ruby · rhenium · May 12, 2026 · Dec 1, 2023 · Aug 15, 2024 · Aug 16, 2024
diff --git a/.github/workflows/push_gem.yml b/.github/workflows/push_gem.yml
@@ -27,11 +27,11 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,6 +1,6 @@
 name: CI
 
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 
 jobs:
   ruby-versions:
@@ -17,8 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # ubuntu-22.04 uses OpenSSL 3.0, ubuntu-20.04 uses OpenSSL 1.1.1
-        os: [ ubuntu-22.04, ubuntu-20.04, macos-latest, windows-latest ]
+        os: [ ubuntu-latest, macos-latest, windows-latest ]
         ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
         exclude:
           - { os: windows-latest, ruby: truffleruby }
@@ -27,15 +26,37 @@ jobs:
           - { os: windows-latest, ruby: ucrt }
           - { os: windows-latest, ruby: mswin }
 
-    steps:
+    steps: &test-steps
       - name: repo checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: load ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true # `bundle install` and cache
+        if: ${{ !endsWith(matrix.os, 'ppc64le') && !endsWith(matrix.os, 's390x') }}
+
+      - name: load ruby from deb package
+        run: |
+          sudo apt update
+          sudo apt install ruby-full bundler
+          sudo bundle install --jobs $(nproc)
+        if: ${{ endsWith(matrix.os, 'ppc64le') || endsWith(matrix.os, 's390x') }}
+
+      # See https://github.com/oneclick/rubyinstaller2/issues/60
+      # The builtin DLLs are preferred over the mingw-w64/vcpkg DLLs. This is a
+      # temporary workaround until they update the DLLs to OpenSSL 3.5.x.
+      - name: Update RI2/mswin builtin DLLs
+        run: |
+          $dst = "$((Get-Item (Get-Command ruby).Definition).DirectoryName)\ruby_builtin_dlls"
+          if ("${{ matrix.ruby }}" -eq "mswin") {
+            $src = "C:\vcpkg\installed\x64-windows\bin"
+          } else {
+            $src = "$((Get-Item (Get-Command ruby).Definition).DirectoryName)\..\msys64\ucrt64\bin"
+          }
+          Copy-Item "$src\libcrypto-3-x64.dll", "$src\libssl-3-x64.dll" $dst
+        if: ${{ matrix.os == 'windows-latest' && (matrix.ruby == '3.2' || matrix.ruby == '3.3' || matrix.ruby == 'mswin') }}
 
       # Enable the verbose option in mkmf.rb to print the compiling commands.
       - name: enable mkmf verbose
@@ -47,12 +68,28 @@ jobs:
         if: ${{ !matrix.skip-warnings }}
 
       - name: rake compile
-        run:  bundle exec rake compile
+        run:  bundle exec rake debug_compiler compile
+
+      - name: rake debug
+        run:  bundle exec rake debug
 
       - name: rake test
         run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately"
         timeout-minutes: 5
 
