
          cd ~
          if [ "$(uname -m)" = 'aarch64' ]; then
            arch='arm64'
          else
            arch='x86_64'
          fi
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location --proto-redir =https "https://github.com/rustls/rustls-ffi/releases/download/v${RUSTLS_VERSION}/rustls-ffi-${arch}-linux-gnu.zip" --output pkg.bin
          sha256sum pkg.bin && unzip pkg.bin -d rustls && rm -f pkg.bin
          sed -i.bak 's|prefix=dist|prefix=/home/runner/rustls|g' rustls/lib/pkgconfig/rustls.pc; cat rustls/lib/pkgconfig/rustls.pc

      - name: 'install Intel compilers'
        if: ${{ contains(matrix.build.install_steps, 'intelc') }}
        timeout-minutes: 4
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | \
            sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
          sudo add-apt-repository 'deb https://apt.repos.intel.com/oneapi all main'
          sudo apt-get -o Dpkg::Use-Pty=0 install intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
          source /opt/intel/oneapi/setvars.sh
          printenv >> "$GITHUB_ENV"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: 'autoreconf'
        if: ${{ matrix.build.configure }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          CC: '${{ matrix.build.CC }}'
          CFLAGS: '${{ matrix.build.CFLAGS }}'
          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
          LIBS: '${{ matrix.build.LIBS }}'
          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
          MATRIX_GENERATE: '${{ matrix.build.generate }}'
          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
        run: |
          [[ "${MATRIX_INSTALL_STEPS}" = *'awslc'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake -B bld -G Ninja \
              -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-unknown-linux-gnu" -DBUILD_STATIC_LIBS=ON \
              -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
              ${MATRIX_GENERATE}
          else
            mkdir bld && cd bld && \
            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
              ${MATRIX_CONFIGURE}
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'curl_config.h'
        run: |
          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
          grep -F '#define' bld/lib/curl_config.h | sort || true

      - name: 'libcurl.pc, curl-config'
        run: |
          for f in libcurl.pc curl-config; do
            echo "::group::${f}"; grep -v '^#' bld/"${f}" || true; echo '::endgroup::'
          done

      - name: 'test configs'
        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose
          else
            make -C bld V=1
          fi

      - name: 'single-use function check'
        if: ${{ (contains(matrix.build.configure, '--disable-unity') || contains(matrix.build.generate, '-DCMAKE_UNITY_BUILD=OFF')) && !contains(matrix.build.install_steps, 'filc') }}
        background: true
        run: |
          git config --global --add safe.directory "*"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            libcurla=bld/lib/libcurl.a
          else
            libcurla=bld/lib/.libs/libcurl.a
          fi
          ./scripts/singleuse.pl --unit "${libcurla}"

      - name: 'curl -V'
        run: |
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | sort -z | xargs -0 file --
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | sort -z | xargs -0 stat -c '%10s bytes: %n' --
          bld/src/curl --disable -V

      - name: 'curl install'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --install bld --strip
            if [[ "${MATRIX_INSTALL_STEPS}" = *'clean'* ]]; then
              cmake --build bld --target curl_uninstall
            fi
          else
            make -C bld V=1 install
          fi

      - name: 'randcurl'
        if: ${{ contains(matrix.build.install_steps, 'randcurl') }}
        background: true
        run: |
          mkdir run
          cd run
          ../.github/scripts/randcurl.pl 60 ../bld/src/curl

      - name: 'build tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target testdeps
          else
            make -C bld V=1 -C tests
          fi

      - name: 'test-linter'
        if: ${{ contains(matrix.build.install_steps, 'test-linter') }}
        background: true
        run: cd tests && ./test-linter.pl ../bld

      - name: 'run tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        timeout-minutes: ${{ contains(matrix.build.install_packages, 'valgrind') && 15 || 10 }}
        env:
          TEST_TARGET: ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
          TFLAGS: '${{ matrix.build.tflags }}'
        run: |
          if [ "${TEST_TARGET}" = 'test-ci' ] && [[ "${MATRIX_INSTALL_PACKAGES}" = *'valgrind'* ]]; then
            TFLAGS+=' -j6'
            TFLAGS+=' !776'  # skip long-running flaky test
            TFLAGS+=' !1674'  # skip long-running test
            if [[ "${MATRIX_INSTALL_PACKAGES}" = *'libgss-dev'* ]]; then
              TFLAGS+=' ~2077 ~2078'  # memory leaks from Curl_auth_decode_spnego_message() -> gss_init_sec_context()
            fi
          elif [ "${TEST_TARGET}" != 'test-ci' ]; then
            TFLAGS+=' --buildinfo'  # only test-ci sets this by default, set it manually for test-torture
          fi
          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
          if [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test1'* ]]; then
            locale || true
            export LC_ALL=C
            export LC_CTYPE=C
            export LC_NUMERIC=fr_FR.UTF-8
          fi
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target "${TEST_TARGET}"
            if [[ "${MATRIX_INSTALL_STEPS}" = *'clean'* ]]; then
              cmake --build bld --target clean-certs
            fi
          else
            make -C bld V=1 "${TEST_TARGET}"
          fi

      - name: 'install pytest prereqs'
        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
        uses: $/.github/actions/pkg-install
        with:
          pip: -r tests/http/requirements.txt

      - name: 'run pytest'
        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
        env:
          PYTEST_ADDOPTS: '--color=yes'
          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
        run: |
          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target curl-pytest-ci
          else
            make -C bld V=1 pytest-ci
          fi

      - name: 'build examples'
        if: ${{ !contains(matrix.build.install_packages, 'valgrind') && !contains(matrix.build.name, '!examples') }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target curl-examples-build
          else
            make -C bld V=1 examples
          fi