.gitlab-ci.yml

   1 # In the interest of reliability and performance, please avoid installing
   2 # external dependencies here, e.g. via tools/*-setup.sh, apt, dnf, or yum.
   3 # Do so in the appropriate Dockerfile at
   4 # https://gitlab.com/wireshark/wireshark-containers/ instead.
   5 # The resulting images can be found at
   6 # https://gitlab.com/wireshark/wireshark-containers/container_registry
   7
   8 stages:
   9   - build
  10   - analysis
  11   - test
  12   - fuzz-asan
  13   - fuzz-randpkt
  14   - fuzz-valgrind
  15
  16 variables:
  17   # Ensure that checkouts are a) fast and b) have a reachable tag. In a
  18   # brighter, more glorious future we might be able to use --shallow-since:
  19   # https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3460
  20   # In the mean time, fetching the last 5000 commits does the job.
  21   # Ensure that all variables are string
  22   GIT_DEPTH: "1"
  23   GIT_FETCH_EXTRA_FLAGS: "--depth=5000"
  24   CCACHE_DIR: "${CI_PROJECT_DIR}/ccache"
  25   # The Qt versions that we ship in the development installers.
  26   WINDOWS_QT_VERSION: "6.8.1"
  27   MACOS_QT_VERSION: "6.5.3"
  28   # Enable color output in various tools.
  29   # CMake, Ninja, and others: https://bixense.com/clicolors/
  30   CLICOLOR_FORCE: "1"
  31   # pytest
  32   FORCE_COLOR: "1"
  33   # Homebrew
  34   HOMEBREW_COLOR: "1"
  35   # Skip irrelevant SAST scanners:
  36   SAST_EXCLUDED_ANALYZERS: "brakeman,eslint,security-code-scan,semgrep,spotbugs"
  37
  38 workflow:
  39   auto_cancel:
  40     # Automatically cancel pipelines if new changes are pushed to a branch
  41     # and the job is interruptible. Jobs are not interruptible by default.
  42     on_new_commit: interruptible
  43
  44 # Scheduled builds additionally set SCHEDULE_TYPE, which can be one of:
  45 # - 2x-daily: Twice daily at 07:00 and 19:00 UTC
  46 # - daily: Daily at 10:00 UTC
  47 # - weekly: Sunday at 14:00 UTC
  48 # - coverity-visual-c++: Monday, Wednesday, & Friday at 12:00 UTC
  49 # - coverity-gcc: Sunday, Tuesday, Thursday & Saturday at 12:00 UTC
  50
  51 # Common rule stanzas
  52 # These must currently be including using "!reference tags". "extends:" and
  53 # YAML anchors won't work:
  54 # https://gitlab.com/gitlab-org/gitlab/-/issues/322992
  55
  56 # Commits that have been approved and merged. Run automatically in the main
  57 # repo and allow manual runs in the web UI and in forks.
  58 # Release builds: CI_PIPELINE_SOURCE=api
  59 .if-merged:
  60   # Regular commits: CI_PIPELINE_SOURCE=push, CI_COMMIT_BRANCH=master
  61   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  62   # "Run pipeline" button commits, cherry picks
  63   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  64   # Tagged release builds: CI_PIPELINE_SOURCE=api (should be "web"?)
  65   - if: '$CI_PIPELINE_SOURCE == "api"'
  66   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_URL !~ /.*gitlab.com\/wireshark\/wireshark/'
  67     when: manual
  68 # Merged commits for runners which are only available in
  69 # wireshark/wireshark, e.g. wireshark-windows-*. Run automatically in
  70 # the main repo and allow manual runs in the web UI.
  71 .if-w-w-only-merged:
  72   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  73   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  74   - if: '$CI_PIPELINE_SOURCE == "api"'
  75 # Incoming merge requests.
  76 .if-merge-request:
  77   - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  78     interruptible: true
  79 # Incoming non-detached merge requests. Must be used for runners which are only
  80 # available in wireshark/wireshark, e.g. wireshark-windows-*
  81 .if-w-w-only-merge-request:
  82   - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  83     interruptible: true
  84 # Scheduled jobs. Care should be taken when changing this since the scheduler
  85 # often doesn't report errors.
