.gitlab-ci.yml

   1 # In the interest of reliability and performance, please avoid installing
   2 # external dependencies here, e.g. via tools/*-setup.sh, apt, dnf, or yum.
   3 # Do so in the appropriate Dockerfile at
   4 # https://gitlab.com/wireshark/wireshark-containers/ instead.
   5 # The resulting images can be found at
   6 # https://gitlab.com/wireshark/wireshark-containers/container_registry
   7
   8 stages:
   9   - build
  10   - analysis
  11   - test
  12   - fuzz-asan
  13   - fuzz-randpkt
  14   - fuzz-valgrind
  15
  16 variables:
  17   # Ensure that checkouts are a) fast and b) have a reachable tag. In a
  18   # brighter, more glorious future we might be able to use --shallow-since:
  19   # https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3460
  20   # In the mean time, fetching the last 5000 commits does the job.
  21   # Ensure that all variables are string
  22   GIT_DEPTH: "1"
  23   GIT_FETCH_EXTRA_FLAGS: "--depth=5000"
  24   CCACHE_DIR: "${CI_PROJECT_DIR}/ccache"
  25   # Enable color output in various tools.
  26   # CMake, Ninja, and others: https://bixense.com/clicolors/
  27   CLICOLOR_FORCE: "1"
  28   # pytest
  29   FORCE_COLOR: "1"
  30   # Homebrew
  31   HOMEBREW_COLOR: "1"
  32   # Skip irrelevant SAST scanners:
  33   SAST_EXCLUDED_ANALYZERS: "brakeman,eslint,security-code-scan,semgrep,spotbugs"
  34
  35 workflow:
  36   auto_cancel:
  37     # Automatically cancel pipelines if new changes are pushed to a branch
  38     # and the job is interruptible. Jobs are not interruptible by default.
  39     on_new_commit: interruptible
  40
  41 # Scheduled builds additionally set SCHEDULE_TYPE, which can be one of:
  42 # - 2x-daily: Twice daily at 07:00 and 19:00 UTC
  43 # - daily: Daily at 10:00 UTC
  44 # - weekly: Sunday at 14:00 UTC
  45 # - coverity-visual-c++: Monday, Wednesday, & Friday at 12:00 UTC
  46 # - coverity-gcc: Sunday, Tuesday, Thursday & Saturday at 12:00 UTC
  47
  48 # Common rule stanzas
  49 # These must currently be including using "!reference tags". "extends:" and
  50 # YAML anchors won't work:
  51 # https://gitlab.com/gitlab-org/gitlab/-/issues/322992
  52
  53 # Commits that have been approved and merged. Run automatically in the main
  54 # repo and allow manual runs in the web UI and in forks.
  55 # Release builds: CI_PIPELINE_SOURCE=api
  56 .if-merged:
  57   # Regular commits: CI_PIPELINE_SOURCE=push, CI_COMMIT_BRANCH=master
  58   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  59   # "Run pipeline" button commits, cherry picks
  60   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  61   # Tagged release builds: CI_PIPELINE_SOURCE=api (should be "web"?)
  62   - if: '$CI_PIPELINE_SOURCE == "api"'
  63   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_URL !~ /.*gitlab.com\/wireshark\/wireshark/'
  64     when: manual
  65 # Merged commits for runners which are only available in
  66 # wireshark/wireshark, e.g. wireshark-windows-*. Run automatically in
  67 # the main repo and allow manual runs in the web UI.
  68 .if-w-w-only-merged:
  69   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  70   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  71   - if: '$CI_PIPELINE_SOURCE == "api"'
  72 # Incoming merge requests.
  73 .if-merge-request:
  74   - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  75     interruptible: true
  76 # Incoming non-detached merge requests. Must be used for runners which are only
  77 # available in wireshark/wireshark, e.g. wireshark-windows-*
  78 .if-w-w-only-merge-request:
  79   - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  80     interruptible: true
  81 # Scheduled jobs. Care should be taken when changing this since the scheduler
  82 # often doesn't report errors.
  83 .if-weekly-schedule:
  84   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "weekly"'
  85 .if-daily-schedule:
  86   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily"'
  87 .if-2x-daily-schedule:
  88   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "2x-daily"'
  89 # Fuzz jobs. Care should be taken when changing this since the scheduler
  90 # often doesn't report errors.
  91 .if-fuzz-schedule:
  92   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "fuzz"'
  93
  94 .build-linux:
  95   stage: build
  96   tags:
  97     - saas-linux-small-amd64
  98   before_script:
  99     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 100     - env | grep ^CI | sort
 101     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 102   after_script:
 103     - for builddir in build/packaging/rpm/BUILD/wireshark-*/build build/packaging/rpm/BUILD/wireshark-* build obj-*; do [ ! -d "$builddir/run" ] || break; done
 104     - if [[ "$CI_JOB_NAME" == "build:rpm-opensuse-"* ]]; then export LD_LIBRARY_PATH=$builddir/run; fi
 105     - if [ -f $builddir/run/tshark ]; then $builddir/run/tshark --version; fi
 106   needs: []
 107
 108 .test-linux:
 109   stage: test
 110   tags:
 111     - saas-linux-small-amd64
 112   variables:
 113     GIT_STRATEGY: none
 114
 115 .build-ubuntu:
 116   extends: .build-linux
 117   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 118   retry: 1
 119   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 120   cache:
 121     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 122     key: ${CI_JOB_NAME}-master
 123     paths:
 124       - ccache/
 125   before_script:
 126     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 127     - env | grep ^CI | sort
 128     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 129     - useradd user
 130     - export LANG=en_US.UTF-8
 131     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 132     - mkdir -p ccache
 133     - ccache --show-stats
 134     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 135     - export DH_QUIET=1
 136     - export MAKEFLAGS=--silent
 137     - NUM_COMMITS=$(curl --silent $CI_API_V4_URL/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/commits | jq length)
 138     - echo "$NUM_COMMITS commit(s) in this MR"
 139     - mkdir build
 140     - cd build
 141   script:
 142     # setcap restricts our library paths
 143     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 144     - CFLAGS=-Wl,-rpath=$(pwd)/run CXXFLAGS=-Wl,-rpath=$(pwd)/run cmake -GNinja -DENABLE_CCACHE=ON $CMAKE_ARGS ..
 145     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 146     - ninja
 147     - ninja install
 148   after_script:
 149     # The cache should be large enough to be useful but it shouldn't take
 150     # too long to restore+save each run.
 151     - cd "$CI_PROJECT_DIR"
 152     - ccache --max-size $( du --total --summarize --block-size=1M *build*/ | awk 'END {printf ("%dM", $1 * 1.5)}' )
 153
 154 .build-rpm:
 155   extends: .build-linux
 156   rules: !reference [.if-2x-daily-schedule]
 157   before_script:
 158     # Hack to let ninja make full use of the system on Fedora and Rocky.
 159     - export RPM_BUILD_NCPUS=$(( $( getconf _NPROCESSORS_ONLN ) + 2 ))
 160     - git config --global user.email "you@example.com"
 161     - git config --global user.name "Your Name"
 162     - mkdir build
 163     - cd build
 164     - ../tools/make-version.py --set-release ..
 165     - mv -v ../wireshark-*.tar.* .
