Use HTTP for result uploads

.github/workflows/release.yml

@@ -32,37 +32,20 @@ jobs:
         include:
           - target: linux-amd64
             os: ubuntu-24.04
-            openssl_target: linux-x86_64
-            cross_prefix: ''
           - target: linux-i386
             os: ubuntu-24.04
-            openssl_target: linux-x86
-            cross_prefix: ''
           - target: linux-arm64
             os: ubuntu-24.04-arm
-            openssl_target: linux-aarch64
-            cross_prefix: ''
-            openssl_options: no-asm
           - target: linux-ppc32be
             os: ubuntu-24.04
-            openssl_target: linux-ppc
-            cross_prefix: powerpc-linux-gnu-
           - target: macos-amd64
             os: macos-14
-            openssl_target: darwin64-x86_64-cc
-            cross_prefix: ''
           - target: macos-arm64
             os: macos-14
-            openssl_target: darwin64-arm64-cc
-            cross_prefix: ''
           - target: windows-amd64
             os: ubuntu-24.04
-            openssl_target: ''
-            cross_prefix: ''
           - target: windows-i386
             os: ubuntu-24.04
-            openssl_target: ''
-            cross_prefix: ''
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out source
@@ -92,62 +75,26 @@ jobs:
           sudo apt-get update
           sudo apt-get install --yes gcc-mingw-w64-i686
 
-      - name: Build static OpenSSL
+      - name: Build Linux executable
-        if: matrix.openssl_target != ''
-        env:
-          OPENSSL_VERSION: 3.5.7
-          OPENSSL_TARGET: ${{ matrix.openssl_target }}
-          CROSS_PREFIX: ${{ matrix.cross_prefix }}
-          OPENSSL_OPTIONS: ${{ matrix.openssl_options }}
-          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target == 'macos-amd64' && '10.5' || '' }}
-        run: |
-          curl --fail --location --retry 3 \
-            "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" \
-            --output openssl.tar.gz
-          tar -xzf openssl.tar.gz
-          cd "openssl-${OPENSSL_VERSION}"
-          CROSS_COMPILE="$CROSS_PREFIX" ./Configure "$OPENSSL_TARGET" \
-            no-shared no-tests no-module no-dso $OPENSSL_OPTIONS \
-            --prefix="$GITHUB_WORKSPACE/openssl-static" \
-            --openssldir=/etc/ssl
-          make -j3 build_sw
-          make install_sw
-
-      - name: Build Linux executable with static OpenSSL
         if: startsWith(matrix.target, 'linux-')
         run: |
-          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
+          make "${{ matrix.target }}"
-          EXTRA_STATIC_LIBS='-ldl'
-          if [ "${{ matrix.target }}" = linux-ppc32be ]; then
-            EXTRA_STATIC_LIBS="$EXTRA_STATIC_LIBS -latomic"
-          fi
-          make "${{ matrix.target }}" \
-            TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
-            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS"
           file "dist/fossbench-${{ matrix.target }}"
           if ! file "dist/fossbench-${{ matrix.target }}" | grep -q 'dynamically linked'; then
             echo 'Linux release uses static glibc, which is unsafe with NSS-based DNS' >&2
             exit 1
           fi
-          if readelf -d "dist/fossbench-${{ matrix.target }}" | grep -E 'NEEDED.*lib(ssl|crypto)'; then
-            echo 'Linux release uses dynamic OpenSSL' >&2
-            exit 1
-          fi
           if [ "${{ matrix.target }}" != linux-ppc32be ]; then
             "dist/fossbench-${{ matrix.target }}" --help
           fi
 
-      - name: Build macOS executable with static OpenSSL
+      - name: Build macOS executable
         if: startsWith(matrix.target, 'macos-')
         env:
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target == 'macos-amd64' && '10.5' || '' }}
         run: |
-          OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
           build_log="$(mktemp)"
-          if ! make "${{ matrix.target }}" \
+          if ! make "${{ matrix.target }}" >"$build_log" 2>&1; then
-              TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
-              TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a" \
-              >"$build_log" 2>&1; then
             cat "$build_log"
             {
               echo '## macOS build failure'
@@ -158,10 +105,6 @@ jobs:
             exit 1
           fi
           cat "$build_log"
-          if otool -L "dist/fossbench-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then
-            echo 'macOS release uses dynamic OpenSSL' >&2
-            exit 1
-          fi
 
