name: Build and Publish Ri (Rust/C/Python)
on:
push:
branches:
- master
release:
types: [published]
workflow_dispatch:
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
jobs:
build-cli-linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Build CLI
run: make build-cli-linux-x64
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-linux-x64
path: target/x86_64-unknown-linux-gnu/release/ric
build-cli-linux-arm64:
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Build CLI
run: make build-cli-linux-arm64
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-linux-arm64
path: target/aarch64-unknown-linux-gnu/release/ric
build-cli-windows:
runs-on: windows-2022
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:x64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_INCLUDE_DIR=C:\vcpkg\installed\x64-windows\include" >> $env:GITHUB_ENV
echo "OPENSSL_LIB_DIR=C:\vcpkg\installed\x64-windows\lib" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build CLI
run: make build-cli-windows-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-windows-x64
path: target/x86_64-pc-windows-msvc/release/ric.exe
build-cli-windows-arm64:
runs-on: windows-11-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-pc-windows-msvc
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:arm64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\arm64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_INCLUDE_DIR=C:\vcpkg\installed\arm64-windows\include" >> $env:GITHUB_ENV
echo "OPENSSL_LIB_DIR=C:\vcpkg\installed\arm64-windows\lib" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build CLI
run: make build-cli-windows-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-windows-arm64
path: target/aarch64-pc-windows-msvc/release/ric.exe
build-cli-macos:
runs-on: macos-15-intel
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: x86_64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Build CLI
run: make build-cli-macos-x64
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-macos-x64
path: target/x86_64-apple-darwin/release/ric
build-cli-macos-arm64:
runs-on: macos-15
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Build CLI
run: make build-cli-macos-arm64
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: cli-macos-arm64
path: target/aarch64-apple-darwin/release/ric
build-rust-linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build
run: make build-linux-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-linux-x64
path: target/x86_64-unknown-linux-gnu/release/libri.*
build-rust-linux-arm64:
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build
run: make build-linux-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-linux-arm64
path: target/aarch64-unknown-linux-gnu/release/libri.*
build-rust-windows:
runs-on: windows-2022
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:x64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build
run: make build-windows-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-windows-x64
path: target/x86_64-pc-windows-msvc/release/ri.dll
build-rust-macos:
runs-on: macos-15-intel
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: x86_64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build Rust library
run: make build-macos-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-macos-x64
path: target/x86_64-apple-darwin/release/libri.*
build-rust-macos-arm64:
runs-on: macos-15
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build Rust library
run: make build-macos-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-macos-arm64
path: target/aarch64-apple-darwin/release/libri.*
build-rust-windows-arm64:
runs-on: windows-11-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-pc-windows-msvc
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:arm64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\arm64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build Rust library
run: make build-windows-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: rust-windows-arm64
path: target/aarch64-pc-windows-msvc/release/ri.dll
build-c-libs-linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build C static library
run: make build-c-linux-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-linux-x64
path: |
target/x86_64-unknown-linux-gnu/release/libri.a
include/ri.h
build-c-libs-linux-arm64:
runs-on: ubuntu-24.04-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build C static library
run: make build-c-linux-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-linux-arm64
path: |
target/aarch64-unknown-linux-gnu/release/libri.a
include/ri.h
build-c-libs-windows:
runs-on: windows-2022
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\x64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:x64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build C static library
