Tooling

The OpenSSL build is largely driven by Perl. The build pipeline, plus the auxiliary scripts you will run while developing, are summarized here. The build system itself is described in more depth in reference/build-system.

The build pipeline

graph LR
    A[Configure / config] --> B[Configurations/*.conf<br/>+ build.info files]
    B --> C[configdata.pm + Makefile]
    C --> D[make]
    D --> E[libcrypto.so, libssl.so,<br/>apps/openssl, providers/*.so]
    D --> F[generated headers<br/>include/openssl/configuration.h,<br/>opensslconf.h, …]

• ./Configure (Perl, ~145 KB) chooses the target, parses flags, evaluates Configurations/*.conf, and emits a Makefile via Configurations/unix-Makefile.tmpl (or windows / vms equivalents).
• build.info files live in every source-bearing directory; they list what to compile and what to link.
• configdata.pm is a Perl module emitted by Configure containing the resolved configuration. Helper scripts read it.

To re-configure with the same settings, just rerun ./Configure — its current arguments are the first comment in configdata.pm.

Script catalogue (selected)

util/ is the central script directory. The most useful entries:

Script	What it does
util/wrap.pl	Run a just-built binary with the right LD_LIBRARY_PATH. Use this everywhere instead of LD_LIBRARY_PATH=....
util/find-doc-nits	The doc linter invoked by make doc-nits.
util/mkdef.pl	Generate the linker version scripts from *.num files.
util/mknum.pl	Update *.num files when you add a public symbol.
util/mkerr.pl	Generate *err.h and *_err.c from crypto/err/openssl.txt.
util/check-news-changes.sh	Verify CHANGES.md was updated where appropriate.
util/checkplatformsyms.pl	Audit per-platform symbol availability.
util/reformat-patches.sh	Re-run clang-format on a series of patches.
util/markdownlint.rb	Project-specific markdown linting rules.
util/lang-compress.pl, util/c-compress-test.pl	Used by the build to compress source.
util/dofile.pl	Templating engine used to fill in *.in files.
util/perl/	The OpenSSL::* Perl modules used by Configure, the templates, and the test harness.
apps/progs.pl	Generates the openssl CLI's command dispatch table.

crypto/perlasm/ is the perlasm framework that the assembly generators in crypto/{aes,sha,bn,modes,...}/asm/*.pl build on. Each generator emits architecture-specific assembly tailored to the assembler in use.

Quick local sanity check

Before pushing:

./Configure --strict-warnings --debug
make -j$(nproc) update         # regenerate any generated files
make -j$(nproc)
make doc-nits
make test V=1                  # or a focused subset
pre-commit run --all-files     # clang-format + codespell

The CI pipeline (.github/workflows/ci.yml) runs an expanded version of this matrix.

CI

There are 32 GitHub Actions workflows:

Workflow	When it runs	Purpose
ci.yml	Every PR / push	Fast feedback. Multiple Linux configurations + sanitizers + Windows.
os-zoo.yml	Daily	Build across many OSes (BSDs, macOS, Solaris-derivatives, …).
compiler-zoo.yml	Daily	Many compilers and versions.
cross-compiles.yml, aarch64-more-cross-compiles.yml, riscv-more-cross-compiles.yml	Daily	Cross-compile matrix.
run-checker-daily.yml, run-checker-merge.yml, run-checker-ci.yml	Various	A grid of Configure flag combinations.
provider-compatibility.yml, prov-compat-label.yml	PR + scheduled	Cross-version FIPS provider compatibility tests.
run_quic_interop.yml	Scheduled	QUIC interop matrix.
interop-tests.yml	Scheduled	TLS interop.
fips-checksums.yml, fips-label.yml	Scheduled	FIPS module fingerprint sanity.
fuzz-checker.yml, oss-fuzz.yml	PR / push	Fuzzer sanity, OSS-Fuzz integration.
valgrind-daily.yml	Daily	Valgrind run of the full suite.
static-analysis.yml, static-analysis-on-prem.yml	Daily	Coverity-style scans.
style-checks.yml	PR	clang-format, codespell.
windows.yml, windows_comp.yml	PR	Windows-specific builds.
make-release.yml, backport.yml, coveralls.yml, check-news-changes.yml, ct-validation-daily.yml, deploy-docs-openssl-org.yml, make-test, perl-minimal-checker.yml	Various	Release plumbing, backports, coverage, deploy, …

dev/

The dev/ directory holds release-engineering scripts (the dev/release.sh and friends) for cutting tags and tarballs. As a contributor you will rarely touch this; it is run by maintainers as part of make-release.yml.

Editor configuration

doc/openssl-c-indent.el ships an Emacs c-indent style for the project. doc/dir-locals.example.el shows how to enable it project-wide. The repository's .editorconfig is implicit via clang-format.

OPENSSL_TRACE and runtime debugging

See debugging for enable-trace, the trace categories, and TLS message tracing.