 166   artifacts:
 167     paths:
 168       - build/packaging/rpm/RPMS
 169     expire_in: 3 days
 170   needs:
 171     - 'Source Package'
 172
 173 .test-rpm:
 174   extends: .test-linux
 175   rules: !reference [.if-2x-daily-schedule]
 176
 177 .build-windows:
 178   stage: build
 179   retry: 1
 180   before_script:
 181     - if (-Not (Test-Path C:\Development)) { New-Item -Path C:\Development -ItemType "directory" }
 182     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 183     - $env:Configuration = "RelWithDebInfo"
 184     - $env:Path += ";C:\Program Files\CMake\bin"
 185     - $env:CMAKE_PREFIX_PATH = "C:\qt\6.8.0\msvc2022_64"
 186     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 187     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set " | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 188     # Testing / debugging only.
 189     # - cmd.exe /c "set CI_PIPELINE_SOURCE"
 190     # - cmd.exe /c "set CI_PROJECT_URL"
 191     #- dir c:\
 192     #- dir c:\qt
 193     #- $env:path.split(";")
 194     #- cmd.exe /c "set"
 195     #- Get-Location
 196     - mkdir build
 197     - cd build
 198   needs: []
 199
 200 # macOS runners are still beta:
 201 # https://about.gitlab.com/blog/2021/08/23/build-cloud-for-macos-beta/
 202 # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html#vm-images
 203 # https://gitlab.com/gitlab-org/ci-cd/shared-runners/images/macstadium/orka/-/blob/main/toolchain/monterey.yml
 204 .build-macos:
 205   stage: build
 206   tags: [ saas-macos-medium-m1 ] # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html
 207   retry: 1
 208   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 209   cache:
 210     key: ${CI_JOB_NAME}-master
 211     paths:
 212       - ccache/
 213   variables:
 214     HOMEBREW_NO_AUTO_UPDATE: "1"
 215     HOMEBREW_DISPLAY_INSTALL_TIMES: "1"
 216     HOMEBREW_NO_INSTALL_CLEANUP: "1"
 217     HOMEBREW_NO_INSTALL_UPGRADE: "1"
 218     HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: "1"
 219     HOMEBREW_NO_UPDATE_REPORT_NEW: "1"
 220   before_script:
 221     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 222     - env | grep ^CI | sort
 223     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 224     - brew --version
 225     - printf "\e[0Ksection_start:%s:brew_section[collapsed=true]\r\e[0KInstalling prerequisites" "$( date +%s)"
 226     - ./tools/macos-setup-brew.sh --install-optional --install-test-deps
 227     - printf "\e[0Ksection_end:%s:brew_section\r\e[0K" "$( date +%s)"
 228     - python3 -m venv $CI_PROJECT_DIR/.venv
 229     - source $CI_PROJECT_DIR/.venv/bin/activate
 230     - pip3 install pytest pytest-xdist
 231     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 232     - mkdir -p ccache
 233     - ccache --show-stats
 234     - mkdir build
 235     - cd build
 236   script:
 237     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 238     - cmake -G Ninja -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 239     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 240     - ninja
 241     - ninja test-programs
 242     - pytest --disable-capture
 243   after_script:
 244     # The cache should be large enough to be useful but it shouldn't take
 245     # too long to restore+save each run.
 246     - ccache --max-size $( gdu --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 247   needs: []
 248
 249 .build-mingw:
 250   stage: build
 251   image: registry.gitlab.com/wireshark/wireshark-containers/mingw-dev
 252   tags:
 253     - saas-linux-small-amd64
 254   cache:
 255     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 256     key: ${CI_JOB_NAME}-master
 257     paths:
 258       - ccache/
 259   before_script:
 260     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 261     - env | grep ^CI | sort
 262     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 263     - mkdir -p ccache
 264     - ccache --show-stats
 265     - mkdir build
 266     - cd build
 267   script:
 268     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 269     - ninja
 270   after_script:
 271     # The cache should be large enough to be useful but it shouldn't take
 272     # too long to restore+save each run.
 273     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 274   needs: []
 275
 276 Source Package:
 277   extends: .build-ubuntu
 278   stage: .pre
 279   rules:
 280     - !reference [.if-w-w-only-merged]
 281     - !reference [.if-2x-daily-schedule]
 282   script:
 283     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 284     - ../tools/update-appdata.py
 285     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 286     - cmake -G Ninja $CMAKE_ARGS ..
 287     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 288     - cd $CI_PROJECT_DIR
 289     - build/packaging/source/git-export-release.sh -d .
 290     - cd build
 291     - ninja release_notes
 292     - WIRESHARK_VERSION=$(< wireshark_version.txt)
 293     - cp -v doc/release-notes.html ../release-notes-${WIRESHARK_VERSION}.html
 294     - cp -v doc/release-notes.txt ../release-notes-${WIRESHARK_VERSION}.txt
 295     - cd ..
 296     - zstdcat --threads=0 wireshark-${WIRESHARK_VERSION}.tar.zst | xz --threads=0 > wireshark-${WIRESHARK_VERSION}.tar.xz
 297   after_script:
 298     # - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 299     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 300     - if [ -n "$SCHEDULE_TYPE" ] ; then exit 0 ; fi
 301     - stat --format="%n %s bytes" wireshark-*.tar.*
 302     - for digest in sha512 sha256 sha1 ; do openssl $digest wireshark-*.tar.* ; done
 303     - if [ -n "$MC_DESTINATION_DIST" ] ; then mc --quiet cp wireshark-*.tar.* "$MC_DESTINATION_DIST/" ; fi
 304     - if [ -n "$MC_DESTINATION_RELEASE" ] ; then mc --quiet cp release-notes-*.{txt,html} "$MC_DESTINATION_RELEASE/" ; fi
 305   artifacts:
 306     paths:
 307       - wireshark-*.tar.*
 308       - release-notes-*.html
 309       - release-notes-*.txt
 310
 311 # Job to generate packages for Debian stable
 312 Debian Stable APT Package:
 313   extends: .build-linux
 314   rules: !reference [.if-2x-daily-schedule]
 315   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 316   script:
 317     - ln --symbolic --no-dereference --force packaging/debian
 318     - tools/make-version.py --set-release .
 319     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 320     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 321     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 322     - export DH_QUIET=1
 323     - export MAKEFLAGS=--silent
 324     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ dpkg-buildpackage -b --no-sign -jauto -zfast
 325     # Please don't add a Lintian step unless you can guarantee that someone
 326     # will fix any breakages that invariably pop up.
 327     - mkdir debian-packages
 328     - mv -v ../*.deb debian-packages/
 329   artifacts:
 330     paths:
 331       - debian-packages/*.deb
 332     expire_in: 3 days
 333
 334 Debian Stable APT Test:
 335   extends: .test-linux
 336   rules: !reference [.if-2x-daily-schedule]
 337   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 338   stage: test
 339   script:
 340     - DEBIAN_FRONTEND=noninteractive apt-get install ./debian-packages/*.deb -y
 341     - tshark --version
 342   variables:
 343     GIT_STRATEGY: none
 344   needs: [ 'Debian Stable APT Package' ]
 345
 346 Fedora RPM Package:
 347   extends: .build-rpm
 348   image: registry.gitlab.com/wireshark/wireshark-containers/fedora-dev
 349   script:
 350     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 351     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 352     - export FORCE_CMAKE_NINJA_NON_VERBOSE=1
 353     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 354     - cmake3 -G Ninja ..
 355     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 356     - ninja wireshark_rpm
 357
 358 # Fedora RPM Test:
 359 #   extends: .test-rpm
 360 #   image: fedora
 361 #   script:
 362 #     - dnf install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 363 #     - tshark --version
 364 #  needs: [ 'Fedora RPM Package' ]
 365
 366 openSUSE 15.6 RPM Package:
 367   extends: .build-rpm
 368   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.6-dev
 369   script:
 370     - source /gcc-latest.env
 371     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 372     - cmake -G Ninja ..