run: make build-c-windows-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-windows-x64
path: |
target/x86_64-pc-windows-msvc/release/ri.lib
include/ri.h
build-c-libs-macos:
runs-on: macos-15-intel
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: x86_64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build C static library
run: make build-c-macos-x64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-macos-x64
path: |
target/x86_64-apple-darwin/release/libri.a
include/ri.h
build-c-libs-macos-arm64:
runs-on: macos-15
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-apple-darwin
- name: Install dependencies
run: brew install --quiet cmake pkg-config openssl
- name: Sync Cargo.lock with Cargo.toml
run: cargo update -p oqs
- name: Build C static library
run: make build-c-macos-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-macos-arm64
path: |
target/aarch64-apple-darwin/release/libri.a
include/ri.h
build-c-libs-windows-arm64:
runs-on: windows-11-arm
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: aarch64-pc-windows-msvc
- name: Setup MSVC
uses: ilammy/msvc-dev-cmd@v1
- name: Fix PATH for MSVC linker
run: |
$msvcBin = "C:\Program Files\Microsoft Visual Studio\2022\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
if (-not $msvcBin) {
$msvcBin = "C:\Program Files (x86)\Microsoft Visual Studio\*\VC\Tools\MSVC\*\bin\Hostx64\arm64"
$msvcBin = (Get-ChildItem $msvcBin -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
}
if ($msvcBin) {
$env:PATH = "$msvcBin;$env:PATH"
echo "Added MSVC bin to PATH: $msvcBin"
}
- name: Install OpenSSL
run: |
vcpkg install openssl:arm64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\arm64-windows" >> $env:GITHUB_ENV
echo "OPENSSL_NO_VENDOR=1" >> $env:GITHUB_ENV
- name: Sync Cargo.lock with Cargo.toml
shell: bash
run: cargo update -p oqs
- name: Build C static library
run: make build-c-windows-arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Upload C library artifact
uses: actions/upload-artifact@v4
with:
name: c-libs-windows-arm64
path: |
target/aarch64-pc-windows-msvc/release/ri.lib
include/ri.h
build-java:
runs-on: ubuntu-latest
needs: [build-rust-linux, build-rust-linux-arm64, build-rust-windows, build-rust-windows-arm64, build-rust-macos, build-rust-macos-arm64]
steps:
- uses: actions/checkout@v4
- name: Set up JDK 11
uses: actions/setup-java@v4
with:
java-version: '11'
distribution: 'temurin'
- name: Download Linux x64 native library
uses: actions/download-artifact@v4
with:
name: rust-linux-x64
path: native/linux-x64
- name: Download Linux ARM64 native library
uses: actions/download-artifact@v4
with:
name: rust-linux-arm64
path: native/linux-arm64
- name: Download Windows x64 native library
uses: actions/download-artifact@v4
with:
name: rust-windows-x64
path: native/windows-x64
- name: Download macOS x64 native library
uses: actions/download-artifact@v4
with:
name: rust-macos-x64
path: native/macos-x64
- name: Download macOS ARM64 native library
uses: actions/download-artifact@v4
with:
name: rust-macos-arm64
path: native/macos-arm64
- name: Download Windows ARM64 native library
uses: actions/download-artifact@v4
with:
name: rust-windows-arm64
path: native/windows-arm64
- name: Organize native libraries
run: |
mkdir -p java/src/main/resources/native/linux-x64
mkdir -p java/src/main/resources/native/linux-arm64
mkdir -p java/src/main/resources/native/windows-x64
mkdir -p java/src/main/resources/native/windows-arm64
mkdir -p java/src/main/resources/native/macos-x64
mkdir -p java/src/main/resources/native/macos-arm64
cp native/linux-x64/libri.so java/src/main/resources/native/linux-x64/ 2>/dev/null || true
cp native/linux-arm64/libri.so java/src/main/resources/native/linux-arm64/ 2>/dev/null || true
cp native/windows-x64/ri.dll java/src/main/resources/native/windows-x64/ 2>/dev/null || true
cp native/windows-arm64/ri.dll java/src/main/resources/native/windows-arm64/ 2>/dev/null || true
cp native/macos-x64/libri.dylib java/src/main/resources/native/macos-x64/ 2>/dev/null || true
cp native/macos-arm64/libri.dylib java/src/main/resources/native/macos-arm64/ 2>/dev/null || true
- name: Build with Maven
run: |
cd java
mvn clean package -DskipTests
- name: Upload JAR artifact
uses: actions/upload-artifact@v4
with:
name: java-library
path: java/target/ri-*.jar
build-python:
runs-on: ${{ matrix.runs-on }}
env:
PIP_DISABLE_PIP_VERSION_CHECK: '1'
CARGO_HTTP_TIMEOUT: '60'
CARGO_NET_GIT_FETCH_WITH_CLI: 'true'
strategy:
fail-fast: false
matrix:
include:
- python: '3.8'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.9'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.10'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.11'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.12'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.13'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.14'
runs-on: ubuntu-latest
target: x86_64-unknown-linux-gnu
