improve build scripts and releases flows (#694)

Author: mensfeld

.github/workflows/ci_linux_alpine_x86_64_musl_complementary.yml

@@ -49,6 +49,11 @@ on:
     paths:
       - '.github/workflows/ci_linux_alpine_x86_64_musl_complementary.yml'
     branches: [ main ]
+  push:
+    branches:
+      - 'v[0-9]+.[0-9]+.*'
+    tags-ignore:
+      - '**'
 
 permissions:
   contents: read

.github/workflows/ci_linux_debian_x86_64_gnu_complementary.yml

@@ -55,6 +55,11 @@ on:
     paths:
       - '.github/workflows/ci_linux_debian_x86_64_gnu_complementary.yml'
     branches: [ main ]
+  push:
+    branches:
+      - 'v[0-9]+.[0-9]+.*'
+    tags-ignore:
+      - '**'
 
 permissions:
   contents: read

.github/workflows/ci_linux_ubuntu_aarch64_gnu_complementary.yml

@@ -50,6 +50,11 @@ on:
     paths:
       - '.github/workflows/ci_linux_ubuntu_aarch64_gnu_complementary.yml'
     branches: [ main ]
+  push:
+    branches:
+      - 'v[0-9]+.[0-9]+.*'
+    tags-ignore:
+      - '**'
 
 permissions:
   contents: read

.github/workflows/ci_linux_ubuntu_x86_64_gnu_complementary.yml

@@ -49,6 +49,11 @@ on:
     paths:
       - '.github/workflows/ci_linux_ubuntu_x86_64_gnu_complementary.yml'
     branches: [ main ]
+  push:
+    branches:
+      - 'v[0-9]+.[0-9]+.*'
+    tags-ignore:
+      - '**'
 
 permissions:
   contents: read

ext/build_linux_aarch64_gnu.sh

@@ -79,10 +79,13 @@ if [ ! -f "$OPENSSL_PREFIX/lib/libssl.a" ] && [ ! -f "$OPENSSL_PREFIX/lib64/libs
     ./Configure linux-aarch64 \
         no-shared \
         no-dso \
-        --prefix="$OPENSSL_PREFIX"
+        --prefix="$OPENSSL_PREFIX" \
+        --openssldir="/etc/ssl" \
+        --with-rand-seed=os \
+        -DOPENSSL_NO_HEARTBEATS
     make clean || true
     make -j$(get_cpu_count)
-    make install
+    make install_sw
     unset CFLAGS
     log "OpenSSL built successfully"
 else

ext/build_linux_x86_64_gnu.sh

@@ -72,10 +72,13 @@ if [ ! -f "$OPENSSL_PREFIX/lib/libssl.a" ] && [ ! -f "$OPENSSL_PREFIX/lib64/libs
     ./Configure linux-x86_64 \
         no-shared \
         no-dso \
-        --prefix="$OPENSSL_PREFIX"
+        --prefix="$OPENSSL_PREFIX" \
+        --openssldir="/etc/ssl" \
+        --with-rand-seed=os \
+        -DOPENSSL_NO_HEARTBEATS
     make clean || true
     make -j$(get_cpu_count)
-    make install
+    make install_sw
     unset CFLAGS
     log "OpenSSL built successfully"
 else

ext/build_linux_x86_64_musl.sh

@@ -166,15 +166,17 @@ build_openssl_musl() {
             no-dso \
             no-engine \
             --prefix="$openssl_prefix" \
-            --openssldir="$openssl_prefix/ssl"
+            --openssldir="/etc/ssl" \
+            --with-rand-seed=os \
+            -DOPENSSL_NO_HEARTBEATS
 
         make -j$(get_cpu_count)
 
         # Try the install and capture any errors
         log "Installing OpenSSL..."
-        if ! make install_sw install_ssldirs 2>&1; then
-            warn "install_sw failed, trying full install..."
-            make install || {
+        if ! make install_sw 2>&1; then
+            warn "install_sw failed, trying again..."
+            make install_sw || {
                 # If install fails, check if libraries were actually built
                 if [ -f "libssl.a" ] && [ -f "libcrypto.a" ]; then
                     log "Install failed but libraries exist, copying manually..."

ext/build_macos_arm64.sh

@@ -86,17 +86,21 @@ build_openssl_macos() {
                 no-shared \
                 no-dso \
                 --prefix="$openssl_prefix" \
-                --openssldir="$openssl_prefix/ssl"
+                --openssldir="/etc/ssl" \
+                --with-rand-seed=os \
+                -DOPENSSL_NO_HEARTBEATS
         else
             ./Configure darwin64-x86_64-cc \
                 no-shared \
                 no-dso \
                 --prefix="$openssl_prefix" \
-                --openssldir="$openssl_prefix/ssl"
+                --openssldir="/etc/ssl" \
+                --with-rand-seed=os \
+                -DOPENSSL_NO_HEARTBEATS
         fi
 
         make -j$(get_cpu_count)
-        make install
+        make install_sw
 
         # Verify the build
         if [ ! -f "$openssl_prefix/lib/libssl.a" ] || [ ! -f "$openssl_prefix/lib/libcrypto.a" ]; then