 373     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 374     - ninja wireshark_rpm
 375
 376 openSUSE 15.6 RPM Test:
 377   extends: .test-rpm
 378   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.6-dev
 379   script:
 380     - zypper --no-gpg-checks --no-remote install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 381     - tshark --version
 382   needs: [ 'openSUSE 15.6 RPM Package' ]
 383
 384 Rocky Linux 9 RPM Package:
 385   extends: .build-rpm
 386   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 387   script:
 388     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 389     - cmake -G Ninja -DUSE_qt6=OFF ..
 390     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 391     - ninja wireshark_rpm
 392
 393 Rocky Linux 9 RPM Test:
 394   extends: .test-rpm
 395   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 396   script:
 397     - dnf --nogpgcheck localinstall -y build/packaging/rpm/RPMS/x86_64/*.rpm
 398     - tshark --version
 399   needs: [ 'Rocky Linux 9 RPM Package' ]
 400
 401 Ubuntu APT Package:
 402   extends: .build-ubuntu
 403   rules: !reference [.if-2x-daily-schedule]
 404   script:
 405     # build-ubuntu puts us in `build`.
 406     - cd ..
 407     - ln --symbolic --no-dereference --force packaging/debian
 408     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ MAKE=ninja dpkg-buildpackage -us -uc -rfakeroot -jauto -zfast
 409     # Please don't add a Lintian step unless you can guarantee that someone
 410     # will fix any breakages that invariably pop up.
 411     - mkdir ubuntu-packages
 412     - mv ../*.deb ubuntu-packages/
 413   after_script:
 414     # dpkg-buildpackage builds in obj-<triplet>, so we need to override
 415     # .build-ubuntu. We also build more stuff, so decrease our multiplier.
 416     - ccache --max-size $( du --summarize --block-size=1M --total "$CI_PROJECT_DIR"/obj-* | awk '/total$/ {printf ("%dM", $1 * 1.25)}' )
 417   artifacts:
 418     paths:
 419       - ubuntu-packages/*.deb
 420     expire_in: 3 days
 421
 422 Ubuntu APT Test:
 423   extends: .test-linux
 424   rules: !reference [.if-2x-daily-schedule]
 425   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 426   stage: test
 427   script:
 428     - DEBIAN_FRONTEND=noninteractive apt-get install ./ubuntu-packages/*.deb -y
 429     - tshark --version
 430   variables:
 431     GIT_STRATEGY: none
 432   needs: [ 'Ubuntu APT Package' ]
 433
 434 Arch Linux :
 435   extends: .build-linux
 436   rules: !reference [.if-2x-daily-schedule]
 437   image: registry.gitlab.com/wireshark/wireshark-containers/arch-dev
 438   script:
 439     - COMMON_PACMAN_ARGS="--sync --refresh --sysupgrade --needed --noconfirm"
 440     - ./tools/make-version.py --set-release --version-file=wireshark_version.txt .
 441     - WIRESHARK_VERSION=$(cat wireshark_version.txt)
 442     - WIRESHARK_PREFIX="/opt/wireshark-$WIRESHARK_VERSION"
 443     # There are no falcosecurity/libs or falcosecurity/plugins packages for Arch,
 444     # so just build them ourselves for now.
 445     - pushd /tmp
 446     # falcosecurity/plugins
 447     - pacman $COMMON_PACMAN_ARGS go
 448     - git clone https://github.com/falcosecurity/plugins.git falco-plugins
 449     - pushd /tmp/falco-plugins/plugins/cloudtrail
 450     - make
 451     - popd
 452     - pushd /tmp/falco-plugins/plugins/gcpaudit
 453     - make
 454     - popd
 455     # falcosecurity/libs
 456     - pacman $COMMON_PACMAN_ARGS uthash libelf onetbb jsoncpp re2
 457     - export LDFLAGS=-Wl,-rpath,'$ORIGIN/../lib'
 458     - git clone https://github.com/falcosecurity/libs.git falco-libs
 459     - cd /tmp/falco-libs
 460     - git switch -c 0.18.1 0.18.1
 461     - printf "\e[0Ksection_start:%s:fslibs_cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 462     - cmake -B build -G Ninja -DBUILD_SHARED_LIBS=on -DMINIMAL_BUILD=on -DBUILD_DRIVER=off -DENABLE_ENGINE_KMOD=off -DBUILD_LIBSCAP_EXAMPLES=off -DUSE_BUNDLED_DEPS=off -DUSE_BUNDLED_VALIJSON=on -DCREATE_TEST_TARGETS=off -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_RPATH='$ORIGIN/../lib' -DCMAKE_INSTALL_PREFIX=$WIRESHARK_PREFIX
 463     - printf "\e[0Ksection_end:%s:fslibs_cmake_section\r\e[0K" "$( date +%s)"
 464     - ninja -C build
 465     - ninja -C build install
 466     - sed -i -e 's/-linstall_lib_link_libraries-NOTFOUND/-lscap_platform -lscap_platform_util/g' $WIRESHARK_PREFIX/lib/pkgconfig/libscap.pc
 467     - popd
 468     - export CMAKE_PREFIX_PATH=$WIRESHARK_PREFIX
 469     - mkdir build
 470     - cd build
 471     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 472     - cmake -G Ninja -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS="/tmp/falco-plugins/plugins/cloudtrail/libcloudtrail.so;/tmp/falco-plugins/plugins/gcpaudit/libgcpaudit.so" -DCMAKE_INSTALL_PREFIX=$WIRESHARK_PREFIX ..
 473     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 474     - ninja
 475     - ninja install
 476     - install -v -D -m 755 -t $WIRESHARK_PREFIX/lib/stratoshark/plugins/4.5/epan run/plugins/4.5/epan/falco-bridge.so
 477     - install -v -D -m 755 -t $WIRESHARK_PREFIX/lib/stratoshark/plugins/falco run/plugins/falco/*.so
 478     # XXX Need to add an install prereqs script
 479     - tar -C / -cJf $CI_PROJECT_DIR/wireshark-arch-$WIRESHARK_VERSION.tar.xz opt/wireshark-$WIRESHARK_VERSION
 480   artifacts:
 481     paths:
 482       - $CI_PROJECT_DIR/wireshark-arch-*.tar.xz
 483
 484 Windows x64 Package:
 485   extends: .build-windows
 486   rules: !reference [.if-w-w-only-merged]
 487   tags:
 488     - wireshark-windows-x64-package
 489   before_script:
 490     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 491     - $env:Configuration = "RelWithDebInfo"
 492     - $env:CMAKE_PREFIX_PATH = "C:\Qt\6.8.0\msvc2022_64"
 493     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 494     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 495     - mkdir build
 496     - cd build
 497   script:
 498     - C:\Windows\py.exe ..\tools\make-version.py --set-release --version-file=wireshark_version.txt ..
 499     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DENABLE_SIGNED_NSIS=on ..
 500     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 501     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 502     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 503     - msbuild /verbosity:minimal /maxcpucount stratoshark_nsis_prep.vcxproj
 504     - msbuild /verbosity:minimal /maxcpucount wireshark_wix_prep.vcxproj
 505     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 506     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 507     - msbuild /verbosity:minimal stratoshark_nsis.vcxproj
 508     # No need for explicit signing of NSIS installer here. The signing is done by makensis.
