ci: verify static driver links against OpenSSL 3.0

Author: wprzytula

.github/workflows/build-cpack-packages.yml

@@ -57,7 +57,12 @@ jobs:
           sudo apt-get update -y
           make install-build-dependencies
           make build-static-integration-test-bin
-          rm -rf build-static
+
+      - name: Verify static driver links against OpenSSL 3.0 (issue #455)
+        run: make verify-openssl-3.0-compat
+
+      - name: Clean up static build directory
+        run: rm -rf build-static
 
       - name: Collect artifacts
         if: inputs.save-artifacts

.github/workflows/build-lint-and-test.yml

@@ -48,9 +48,13 @@ jobs:
         run: make build-integration-test-bin
 
       - name: Verify static linking builds (regression test for issue #164)
-        run: |
-          make build-static-integration-test-bin
-          rm -rf build-static
+        run: make build-static-integration-test-bin
+
+      - name: Verify static driver links against OpenSSL 3.0 (issue #455)
+        run: make verify-openssl-3.0-compat
+
+      - name: Clean up static build directory
+        run: rm -rf build-static
 
       - name: Save integration test binary
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4

Makefile

@@ -349,6 +349,53 @@ else
 	"${STATIC_BUILD_DIR}/cassandra-integration-tests" --gtest_list_tests > /dev/null
 endif
 
+# =============================================================================
+# OpenSSL 3.0 Compatibility Verification
+# =============================================================================
+# Regression test for issue #455: ensures the static driver archive can link
+# against OpenSSL 3.0 (our minimum supported version). Rather than rebuilding
+# from source, this target installs the artifact already produced by the
+# build-static-driver target into a sysroot alongside OpenSSL 3.0.2 from a
+# pinned Launchpad deb. If the archive references symbols only available in
+# OpenSSL >3.0 (e.g. due to build environment contamination), the link fails.
+#
+# This target is Linux/amd64-only (matches our release artifact platform).
+# =============================================================================
+
+OPENSSL_3_0_COMPAT_SYSROOT := /tmp/openssl-3.0-compat-sysroot
+OPENSSL_3_0_LIBSSL_DEV_URL := https://launchpad.net/ubuntu/+archive/primary/+files/libssl-dev_3.0.2-0ubuntu1_amd64.deb
+
+verify-openssl-3.0-compat: build-static-driver
+	@echo "=== Verifying static driver links against OpenSSL 3.0 (issue #455) ==="
+	rm -rf "$(OPENSSL_3_0_COMPAT_SYSROOT)"
+	mkdir -p "$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/pkgconfig"
+	mkdir -p "$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/include"
+	cp "$(STATIC_BUILD_DIR)/libscylladb_static.a" \
+		"$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/"
+	cp "$(STATIC_BUILD_DIR)/scylla-rust-wrapper/scylladb_static.pc" \
+		"$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/pkgconfig/"
+	cp include/cassandra.h include/cassandra_deleted_functions.h \
+		"$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/include/"
+	curl -fL -o /tmp/libssl-dev_3.0.2.deb "$(OPENSSL_3_0_LIBSSL_DEV_URL)"
+	dpkg-deb -x /tmp/libssl-dev_3.0.2.deb "$(OPENSSL_3_0_COMPAT_SYSROOT)"
+	rm -f "$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/lib/x86_64-linux-gnu/libssl.so"
+	rm -f "$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/lib/x86_64-linux-gnu/libcrypto.so"
+	PKG_CONFIG_SYSROOT_DIR="$(OPENSSL_3_0_COMPAT_SYSROOT)" \
+	PKG_CONFIG_PATH="$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/pkgconfig:$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/lib/x86_64-linux-gnu/pkgconfig" \
+	pkg-config --libs --static scylladb_static
+	cc \
+		$$(PKG_CONFIG_SYSROOT_DIR="$(OPENSSL_3_0_COMPAT_SYSROOT)" \
+		   PKG_CONFIG_PATH="$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/pkgconfig:$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/lib/x86_64-linux-gnu/pkgconfig" \
+		   pkg-config --cflags scylladb_static) \
+		examples/ssl/ssl.c \
+		$$(PKG_CONFIG_SYSROOT_DIR="$(OPENSSL_3_0_COMPAT_SYSROOT)" \
+		   PKG_CONFIG_PATH="$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/local/lib/x86_64-linux-gnu/pkgconfig:$(OPENSSL_3_0_COMPAT_SYSROOT)/usr/lib/x86_64-linux-gnu/pkgconfig" \
+		   pkg-config --libs --static scylladb_static) \
+		-o /tmp/openssl-3.0-compat-link-test
+	@echo "=== OpenSSL 3.0 compatibility verified ==="
+	rm -rf "$(OPENSSL_3_0_COMPAT_SYSROOT)" \
+		/tmp/libssl-dev_3.0.2.deb /tmp/openssl-3.0-compat-link-test
+
 build-examples:
 	@echo "Building examples to ${EXAMPLES_DIR}"
 	@mkdir "${BUILD_DIR}" >/dev/null 2>&1 || true