       - name: Build Windows executable
         if: startsWith(matrix.target, 'windows-')
@@ -218,5 +161,5 @@ jobs:
             release/SHA256SUMS \
             --repo "$GITHUB_REPOSITORY" \
             --title "Release $RELEASE_TAG" \
-            --notes "⚠️ **i386 (Pentium 4) support is new in this release and still being validated on real hardware.** i386 benchmark scores should not be considered accurate yet." \
+            --notes "Fixed x86/Linux builds on systems without OpenSSL development headers. Result uploads now use plain HTTP on every platform, removing the OpenSSL build and runtime dependency." \
             --generate-notes

Makefile

@@ -3,9 +3,7 @@
 
 CC      ?= cc
 CFLAGS  ?= -O2 -Wall -Wextra
-TLS_CFLAGS ?=
+LDLIBS  ?= -lm
-TLS_LDLIBS ?= -lssl -lcrypto
-LDLIBS  ?= -lm $(TLS_LDLIBS)
 # Needed for the worker threads.
 PTHREAD := -pthread
 
@@ -119,31 +117,31 @@ windows-amd64: $(DIST)/fossbench-windows-amd64.exe
 windows-i386: $(DIST)/fossbench-windows-i386.exe
 
 $(DIST)/fossbench-linux-arm64: $(DRIVER) $(DRIVER_DEPS) $(ASM_ARM64) | $(DIST)
-	$(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
+	$(CC_ARM64) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-amd64: $(DRIVER) $(DRIVER_DEPS) $(ASM_AMD64) | $(DIST)
-	$(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
+	$(CC_AMD64) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-i386: $(DRIVER) $(DRIVER_DEPS) $(ASM_I386) | $(DIST)
-	$(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS)
+	$(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-ppc32be: $(DRIVER) $(DRIVER_DEPS) $(ASM_PPC32) | $(DIST)
-	$(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS)
+	$(CC_PPC32BE) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-ppc64be: $(DRIVER) $(DRIVER_DEPS) $(ASM_PPC64) | $(DIST)
-	$(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS)
+	$(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-macos-arm64: $(DRIVER) $(DRIVER_DEPS) $(ASM_ARM64) | $(DIST)
-	$(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
+	$(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-macos-amd64: $(DRIVER) $(DRIVER_DEPS) $(ASM_AMD64) | $(DIST)
-	MACOSX_DEPLOYMENT_TARGET=$(MACOS_AMD64_MIN) $(CC_MACOS_AMD64) -arch x86_64 -mmacosx-version-min=$(MACOS_AMD64_MIN) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -Wl,-no_fixup_chains -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
+	MACOSX_DEPLOYMENT_TARGET=$(MACOS_AMD64_MIN) $(CC_MACOS_AMD64) -arch x86_64 -mmacosx-version-min=$(MACOS_AMD64_MIN) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -Wl,-no_fixup_chains -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
 	@echo "built $@"
 
 # Windows builds are static and use WinHTTP.
@@ -179,7 +177,7 @@ NATIVE_HAS_RULE := yes
 endif
 ifneq ($(NATIVE_HAS_RULE),yes)
 $(NATIVE_BIN): $(DRIVER) $(DRIVER_DEPS) $(HOST_KERNEL) | $(DIST)
-	$(CC) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS)
+	$(CC) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS)
 	@echo "built $@"
 endif
 

README.md

@@ -36,7 +36,7 @@ fails.
 ## Build
 
 GNU Make, a C compiler, pthreads, and the system math library are required.
-Linux and macOS also require OpenSSL. Windows uses WinHTTP.
+Uploads use plain HTTP and require no TLS library.
 
 Build for the current machine:
 
@@ -93,7 +93,7 @@ code and link that can be used to attach the result to a fossbench.net account:
 Set another server at compile time:
 
 ```sh
-make CFLAGS='-O2 -Wall -Wextra -DFB_API_BASE_URL=\"https://bench.example.com\"'
+make CFLAGS='-O2 -Wall -Wextra -DFB_API_BASE_URL=\"http://bench.example.com\"'
 ```
 
 ## Workloads

src/app/benchmark.c

@@ -18,10 +18,6 @@
 #if !defined(_WIN32) && !defined(FB_NO_UPLOAD)
 #  include <sys/socket.h>
 #  include <netdb.h>
-#  include <openssl/ssl.h>
-#  include <openssl/err.h>
-#  include <openssl/pem.h>
-#  include "../ca_bundle.h"
 #endif
 #if defined(__APPLE__)
 #  include <sys/types.h>
@@ -32,9 +28,9 @@
 