manylinux: manylinux_2_28
docker: true
- python: '3.8'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.9'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.10'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.11'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.12'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.13'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.14'
runs-on: ubuntu-24.04-arm
target: aarch64-unknown-linux-gnu
manylinux: null
docker: false
- python: '3.8'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.9'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.10'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.11'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.12'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.13'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.14'
runs-on: windows-2022
target: x86_64-pc-windows-msvc
manylinux: null
- python: '3.11'
runs-on: windows-11-arm
target: aarch64-pc-windows-msvc
manylinux: null
- python: '3.12'
runs-on: windows-11-arm
target: aarch64-pc-windows-msvc
manylinux: null
- python: '3.13'
runs-on: windows-11-arm
target: aarch64-pc-windows-msvc
manylinux: null
- python: '3.14'
runs-on: windows-11-arm
target: aarch64-pc-windows-msvc
manylinux: null
- python: '3.8'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.9'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.10'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.11'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.12'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.13'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.14'
runs-on: macos-15-intel
target: x86_64-apple-darwin
manylinux: null
- python: '3.8'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.9'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.10'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.11'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.12'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.13'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
- python: '3.14'
runs-on: macos-15
target: aarch64-apple-darwin
manylinux: null
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python }}
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
targets: ${{ matrix.target }}
- name: Install system dependencies (Linux)
if: runner.os == 'Linux'
run: make setup-deps
- name: Install dependencies (macOS)
if: runner.os == 'macOS'
run: brew install --quiet cmake pkg-config openssl
- name: Setup MSVC (Windows)
if: runner.os == 'Windows'
uses: ilammy/msvc-dev-cmd@v1
- name: Install OpenSSL (Windows x64)
if: runner.os == 'Windows' && !contains(matrix.target, 'aarch64')
run: |
vcpkg install openssl:x64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
- name: Install OpenSSL (Windows ARM64)
if: runner.os == 'Windows' && contains(matrix.target, 'aarch64')
run: |
vcpkg install openssl:arm64-windows
vcpkg integrate install
echo "OPENSSL_DIR=C:\vcpkg\installed\arm64-windows" >> $env:GITHUB_ENV
- name: Configure macOS linker
if: matrix.target == 'x86_64-apple-darwin' || matrix.target == 'aarch64-apple-darwin'
run: |
sudo dscacheutil -flushcache 2>/dev/null || true
sudo killall -HUP mDNSResponder 2>/dev/null || true
git config --global http.postBuffer 524288000
git config --global http.lowSpeedLimit 0
git config --global http.lowSpeedTime 999999
mkdir -p .cargo
cat > .cargo/config.toml << 'CARGO_EOF'
[target.x86_64-apple-darwin]
rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
[target.aarch64-apple-darwin]
rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
[net]
retry = 5
[http]
timeout = 60
CARGO_EOF
- name: Cache pip packages
uses: actions/cache@v4
with:
path: |
~/.cache/pip
~/Library/Caches/pip
~\AppData\Local\pip\Cache
key: pip-${{ matrix.python }}-${{ matrix.target }}-${{ hashFiles('**/pyproject.toml', '**/Cargo.toml') }}
restore-keys: |
pip-${{ matrix.python }}-${{ matrix.target }}-
pip-${{ matrix.python }}-
- name: Cache Rust dependencies
uses: Swatinem/rust-cache@v2
with:
cache-on-failure: true
shared-key: ${{ matrix.target }}
save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'pull_request' }}
- name: Configure static linking
if: runner.os == 'Linux'
run: |
mkdir -p .cargo
cat > .cargo/config.toml << 'CARGO_EOF'
[profile.release]
lto = true
codegen-units = 1
strip = true
CARGO_EOF
- name: Upgrade pip
run: |
python -m pip install --upgrade pip setuptools wheel
pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
- name: Install dependencies
run: pip install maturin auditwheel -i https://pypi.org/simple --quiet
- name: Sync Cargo.lock and prefetch dependencies
shell: bash
run: |
for i in 1 2 3 4 5 6 7 8 9 10; do
echo "=== cargo update attempt $i ==="
if cargo update -p oqs; then
echo "cargo update succeeded on attempt $i"
break
fi
echo "cargo update attempt $i failed, sleeping before retry..."
