From 774f34a0e0a89f232e5d74d3361fc5d0da7e4a7e Mon Sep 17 00:00:00 2001 From: Kaukab Date: Wed, 28 Jan 2026 01:29:54 +0000 Subject: [PATCH 1/7] Initial implementation of CI check: --- .github/bin/check_boring_fork_freshness.sh | 63 +++++++++++++++++++ .../workflows/boringssl-fork-freshness.yml | 20 ++++++ 2 files changed, 83 insertions(+) create mode 100755 .github/bin/check_boring_fork_freshness.sh create mode 100644 .github/workflows/boringssl-fork-freshness.yml diff --git a/.github/bin/check_boring_fork_freshness.sh b/.github/bin/check_boring_fork_freshness.sh new file mode 100755 index 00000000000..ba3e664d015 --- /dev/null +++ b/.github/bin/check_boring_fork_freshness.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Configurable via env (easy to adjust in CI) +FORK_REPO="${FORK_REPO:-kaukabrizvi/boring}" # owner/repo +FORK_BRANCH="${FORK_BRANCH:-symbol-prefixing}" # branch to check +THRESHOLD_DAYS="${THRESHOLD_DAYS:-180}" # ~6 months + +# Requires: curl, jq +if ! command -v jq >/dev/null 2>&1; then + echo "ERROR: jq is required for the BoringSSL fork freshness check." + exit 2 +fi + +commit_api="https://api.github.com/repos/${FORK_REPO}/commits/${FORK_BRANCH}" +json="$(curl -fsSL "${commit_api}")" + +last_commit_date="$(echo "${json}" | jq -r '.commit.committer.date')" +last_commit_sha="$(echo "${json}" | jq -r '.sha')" + +if [[ -z "${last_commit_date}" || "${last_commit_date}" == "null" ]]; then + echo "ERROR: Could not determine last commit date for ${FORK_REPO}@${FORK_BRANCH} from GitHub API." + exit 2 +fi + +now_epoch="$(date -u +%s)" +commit_epoch="$(date -u -d "${last_commit_date}" +%s)" +age_days="$(( (now_epoch - commit_epoch) / 86400 ))" + +if (( age_days > THRESHOLD_DAYS )); then + cat < Date: Thu, 29 Jan 2026 01:03:24 +0000 Subject: [PATCH 2/7] Add new line at the end of workflow --- .github/workflows/boringssl-fork-freshness.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/boringssl-fork-freshness.yml b/.github/workflows/boringssl-fork-freshness.yml index 52fc38120ef..9b0443dd928 100644 --- a/.github/workflows/boringssl-fork-freshness.yml +++ b/.github/workflows/boringssl-fork-freshness.yml @@ -17,4 +17,5 @@ jobs: FORK_REPO: kaukabrizvi/boring FORK_BRANCH: symbol-prefixing THRESHOLD_DAYS: "180" - run: .github/bin/check_boringssl_fork_freshness.sh \ No newline at end of file + run: .github/bin/check_boringssl_fork_freshness.sh + \ No newline at end of file From 0a5205527499e3772540665bada628c0312862a6 Mon Sep 17 00:00:00 2001 From: Kaukab Date: Thu, 29 Jan 2026 17:20:55 +0000 Subject: [PATCH 3/7] Modify faliure script to update fork --- .github/bin/check_boring_fork_freshness.sh | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/.github/bin/check_boring_fork_freshness.sh b/.github/bin/check_boring_fork_freshness.sh index ba3e664d015..c091d8f5c97 100755 --- a/.github/bin/check_boring_fork_freshness.sh +++ b/.github/bin/check_boring_fork_freshness.sh @@ -39,23 +39,11 @@ ERROR: BoringSSL fork branch appears stale. Why this is failing: s2n-tls currently depends on a forked BoringSSL branch (for symbol prefixing) to avoid - OpenSSL symbol collisions in integration tests. A stale fork is a maintenance risk. - -How to refresh the fork (typical workflow): - 1) Sync fork branch with upstream BoringSSL: - git clone git@github.com:${FORK_REPO}.git - cd boring - git remote add upstream https://github.com/google/boringssl.git - git fetch upstream - git checkout ${FORK_BRANCH} - git merge --ff-only upstream/master # adjust if upstream uses main - git push origin ${FORK_BRANCH} - - 2) Update s2n-tls to point at the refreshed fork commit (wherever this is pinned), - then open a PR. - -If the fork is intentionally frozen, raise THRESHOLD_DAYS or disable this check with a comment -explaining why. + OpenSSL symbol collisions in integration tests. A stale fork risks outdated testing. + +Refresh git@github.com:${FORK_REPO}/tree/${FORK_BRANCH} by syncing it with the upstream repository, +resolving merge conflicts if they appear. This should be done periodically and has not been done in +~${age_days} days. EOF exit 1 fi From e0a8c82f47173fead41cc1d82695d817a1cdcbfe Mon Sep 17 00:00:00 2001 From: Kaukab Date: Thu, 29 Jan 2026 17:21:58 +0000 Subject: [PATCH 4/7] Spacing --- .github/workflows/boringssl-fork-freshness.