 /* The server URL can be changed when building. */
 #ifndef FB_API_BASE_URL
-#  define FB_API_BASE_URL "https://fossbench.net"
+#  define FB_API_BASE_URL "http://fossbench.net"
 #endif
-#define FB_VERSION "0.2.1"
+#define FB_VERSION "0.2.2"
 
 #if defined(__aarch64__) || defined(__arm64__) || defined(_M_ARM64)
 #  define D_INT  "64-bit ALU: madd, umulh, udiv, bitops"

src/app/upload.c

@@ -43,50 +43,10 @@ static int json_string_field(const char *json, const char *field, char *dst, siz
 	return *p == '"' && used > 0;
 }
 
-#if !defined(_WIN32)
-/* Load the certificates included with the program. */
-static int load_embedded_ca_bundle(SSL_CTX *ctx)
-{
-	X509_STORE *store = SSL_CTX_get_cert_store(ctx);
-	BIO *bio = BIO_new_mem_buf(fb_ca_bundle_pem, -1);
-	X509 *cert;
-	int loaded = 0;
-
-	if (!bio) return 0;
-	while ((cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
-		if (X509_STORE_add_cert(store, cert)) loaded++;
-		X509_free(cert);
-	}
-	BIO_free(bio);
-	ERR_clear_error();	/* Reaching the end sets an error, which is fine. */
-	return loaded > 0;
-}
-#endif
-
 #if defined(_WIN32)
-/* Check if WinHTTP found a certificate problem. */
-static int is_winhttp_secure_error(DWORD err)
-{
-	switch (err) {
-	case ERROR_WINHTTP_SECURE_CERT_DATE_INVALID:
-	case ERROR_WINHTTP_SECURE_CERT_CN_INVALID:
-	case ERROR_WINHTTP_SECURE_INVALID_CA:
-	case ERROR_WINHTTP_SECURE_CERT_REV_FAILED:
-	case ERROR_WINHTTP_SECURE_CHANNEL_ERROR:
-	case ERROR_WINHTTP_SECURE_INVALID_CERT:
-	case ERROR_WINHTTP_SECURE_CERT_REVOKED:
-	case ERROR_WINHTTP_SECURE_FAILURE:
-	case ERROR_WINHTTP_SECURE_CERT_WRONG_USAGE:
-	case ERROR_WINHTTP_SECURE_FAILURE_PROXY:
-		return 1;
-	default:
-		return 0;
-	}
-}
-
 /* Send the request with Windows networking. */
 static int winhttp_post(const char *host, const char *port, const char *path,
-			 int use_tls, const char *payload, int payload_len,
+			 const char *payload, int payload_len,
 			 const char *auth_header, int *out_status,
 			 char *response, size_t response_cap)
 {
@@ -116,24 +76,17 @@ static int winhttp_post(const char *host, const char *port, const char *path,
 		goto done;
 	}
 	hrequest = WinHttpOpenRequest(hconnect, L"POST", wpath, NULL, WINHTTP_NO_REFERER,
-				      WINHTTP_DEFAULT_ACCEPT_TYPES,
+				      WINHTTP_DEFAULT_ACCEPT_TYPES, 0);
-				      use_tls ? WINHTTP_FLAG_SECURE : 0);
 	if (!hrequest) {
 		fprintf(stderr, "  upload error: cannot create HTTP request\n");
 		goto done;
 	}
 	if (!WinHttpSendRequest(hrequest, wheaders, (DWORD)-1L, (LPVOID)payload,
 				(DWORD)payload_len, (DWORD)payload_len, 0)) {
-		if (is_winhttp_secure_error(GetLastError()))
-			fprintf(stderr, "  upload error: TLS connection or certificate verification failed\n");
-		else
 		fprintf(stderr, "  upload error: send failed\n");
 		goto done;
 	}
 	if (!WinHttpReceiveResponse(hrequest, NULL)) {
-		if (is_winhttp_secure_error(GetLastError()))
-			fprintf(stderr, "  upload error: TLS connection or certificate verification failed\n");
-		else
 		fprintf(stderr, "  upload error: no server response\n");
 		goto done;
 	}
@@ -176,21 +129,17 @@ static int upload_results(const struct system_info *info, double score,
 	char auth_header[600], response_body[2048], claim_url[1024];
 	char cpu[512], model[512], os[512], compiler[256], kernel[256];
 	const char *base = FB_API_BASE_URL, *p, *slash, *colon;
-	int use_tls, status = 0, payload_len;
+	int status = 0, payload_len;
 #if !defined(_WIN32)
 	char request[20000], response[4096];
 	struct addrinfo hints, *addresses = NULL, *a;
-	SSL_CTX *tls_ctx = NULL;
-	SSL *tls = NULL;
 	int fd = -1, request_len;
 #endif
 
