mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-08 09:21:48 +08:00
Nikos Mavrogiannopoulos
f0406217eb
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
522 lines
14 KiB
YAML
522 lines
14 KiB
YAML
stages:
|
|
- preliminaries # signoff / static analysis
|
|
- testing
|
|
- deploy
|
|
|
|
variables:
|
|
BUILD_IMAGES_PROJECT: openconnect/build-images
|
|
ALPINE_BUILD: buildenv-alpine
|
|
DEBIAN_BUILD: buildenv-debian
|
|
DEBIAN_X86_CROSS_BUILD: buildenv-debian-x86
|
|
FEDORA_BUILD: buildenv-fedora44
|
|
UBUNTU22_BUILD: buildenv-ubuntu22
|
|
UBUNTU26_BUILD: buildenv-ubuntu26
|
|
CENTOS8_BUILD: buildenv-centos8
|
|
CENTOS9_BUILD: buildenv-centos9
|
|
CENTOS10_BUILD: buildenv-centos10
|
|
MINIMAL_OPTIONS: >-
|
|
-Dlocal-protobuf=true -Dlocal-talloc=true -Dlibnl=disabled
|
|
-Dmaxmind=disabled -Dgeoip=disabled -Dliboath=disabled
|
|
-Dpam=disabled -Dradius=disabled -Dutmp=disabled
|
|
-Dlibwrap=disabled -Dseccomp=disabled -Dsystemd=disabled
|
|
-Dlz4=disabled -Dgssapi=disabled
|
|
-Danyconnect-compat=disabled -Dcompression=disabled
|
|
-Droot-tests=false
|
|
JOBS: 6
|
|
|
|
config-scope-check:
|
|
stage: preliminaries
|
|
script:
|
|
- python3 tests/check-config-scope.py
|
|
|
|
Signoff:
|
|
stage: preliminaries
|
|
script:
|
|
# Quoted to work around https://gitlab.com/gitlab-org/gitlab-foss/-/issues/20177
|
|
- 'echo "Checking for new commits without Signed-off-by: tags as described in https://gitlab.com/openconnect/ocserv/-/blob/master/CONTRIBUTING.md"'
|
|
# Last bad commit
|
|
- 'git log 6a65e3acdd3251fe20815cc2984a2781d9717173.. --grep "(^Signed-off-by)|(^Merge branch)|(^This reverts commit)" --extended-regexp --invert-grep --exit-code'
|
|
- echo "None (good)"
|
|
|
|
Debian:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- meson setup build -Doidc-auth=enabled
|
|
- ninja -C build -j$JOBS
|
|
- export OCSERV_ALLOW_BROKEN_CLIENTS=1
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
i386/Debian:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_X86_CROSS_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
# Radius seems to be malfunctioning on i386 build
|
|
- meson setup build -Doidc-auth=enabled -Dradius=disabled
|
|
- ninja -C build -j$JOBS
|
|
- VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild --no-suite fw
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Ubuntu26.04:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU26_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled
|
|
- ninja -C build -j$JOBS
|
|
- export MALLOC_CHECK_=3
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Ubuntu22.04:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU22_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled
|
|
- ninja -C build -j$JOBS
|
|
- export MALLOC_CHECK_=3
|
|
# gssapi tests are skipped: openssl on Ubuntu22 doesn't support md4
|
|
# See https://bugs.launchpad.net/ubuntu/+source/gss-ntlmssp/+bug/1995915
|
|
- meson test -C build --num-processes $JOBS --no-rebuild --no-suite gssapi
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Centos8:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build
|
|
- chmod og-w tests/data/raddb
|
|
- chmod og-w tests/data/raddb/*
|
|
- ninja -C build -j$JOBS
|
|
- VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Centos9:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS9_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build
|
|
- chmod og-w tests/data/raddb
|
|
- chmod og-w tests/data/raddb/*
|
|
- ninja -C build -j$JOBS
|
|
- VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Centos10:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS10_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build
|
|
- chmod og-w tests/data/raddb
|
|
- chmod og-w tests/data/raddb/*
|
|
- ninja -C build -j$JOBS
|
|
- VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
Coverity:
|
|
stage: preliminaries
|
|
allow_failure: true
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
|
|
only:
|
|
- schedules
|
|
- coverity
|
|
script:
|
|
- wget --quiet https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
|
|
- tar xfz /tmp/coverity_tool.tgz
|
|
- git submodule update --init
|
|
- CFLAGS="-g -O0" meson setup build -Dlatency-stats=enabled
|
|
- cov-analysis-linux64-*/bin/cov-build --dir cov-int ninja -C build -j$JOBS
|
|
- tar cfz cov-int.tar.gz cov-int
|
|
- curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
|
|
--form token=$COVERITY_SCAN_TOKEN --form email=n.mavrogiannopoulos@gmail.com
|
|
--form file=@cov-int.tar.gz --form version="`git describe --tags`"
|
|
--form description="CI build"
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- cov-int/*.txt
|
|
|
|
# Test building with musl
|
|
musl/Alpine:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ALPINE_BUILD
|
|
script:
|
|
- meson setup build -Dwith-werror=true
|
|
- ninja -C build -j$JOBS
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
untracked: true
|
|
when: on_failure
|
|
|
|
Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
# ensure gcov scripts are writable
|
|
- umask 000
