add HTTPS uploads and static release builds

.github/workflows/release.yml

@@ -32,14 +32,24 @@ jobs:
         include:
           - target: linux-amd64
             os: ubuntu-24.04
+            openssl_target: linux-x86_64
+            cross_prefix: ''
           - target: linux-arm64
             os: ubuntu-24.04
+            openssl_target: linux-aarch64
+            cross_prefix: aarch64-linux-gnu-
           - target: linux-ppc32be
             os: ubuntu-24.04
+            openssl_target: linux-ppc
+            cross_prefix: powerpc-linux-gnu-
           - target: macos-amd64
             os: macos-14
+            openssl_target: darwin64-x86_64-cc
+            cross_prefix: ''
           - target: macos-arm64
             os: macos-14
+            openssl_target: darwin64-arm64-cc
+            cross_prefix: ''
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out source
@@ -57,8 +67,49 @@ jobs:
           sudo apt-get update
           sudo apt-get install --yes gcc-powerpc-linux-gnu
 
-      - name: Build
+      - name: Build static OpenSSL
-        run: make ${{ matrix.target }}
+        env:
+          OPENSSL_VERSION: 3.5.7
+          OPENSSL_TARGET: ${{ matrix.openssl_target }}
+          CROSS_PREFIX: ${{ matrix.cross_prefix }}
+        run: |
+          curl --fail --location --retry 3 \
+            "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" \
+            --output openssl.tar.gz
+          tar -xzf openssl.tar.gz
+          cd "openssl-${OPENSSL_VERSION}"
+          CROSS_COMPILE="$CROSS_PREFIX" ./Configure "$OPENSSL_TARGET" \
+            no-shared no-tests no-module no-dso \
+            --prefix="$GITHUB_WORKSPACE/openssl-static" \
+            --openssldir=/etc/ssl
+          make -j3 build_sw
+          make install_sw
+
+      - name: Build static Linux executable
+        if: startsWith(matrix.target, 'linux-')
+        run: |
+          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
+          make "${{ matrix.target }}" \
+            TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
+            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a -ldl" \
+            LDFLAGS=-static
+          file "dist/fossmark-${{ matrix.target }}"
+          if ldd "dist/fossmark-${{ matrix.target }}" 2>&1 | grep -q '=>'; then
+            echo 'Linux release binary is dynamically linked' >&2
+            exit 1
+          fi
+
+      - name: Build macOS executable with static OpenSSL
+        if: startsWith(matrix.target, 'macos-')
+        run: |
+          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
+          make "${{ matrix.target }}" \
+            TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
+            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a"
+          if otool -L "dist/fossmark-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then
+            echo 'macOS release uses dynamic OpenSSL' >&2
+            exit 1
+          fi
 
       - name: Package artifact
         run: tar -czf fossmark-${{ matrix.target }}.tar.gz -C dist fossmark-${{ matrix.target }}

Makefile

@@ -35,7 +35,9 @@
 
 CC      ?= cc
 CFLAGS  ?= -O2 -Wall -Wextra
-LDLIBS  ?= -lm
+TLS_CFLAGS ?=
+TLS_LDLIBS ?= -lssl -lcrypto
+LDLIBS  ?= -lm $(TLS_LDLIBS)
 # The driver spreads each workload across all cores with pthreads.
 PTHREAD := -pthread
 
@@ -115,23 +117,23 @@ macos-arm64: $(DIST)/fossmark-macos-arm64
 macos-amd64: $(DIST)/fossmark-macos-amd64
 
 $(DIST)/fossmark-linux-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST)
-	$(CC_ARM64) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
+	$(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossmark-linux-amd64: $(DRIVER) $(ASM_AMD64) | $(DIST)
-	$(CC_AMD64) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
+	$(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossmark-linux-ppc32be: $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) | $(DIST)
-	$(CC_PPC32BE) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) $(LDLIBS)
+	$(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossmark-macos-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST)
-	$(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
+	$(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossmark-macos-amd64: $(DRIVER) $(ASM_AMD64) | $(DIST)
-	$(CC_MACOS_AMD64) -arch x86_64 $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
+	$(CC_MACOS_AMD64) -arch x86_64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
 	@echo "built $@"
 
