stages: - stage1-testing # we utilize the images generated by the build-images project, to # speed up CI runs. We also use ccache and store config.cache # to speed up compilation. We include a version number in cache # name to allow expiration of old caches. cache: key: "$CI_JOB_NAME-ver5" paths: - cache/ before_script: # CCache Config - mkdir -p cache - export CCACHE_BASEDIR=${PWD} - export CCACHE_DIR=${PWD}/cache - export CC="ccache gcc" after_script: # somehow after_script looses environment - export CCACHE_BASEDIR=${PWD} - export CCACHE_DIR=${PWD}/cache - ccache -s variables: BUILD_IMAGES_PROJECT: gnutls/build-images DEBIAN_STRETCH_BUILD: buildenv-debian-stretch DEBIAN_CROSS_BUILD: buildenv-debian-cross FEDORA_BUILD: buildenv-f28 FEDORA_X86_BUILD: buildenv-f28-x86 CPPCHECK_OPTIONS: "--enable=warning --enable=style --enable=performance --enable=portability --std=c99 --suppressions-list=devel/cppcheck.suppressions --template='{id}:{file}:{line},{severity},{message}'" GET_SOURCES_ATTEMPTS: "3" ################################################## # Stage 1, documentation, and advanced checks ################################################## doc-dist.Fedora: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - git submodule update --init --no-fetch - make autoreconf - CFLAGS="-std=c99 -O2 -g" dash ./configure --disable-gcc-warnings --cache-file cache/config.cache --prefix=/usr --libdir=/usr/lib64 --disable-cxx --disable-non-suiteb-curves --enable-gtk-doc --disable-maintainer-mode - make -C doc stamp-vti && make -C doc stamp-1 && make -j$(nproc) - make -C doc gnutls.html - PATH="$PATH:/usr/share/sgml/docbook/xsl-stylesheets-1.79.1/epub/bin/" make -C doc gnutls.epub && make -C doc/latex gnutls.pdf - make dist tags: - shared except: - tags abi-coverage.Fedora: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - git submodule update --init --no-fetch - make autoreconf - CFLAGS="-g -Og" dash ./configure --disable-gcc-warnings --cache-file cache/config.cache --prefix=/usr --libdir=/usr/lib64 --enable-code-coverage --disable-non-suiteb-curves --disable-maintainer-mode --disable-doc && make -j$(nproc) - make abi-check - make pic-check - make -j$(nproc) check - make local-code-coverage-output || true tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - ./*.xml - ./gnutls-prev-abi.tmp/ - compat_reports/ - tests/*.log - tests/*/*.log - tests/suite/*/*.log - guile/tests/*.log minimal.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - echo "No tools build" - make autoreconf - dash ./configure --cache-file cache/config.cache --disable-gcc-warnings --disable-full-test-suite --disable-doc --disable-guile --disable-tools --enable-tests - make -j$(nproc) - make -j$(nproc) check - echo "Minimal build" - dnf remove -y libunistring-devel libtasn1-devel libidn-devel && dash ./configure --with-included-libtasn1 --enable-valgrind-tests --disable-doc --disable-dtls-srtp-support --disable-alpn-support --disable-tests --disable-heartbeat-support --disable-srp-authentication --disable-psk-authentication --disable-anon-authentication --disable-dhe --disable-ecdhe --disable-ocsp --disable-non-suiteb-curves --with-included-unistring --disable-nls --disable-libdane --without-p11-kit --without-tpm --disable-ssl3-support --disable-ssl2-support --disable-doc --enable-openssl-compatibility --disable-gcc-warnings - make -j$(nproc) tags: - shared except: - tags no-SSL-3.0.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - make autoreconf - mkdir -p build && cd build && dash ../configure --disable-gcc-warnings --cache-file ../cache/config.cache --disable-ssl3-support --disable-ssl2-support --disable-full-test-suite --enable-seccomp-tests --disable-doc --disable-guile && make -j$(nproc) && make check -j$(nproc) - cd .. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/guile/tests/*.log - build/tests/*.log - build/*.log - build/tests/*/*.log - build/tests/suite/*/*.log TLS1.3/interop: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - git submodule update --init --no-fetch - make autoreconf - dash ./configure --disable-gcc-warnings --cache-file ./cache/config.cache --disable-ssl3-support --disable-ssl2-support --disable-full-test-suite --enable-seccomp-tests --disable-doc --disable-guile && make -j$(nproc) - cd devel/openssl && ./config enable-tls1_3 && make -j$(nproc) && cd ../.. - make -C tests/suite TESTS=testcompat-tls13-openssl.sh check tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/guile/tests/*.log - build/tests/*.log - build/*.log - build/tests/*/*.log - build/tests/suite/*/*.log FIPS140-2.