 509     - msbuild /verbosity:minimal wireshark_wix.vcxproj
 510     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\wix\Wireshark-*.msi
 511     - msbuild /verbosity:minimal wireshark_portableapps.vcxproj
 512     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\portableapps\WiresharkPortable*.exe
 513     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-x64.exe packaging\nsis\Stratoshark-*-x64.exe packaging\wix\Wireshark-*-x64.msi packaging\portableapps\WiresharkPortable??_*.paf.exe
 514     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 515     - C:\gitlab-builds\bin\mse-scan.ps1
 516     - run\RelWithDebInfo\tshark --version
 517     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-x64.exe", "packaging\nsis\Stratoshark-*-x64.exe", "packaging\wix\Wireshark-*-x64.msi", "packaging\portableapps\WiresharkPortable??_*.paf.exe", "Wireshark-pdb-*x64.zip"
 518     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 519     - if (Test-Path env:MC_DESTINATION_WINDOWS_X64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_X64/" }
 520     - $nsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-x64.exe).Hash
 521     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 522     - Set-Content -Path release-info-$($wiresharkVersion)-windows-x64.ini -Value ("[DEFAULT]`nnsis_sha256 = $nsisSha256")
 523     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp release-info-$($wiresharkVersion)-windows-x64.ini "$env:MC_DESTINATION_RELEASE/" }
 524     - C:\Windows\py.exe -m pytest
 525   artifacts:
 526     paths:
 527       - build/release-info-*.ini
 528
 529 Windows Arm64 Package:
 530   extends: .build-windows
 531   rules: !reference [.if-w-w-only-merged]
 532   tags:
 533     - wireshark-windows-arm64-package
 534   before_script:
 535     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 536     - $env:Configuration = "RelWithDebInfo"
 537     - $env:CMAKE_PREFIX_PATH = "C:\Qt\6.8.0\msvc2022_arm64"
 538     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 539     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsarm64.bat`" && set" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 540     - mkdir build
 541     - cd build
 542   script:
 543     - C:\Windows\py.exe ..\tools\make-version.py --set-release --version-file=wireshark_version.txt ..
 544     - cmake -G "Visual Studio 17 2022" -A arm64 -DENABLE_LTO=off -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DENABLE_SIGNED_NSIS=on ..
 545     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 546     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 547     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 548     - msbuild /verbosity:minimal /maxcpucount stratoshark_nsis_prep.vcxproj
 549     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 550     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 551     - msbuild /verbosity:minimal stratoshark_nsis.vcxproj
 552     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-arm64.exe packaging\nsis\Stratoshark-*-arm64.exe
 553     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 554     - C:\gitlab-builds\bin\mse-scan.ps1
 555     - run\RelWithDebInfo\tshark --version
 556     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-arm64.exe", "packaging\nsis\Stratoshark-*-arm64.exe", "Wireshark-pdb-*arm64.zip"
 557     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 558     - if (Test-Path env:MC_DESTINATION_WINDOWS_ARM64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_ARM64/" }
 559     - $nsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-arm64.exe).Hash
 560     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 561     - Set-Content -Path release-info-$($wiresharkVersion)-windows-arm64.ini -Value ("[DEFAULT]`nnsis_sha256 = $nsisSha256")
 562     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp release-info-$($wiresharkVersion)-windows-arm64.ini "$env:MC_DESTINATION_RELEASE/" }
 563     - C:\Windows\py.exe -m pytest
 564   artifacts:
 565     paths:
 566       - build/release-info-*.ini
 567
 568 Windows MinGW-w64 Package:
 569   extends: .build-mingw
 570   rules: !reference [.if-w-w-only-merged]
 571   script:
 572     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 573     - ninja
 574     - ninja user_guide_html
 575     - ninja wireshark_nsis_prep
 576     - ninja wireshark_nsis
 577   artifacts:
 578     paths:
 579       - build/packaging/nsis/wireshark-*.exe
 580     expire_in: 3 days
 581
 582 macOS Arm Package:
 583   stage: build
 584   rules: !reference [.if-w-w-only-merged]
 585   variables:
 586     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 587   tags:
 588     - wireshark-macos-arm-package
 589   retry: 1
 590   script:
 591     - export CMAKE_PREFIX_PATH=/usr/local/Qt-6.5.3
 592     # Not needed for Falco libs 0.19?
 593     - export CXXFLAGS="-isystem /usr/local/include/falcosecurity"
 594     - export PATH="$PATH:$HOME/bin"
 595     - mkdir build
 596     - cd build
 597     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 598     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 599     - cmake -DENABLE_CCACHE=ON -DCMAKE_APPLE_SILICON_PROCESSOR=arm64 -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DCMAKE_OSX_ARCHITECTURES=arm64 -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS=/usr/local/lib/falco-plugins/libcloudtrail.so -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 600     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 601     - ninja
 602     - codesign-prep
 603     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 604     - ninja wireshark_dmg
 605     - ninja stratoshark_dmg
 606     - cd run
 607     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 608     - xcrun stapler staple Wireshark?[1-9]*.dmg
 609     - xcrun notarytool submit Stratoshark?[0-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 610     - xcrun stapler staple Stratoshark?[0-9]*.dmg
 611     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg Stratoshark?[0-9]*.dmg
 612     - stat -f "%N %z bytes" Wireshark*.dmg Stratoshark*.dmg
 613     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg Stratoshark*.dmg ; done
 614     - |
 615       if [ -n "$S3_DESTINATION_MACOS_ARM64" ] ; then
 616         aws s3 cp Wireshark?[1-9]*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 617         aws s3 cp Wireshark?dSYM*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 618         aws s3 cp Stratoshark?[0-9]*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 619         aws s3 cp Stratoshark?dSYM*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 620       fi
 621     - SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 622     - $CI_PROJECT_DIR/build/run/tshark --version
 623     - DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 624     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 625     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$SPARKLE_SIGNATURE" "$DMG_SHA256" > release-info-${WIRESHARK_VERSION}-macos-arm64.ini
 626     - if [[ -n "$S3_DESTINATION_RELEASE" ]] ; then aws s3 cp release-info-${WIRESHARK_VERSION}-macos-arm64.ini "$S3_DESTINATION_RELEASE/" ; fi
 627     - cd ..
 628     - ninja test
 629   artifacts:
 630     paths:
 631       - build/run/release-info-*.ini
 632   needs: []
 633
 634 macOS Intel Package:
 635   stage: build
 636   rules: !reference [.if-w-w-only-merged]
 637   variables:
 638     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 639   tags:
 640     - wireshark-macos-intel-package
 641   retry: 1
 642   script:
 643     - export CMAKE_PREFIX_PATH=/usr/local/Qt-6.5.3
 644     # Not needed for Falco libs 0.19?