-	if (!strncmp(base, "https://", 8)) {
+	if (!strncmp(base, "http://", 7)) {
-		use_tls = 1; p = base + 8; strcpy(port, "443");
+		p = base + 7; strcpy(port, "80");
-	} else if (!strncmp(base, "http://", 7)) {
-		use_tls = 0; p = base + 7; strcpy(port, "80");
 	} else {
-		fprintf(stderr, "  upload error: unsupported URL scheme\n");
+		fprintf(stderr, "  upload error: only HTTP URLs are supported\n");
 		return 0;
 	}
 	slash = strchr(p, '/');
@@ -281,31 +230,10 @@ static int upload_results(const struct system_info *info, double score,
 	}
 	freeaddrinfo(addresses);
 	if (fd < 0) { fprintf(stderr, "  upload error: cannot connect to %s:%s\n", host, port); return 0; }
-	if (use_tls) {
-		tls_ctx = SSL_CTX_new(TLS_client_method());
-		if (!tls_ctx) {
-			fprintf(stderr, "  upload error: cannot initialize TLS trust store\n");
-			goto upload_failed;
-		}
-		SSL_CTX_set_default_verify_paths(tls_ctx);	/* Try system certificates too. */
-		if (!load_embedded_ca_bundle(tls_ctx)) {
-			fprintf(stderr, "  upload error: cannot initialize TLS trust store\n");
-			goto upload_failed;
-		}
-		SSL_CTX_set_verify(tls_ctx, SSL_VERIFY_PEER, NULL);
-		tls = SSL_new(tls_ctx);
-		if (!tls || !SSL_set_tlsext_host_name(tls, host) ||
-		    !SSL_set1_host(tls, host) || !SSL_set_fd(tls, fd) ||
-		    SSL_connect(tls) != 1) {
-			fprintf(stderr, "  upload error: TLS connection or certificate verification failed\n");
-			goto upload_failed;
-		}
-	}
 	{
 		size_t sent = 0;
 		while (sent < (size_t)request_len) {
-			int n = use_tls ? SSL_write(tls, request + sent, (int)((size_t)request_len - sent)) :
+			int n = (int)send(fd, request + sent, (size_t)request_len - sent, 0);
-				(int)send(fd, request + sent, (size_t)request_len - sent, 0);
 			if (n <= 0) { fprintf(stderr, "  upload error: send failed\n"); goto upload_failed; }
 			sent += (size_t)n;
 		}
@@ -314,8 +242,7 @@ static int upload_results(const struct system_info *info, double score,
 		size_t used = 0;
 		int n;
 		do {
-			n = use_tls ? SSL_read(tls, response + used, (int)(sizeof(response) - used - 1)) :
+			n = (int)recv(fd, response + used, sizeof(response) - used - 1, 0);
-				(int)recv(fd, response + used, sizeof(response) - used - 1, 0);
 			if (n > 0) used += (size_t)n;
 		} while (n > 0 && used + 1 < sizeof(response));
 		if (used == 0) { fprintf(stderr, "  upload error: no server response\n"); goto upload_failed; }
@@ -326,11 +253,9 @@ static int upload_results(const struct system_info *info, double score,
 			if (body) snprintf(response_body, sizeof(response_body), "%s", body + 4);
 		}
 	}
-	if (tls) { SSL_shutdown(tls); SSL_free(tls); }
-	if (tls_ctx) SSL_CTX_free(tls_ctx);
 	close(fd);
 #else
-	if (!winhttp_post(host, port, path, use_tls, payload, payload_len, auth_header,
+	if (!winhttp_post(host, port, path, payload, payload_len, auth_header,
 			  &status, response_body, sizeof(response_body)))
 		return 0;
 #endif
@@ -357,8 +282,6 @@ static int upload_results(const struct system_info *info, double score,
 
 #if !defined(_WIN32)
 upload_failed:
-	if (tls) SSL_free(tls);
-	if (tls_ctx) SSL_CTX_free(tls_ctx);
 	if (fd >= 0) close(fd);
 	return 0;
 #endif