 # When the host is Linux/ARM64 or Linux/AMD64, the native binary IS one of the
@@ -154,7 +156,7 @@ NATIVE_HAS_RULE := yes
 endif
 ifneq ($(NATIVE_HAS_RULE),yes)
 $(NATIVE_BIN): $(DRIVER) $(HOST_KERNEL) | $(DIST)
-	$(CC) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS)
+	$(CC) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS)
 	@echo "built $@"
 endif
 
@@ -167,7 +169,7 @@ bench: $(NATIVE_BIN)
 
 # Build and run the kernel correctness tests for the host arch.
 test: | $(DIST)
-	$(CC) $(CFLAGS) $(PTHREAD) -o $(DIST)/test_kernels src/test_kernels.c $(HOST_KERNEL) $(LDLIBS)
+	$(CC) $(CFLAGS) $(PTHREAD) -o $(DIST)/test_kernels src/test_kernels.c $(HOST_KERNEL) -lm
 	./$(DIST)/test_kernels
 
 clean:

README.md

@@ -34,7 +34,8 @@ distorting the result.
 
 ## Build and run
 
-You need a C compiler, GNU Make, pthreads, and the system math library.
+You need a C compiler, GNU Make, OpenSSL development headers and libraries,
+pthreads, and the system math library.
 
 ```sh
 make
@@ -55,7 +56,7 @@ make macos-amd64
 make all
 ```
 
-`make all` builds both Linux targets. Cross-compilation requires a suitable
+`make all` builds all three Linux targets. Cross-compilation requires a suitable
 toolchain. Override the target compiler when its name differs from the default:
 
 ```sh
@@ -87,15 +88,18 @@ FOSSMARK_API_TOKEN=your_token ./dist/fossmark-linux-amd64
 ```
 
 The API base URL is defined by `FM_API_BASE_URL` in `src/main.c` and defaults to
-`http://localhost:8080`. A release build can override it without editing the
+`https://fossbench.net`. A release build can override it without editing the
 source:
 
 ```sh
-make CFLAGS='-O2 -Wall -Wextra -DFM_API_BASE_URL=\"http://bench.example.com\"'
+make CFLAGS='-O2 -Wall -Wextra -DFM_API_BASE_URL=\"https://bench.example.com\"'
 ```
 
-The built-in uploader currently supports plain HTTP. An HTTPS production URL
+HTTPS uploads use OpenSSL with certificate and hostname verification.
-will require TLS support (or submission through a TLS-terminating local proxy).
+
+Release binaries statically include OpenSSL. Linux releases are fully static;
+macOS releases retain only Apple's required system-library linkage because the
+macOS toolchain does not support fully static executables.
 
 ## Continuous integration and releases
 

src/main.c

@@ -29,15 +29,17 @@
 #  include <sys/socket.h>
 #  include <sys/utsname.h>
 #  include <netdb.h>
+#  include <openssl/ssl.h>
+#  include <openssl/err.h>
 #endif
 #if defined(__APPLE__)
 #  include <sys/types.h>
 #  include <sys/sysctl.h>
 #endif
 
-/* Change this at build time with -DFM_API_BASE_URL=\"http://host:port\". */
+/* Change this at build time with -DFM_API_BASE_URL=\"https://host\". */
 #ifndef FM_API_BASE_URL
-#  define FM_API_BASE_URL "http://localhost:8080"
+#  define FM_API_BASE_URL "https://fossbench.net"
 #endif
 #define FM_VERSION "0.1.2"
 
@@ -758,17 +760,23 @@ static void json_escape(const char *src, char *dst, size_t cap)
 static int upload_results(const struct system_info *info, double score,
 			  uint64_t duration_ms, const char *token)
 {
-	char host[256], port[16] = "80", path[512], payload[2048], request[4096];
+	char host[256], port[16], path[512], payload[2048], request[4096];
 	char cpu[512], os[512], compiler[256], response[512];
 	const char *base = FM_API_BASE_URL, *p, *slash, *colon;
 	struct addrinfo hints, *addresses = NULL, *a;
-	int fd = -1, status = 0, payload_len, request_len;
+	SSL_CTX *tls_ctx = NULL;
+	SSL *tls = NULL;
+	int use_tls, fd = -1, status = 0, payload_len, request_len;
 