 645     - export CXXFLAGS="-isystem /usr/local/include/falcosecurity"
 646     - export PATH="$PATH:$HOME/bin"
 647     - mkdir build
 648     - cd build
 649     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 650     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 651     - cmake -DENABLE_CCACHE=ON -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS=/usr/local/lib/falco-plugins/libcloudtrail.so -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 652     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 653     - ninja
 654     - codesign-prep
 655     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 656     - ninja wireshark_dmg
 657     - ninja stratoshark_dmg
 658     - cd run
 659     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 660     - xcrun stapler staple Wireshark?[1-9]*.dmg
 661     - xcrun notarytool submit Stratoshark?[0-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 662     - xcrun stapler staple Stratoshark?[0-9]*.dmg
 663     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg Stratoshark?[0-9]*.dmg
 664     - stat -f "%N %z bytes" Wireshark*.dmg Stratoshark*.dmg
 665     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg Stratoshark*.dmg ; done
 666     - |
 667       if [ -n "$S3_DESTINATION_MACOS_INTEL64" ] ; then
 668         aws s3 cp Wireshark?[1-9]*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 669         aws s3 cp Wireshark?dSYM*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 670         aws s3 cp Stratoshark?[0-9]*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 671         aws s3 cp Stratoshark?dSYM*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 672       fi
 673     - SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 674     - $CI_PROJECT_DIR/build/run/tshark --version
 675     - DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 676     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 677     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$SPARKLE_SIGNATURE" "$DMG_SHA256" > release-info-${WIRESHARK_VERSION}-macos-intel64.ini
 678     - if [[ -n "$S3_DESTINATION_RELEASE" ]] ; then aws s3 cp release-info-${WIRESHARK_VERSION}-macos-intel64.ini "$S3_DESTINATION_RELEASE/" ; fi
 679     - cd ..
 680     - ninja test
 681   artifacts:
 682     paths:
 683       - build/run/release-info-*.ini
 684   needs: []
 685
 686 # Build the User's Guide and Developer's Guide
 687 Documentation:
 688   extends: .build-linux
 689   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 690   rules:
 691     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
 692       changes:
 693         - "doc/**/*"
 694         - "epan/wslua/**/*"
 695     - if: '$CI_PIPELINE_SOURCE == "push"'
 696       when: manual
 697       allow_failure: true
 698   script:
 699     # XXX We might want to move this to wireshark-ubuntu-dev or debian-setup.sh.
 700     - DEBIAN_FRONTEND=noninteractive apt-get update
 701     - DEBIAN_FRONTEND=noninteractive apt-get --yes install ruby-asciidoctor-pdf ruby-coderay ruby-dev
 702     - NOKOGIRI_USE_SYSTEM_LIBRARIES=1 gem install asciidoctor-epub3
 703     - mkdir build
 704     - cd build
 705     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 706     - cmake -GNinja ..
 707     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 708     - ninja all_guides faq_html
 709     - cd doc
 710     - for HTML_DIR in ws[ud]g_html{,_chunked} ; do zip -9 -r "$HTML_DIR.zip" "$HTML_DIR" ; done
 711     - gzip -9 faq.html
 712     - if [ -n "$MC_DESTINATION_DOCS" ] ; then mc --quiet cp ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} faq.html.gz "$MC_DESTINATION_DOCS/" ; fi
 713     - mv -v ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} faq.html.gz ../..
 714   after_script:
 715     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 716   artifacts:
 717     paths:
 718       - wsug_html.zip
 719       - wsug_html_chunked.zip
 720       - wsdg_html.zip
 721       - wsdg_html_chunked.zip
 722       - "Wireshark User's Guide.pdf"
 723       - "Wireshark Developer's Guide.pdf"
 724       - "Wireshark User's Guide.epub"
 725       - "Wireshark Developer's Guide.epub"
 726       - faq.html.gz
 727   needs: []
 728
 729
 730 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#linux-shared-runners
 731
 732 Commit Check:
 733   extends: .build-ubuntu
 734   rules: !reference [.if-merge-request]
 735   variables:
 736     GITLAB_REPO: "$CI_MERGE_REQUEST_PROJECT_URL"
 737   script:
 738     # build-ubuntu puts us in `build`.
 739     - cd ..
 740     - git status
 741     # We have the following options for displaying information in a merge request
 742     # from a pipleline job:
 743     #
 744     # - The Notes API, which requires a valid GitLab CI_JOB_TOKEN variable, which
 745     #   isn't available for outside projects:
 746     #   https://gitlab.com/gitlab-org/gitlab/-/issues/464591.
 747     #
 748     # - Code Quality, which requires extra configuration, using a special container
 749     #   image, and writing a custom plugin:
 750     #   https://docs.gitlab.com/ee/ci/testing/code_quality.html.
 751     #
 752     # - Unit test reports, which must be formatted as JUnit XML:
 753     #   https://docs.gitlab.com/ee/ci/testing/unit_test_reports.html
 754     #   https://www.ibm.com/docs/en/developer-for-zos/14.2?topic=formats-junit-xml-format
 755     #
 756     # Let's generate a unit test report using tools/wrap-ci-test.py.
 757     - REPORT_FILE=commit_checks.xml
 758     - TEST_SUITE=commit_checks
 759     - EXIT_CODE=0
 760     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case num_commits --command "[ $NUM_COMMITS -lt 2 ] || (echo 'ℹ️ This merge request has more than one commit. Please squash any trivial ones:\n'; git log --oneline --no-decorate --max-count=$NUM_COMMITS ; false)" || true
 761     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/pre-commit ./tools/pre-commit $( git log --max-count=$NUM_COMMITS --pretty=format:%h ) || EXIT_CODE=1
 762     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/validate-commit ./tools/validate-commit.py $( git log --max-count=$NUM_COMMITS --pretty=format:%h ) || EXIT_CODE=1
 763     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/checklicenses ./tools/checklicenses.py || EXIT_CODE=1
 764     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/check_help_urls ./tools/check_help_urls.py || EXIT_CODE=1
 765     - exit $EXIT_CODE
 766   artifacts:
 767     when: always
 768     paths:
 769       - commit_checks.xml
 770     reports:
 771       junit: commit_checks.xml
 772
 773 Ubuntu GCC Build:
 774   extends: .build-ubuntu
 775   rules: !reference [.if-merge-request]
 776   variables:
 777     CC: "gcc"
 778     CXX: "g++"
 779   needs: [ 'Commit Check' ]
 780   script:
 781     - source /gcc-latest.env
 782     # build-ubuntu puts us in `build`.
 783     - cd ..
 784     - mv build "🦈 build 🦈"
 785     - cd "🦈 build 🦈"
 786     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 787     # Test release build.
 788     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=on ..
 789     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 790     - script --command ninja --flush --quiet --return ../gcc_report.txt
 791     - ansi2html < ../gcc_report.txt > ../gcc_report.html
 792     - ninja test-programs
 793     - chown -R user .
 794     - if [ -f run/dumpcap ]; then setcap cap_net_raw,cap_net_admin+eip run/dumpcap; fi
 795     - if [ -f run/dumpcap ]; then su user -c "run/dumpcap -D" ; fi
 796     - su user -c "pytest-3 --junitxml=../ubuntu_tests.xml"
 797     # Test CMake install code and CPack config code. Select any one of the archive generators.
 798     - ninja user_guide_html
 799     - ninja developer_guide_html
 800     - cpack -G TZST .
 801     - ls wireshark-*.tar.zst{,.sha256}
 802   artifacts:
 803     when: always
 804     paths:
 805       - gcc_report.html
 806     reports:
 807       junit: ubuntu_tests.xml
 808
 809 Ubuntu Qt5 Build:
 810   extends: .build-ubuntu
 811   rules:
 812     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 813       interruptible: true
 814       changes:
 815         - "ui/**/*"
 816     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 817       when: manual
 818       allow_failure: true
 819   needs: [ 'Commit Check' ]
 820   script:
 821     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 822     - cmake -G Ninja -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -DUSE_qt6=OFF ..