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/boringssl-fork-freshness.yml b/.github/workflows/boringssl-fork-freshness.yml index 9b0443dd928..03eca9a1cc5 100644 --- a/.github/workflows/boringssl-fork-freshness.yml +++ b/.github/workflows/boringssl-fork-freshness.yml @@ -18,4 +18,3 @@ jobs: FORK_BRANCH: symbol-prefixing THRESHOLD_DAYS: "180" run: .github/bin/check_boringssl_fork_freshness.sh - \ No newline at end of file From 8b4ecb52e6a9b9e6c48e93f2bdd32b35624fb706 Mon Sep 17 00:00:00 2001 From: Kaukab Date: Mon, 9 Feb 2026 19:42:34 +0000 Subject: [PATCH 5/7] Rename bin script --- ...boring_fork_freshness.sh => check_boringssl_fork_freshness.sh} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/bin/{check_boring_fork_freshness.sh => check_boringssl_fork_freshness.sh} (100%) diff --git a/.github/bin/check_boring_fork_freshness.sh b/.github/bin/check_boringssl_fork_freshness.sh similarity index 100% rename from .github/bin/check_boring_fork_freshness.sh rename to .github/bin/check_boringssl_fork_freshness.sh From 807a1fe3997df9720524d894f55e8ec0118c3f51 Mon Sep 17 00:00:00 2001 From: Kaukab Date: Mon, 9 Feb 2026 20:01:05 +0000 Subject: [PATCH 6/7] Test failure case --- .github/workflows/boringssl-fork-freshness.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/boringssl-fork-freshness.yml b/.github/workflows/boringssl-fork-freshness.yml index 03eca9a1cc5..f85f722a864 100644 --- a/.github/workflows/boringssl-fork-freshness.yml +++ b/.github/workflows/boringssl-fork-freshness.yml @@ -16,5 +16,5 @@ jobs: env: FORK_REPO: kaukabrizvi/boring FORK_BRANCH: symbol-prefixing - THRESHOLD_DAYS: "180" + THRESHOLD_DAYS: "1" run: .github/bin/check_boringssl_fork_freshness.sh From 4f9250f3c50010b45069c8d8c4a9712951b73b25 Mon Sep 17 00:00:00 2001 From: Kaukab Date: Mon, 9 Feb 2026 20:58:14 +0000 Subject: [PATCH 7/7] Change threshold to 60 days --- .github/bin/check_boringssl_fork_freshness.sh | 5 ++--- .github/workflows/boringssl-fork-freshness.yml | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/bin/check_boringssl_fork_freshness.sh b/.github/bin/check_boringssl_fork_freshness.sh index c091d8f5c97..5b7dee535d5 100755 --- a/.github/bin/check_boringssl_fork_freshness.sh +++ b/.github/bin/check_boringssl_fork_freshness.sh @@ -1,12 +1,11 @@ #!/usr/bin/env bash set -euo pipefail -# Configurable via env (easy to adjust in CI) +# The script is configurable via environment variablesß FORK_REPO="${FORK_REPO:-kaukabrizvi/boring}" # owner/repo FORK_BRANCH="${FORK_BRANCH:-symbol-prefixing}" # branch to check -THRESHOLD_DAYS="${THRESHOLD_DAYS:-180}" # ~6 months +THRESHOLD_DAYS="${THRESHOLD_DAYS:-60}" # ~2 months -# Requires: curl, jq if ! command -v jq >/dev/null 2>&1; then echo "ERROR: jq is required for the BoringSSL fork freshness check." exit 2 diff --git a/.github/workflows/boringssl-fork-freshness.yml b/.github/workflows/boringssl-fork-freshness.yml index f85f722a864..fcdc78d1aac 100644 --- a/.github/workflows/boringssl-fork-freshness.yml +++ b/.github/workflows/boringssl-fork-freshness.yml @@ -16,5 +16,5 @@ jobs: env: FORK_REPO: kaukabrizvi/boring FORK_BRANCH: symbol-prefixing - THRESHOLD_DAYS: "1" + THRESHOLD_DAYS: "60" run: .github/bin/check_boringssl_fork_freshness.sh