  86 .if-weekly-schedule:
  87   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "weekly"'
  88 .if-daily-schedule:
  89   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily"'
  90 .if-2x-daily-schedule:
  91   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "2x-daily"'
  92 # Fuzz jobs. Care should be taken when changing this since the scheduler
  93 # often doesn't report errors.
  94 .if-fuzz-schedule:
  95   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "fuzz"'
  96
  97 .build-linux:
  98   stage: build
  99   tags:
 100     - saas-linux-small-amd64
 101   before_script:
 102     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 103     - env | grep ^CI | sort
 104     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 105   after_script:
 106     - for builddir in build/packaging/rpm/BUILD/wireshark-*/build build/packaging/rpm/BUILD/wireshark-* build obj-*; do [ ! -d "$builddir/run" ] || break; done
 107     - if [[ "$CI_JOB_NAME" == "build:rpm-opensuse-"* ]]; then export LD_LIBRARY_PATH=$builddir/run; fi
 108     - if [ -f $builddir/run/tshark ]; then $builddir/run/tshark --version; fi
 109   needs: []
 110
 111 .test-linux:
 112   stage: test
 113   tags:
 114     - saas-linux-small-amd64
 115   variables:
 116     GIT_STRATEGY: none
 117
 118 .build-ubuntu:
 119   extends: .build-linux
 120   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 121   retry: 1
 122   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 123   cache:
 124     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 125     key: ${CI_JOB_NAME}-master
 126     paths:
 127       - ccache/
 128   before_script:
 129     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 130     - env | grep ^CI | sort
 131     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 132     - useradd user
 133     - export LANG=en_US.UTF-8
 134     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 135     - mkdir -p ccache
 136     - ccache --show-stats
 137     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 138     - export DH_QUIET=1
 139     - export MAKEFLAGS=--silent
 140     - NUM_COMMITS=$(curl --silent $CI_API_V4_URL/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/commits | jq length)
 141     - echo "$NUM_COMMITS commit(s) in this MR"
 142     - mkdir build
 143     - cd build
 144   script:
 145     # setcap restricts our library paths
 146     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 147     - CFLAGS=-Wl,-rpath=$(pwd)/run CXXFLAGS=-Wl,-rpath=$(pwd)/run cmake -GNinja -DENABLE_CCACHE=ON $CMAKE_ARGS ..
 148     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 149     - ninja
 150     - ninja install
 151   after_script:
 152     # The cache should be large enough to be useful but it shouldn't take
 153     # too long to restore+save each run.
 154     - cd "$CI_PROJECT_DIR"
 155     - ccache --max-size $( du --total --summarize --block-size=1M *build*/ | awk 'END {printf ("%dM", $1 * 1.5)}' )
 156
 157 .build-rpm:
 158   extends: .build-linux
 159   rules: !reference [.if-2x-daily-schedule]
 160   before_script:
 161     # Hack to let ninja make full use of the system on Fedora and Rocky.
 162     - export RPM_BUILD_NCPUS=$(( $( getconf _NPROCESSORS_ONLN ) + 2 ))
 163     - git config --global user.email "you@example.com"
 164     - git config --global user.name "Your Name"
 165     - mkdir build
 166     - cd build
 167     - ../tools/make-version.py --set-release ..
 168     - mv -v ../wireshark-*.tar.* .
 169   artifacts:
 170     paths:
 171       - build/packaging/rpm/RPMS
 172     expire_in: 3 days
 173   needs:
 174     - 'Source Package'
 175
 176 .test-rpm:
 177   extends: .test-linux
 178   rules: !reference [.if-2x-daily-schedule]
 179
 180 .build-windows:
 181   stage: build
 182   retry: 1
 183   before_script:
 184     - if (-Not (Test-Path C:\Development)) { New-Item -Path C:\Development -ItemType "directory" }
 185     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 186     - $env:Configuration = "RelWithDebInfo"
 187     - $env:Path += ";C:\Program Files\CMake\bin"
 188     - $env:CMAKE_PREFIX_PATH = "C:\qt\$($env:WINDOWS_QT_VERSION)\msvc2022_64"
 189     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 190     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set " | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 191     # Testing / debugging only.