 823     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 824     - ninja
 825     - run/wireshark -v
 826
 827 Fedora MinGW Build:
 828   extends: .build-mingw
 829   rules: !reference [.if-merge-request]
 830   needs: [ 'Commit Check' ]
 831
 832 Clang + Code Checks:
 833   extends: .build-ubuntu
 834   tags:
 835     - saas-linux-medium-amd64
 836   rules: !reference [.if-merge-request]
 837   needs: [ 'Commit Check' ]
 838   script:
 839     - source /clang-latest.env
 840     - apt-get update && apt-get --yes install python3-venv
 841     - python3 -m venv $CI_PROJECT_DIR/.venv
 842     - source $CI_PROJECT_DIR/.venv/bin/activate
 843     # build-ubuntu puts us in `build`.
 844     - cd ..
 845     - mkdir cppcheck
 846     - ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS | tee cppcheck/cppcheck_report.txt
 847     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS -x > cppcheck/cppcheck_report.xml ; fi
 848     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then cppcheck-htmlreport --file cppcheck/cppcheck_report.xml  --report-dir cppcheck ; fi
 849     - cd build
 850     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 851     # We don't have an "All options" job, so build fuzzshark and tfshark here.
 852     - cmake -DENABLE_CHECKHF_CONFLICT=on -DCMAKE_EXPORT_COMPILE_COMMANDS=on -DCMAKE_C_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DCMAKE_CXX_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DBUILD_fuzzshark=ON -DBUILD_tfshark=On -DBUILD_stratoshark=ON -DENABLE_DEBUG=ON -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -G Ninja ..
 853     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 854     - printf "\e[0Ksection_start:%s:asn1_section[collapsed=false]\r\e[0KRegenerating ASN.1 dissectors" "$( date +%s)"
 855     - ninja --quiet asn1
 856     - git diff --exit-code ${CI_COMMIT_SHA} ..
 857     - printf "\e[0Ksection_end:%s:asn1_section\r\e[0K" "$( date +%s)"
 858     - printf "\e[0Ksection_start:%s:pidl_section[collapsed=true]\r\e[0KRegenerating PIDL dissectors" "$( date +%s)"
 859     - ninja pidl-dissectors
 860     - ninja idl2wrs-dissectors
 861     - git diff --exit-code ${CI_COMMIT_SHA} ..
 862     - printf "\e[0Ksection_end:%s:pidl_section\r\e[0K" "$( date +%s)"
 863     - mkdir ../html
 864     - script --command ninja --flush --quiet --return ../tmp_clang_report.txt
 865     - ansi2txt < ../tmp_clang_report.txt > ../clang_report.txt
 866     - ansi2html < ../tmp_clang_report.txt > ../html/clang_report.html
 867     - ./run/tshark -v 2> >(tee ../checkhf_conflict.txt)
 868     - ../tools/validate-clang-check.sh -c $CLANG_VERSION 2> >(tee ../tmp_clang_analyzer_check.txt)
 869     - ansi2txt < ../tmp_clang_analyzer_check.txt > ../clang_analyzer_check.txt
 870     - ansi2html < ../tmp_clang_analyzer_check.txt > ../html/clang_analyzer_check.html
 871     - ninja checkAPI
 872     - ninja shellcheck
 873     - cd ..
 874     - pip3 install pyspellchecker
 875     - ./tools/check_spelling.py --no-wikipedia --comments --commits $NUM_COMMITS | tee spelling_check.txt
 876     - ./tools/check_typed_item_calls.py --consecutive --label --mask --check-bitmask-fields --commits $NUM_COMMITS | tee item_calls_check.txt
 877     - ./tools/check_tfs.py --check-value-strings --commits $NUM_COMMITS | tee tfs_check.txt
 878     - ./tools/check_val_to_str.py --commits $NUM_COMMITS | tee val_to_str_check.txt
 879     - ./tools/check_col_apis.py --commits $NUM_COMMITS | tee col_apis_check.txt
 880   artifacts:
 881     paths:
 882       - clang_report.txt
 883       - clang_analyzer_check.txt
 884       - cppcheck
 885       - spelling_check.txt
 886       - item_calls_check.txt
 887       - tfs_check.txt
 888       - val_to_str_check.txt
 889       - col_apis_check.txt
 890       - checkhf_conflict.txt
 891       - html/
 892
 893 No options:
 894   extends: .build-ubuntu
 895   rules: !reference [.if-merge-request]
 896   needs: [ 'Commit Check' ]
 897   script: |
 898     cmake -GNinja -DENABLE_CCACHE=ON \
 899       -DENABLE_BROTLI=OFF -DENABLE_CAP=OFF -DENABLE_CHECKHF_CONFLICT=ON -DENABLE_GNUTLS=OFF \
 900       -DENABLE_KERBEROS=OFF -DENABLE_LIBXML2=OFF -DENABLE_ILBC=OFF -DENABLE_LUA=OFF -DENABLE_LZ4=OFF \
 901       -DENABLE_MINIZIP=OFF -DENABLE_NETLINK=OFF -DENABLE_NGHTTP2=OFF -DENABLE_NGHTTP3=OFF \
 902       -DENABLE_BCG729=OFF -DENABLE_OPUS=OFF -DENABLE_PCAP=OFF -DENABLE_PLUGIN_IFDEMO=ON \
 903       -DENABLE_PLUGINS=OFF -DENABLE_SBC=OFF -DENABLE_SMI=OFF -DENABLE_SNAPPY=OFF -DENABLE_SPANDSP=OFF \
 904       -DENABLE_ZLIB=OFF -DENABLE_ZSTD=OFF -DBUILD_mmdbresolve=OFF ..
 905     ninja
 906
 907 # Windows runners are still beta, at least technically:
 908 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
 909 Windows Build:
 910   extends: .build-windows
 911   rules: !reference [.if-w-w-only-merge-request]
 912   tags:
 913     - wireshark-windows-merge-req
 914   needs: [ 'Commit Check' ]
 915   script:
 916     # lib{sinsp,scap} don't support Configuration=Debug, so we can't enable
 917     # BUILD_stratoshark or BUILD_falcodump here just yet.
 918     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
 919     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug Wireshark.sln
 920     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug test-programs.vcxproj
 921     - C:\Windows\py.exe -m pytest --disable-gui --build-type=Debug --junitxml=../windows_tests.xml
 922   artifacts:
 923     when: always
 924     reports:
 925       junit: windows_tests.xml
 926
 927 macOS Build:
 928   extends: .build-macos
 929   rules: !reference [.if-w-w-only-merge-request]
 930   script:
 931     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 932     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 933     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 934     - ninja
 935     - ninja test-programs
 936     - pytest --disable-capture --junitxml=../macos_tests.xml
 937   artifacts:
 938     when: always
 939     reports:
 940       junit: macos_tests.xml
 941   needs: [ 'Commit Check' ]
 942
 943 # Adapted from https://www.synopsys.com/blogs/software-security/integrating-coverity-scan-with-gitlab-ci/
 944 # and https://gitlab.gnome.org/GNOME/glib/-/blob/8f57a5b9/.gitlab-ci.yml#L481
 945 Coverity GCC Scan:
 946   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 947   rules:
 948     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
 949   stage: analysis
 950   needs: []
 951   variables:
 952     CC: gcc
 953     CXX: g++
 954     # cov-build doesn’t handle GLIB_DEPRECATED_ENUMERATOR
 955     CFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 956     CXXFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 957   script:
 958     - curl --output /tmp/cov-analysis-linux64.tar.gz --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/linux64
 959     - tar --directory=/tmp --extract --gzip --file /tmp/cov-analysis-linux64.tar.gz
 960     - mkdir build
 961     - cd build
 962     - cmake -G Ninja ..