sleep $((i * 5))
done
for i in 1 2 3 4 5 6 7 8 9 10; do
echo "=== cargo fetch attempt $i ==="
if cargo fetch; then
echo "cargo fetch succeeded on attempt $i"
break
fi
echo "cargo fetch attempt $i failed, sleeping before retry..."
sleep $((i * 5))
done
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Build wheel (non-Docker, non-Windows-ARM64)
if: matrix.docker != true && matrix.target != 'aarch64-pc-windows-msvc'
run: make build-python TARGET=${{ matrix.target }}
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Build wheel (Windows ARM64 - no protocol/oqs)
if: matrix.target == 'aarch64-pc-windows-msvc'
run: make build-python TARGET=${{ matrix.target }} PLATFORM=windows ARCH=arm64
env:
CARGO_NET_RETRY: '10'
CARGO_NET_TIMEOUT: '300'
- name: Build Linux wheel with manylinux
if: matrix.docker == true
uses: PyO3/maturin-action@v1
with:
command: build
target: ${{ matrix.target }}
manylinux: ${{ matrix.manylinux }}
maturin-version: v1.8.3
args: --release -o dist
container-env: |
OPENSSL_NO_VENDOR=1
OPENSSL_DIR=/usr
OPENSSL_STATIC=0
CARGO_NET_RETRY=10
CARGO_NET_TIMEOUT=300
RUST_BACKTRACE=1
PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig
PKG_CONFIG_ALLOW_CROSS=1
before-script-linux: |
set +e
# Mirror the OpenSSL flags into the shell session so that any
# `cargo` invocation in this script (e.g. `cargo update`) sees
# the same env as the subsequent `maturin build` (which gets
# them via the `container-env:` field above).
export OPENSSL_NO_VENDOR=1
export OPENSSL_DIR=/usr
export OPENSSL_STATIC=0
export CARGO_NET_RETRY=10
export CARGO_NET_TIMEOUT=300
export RUST_BACKTRACE=1
export PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig
export PKG_CONFIG_ALLOW_CROSS=1
# manylinux_2_28 is based on AlmaLinux 8 (dnf). The older
# manylinux_2_17 image (CentOS 7) is EOL — its yum repos
# return 404 from vault.centos.org, so we avoid CentOS Vault
# entirely and rely on the fresh dnf repos that come with
# AlmaLinux 8.
if command -v dnf >/dev/null 2>&1; then
# Critical packages — must succeed or cargo build will fail
# with "openssl/opensslv.h: No such file or directory".
# We disable the `| tail -20 || true` swallow so a real
# failure (e.g. a stale dnf cache, repo 404, missing
# openssl-devel in the repo) aborts the step instead of
# being silently hidden.
( set -e
dnf install -y \
openssl-devel \
openssl-libs \
pkgconfig \
perl-IPC-Cmd \
perl-core \
make \
gcc \
gcc-c++ \
cyrus-sasl-devel \
libcurl-devel \
2>&1 | tail -40
)
# Optional packages — failures here are tolerated because
# some are in EPEL/CodeReady that may not be enabled.
dnf install -y \
cmake \
clang \
llvm \
libffi-devel \
krb5-devel \
zlib-devel \
2>&1 | tail -20 || true
else
# Fallback for manylinux_2_17 (CentOS 7) if it is ever
# re-enabled in the future.
( set -e
yum install -y \
openssl-devel \
openssl-libs \
pkgconfig \
perl-IPC-Cmd \
perl-core \
make \
gcc \
gcc-c++ \
cyrus-sasl-devel \
libcurl-devel \
2>&1 | tail -40
)