 192     # - cmd.exe /c "set CI_PIPELINE_SOURCE"
 193     # - cmd.exe /c "set CI_PROJECT_URL"
 194     #- dir c:\
 195     #- dir c:\qt
 196     #- $env:path.split(";")
 197     #- cmd.exe /c "set"
 198     #- Get-Location
 199     - mkdir build
 200     - cd build
 201   needs: []
 202
 203 # macOS runners are still beta:
 204 # https://about.gitlab.com/blog/2021/08/23/build-cloud-for-macos-beta/
 205 # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html#vm-images
 206 # https://gitlab.com/gitlab-org/ci-cd/shared-runners/images/macstadium/orka/-/blob/main/toolchain/monterey.yml
 207 .build-macos:
 208   stage: build
 209   tags: [ saas-macos-medium-m1 ] # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html
 210   retry: 1
 211   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 212   cache:
 213     key: ${CI_JOB_NAME}-master
 214     paths:
 215       - ccache/
 216   variables:
 217     HOMEBREW_NO_AUTO_UPDATE: "1"
 218     HOMEBREW_DISPLAY_INSTALL_TIMES: "1"
 219     HOMEBREW_NO_INSTALL_CLEANUP: "1"
 220     HOMEBREW_NO_INSTALL_UPGRADE: "1"
 221     HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: "1"
 222     HOMEBREW_NO_UPDATE_REPORT_NEW: "1"
 223   before_script:
 224     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 225     - env | grep ^CI | sort
 226     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 227     - brew --version
 228     - printf "\e[0Ksection_start:%s:brew_section[collapsed=true]\r\e[0KInstalling prerequisites" "$( date +%s)"
 229     - ./tools/macos-setup-brew.sh --install-optional --install-test-deps
 230     - printf "\e[0Ksection_end:%s:brew_section\r\e[0K" "$( date +%s)"
 231     - python3 -m venv $CI_PROJECT_DIR/.venv
 232     - source $CI_PROJECT_DIR/.venv/bin/activate
 233     - pip3 install pytest pytest-xdist
 234     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 235     - mkdir -p ccache
 236     - ccache --show-stats
 237     - mkdir build
 238     - cd build
 239   script:
 240     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 241     - cmake -G Ninja -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 242     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 243     - ninja
 244     - ninja test-programs
 245     - pytest --disable-capture
 246   after_script:
 247     # The cache should be large enough to be useful but it shouldn't take
 248     # too long to restore+save each run.
 249     - ccache --max-size $( gdu --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 250   needs: []
 251
 252 .build-mingw:
 253   stage: build
 254   image: registry.gitlab.com/wireshark/wireshark-containers/mingw-dev
 255   tags:
 256     - saas-linux-small-amd64
 257   cache:
 258     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 259     key: ${CI_JOB_NAME}-master
 260     paths:
 261       - ccache/
 262   before_script:
 263     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 264     - env | grep ^CI | sort
 265     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 266     - mkdir -p ccache
 267     - ccache --show-stats
 268     - mkdir build
 269     - cd build
 270   script:
 271     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 272     - ninja
 273   after_script:
 274     # The cache should be large enough to be useful but it shouldn't take
 275     # too long to restore+save each run.
 276     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 277   needs: []
 278
 279 Source Package:
 280   extends: .build-ubuntu
 281   stage: .pre
 282   rules:
 283     - !reference [.if-w-w-only-merged]
 284     - !reference [.if-2x-daily-schedule]
 285   script:
 286     - ../tools/make-version.py --set-release --wireshark-version-file=wireshark_version.txt --stratoshark-version-file=stratoshark_version.txt ..
 287     - ../tools/update-appdata.py
 288     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 289     - cmake -G Ninja $CMAKE_ARGS ..
 290     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 291     - cd $CI_PROJECT_DIR
 292     - build/packaging/source/git-export-release.sh -d .
 293     - cd build
 294     - ninja release_notes
 295     - WIRESHARK_VERSION=$(< wireshark_version.txt)
 296     - cp -v "doc/Wireshark Release Notes.html" ../wireshark-release-notes-${WIRESHARK_VERSION}.html
 297     - cp -v "doc/Wireshark Release Notes.txt" ../wireshark-release-notes-${WIRESHARK_VERSION}.txt
 298     - STRATOSHARK_VERSION=$(< stratoshark_version.txt)
 299     - cp -v "doc/Stratoshark Release Notes.html" ../stratoshark-release-notes-${STRATOSHARK_VERSION}.html
 300     - cp -v "doc/Stratoshark Release Notes.txt" ../stratoshark-release-notes-${STRATOSHARK_VERSION}.txt
 301     - cd ..