 963     - /tmp/cov-analysis-linux64-*/bin/cov-build --return-emit-failures --dir ../cov-int ninja
 964     - cd ..
 965     - tar --create --gzip --file cov-int.tar.gz cov-int
 966     - echo "export ARTIFACT_JOB_URL=$CI_JOB_URL" > job_environment_variables.sh
 967     - echo "export GIT_DESCRIPTION=$( git describe --tags )" >> job_environment_variables.sh
 968   artifacts:
 969     paths:
 970       - cov-int.tar.gz
 971       - job_environment_variables.sh
 972
 973 Coverity GCC Submit:
 974   image: curlimages/curl
 975   rules:
 976     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
 977   stage: .post
 978   script:
 979     - . job_environment_variables.sh
 980     - echo $ARTIFACT_JOB_URL
 981     - echo $GIT_DESCRIPTION
 982     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.tar.gz&version=$GIT_DESCRIPTION&description=Ubuntu $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
 983   needs: [ 'Coverity GCC Scan' ]
 984
 985 Coverity Visual C++ Scan:
 986   extends: .build-windows
 987   rules:
 988     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
 989   tags:
 990     - wireshark-windows-merge-req
 991   stage: analysis
 992   needs: []
 993   script:
 994     - $gitDescription = (( git describe --tags ) | Out-String).Trim()
 995     - C:\Windows\System32\curl --output $env:temp\cov-analysis-win64.zip --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/win64
 996     - C:\ProgramData\chocolatey\tools\7z x "$env:temp\cov-analysis-win64.zip" -y -r -o"$env:temp"
 997     - cmake -DTEST_EXTRA_ARGS=--enable-release -DENABLE_LTO=off -G "Visual Studio 17 2022" -A x64 ..
 998     - $covAnalysisWin64 = (Get-ChildItem -Path $env:temp -Filter "cov-analysis-win64-*" -Directory)[0].FullName
 999     - Invoke-Expression "& $covAnalysisWin64\bin\cov-build.exe --return-emit-failures --dir ..\cov-int msbuild /verbosity:minimal `"/consoleloggerparameters:PerformanceSummary;NoSummary`" /maxcpucount:1 Wireshark.sln"
1000     - cd ..
1001     - C:\ProgramData\chocolatey\tools\7z a -tzip cov-int.zip cov-int
1002     - '"export ARTIFACT_JOB_URL=$env:CI_JOB_URL" | Out-File -Encoding ascii job_environment_variables.sh'
1003     - '"export GIT_DESCRIPTION=$gitDescription" | Out-File -Encoding ascii -Append job_environment_variables.sh'
1004   artifacts:
1005     paths:
1006       - cov-int.zip
1007       - job_environment_variables.sh
1008
1009 Coverity Visual C++ Submit:
1010   image: curlimages/curl
1011   rules:
1012     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
1013   stage: .post
1014   script:
1015     - sed -i -e 's/\r//' job_environment_variables.sh
1016     - . job_environment_variables.sh
1017     - echo $ARTIFACT_JOB_URL
1018     - echo $GIT_DESCRIPTION
1019     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.zip&version=$GIT_DESCRIPTION&description=Windows $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
1020   needs: [ 'Coverity Visual C++ Scan' ]
1021
1022 Clang Static Analyzer:
1023   extends: .build-ubuntu
1024   rules: !reference [.if-daily-schedule]
1025   stage: analysis
1026   needs: []
1027   script:
1028     - source /clang-latest.env
1029     - scan-build-${CLANG_VERSION} --exclude tools cmake -DCMAKE_BUILD_TYPE=Debug -DENABLE_WERROR=OFF -G Ninja ..
1030     - scan-build-${CLANG_VERSION} --exclude tools -o ../sbout ninja
1031     - cd ../sbout
1032     - RAW_DIR=$( find ../sbout -type d -name "20??-??-??-*" -printf "%P\n" | head )
1033     - SB_DIR="scan-build-$RAW_DIR"
1034     - mv "$RAW_DIR" "$SB_DIR"
1035     - if [ -d logs ] ; then mv logs $SB_DIR ; fi
1036     - chmod -R u=rwX,go=rX "$SB_DIR"
1037     - zip -9 -r "${SB_DIR}.zip" "$SB_DIR"
1038     - if [ -n "$MC_DESTINATION_ANALYSIS" ] ; then mc --quiet cp "${SB_DIR}.zip" "$MC_DESTINATION_ANALYSIS/" ; fi
1039
1040 # Windows runners are still beta, at least technically:
1041 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
1042 Visual Studio Code Analysis:
1043   extends: .build-windows
1044   tags:
1045     - wireshark-windows-dev
1046   rules:
1047     # The wireshark-windows-* tags are only available in wireshark/wireshark.
1048     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
1049   script:
1050     - py -m venv sarif-tools.venv
1051     - sarif-tools.venv\Scripts\pip.exe install sarif-tools
1052     - New-Item -Path C:\MinIO -Type "directory"
1053     - Invoke-Webrequest -OutFile C:\MinIO\mc.exe https://dl.min.io/client/mc/release/windows-amd64/archive/mc.RELEASE.2024-07-03T20-17-25Z
1054     - if ($( Get-FileHash -Algorithm SHA256 -Path C:\MinIO\mc.exe ).Hash -ne "A379139FB32C0ADDB6C05786782602B5106D13402759AC1B4A88285A4D5EAAD3" ) { Exit 1 }
1055     - $env:caexcludepath = "C:\Qt;$env:INCLUDE"
1056     - cmake -DENABLE_CODE_ANALYSIS=ON -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
1057     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount:2 Wireshark.sln
1058     - $report = "visual-c++-analyze-" + (Get-Date -format "yyyy-MM-dd") + ".html"
1059     - sarif-tools.venv\Scripts\sarif html --output $report
1060     - if (Test-Path env:MC_DESTINATION_ANALYSIS) { C:\MinIO\mc --quiet cp "$report" "$env:MC_DESTINATION_ANALYSIS/" }
1061
1062 # Build all doxygen docs
1063 API Reference:
1064   extends: .build-ubuntu
1065   rules: !reference [.if-daily-schedule]
1066   script:
1067     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1068     - cmake -GNinja ..
1069     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1070     - ninja wsar_html_zip 2>&1 > doxygen_output.txt | tee doxygen_errors.txt
1071     - mv wsar_html.zip doxygen_{output,errors}.txt ..
1072     - cd ..
1073     - if [ -n "$MC_DESTINATION_DOCS" ] ; then mc --quiet cp wsar_html.zip "$MC_DESTINATION_DOCS/" ; fi
1074   after_script:
1075     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
1076   artifacts:
1077     paths:
1078     - doxygen_errors.txt
1079     - doxygen_output.txt
1080     - wsar_html.zip
1081   needs: []
1082
1083 Code Lines and Data:
1084   extends: .build-ubuntu
1085   rules: !reference [.if-daily-schedule]
1086   stage: analysis
1087   variables:
1088     CLOC_OUT: /tmp/cloc.txt
1089     SCC_OUT: /tmp/scc.txt
1090     SLOC_OUT: /tmp/sloccount.txt
1091     TOKEI_OUT: /tmp/tokei.txt
1092   script:
1093     - DEBIAN_FRONTEND=noninteractive apt-get update
1094     - DEBIAN_FRONTEND=noninteractive apt-get --yes install sloccount cloc curl unzip
1095     - pushd /tmp
1096     - curl -L -O https://github.com/boyter/scc/releases/download/v3.0.0/scc-3.0.0-x86_64-unknown-linux.zip
1097     - unzip scc-3.0.0-x86_64-unknown-linux.zip
1098     - curl -L -O https://github.com/XAMPPRocky/tokei/releases/download/v12.1.2/tokei-x86_64-unknown-linux-gnu.tar.gz
1099     - tar -xf tokei-x86_64-unknown-linux-gnu.tar.gz
1100     - popd
1101     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1102     - cmake -G Ninja ..
