Repository navigation
Build Windows release dependencies from source - #527
Merged
Merged
Conversation
The Windows release jobs took OpenSSL and zlib from vcpkg's pinned baseline, which ships OpenSSL 3.1.2. The 3.1 series reached end of life in March 2025. Updating the baseline would not help: vcpkg's newest OpenSSL, 3.6.5, went out of support on 1 November 2026, and its 3.5 LTS builds stop at 3.5.4. Build OpenSSL 3.5.9, as the macOS job does, and zlib 1.3.2 from source with the static runtime, pinning both and NASM by SHA-256. Keep OpenSSL's default prefix under Program Files and stage the installation with DESTDIR: the prefix is compiled in as the engine and provider search path, so it must not be a directory that unprivileged users can create. Clear the VCPKG_ROOT set by msvc-dev-cmd, so CMakeLists.txt does not load the vcpkg toolchain, and verify that the binary depends on no runtime or third-party DLLs and uses the pinned OpenSSL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Windows release binaries take OpenSSL from vcpkg's pinned baseline, which ships OpenSSL 3.1.2. The 3.1 series reached end of life in March 2025. Updating the baseline wouldn't help: vcpkg's newest OpenSSL, 3.6.5, went out of support on 1 November 2026, and its 3.5 LTS builds stop at 3.5.4.
Fix
/MT). Both tarballs, and the NASM used for the x64 assembly, are pinned by SHA-256. arm64 uses the sameVC-WIN64-CLANGASM-ARMtarget as vcpkg.C:\Program Filesand stage the installation withDESTDIR. OpenSSL compiles the prefix in as the directory it searches for engines and providers, so it must not be somewhere unprivileged users can write.VCPKG_ROOTthatmsvc-dev-cmdsets, soCMakeLists.txtdoesn't load the vcpkg toolchain.The libraries are cached per MSVC toolset. A cold build adds about 8–10 minutes per job.
Validation
I ran the workflow via
workflow_dispatchfrom a temporary branch with only the Windows jobs enabled (42080500269). Both architectures linked OpenSSL 3.5.9 and zlib 1.3.2, depend only on system DLLs, and passed all 391 tests. The legacy provider is compiled in, so the tests printed no "Unable to load provider: legacy" warnings.