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - make autoreconf - mkdir -p build && cd build && dash ../configure --disable-gcc-warnings --cache-file ../cache/config.cache --disable-non-suiteb-curves --enable-fips140-mode --disable-doc --disable-full-test-suite --disable-guile - make -j$(nproc) - GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS=1 GNUTLS_FORCE_FIPS_MODE=1 make check -j$(nproc) - make check -j$(nproc) - cd .. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/guile/tests/*.log - build/tests/*.log - build/tests/*/*.log valgrind.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - make autoreconf - dash ./configure --disable-gcc-warnings --disable-doc --cache-file cache/config.cache --disable-guile --disable-full-test-suite --enable-valgrind-tests - make -j$(nproc) - make check -j$(nproc) tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - ./*.log - tests/*.log - tests/*/*.log # Two runs, one with normal backend and another with pkcs11 trust store asan.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - git submodule update --init --no-fetch - make autoreconf - CFLAGS="-fsanitize=address -g -O2" CXXFLAGS=$CFLAGS LDFLAGS="-static-libasan" dash ./configure --disable-gcc-warnings --disable-doc --cache-file cache/config.cache --disable-non-suiteb-curves --disable-guile - make -j$(nproc) - LSAN_OPTIONS="suppressions=$(pwd)/fuzz/lsan.supp" make check -j$(nproc) - LSAN_OPTIONS="suppressions=$(pwd)/fuzz/lsan.supp" make -C fuzz check -j$(nproc) GNUTLS_CPUID_OVERRIDE=0x1 - LSAN_OPTIONS="suppressions=$(pwd)/fuzz/lsan.supp" make -C fuzz check -j$(nproc) GNUTLS_CPUID_OVERRIDE=0x2 - LSAN_OPTIONS="suppressions=$(pwd)/fuzz/lsan.supp" make -C fuzz check -j$(nproc) GNUTLS_CPUID_OVERRIDE=0x4 - LSAN_OPTIONS="suppressions=$(pwd)/fuzz/lsan.supp" make -C fuzz check -j$(nproc) GNUTLS_CPUID_OVERRIDE=0x8 - CFLAGS="-fsanitize=address -g -O2" CXXFLAGS=$CFLAGS LDFLAGS="-static-libasan" dash ./configure --cache-file cache/config.cache --disable-doc --with-default-trust-store-pkcs11="pkcs11:" --disable-guile - make -j$(nproc) - make -C tests check -j$(nproc) TESTS="trust-store p11-kit-load.sh" SUBDIRS=. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - ./*.log - tests/*.log - tests/*/*.log - tests/suite/*/*.log static-analyzers.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD before_script: - /bin/true script: - make autoreconf - scan-build ./configure --disable-doc --disable-guile --enable-fips140-mode --enable-valgrind-tests - make -j$(nproc) syntax-check - make -j$(nproc) -C gl - scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C lib - scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C libdane - make -j$(nproc) -C src/gl && scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C src - cppcheck --force -q -Ilib/include -Igl/ -Ilib/ -I. --error-exitcode=1 lib/ -i lib/unistring -i lib/minitasn1 -j$(nproc) $CPPCHECK_OPTIONS - cppcheck --force -q -Ilib/include -Igl/ -Ilibdane/ -I. --error-exitcode=1 libdane/ -j$(nproc) $CPPCHECK_OPTIONS after_script: - /bin/true tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - scan-build-lib/* - scan-build-libdane/* MinGW32.DLLs: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc && echo ':DOSWin:M::MZ::/usr/bin/wine:' > /proc/sys/fs/binfmt_misc/register - make autoreconf - export CC="ccache i686-w64-mingw32-gcc" - dash ./configure --disable-gcc-warnings --host=i686-w64-mingw32 --target=i686-w64-mingw32 --cache-file cache/config.cache --with-included-libtasn1 --disable-nls --disable-guile --with-included-unistring --enable-local-libopts --disable-non-suiteb-curves --disable-full-test-suite --disable-doc && mingw32-make -j$(nproc) && mingw32-make -C tests check -j$(nproc) # Combine generated apps and DLLs. #libwinpthread is required by libgcc #libffi is required by libp11-kit - mkdir -p win32-build/bin && mkdir -p win32-build/lib/includes && cp lib/.libs/*.dll src/.libs/*.exe win32-build/bin && i686-w64-mingw32-strip --strip-unneeded win32-build/bin/*.dll && i686-w64-mingw32-strip win32-build/bin/*.exe && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libp11-*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libnettle-*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libhogweed-*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libgmp-*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libgcc*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libwinpthread*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libidn2-*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/iconv*.dll