1103     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1104     - ninja
1105     - cd ..
1106     - echo -n "cloc version:\ "
1107     - cloc --version
1108     - cloc --quiet . | tee $CLOC_OUT
1109     - /tmp/scc --version
1110     - /tmp/scc --not-match 'qt/.*.ts' . | tee $SCC_OUT
1111     - echo -n "SLOCCount version:\ "
1112     - sloccount --version
1113     - sloccount . | awk "/^Computing results/ { results=1 } { if (results) print }" | tee $SLOC_OUT
1114     - /tmp/tokei --version
1115     - /tmp/tokei --exclude 'qt/*.ts' . | tee $TOKEI_OUT
1116     - |
1117       cat > manuf <<FIN
1118       # This file was generated by TShark $(git describe --tags | sed -e 's/^v//') with the
1119       # command \`tshark -G manuf\`. Its canonical location is
1120       #
1121       # https://www.wireshark.org/download/automated/data/manuf.gz
1122       #
1123       # The first column contains the MAC address block (24, 28 or 36 bits wide,
1124       # per IEEE allocation sizes), the second column contains the shortened name
1125       # used by Wireshark for address name resolution and the third column contains the
1126       # full vendor name from the registry.
1127       #
1128       FIN
1129     - build/run/tshark -G manuf | sed -e 's,:00:00:00/24,,' >> manuf
1130     - gzip --best --keep manuf
1131     - if [ -n "$MC_DESTINATION_ANALYSIS" ] ; then mc --quiet cp "$CLOC_OUT" "$SCC_OUT" "$SLOC_OUT" "$TOKEI_OUT" "$MC_DESTINATION_ANALYSIS/" ; fi
1132     - if [ -n "$MC_DESTINATION_DATA" ] ; then mc --quiet cp manuf manuf.gz "$MC_DESTINATION_DATA/" ; fi
1133   artifacts:
1134     paths:
1135     - manuf
1136     - manuf.gz
1137   needs: []
1138
1139 # Fuzz TShark using ASAN and valgrind.
1140 .fuzz-ubuntu:
1141   extends: .build-ubuntu
1142   retry: 0
1143   rules: !reference [.if-fuzz-schedule]
1144   tags:
1145     - wireshark-ubuntu-fuzz
1146   resource_group: fuzz-master
1147   variables:
1148     INSTALL_PREFIX: "$CI_PROJECT_DIR/_install"
1149     MIN_PLUGINS: 10
1150     MAX_PASSES: 15
1151   before_script:
1152     - source /clang-latest.env
1153     - DEBIAN_FRONTEND=noninteractive apt-get update
1154     # Use DPkg::options::="--force-overwrite" until
1155     # https://bugs.launchpad.net/ubuntu/+source/llvm-toolchain-15/+bug/2008755
1156     # https://github.com/llvm/llvm-project/issues/62104
1157     # are fixed.
1158     - DEBIAN_FRONTEND=noninteractive apt-get --yes --option DPkg::options::="--force-overwrite" install llvm-$CLANG_VERSION
1159     - mkdir -p ccache
1160     - mkdir /tmp/fuzz
1161     - mkdir build
1162     - cd build
1163   after_script:
1164     # The cache should be large enough to be useful but it shouldn't take
1165     # too long to restore+save each run.
1166     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
1167     - if [ "$CI_JOB_STATUS" == "canceled" ]; then exit 0 ; fi
1168     - . /tmp/fuzz_result.sh
1169     - if $FUZZ_PASSED ; then exit 0 ; fi
1170     - echo Fuzzing failed. Generating report.
1171     - FUZZ_CAPTURE=$( find /tmp/fuzz -name "fuzz-*.pcap" -o -name "randpkt-*.pcap" | head -n 1 )
1172     - FUZZ_ERRORS="/tmp/fuzz/$( basename "$FUZZ_CAPTURE" .pcap ).err"
1173     - printf "\nfuzz-test.sh stderr:\n" >> "$FUZZ_ERRORS"
1174     - cat fuzz-test.err >> "$FUZZ_ERRORS"
1175     - if [ -n "$MC_DESTINATION_FUZZ" ] ; then mc --quiet cp "$FUZZ_CAPTURE" "$FUZZ_ERRORS" "$MC_DESTINATION_FUZZ/" ; fi
1176
1177 ASan Menagerie Fuzz:
1178   extends: .fuzz-ubuntu
1179   stage: fuzz-asan
1180   variables:
1181     WIRESHARK_LOG_FATAL: "critical"
1182   script:
1183     - MAX_SECONDS=$(( 6 * 60 * 60 ))
1184     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1185     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1186     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1187     - ninja
1188     - ninja install
1189     - cd ..
1190     - FUZZ_PASSED=true
1191     # /var/menagerie contains captures harvested from wireshark.org's mailing list, wiki, issues, etc.
1192     # We have more captures than we can fuzz in $MAX_SECONDS, so we shuffle them each run.
1193     - ./tools/fuzz-test.sh -a -2 -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1194     # Signal after_script, which runs in its own shell.
1195     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1196     - $FUZZ_PASSED
1197
1198 ASan randpkt Fuzz:
1199   extends: .fuzz-ubuntu
1200   stage: fuzz-randpkt
1201   variables:
1202     WIRESHARK_LOG_FATAL: "critical"
1203   script:
1204     # XXX Reuse fuzz-asan?
1205     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1206     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1207     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1208     - ninja
1209     - ninja install
1210     - cd ..
1211     - FUZZ_PASSED=true
1212     - ./tools/randpkt-test.sh -a -b $INSTALL_PREFIX/bin -d /tmp/fuzz -p $MAX_PASSES 2> fuzz-test.err || FUZZ_PASSED=false
1213     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1214     - $FUZZ_PASSED
1215   needs: [ 'ASan Menagerie Fuzz' ]
1216
1217 Valgrind Menagerie Fuzz:
1218   extends: .fuzz-ubuntu
1219   stage: fuzz-valgrind
1220   resource_group: fuzz-master-valgrind
1221   variables:
1222     # Use DWARF-4 debug info. Valgrind does not support Clang 14 with DWARF-5.
1223     # https://gitlab.com/wireshark/wireshark/-/issues/18191
1224     # https://www.mail-archive.com/valgrind-users@lists.sourceforge.net/msg07239.html
1225     CFLAGS: "-gdwarf-4"
1226     WIRESHARK_LOG_FATAL: "critical"
1227   script:
1228     - DEBIAN_FRONTEND=noninteractive apt-get update
1229     - DEBIAN_FRONTEND=noninteractive apt-get --yes install valgrind
1230     - MAX_SECONDS=$(( 3 * 60 * 60 ))
1231     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1232     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=OFF -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1233     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1234     - ninja
1235     - ninja install
1236     - cd ..
1237     - FUZZ_PASSED=true
1238     - ./tools/fuzz-test.sh -g -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1239     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1240     - $FUZZ_PASSED
1241   needs: [ 'ASan randpkt Fuzz' ]
1242
1243
1244 include:
1245   - template: Security/SAST.gitlab-ci.yml