-	if (strncmp(base, "http://", 7) != 0) {
+	if (!strncmp(base, "https://", 8)) {
-		fprintf(stderr, "  upload error: FM_API_BASE_URL must use http://\n");
+		use_tls = 1; p = base + 8; strcpy(port, "443");
+	} else if (!strncmp(base, "http://", 7)) {
+		use_tls = 0; p = base + 7; strcpy(port, "80");
+	} else {
+		fprintf(stderr, "  upload error: unsupported URL scheme\n");
 		return 0;
 	}
-	p = base + 7; slash = strchr(p, '/');
+	slash = strchr(p, '/');
 	if (!slash) slash = p + strlen(p);
 	colon = memchr(p, ':', (size_t)(slash - p));
 	if (colon) {
@@ -811,23 +819,49 @@ static int upload_results(const struct system_info *info, double score,
 	}
 	freeaddrinfo(addresses);
 	if (fd < 0) { fprintf(stderr, "  upload error: cannot connect to %s:%s\n", host, port); return 0; }
+	if (use_tls) {
+		tls_ctx = SSL_CTX_new(TLS_client_method());
+		if (!tls_ctx || !SSL_CTX_set_default_verify_paths(tls_ctx)) {
+			fprintf(stderr, "  upload error: cannot initialize TLS trust store\n");
+			goto upload_failed;
+		}
+		SSL_CTX_set_verify(tls_ctx, SSL_VERIFY_PEER, NULL);
+		tls = SSL_new(tls_ctx);
+		if (!tls || !SSL_set_tlsext_host_name(tls, host) ||
+		    !SSL_set1_host(tls, host) || !SSL_set_fd(tls, fd) ||
+		    SSL_connect(tls) != 1) {
+			fprintf(stderr, "  upload error: TLS connection or certificate verification failed\n");
+			goto upload_failed;
+		}
+	}
 	{
 		size_t sent = 0;
 		while (sent < (size_t)request_len) {
-			ssize_t n = send(fd, request + sent, (size_t)request_len - sent, 0);
+			int n = use_tls ? SSL_write(tls, request + sent, (int)((size_t)request_len - sent)) :
-			if (n <= 0) { close(fd); fprintf(stderr, "  upload error: send failed\n"); return 0; }
+				(int)send(fd, request + sent, (size_t)request_len - sent, 0);
+			if (n <= 0) { fprintf(stderr, "  upload error: send failed\n"); goto upload_failed; }
 			sent += (size_t)n;
 		}
 	}
 	{
-		ssize_t n = recv(fd, response, sizeof(response) - 1, 0); close(fd);
+		int n = use_tls ? SSL_read(tls, response, sizeof(response) - 1) :
-		if (n <= 0) { fprintf(stderr, "  upload error: no server response\n"); return 0; }
+			(int)recv(fd, response, sizeof(response) - 1, 0);
+		if (n <= 0) { fprintf(stderr, "  upload error: no server response\n"); goto upload_failed; }
 		response[n] = '\0';
 		if (sscanf(response, "HTTP/%*s %d", &status) != 1) status = 0;
 	}
+	if (tls) { SSL_shutdown(tls); SSL_free(tls); }
+	if (tls_ctx) SSL_CTX_free(tls_ctx);
+	close(fd);
 	if (status < 200 || status >= 300) { fprintf(stderr, "  upload failed: server returned HTTP %d\n", status); return 0; }
 	printf("  Results uploaded successfully (HTTP %d).\n", status);
 	return 1;
+
+upload_failed:
+	if (tls) SSL_free(tls);
+	if (tls_ctx) SSL_CTX_free(tls_ctx);
+	if (fd >= 0) close(fd);
+	return 0;
 }
 #endif