 302     - zstdcat --threads=0 wireshark-${WIRESHARK_VERSION}.tar.zst | xz --threads=0 > wireshark-${WIRESHARK_VERSION}.tar.xz
 303   after_script:
 304     # - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 305     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 306     - if [ -n "$SCHEDULE_TYPE" ] ; then exit 0 ; fi
 307     - stat --format="%n %s bytes" wireshark-*.tar.*
 308     - for digest in sha512 sha256 sha1 ; do openssl $digest wireshark-*.tar.* ; done
 309     - if [ -n "$MC_DESTINATION_DIST" ] ; then mc --quiet cp wireshark-*.tar.* "$MC_DESTINATION_DIST/" ; fi
 310     - if [ -n "$MC_DESTINATION_RELEASE" ] ; then mc --quiet cp {wire,strato}shark-release-notes-*.{txt,html} "$MC_DESTINATION_RELEASE/" ; fi
 311   artifacts:
 312     paths:
 313       - wireshark-*.tar.*
 314       - wireshark-release-notes-*.html
 315       - wireshark-release-notes-*.txt
 316       - stratoshark-release-notes-*.html
 317       - stratoshark-release-notes-*.txt
 318
 319 # Job to generate packages for Debian stable
 320 Debian Stable APT Package:
 321   extends: .build-linux
 322   rules: !reference [.if-2x-daily-schedule]
 323   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 324   script:
 325     - ln --symbolic --no-dereference --force packaging/debian
 326     - tools/make-version.py --set-release .
 327     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 328     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 329     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 330     - export DH_QUIET=1
 331     - export MAKEFLAGS=--silent
 332     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ dpkg-buildpackage -b --no-sign -jauto -zfast
 333     # Please don't add a Lintian step unless you can guarantee that someone
 334     # will fix any breakages that invariably pop up.
 335     - mkdir debian-packages
 336     - mv -v ../*.deb debian-packages/
 337   artifacts:
 338     paths:
 339       - debian-packages/*.deb
 340     expire_in: 3 days
 341
 342 Debian Stable APT Test:
 343   extends: .test-linux
 344   rules: !reference [.if-2x-daily-schedule]
 345   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 346   stage: test
 347   script:
 348     - DEBIAN_FRONTEND=noninteractive apt-get install ./debian-packages/*.deb -y
 349     - tshark --version
 350   variables:
 351     GIT_STRATEGY: none
 352   needs: [ 'Debian Stable APT Package' ]
 353
 354 Fedora RPM Package:
 355   extends: .build-rpm
 356   image: registry.gitlab.com/wireshark/wireshark-containers/fedora-dev
 357   script:
 358     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 359     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 360     - export FORCE_CMAKE_NINJA_NON_VERBOSE=1
 361     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 362     - cmake3 -G Ninja ..
 363     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 364     - ninja wireshark_rpm
 365
 366 # Fedora RPM Test:
 367 #   extends: .test-rpm
 368 #   image: fedora
 369 #   script:
 370 #     - dnf install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 371 #     - tshark --version
 372 #  needs: [ 'Fedora RPM Package' ]
 373
 374 openSUSE 15.6 RPM Package:
 375   extends: .build-rpm
 376   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.6-dev
 377   script:
 378     - source /gcc-latest.env
 379     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 380     - cmake -G Ninja ..
 381     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 382     - ninja wireshark_rpm
 383
 384 openSUSE 15.6 RPM Test:
 385   extends: .test-rpm
 386   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.6-dev
 387   script:
 388     - zypper --no-gpg-checks --no-remote install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 389     - tshark --version
 390   needs: [ 'openSUSE 15.6 RPM Package' ]
 391
 392 Rocky Linux 9 RPM Package:
 393   extends: .build-rpm
 394   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 395   script:
 396     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 397     - cmake -G Ninja -DUSE_qt6=OFF ..