win32-build/bin && cp /usr/i686-w64-mingw32/sys-root/mingw/bin/libffi-*.dll win32-build/bin && cp lib/.libs/*.a lib/*.def lib/gnutls.pc win32-build/lib && cp lib/includes/gnutls/*.h win32-build/lib/includes tags: - shared - docker only: - tags artifacts: name: "${CI_PROJECT_NAME}-${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}" paths: - win32-build/ MinGW64.DLLs: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc && echo ':DOSWin:M::MZ::/usr/bin/wine:' > /proc/sys/fs/binfmt_misc/register - make autoreconf - export CC="ccache x86_64-w64-mingw32-gcc" - dash ./configure --disable-gcc-warnings --host=x86_64-w64-mingw32 --target=x86_64-w64-mingw32 --cache-file cache/config.cache --with-included-libtasn1 --disable-guile --disable-nls --with-included-unistring --enable-local-libopts --disable-non-suiteb-curves --disable-full-test-suite --disable-doc && mingw64-make -j$(nproc) && mingw64-make -C tests check -j$(nproc) # Combine generated apps and DLLs. #libwinpthread is required by libgcc #libffi is required by libp11-kit - mkdir -p win64-build/bin && mkdir -p win64-build/lib/includes && cp lib/.libs/*.dll src/.libs/*.exe win64-build/bin && x86_64-w64-mingw32-strip --strip-unneeded win64-build/bin/*.dll && x86_64-w64-mingw32-strip win64-build/bin/*.exe && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libp11-*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libnettle-*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libhogweed-*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libgmp-*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libgcc*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libwinpthread*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libidn2-*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/iconv*.dll win64-build/bin && cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libffi-*.dll win64-build/bin && cp lib/.libs/*.a lib/*.def lib/gnutls.pc win64-build/lib && cp lib/includes/gnutls/*.h win64-build/lib/includes tags: - shared - docker only: - tags artifacts: name: "${CI_PROJECT_NAME}-${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}" paths: - win64-build/ MinGW64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - make autoreconf - export CC="ccache x86_64-w64-mingw32-gcc" - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc && echo ':DOSWin:M::MZ::/usr/bin/wine64:' > /proc/sys/fs/binfmt_misc/register && mkdir -p build && cd build && ./configure --disable-gcc-warnings --host=x86_64-w64-mingw32 --target=x86_64-w64-mingw32 --cache-file cache/config.cache --with-included-libtasn1 --disable-guile --disable-nls --with-included-unistring --enable-local-libopts --disable-full-test-suite --disable-non-suiteb-curves --disable-doc && mingw64-make -j$(nproc) && mingw64-make -C tests check -j$(nproc) - cd .. tags: - shared - docker except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/*.log - build/tests/*.log - build/tests/*/*.log MinGW32: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - make autoreconf - export CC="ccache i686-w64-mingw32-gcc" - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc && echo ':DOSWin:M::MZ::/usr/bin/wine:' > /proc/sys/fs/binfmt_misc/register && mkdir -p build && cd build && dash ../configure --disable-gcc-warnings --host=i686-w64-mingw32 --target=i686-w64-mingw32 --cache-file cache/config.cache --with-included-libtasn1 --disable-guile --disable-nls --with-included-unistring --enable-local-libopts --disable-full-test-suite --disable-non-suiteb-curves --disable-doc && mingw32-make -j$(nproc) && mingw32-make -C tests check -j$(nproc) - cd .. tags: - shared - docker except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/*.log - build/tests/*.log - build/tests/*/*.log # That is a specific runner that we cannot enable universally. # We restrict it to builds under the $BUILD_IMAGES_PROJECT project. FreeBSD.x86_64: stage: stage1-testing image: script: - export CC="ccache clang" - gmake autoreconf && LIBS="-L/usr/local/lib" ./configure --disable-full-test-suite --cache-file cache/config.cache --disable-gcc-warnings --disable-guile --disable-doc && gmake -j$(sysctl hw.ncpu | awk '{print $2}') && gmake check -j$(sysctl hw.ncpu | awk '{print $2}') tags: - freebsd only: - branches@gnutls/gnutls except: - tags artifacts: expire_in: 1 week when: on_failure paths: - ./*.log - tests/*.log - tests/*/*.log # We need a clean 32-bit fedora for testing. Note that this is also # a test for interoperability with openssl 1.0.x. Fedora.x86: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_X86_BUILD script: - git submodule update --init --no-fetch - make autoreconf && mkdir -p build && cd build && CC="ccache gcc -m32" PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig/ ../configure --disable-gcc-warnings --host=i686-redhat-linux --target=i686-redhat-linux --libdir=/usr/lib --disable-cxx --disable-non-suiteb-curves --enable-seccomp-tests --disable-full-test-suite --disable-doc --disable-guile && make -j$(nproc) && make check -j$(nproc) && make pic-check tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/*.log - build/tests/*.log - build/tests/*/*.log - build/tests/suite/*/*.log # Two runs, one with normal backend and another with pkcs11 trust store ubsan-Werror.Fedora.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD script: - git submodule update --init --no-fetch - make autoreconf - CFLAGS="-fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2" CXXFLAGS=$CFLAGS LDFLAGS="-static-libubsan" dash ./configure --cache-file cache/config.cache --disable-non-suiteb-curves --disable-guile --disable-full-test-suite --disable-doc - make -j$(nproc) -C gl - make -j$(nproc) -C lib CFLAGS="-Werror -O2 -g" - make -j$(nproc) -C libdane CFLAGS="-Werror -O2 -g" - make -j$(nproc) -C src/gl - make -j$(nproc) -C src CFLAGS="-Werror -O2 -g -fsanitize=undefined -Wno-error=parentheses -Wno-error=unused-macros" - make -j$(nproc) - make check -j$(nproc) - CFLAGS="-fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2" CXXFLAGS=$CFLAGS LDFLAGS="-static-libubsan" dash ./configure --cache-file cache/config.cache --disable-non-suiteb-curves --disable-guile --disable-doc --disable-full-test-suite --with-default-trust-store-pkcs11="pkcs11:" - make -j$(nproc) - make -C tests check -j$(nproc) TESTS="trust-store p11-kit-load.sh" SUBDIRS=. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - guile/tests/*.log - ./*.log - tests/*.log - tests/*/*.log - tests/suite/*/*.log Debian.x86_64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_STRETCH_BUILD script: - git submodule update --init --no-fetch - make autoreconf && mkdir -p build && cd build && dash ../configure --disable-gcc-warnings --cache-file ../cache/config.cache --disable-doc --disable-guile --disable-full-test-suite && make -j$(nproc) && make check -j$(nproc) - cd .. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/guile/tests/*.log - build/*.log - build/tests/*.log - build/tests/*/*.log - build/tests/suite/*/*.log Debian.aarch64: stage: stage1-testing image: script: - make autoreconf && mkdir -p build && cd build && dash ../configure --disable-gcc-warnings --cache-file ../cache/config.cache --disable-doc --disable-guile --disable-full-test-suite && make -j$(nproc) && make check -j$(nproc) - cd .. tags: - aarch64 only: - branches@gnutls/gnutls except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/*.log - build/tests/*.log - build/tests/*/*.log - build/tests/suite/*/*.log .Debian.cross.template: &Debian_cross_template stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_CROSS_BUILD script: - build=$(dpkg-architecture -qDEB_HOST_GNU_TYPE) - host="${CI_JOB_NAME#*.cross.}" # not setting CC_FOR_BUILD paired with qemu-user/binfmt somehow causes # config.guess to detect the target as the build platform and not activate # cross-compile mode even though --build is given - export CC_FOR_BUILD="ccache gcc" - export CC="ccache $host-gcc" - git submodule update --init --no-fetch - make autoreconf - mkdir -p build - cd build # Debian's softhsm package is not multiarch yet. Missing softhsm libraries # for the target will cause the test suite to fail when p11-kit is enabled. - dash ../configure --build=$build --host=$host --disable-gcc-warnings --cache-file ../cache/config.cache --disable-doc --disable-guile --without-p11-kit --disable-full-test-suite - make -j$(nproc) - make check -j$(nproc) - cd .. tags: - shared except: - tags artifacts: expire_in: 1 week when: on_failure paths: - build/guile/tests/*.log - build/*.log - build/tests/*.log - build/tests/*/*.log - build/tests/suite/*/*.log Debian.cross.arm-linux-gnueabihf: <<: *Debian_cross_template Debian.cross.mips-linux-gnu: <<: *Debian_cross_template