yum install -y \
cmake \
clang \
llvm \
libffi-devel \
krb5-devel \
zlib-devel \
2>&1 | tail -20 || true
fi
# Critical: openssl-sys needs the OpenSSL development headers
# to be present at this exact path because $OPENSSL_DIR=/usr
# is set via container-env. If the dnf install above failed
# silently, abort now with a clear message instead of letting
# cargo build crash with a confusing compiler error.
if [ ! -f /usr/include/openssl/opensslv.h ]; then
echo "FATAL: /usr/include/openssl/opensslv.h not found"
echo "dnf/yum install of openssl-devel did not produce the"
echo "expected development headers. Listing installed OpenSSL"
echo "packages and searching for any opensslv.h on the system:"
rpm -qa 2>/dev/null | grep -i ssl | head -20 || true
find / -name "opensslv.h" 2>/dev/null | head -10 || true
exit 1
fi
# Refresh Cargo.lock so the in-container `cargo build` does not
# have to update the registry for a stale lock entry (e.g. oqs
# bumped in Cargo.toml). Updating here, before the cargo build
# starts, keeps the build deterministic and resilient to
# transient network errors.
cargo update -p oqs || true
# Verify the system OpenSSL is available so the in-container
# cargo build can use it via $OPENSSL_DIR=/usr.
if [ ! -f /usr/include/openssl/opensslv.h ]; then
echo "ERROR: /usr/include/openssl/opensslv.h not found after dnf install"
echo "Listing OpenSSL packages installed:"
rpm -qa 2>/dev/null | grep -i ssl | head -20 || true
else
echo "System OpenSSL found at /usr/include/openssl — using it (OPENSSL_NO_VENDOR=1)"
/usr/bin/openssl version
fi
unset OPENSSL_INCLUDE_DIR
unset OPENSSL_LIB_DIR
# Verify SASL headers are present (sasl2-sys build dependency)
if ! pkg-config --exists libsasl2 2>/dev/null && [ ! -f /usr/include/sasl/sasl.h ]; then
echo "FATAL: libsasl2 development headers not found"
echo "cyrus-sasl-devel should have been installed by dnf above."
echo "Searching for sasl.h on the system:"
find / -name "sasl.h" 2>/dev/null | head -10 || true
rpm -qa 2>/dev/null | grep -i sasl | head -20 || true
exit 1
else
echo "SASL headers found — sasl2-sys will link successfully"
fi
# Configure correct Python version for maturin
PYTHON_VER="${{ matrix.python }}"
PYTHON_MAJOR=$(echo "$PYTHON_VER" | cut -d. -f1)
PYTHON_MINOR=$(echo "$PYTHON_VER" | cut -d. -f2)
PYTHON_BIN="/opt/python/cp${PYTHON_MAJOR}${PYTHON_MINOR}-cp${PYTHON_MAJOR}${PYTHON_MINOR}/bin/python"
if [ -f "$PYTHON_BIN" ]; then
export PATH="$(dirname $PYTHON_BIN):$PATH"
ln -sf "$PYTHON_BIN" /usr/local/bin/python3 || true
ln -sf "$PYTHON_BIN" /usr/local/bin/python || true
fi
- name: List generated files
shell: bash
run: |
ls -la dist/ 2>/dev/null || echo "No files in dist"
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: python-${{ matrix.target }}-${{ matrix.python }}
path: dist/
publish-pypi:
needs: build-python
if: github.event_name == 'release' && !contains(github.event.release.name, 'Test')
runs-on: ubuntu-latest
steps:
- name: Download all artifacts
uses: actions/download-artifact@v4
with:
path: dist
pattern: python-*
merge-multiple: true
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install twine
run: pip install twine
- name: Publish to PyPI
run: |
twine upload dist/*.whl
env:
TWINE_USERNAME: __token__
TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
publish-crate:
needs: [build-rust-linux, build-rust-linux-arm64, build-rust-windows, build-rust-windows-arm64, build-rust-macos, build-rust-macos-arm64]
if: github.event_name == 'release' && !contains(github.event.release.name, 'Test')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install protoc
uses: arduino/setup-protoc@v3
with:
version: '33.x'
repo-token: ${{ github.token }}
- name: Install CMake
uses: jwlawson/actions-setup-cmake@v2
with:
cmake-version: '3.28.x'
- name: Setup Rust
uses: dtolnay/rust-toolchain@master
with:
toolchain: stable
- name: Install system dependencies
run: make setup-deps
- name: Publish to crates.io