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- CFLAGS="-g -O0" meson setup build -Db_coverage=true -Dkerberos-tests=true -Doidc-auth=enabled
|
|
- ninja -C build -j$JOBS
|
|
- COVERAGE=1 VERBOSE=1 meson test -C build --num-processes $JOBS --no-rebuild
|
|
- ninja -C build coverage
|
|
coverage: '/lines[.]+: (\d+\.\d+)/'
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
artifacts:
|
|
expire_in: 1 day
|
|
untracked: true
|
|
when: always
|
|
|
|
noprocfs/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- meson setup build -Dnamespaces=disabled
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
untracked: true
|
|
when: on_failure
|
|
|
|
noprocfs/distcheck/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- meson setup build -Dnamespaces=disabled
|
|
- ninja -C build -j$JOBS
|
|
- meson dist -C build --no-tests
|
|
- mkdir dist-unpack
|
|
- tar -xJf build/meson-dist/ocserv-*.tar.xz -C dist-unpack
|
|
- meson setup dist-unpack/ocserv-* dist-build -Dnamespaces=disabled
|
|
- ninja -C dist-build -j$JOBS
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
- build/meson-dist/
|
|
- dist-build/meson-logs/
|
|
|
|
clang/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- CC=clang meson setup build -Dwith-werror=true
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
untracked: true
|
|
when: on_failure
|
|
|
|
# Tests seccomp filters by asking seccomp to fail with a trap
|
|
seccomp/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- meson setup build -Dkerberos-tests=true -Doidc-auth=enabled -Dseccomp-trap=true
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
untracked: true
|
|
when: on_failure
|
|
|
|
# Tests per-worker RLIMIT_DATA by making setrlimit failures fatal
|
|
worker-memory-limit/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- meson setup build -Dworker-memory-limit-test=true
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
untracked: true
|
|
when: on_failure
|
|
|
|
minimal:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build $MINIMAL_OPTIONS
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
# Build a minimal version with every optional feature disabled
|
|
minimal/Ubuntu26.04:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU26_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build $MINIMAL_OPTIONS
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
# We do not compile with PAM under address sanitizer since we are using co-routines
|
|
# without instrumentation for sanitizer.
|
|
asan/clang/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" meson setup build -Dpam=disabled -Db_lundef=false
|
|
- ninja -C build -j$JOBS
|
|
- DISABLE_ASAN_BROKEN_TESTS=1 meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
ubsan/Fedora:
|
|
stage: testing
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- chmod -R o-w tests/data/raddb
|
|
- git submodule update --init
|
|
- export UBCFLAGS="-Wall -Wextra -fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2 -Werror -Wno-unused-function -Wno-unused-parameter"
|
|
- CFLAGS="$UBCFLAGS" meson setup build
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
static-analyzer/Fedora:
|
|
stage: preliminaries
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- meson setup build -Doidc-auth=enabled -Dlatency-stats=enabled -Dlocal-protobuf=true
|
|
- scan-build --status-bugs -o scan-build-src ninja -C build -j$JOBS
|
|
tags:
|
|
- saas-linux-medium-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- scan-build-src/*
|
|
|
|
codingstyle/Fedora:
|
|
stage: preliminaries
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- find src/ tests/ -name '*.[ch]'| grep -Ev '^(src/http-heads.c|src/cfg.pb-c|src/ipc.pb-c|src/ctl.pb-c|src/pcl|src/protobuf|src/ccan|src/gnulib|src/inih|src/llhttp)'| xargs -I{} clang-format -style=file --dry-run {} -Werror
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
except:
|
|
- tags
|
|
- schedules
|
|
|
|
.FreeBSD:
|
|
stage: testing
|
|
script:
|
|
- git submodule update --init
|
|
- meson setup build -Droot-tests=false
|
|
- ninja -C build -j$JOBS
|
|
- meson test -C build --num-processes $JOBS --no-rebuild
|
|
tags:
|
|
- freebsd
|
|
only:
|
|
- branches@openconnect/ocserv
|
|
except:
|
|
- tags
|
|
- schedules
|
|
artifacts:
|
|
expire_in: 1 week
|
|
when: on_failure
|
|
paths:
|
|
- build/meson-logs/
|
|
|
|
pages:
|
|
stage: deploy
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- mkdir -p public/coverage
|
|
- ninja -C build coverage-html
|
|
- cp -r build/meson-logs/coveragereport/* public/coverage/
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
dependencies:
|
|
- Fedora
|
|
only:
|
|
- master@openconnect/ocserv
|
|
artifacts:
|
|
paths:
|
|
- public
|
|
|
|
triage:
|
|
stage: preliminaries
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- gem install gitlab-triage
|
|
- gitlab-triage --source-id $CI_PROJECT_ID --token "$API_TOKEN" -d
|
|
tags:
|
|
- saas-linux-small-amd64
|
|
only:
|
|
- schedules
|
|
|
|
codespell/Fedora:
|
|
stage: preliminaries
|
|
image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
|
|
script:
|
|
- git submodule update --init
|
|
- codespell .
|
|
tags:
|
|
- saas-linux-small-amd64
|