mirror of
https://git.gnunet.org/libmicrohttpd.git
synced 2026-09-25 04:09:31 +03:00
93 lines
3.4 KiB
Plaintext
93 lines
3.4 KiB
Plaintext
GNU libmicrohttpd -- containerised CI jobs
|
|
==========================================
|
|
|
|
Each job is a directory under contrib/ci/jobs/. It holds a config.ini
|
|
describing the container to use and an executable job.sh that is the
|
|
entry point inside that container. contrib/ci/ci.sh is the driver.
|
|
|
|
Requirements
|
|
------------
|
|
|
|
podman (the driver calls it directly, not docker)
|
|
qemu-user-static only for foreign architectures; without it
|
|
"podman run --arch ..." fails in creative ways.
|
|
See https://wiki.archlinux.org/title/Podman#Foreign_architectures
|
|
|
|
Nothing else has to be installed on the host: every job builds and runs
|
|
inside a debian:trixie container described by contrib/ci/Containerfile
|
|
(or contrib/ci/<arch>.Containerfile, if one exists for the architecture
|
|
the job asks for).
|
|
|
|
Running
|
|
-------
|
|
|
|
One job, from the top of the source tree:
|
|
|
|
contrib/ci/ci.sh 2-test
|
|
|
|
All of them, in numeric order:
|
|
|
|
contrib/ci/run-all-jobs
|
|
|
|
The source tree is bind-mounted into the container at /workdir, so the
|
|
jobs build in your checkout and leave their output there.
|
|
|
|
The jobs
|
|
--------
|
|
|
|
0-codespell spell check. Runs in nixery.dev/shell/codespell, does
|
|
not build a container. Advisory only
|
|
(HALT_ON_FAILURE = False).
|
|
1-build ./bootstrap && ./configure && make. The smoke build:
|
|
default configuration, nothing enabled.
|
|
2-test --enable-asserts --enable-sanitizers=address,undefined
|
|
plus the full "make check". Dumps the logs of every
|
|
failing test.
|
|
3-build-matrix the build-configuration matrix: asserts on/off x
|
|
sanitizers on/off x six digest/auth configurations x
|
|
{64-bit, 32-bit}. Clean out-of-tree build and
|
|
"make check" per combination, with a summary table at
|
|
the end.
|
|
4-fuzz a few seconds per harness of the structure-aware
|
|
fuzzers in src/fuzz, plus a replay of the whole
|
|
committed corpus.
|
|
5-zzuf src/testzzuf, the bit-level fuzzing suite, over a
|
|
moderate sweep of zzuf seeds.
|
|
6-coverage --enable-coverage build, full "make check", lcov +
|
|
genhtml. Writes the HTML report to
|
|
contrib/ci/artifacts/coverage/$CI_COMMIT_REF/html/ and
|
|
prints the path; it uploads nowhere.
|
|
|
|
Every push, and nightly
|
|
-----------------------
|
|
|
|
Run on every push:
|
|
|
|
0-codespell, 1-build, 2-test, 4-fuzz
|
|
|
|
That is the "--enable-asserts --enable-sanitizers" configuration that
|
|
TESTING.md proposal P3 asks for on every push, plus a bounded fuzz run so
|
|
a regression is caught in the pull request.
|
|
|
|
Run nightly:
|
|
|
|
3-build-matrix, 5-zzuf, 6-coverage
|
|
|
|
These are the expensive ones. 3-build-matrix is 48 builds; 5-zzuf and
|
|
6-coverage each run the heavy-test suite.
|
|
|
|
Why 3-build-matrix exists
|
|
-------------------------
|
|
|
|
MAX_DIGEST in src/microhttpd/digestauth.c is 16 in an MD5-only build and
|
|
32 otherwise, so the out-of-bounds write fixed in commit 5a73c1ae
|
|
overflows by a different amount - or not at all - depending only on
|
|
configure flags. Testing one configuration cannot answer whether a fix
|
|
holds in every build a distribution ships. See TESTING.md, proposal P3.
|
|
|
|
Not part of CI: OSS-Fuzz
|
|
------------------------
|
|
|
|
contrib/oss-fuzz/ holds the OSS-Fuzz integration. It is a separate,
|
|
externally driven path and is deliberately not run from these jobs.
|