+  test-ibm:
+    if: github.repository == 'ruby/openssl'
+    name: ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04-ppc64le
+          - os: ubuntu-24.04-s390x
+
+    steps: *test-steps
+
   test-openssls:
     name: >-
       ${{ matrix.openssl }} ${{ matrix.name-extra }}
@@ -66,11 +103,14 @@ jobs:
           - openssl-1.0.2u # EOL
           - openssl-1.1.0l # EOL
           - openssl-1.1.1w # EOL 2023-09-11, still used by RHEL 8 and Ubuntu 20.04
-          - openssl-3.0.15 # Supported until 2026-09-07
-          - openssl-3.1.7 # Supported until 2025-03-14
-          - openssl-3.2.3 # Supported until 2025-11-23
-          - openssl-3.3.2 # Supported until 2026-04-09
-          - openssl-3.4.0 # Supported until 2026-10-22
+          - openssl-3.0.20 # Supported until 2026-09-07 (LTS)
+          - openssl-3.1.8 # EOL 2025-03-14
+          - openssl-3.2.6 # EOL 2025-11-23
+          - openssl-3.3.7 # EOL 2026-04-09
+          - openssl-3.4.5 # Supported until 2026-10-22
+          - openssl-3.5.6 # Supported until 2030-04-08 (LTS)
+          - openssl-3.6.2 # Supported until 2026-11-01
+          - openssl-4.0.0 # Supported until 2027-05-14
           - openssl-master
           # http://www.libressl.org/releases.html
           - libressl-3.1.5 # EOL
@@ -81,20 +121,18 @@ jobs:
           - libressl-3.6.3 # EOL
           - libressl-3.7.3 # EOL
           - libressl-3.8.4 # EOL 2024-10-16
-          - libressl-3.9.2 # Supported until 2025-04-05
-          - libressl-4.0.0
+          - libressl-3.9.2 # EOL 2025-04-05
+          - libressl-4.0.1 # EOL 2025-10-08
+          - libressl-4.1.2 # Supported until 2026-04-28
+          - libressl-4.2.1 # Supported until 2026-10-22
         include:
-          - { name-extra: 'with fips provider', openssl: openssl-3.0.15, fips-enabled: true }
-          - { name-extra: 'with fips provider', openssl: openssl-3.1.7, fips-enabled: true }
-          - { name-extra: 'with fips provider', openssl: openssl-3.2.3, fips-enabled: true }
-          - { name-extra: 'with fips provider', openssl: openssl-3.3.2, fips-enabled: true }
-          - { name-extra: 'without legacy provider', openssl: openssl-3.4.0, append-configure: 'no-legacy' }
+          - { name-extra: 'without legacy provider', openssl: openssl-4.0.0, append-configure: 'no-legacy' }
     steps:
       - name: repo checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - id: cache-openssl
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/openssl
           key: openssl-${{ runner.os }}-${{ matrix.openssl }}-${{ matrix.append-configure || 'default' }}
@@ -119,7 +157,7 @@ jobs:
             OPENSSL_COMMIT=${{ matrix.openssl == 'openssl-master' && 'master' || matrix.openssl }}
             git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
             echo "Git commit: $(git rev-parse HEAD)"
-            ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips ${{ matrix.append-configure }}
+            ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests ${{ matrix.append-configure }}
             make -j4 && make install_sw && make install_fips
             ;;
           libressl-*)
@@ -147,22 +185,22 @@ jobs:
         if: ${{ !matrix.skip-warnings }}
 
       - name: rake compile
-        run:  bundle exec rake compile -- --with-openssl-dir=$HOME/openssl
+        run:  bundle exec rake debug_compiler compile -- --with-openssl-dir=$HOME/openssl
 
-      - name: setup OpenSSL config file for fips
-        run: |
-          sed -e "s|OPENSSL_DIR|$HOME/openssl|" tool/openssl_fips.cnf.tmpl > tmp/openssl_fips.cnf
-          echo "OPENSSL_CONF=$(pwd)/tmp/openssl_fips.cnf" >> $GITHUB_ENV
-        if: matrix.fips-enabled
+      - name: rake debug
+        run:  bundle exec rake debug
 
       - name: rake test
         run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately"
         timeout-minutes: 5
-        if: ${{ !matrix.fips-enabled }}
 
       # Run only the passing tests on the FIPS module as a temporary workaround.
       # TODO Fix other tests, and run all the tests on FIPS module.
       - name: rake test_fips
-        run:  bundle exec rake test_fips TESTOPTS="-v --no-show-detail-immediately"
+        run: |
+          sed -e "s|OPENSSL_DIR|$HOME/openssl|" tool/openssl_fips.cnf.tmpl > tmp/openssl_fips.cnf
+          export OPENSSL_CONF=$(pwd)/tmp/openssl_fips.cnf
+          bundle exec rake debug
+          bundle exec rake test_fips TESTOPTS="-v --no-show-detail-immediately"
         timeout-minutes: 5
-        if: matrix.fips-enabled
+        if: ${{ startsWith(matrix.openssl, 'openssl') && !startsWith(matrix.openssl, 'openssl-1') }}
diff --git a/Rakefile b/Rakefile
@@ -5,8 +5,6 @@ require 'bundler/gem_tasks'
 begin
   require 'rake/extensiontask'
   Rake::ExtensionTask.new('openssl')
-  # Run the debug_compiler task before the compile task.
-  Rake::Task['compile'].prerequisites.unshift :debug_compiler
 rescue LoadError
   warn "rake-compiler not installed. Run 'bundle install' to " \
     "install testing dependency gems."
@@ -40,12 +38,8 @@ RDoc::Task.new do |rdoc|
   rdoc.rdoc_files.include("*.md", "lib/**/*.rb", "ext/**/*.c")
 end
 