run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
publish-maven:
needs: [build-java]
if: github.event_name == 'release' && !contains(github.event.release.name, 'Test')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up JDK 11
uses: actions/setup-java@v4
with:
java-version: '11'
distribution: 'temurin'
- name: Import GPG key
run: |
echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import || true
- name: Download JAR artifact
uses: actions/download-artifact@v4
with:
name: java-library
path: java/target
- name: Build and deploy to Maven Central
run: |
cd java
mkdir -p ~/.m2
echo '<settings><servers><server><id>central</id><username>${CENTRAL_USERNAME}</username><password>${CENTRAL_PASSWORD}</password></server></servers></settings>' > ~/.m2/settings.xml
mvn deploy -P release -DskipTests
env:
CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
publish-testpypi:
needs: build-python
if: github.event_name == 'release' && contains(github.event.release.name, 'Test')
runs-on: ubuntu-latest
steps:
- name: Download all artifacts
uses: actions/download-artifact@v4
with:
path: dist
pattern: python-*
merge-multiple: true
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install twine
run: pip install twine
- name: Publish to TestPyPI
run: |
twine upload --repository-url https://test.pypi.org/legacy/ dist/*.whl
env:
TWINE_USERNAME: __token__
TWINE_PASSWORD: ${{ secrets.PYPI_TEST_API_TOKEN }}
fuzz-smoke:
if: |
(github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'fuzz')) ||
github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
continue-on-error: false
strategy:
fail-fast: false
matrix:
target:
- protocol_frame_parse
- protocol_frame_header_parse
- jwt_validate
- cache_deserialize
- prepared_statement_new
- crypto_decrypt
- crypto_verify_ed25519
- crypto_decrypt_cbc
- queue_message_headers
- gateway_radix_parse
- gateway_radix_find
- dilithium_verify
- kyber_decapsulate
- observability_trace_context
- observability_baggage
- serialization_json
- serialization_yaml
- serialization_bincode
- validation_url
- validation_uuid
- validation_email
- crypto_chacha20poly1305
- crypto_verify_ecdsa
- regex_match
- uuid_parse
steps:
- uses: actions/checkout@v4
- name: Install Rust nightly
uses: dtolnay/rust-toolchain@nightly
- name: Install cargo-fuzz
run: cargo install cargo-fuzz
- name: Install build dependencies
run: |
sudo apt-get update
sudo apt-get install -y libcurl4-openssl-dev libsasl2-dev build-essential \
pkg-config libssl-dev cmake ninja-build clang
- name: Sync Cargo.lock
run: cargo update -p oqs
- name: Run fuzz target for 60 seconds
working-directory: fuzz
run: |
cargo +nightly fuzz run ${{ matrix.target }} -- \
-max_total_time=60 \
-max_len=4096 \
-print_final_stats=1
env:
CARGO_NET_RETRY: '5'
CARGO_NET_TIMEOUT: '120'
- name: Upload crash artifacts
if: failure()
uses: actions/upload-artifact@v4
with:
name: fuzz-crash-${{ matrix.target }}
path: |
fuzz/artifacts/${{ matrix.target }}/
fuzz/corpus/${{ matrix.target }}/
sync-to-gitee:
needs: [build-rust-linux, build-rust-linux-arm64, build-rust-windows, build-rust-windows-arm64, build-rust-macos, build-rust-macos-arm64, build-python]
if: github.event_name == 'release'
runs-on: ubuntu-latest
steps:
- name: Sync Release to Gitee
run: |
# Gitee API endpoint for creating releases
GITEE_API="https://gitee.com/api/v5/repos/dunimd/ri/releases"
# Create JSON payload using jq to properly escape special characters
jq -n \
--arg token "${{ secrets.GITEE_TOKEN }}" \
--arg tag "${{ github.event.release.tag_name }}" \
--arg name "${{ github.event.release.name }}" \
--arg body "${{ github.event.release.body }}" \
'{
access_token: $token,
tag_name: $tag,
name: $name,
body: $body,
prerelease: false,
target_commitish: "master"
}' > payload.json
# Create release on Gitee using curl POST request
curl -X POST "$GITEE_API" \
-H "Content-Type: application/json" \
-d @payload.json
env:
GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}