-task :test => [:compile, :debug]
-task :test_fips => [:compile, :debug]
-
 # Print Ruby and compiler info for debugging purpose.
 task :debug_compiler do
-  ruby '-v'
   compiler = RbConfig::CONFIG['CC']
   case compiler
   when 'gcc', 'clang'
@@ -71,7 +65,7 @@ task :debug do
       Providers: #{providers_str}
     MESSAGE
   EOF
-  ruby %Q(-I./lib -ropenssl -ve'#{ruby_code}')
+  ruby %Q(-I./lib -ropenssl.so -e'#{ruby_code}'), verbose: false
 end
 
 task :default => :test
diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
@@ -13,14 +13,7 @@
 
 require "mkmf"
 
-ssl_dirs = nil
-if defined?(::TruffleRuby)
-  # Always respect the openssl prefix chosen by truffle/openssl-prefix
-  require 'truffle/openssl-prefix'
-  ssl_dirs = dir_config("openssl", ENV["OPENSSL_PREFIX"])
-else
-  ssl_dirs = dir_config("openssl")
-end
+ssl_dirs = dir_config("openssl")
 dir_config_given = ssl_dirs.any?
 
 _, ssl_ldir = ssl_dirs

diff --git a/test/openssl/test_pkey.rb b/test/openssl/test_pkey.rb
@@ -38,6 +38,12 @@ def test_s_generate_parameters
     assert_raise(OpenSSL::PKey::PKeyError) {
       OpenSSL::PKey.generate_parameters("EC", "invalid" => "option")
     }
+  end
+
+  def test_s_generate_parameters_with_block
+    # DSA kengen is not FIPS-approved.
+    # https://github.com/openssl/openssl/commit/49a35f0#diff-605396c063194975af8ce31399d42690ab18186b422fb5012101cc9132660fe1R611-R614
+    omit_on_fips
 
     # Parameter generation callback is called
     if openssl?(3, 0, 0, 0) && !openssl?(3, 0, 0, 6)
@@ -144,32 +150,6 @@ def test_ed25519
     assert_raise(OpenSSL::PKey::PKeyError) { priv.derive(pub) }
   end
 
-  def test_ed25519_not_approved_on_fips
-    omit_on_non_fips
-    # Ed25519 is technically allowed in the OpenSSL 3.0 code as a kind of bug.
-    # So, we need to omit OpenSSL 3.0.
-    #
-    # See OpenSSL providers/fips/fipsprov.c PROV_NAMES_ED25519 entries with
-    # FIPS_DEFAULT_PROPERTIES on openssl-3.0 branch and
-    # FIPS_UNAPPROVED_PROPERTIES on openssl-3.1 branch.
-    #
-    # See also
-    # https://github.com/openssl/openssl/issues/20758#issuecomment-1639658102
-    # for details.
-    unless openssl?(3, 1, 0, 0)
-      omit 'Ed25519 is allowed in the OpenSSL 3.0 FIPS code as a kind of bug'
-    end
-
-    priv_pem = <<~EOF
-    -----BEGIN PRIVATE KEY-----
-    MC4CAQAwBQYDK2VwBCIEIEzNCJso/5banbbDRuwRTg9bijGfNaumJNqM9u1PuKb7
-    -----END PRIVATE KEY-----
-    EOF
-    assert_raise(OpenSSL::PKey::PKeyError) do
-      OpenSSL::PKey.read(priv_pem)
-    end
-  end
-
   def test_x25519
     # Test vector from RFC 7748 Section 6.1
     alice_pem = <<~EOF