 398     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 399     - ninja wireshark_rpm
 400
 401 Rocky Linux 9 RPM Test:
 402   extends: .test-rpm
 403   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 404   script:
 405     - dnf --nogpgcheck localinstall -y build/packaging/rpm/RPMS/x86_64/*.rpm
 406     - tshark --version
 407   needs: [ 'Rocky Linux 9 RPM Package' ]
 408
 409 Ubuntu APT Package:
 410   extends: .build-ubuntu
 411   rules: !reference [.if-2x-daily-schedule]
 412   script:
 413     # build-ubuntu puts us in `build`.
 414     - cd ..
 415     - ln --symbolic --no-dereference --force packaging/debian
 416     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ MAKE=ninja dpkg-buildpackage -us -uc -rfakeroot -jauto -zfast
 417     # Please don't add a Lintian step unless you can guarantee that someone
 418     # will fix any breakages that invariably pop up.
 419     - mkdir ubuntu-packages
 420     - mv ../*.deb ubuntu-packages/
 421   after_script:
 422     # dpkg-buildpackage builds in obj-<triplet>, so we need to override
 423     # .build-ubuntu. We also build more stuff, so decrease our multiplier.
 424     - ccache --max-size $( du --summarize --block-size=1M --total "$CI_PROJECT_DIR"/obj-* | awk '/total$/ {printf ("%dM", $1 * 1.25)}' )
 425   artifacts:
 426     paths:
 427       - ubuntu-packages/*.deb
 428     expire_in: 3 days
 429
 430 Ubuntu APT Test:
 431   extends: .test-linux
 432   rules: !reference [.if-2x-daily-schedule]
 433   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 434   stage: test
 435   script:
 436     - DEBIAN_FRONTEND=noninteractive apt-get install ./ubuntu-packages/*.deb -y
 437     - tshark --version
 438   variables:
 439     GIT_STRATEGY: none
 440   needs: [ 'Ubuntu APT Package' ]
 441
 442 Arch Linux :
 443   extends: .build-linux
 444   rules: !reference [.if-2x-daily-schedule]
 445   image: registry.gitlab.com/wireshark/wireshark-containers/arch-dev
 446   script:
 447     - COMMON_PACMAN_ARGS="--sync --refresh --sysupgrade --needed --noconfirm"
 448     - ./tools/make-version.py --set-release --wireshark-version-file=wireshark_version.txt .
 449     - WIRESHARK_VERSION=$(cat wireshark_version.txt)
 450     - WIRESHARK_PREFIX="/opt/wireshark-$WIRESHARK_VERSION"
 451     # There are no falcosecurity/libs or falcosecurity/plugins packages for Arch,
 452     # so just build them ourselves for now.
 453     - pushd /tmp
 454     # falcosecurity/plugins
 455     - pacman $COMMON_PACMAN_ARGS go
 456     - git clone https://github.com/falcosecurity/plugins.git falco-plugins
 457     - pushd /tmp/falco-plugins/plugins/cloudtrail
 458     - make
 459     - popd
 460     - pushd /tmp/falco-plugins/plugins/gcpaudit
 461     - make
 462     - popd
 463     # falcosecurity/libs
 464     - pacman $COMMON_PACMAN_ARGS uthash libelf onetbb jsoncpp re2
 465     - export LDFLAGS=-Wl,-rpath,'$ORIGIN/../lib'
 466     - git clone https://github.com/falcosecurity/libs.git falco-libs
 467     - cd /tmp/falco-libs
 468     - git switch -c 0.18.1 0.18.1
 469     - printf "\e[0Ksection_start:%s:fslibs_cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 470     - cmake -B build -G Ninja -DBUILD_SHARED_LIBS=on -DMINIMAL_BUILD=on -DBUILD_DRIVER=off -DENABLE_ENGINE_KMOD=off -DBUILD_LIBSCAP_EXAMPLES=off -DUSE_BUNDLED_DEPS=off -DUSE_BUNDLED_VALIJSON=on -DCREATE_TEST_TARGETS=off -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_RPATH='$ORIGIN/../lib' -DCMAKE_INSTALL_PREFIX=$WIRESHARK_PREFIX
 471     - printf "\e[0Ksection_end:%s:fslibs_cmake_section\r\e[0K" "$( date +%s)"
 472     - ninja -C build
 473     - ninja -C build install
 474     - sed -i -e 's/-linstall_lib_link_libraries-NOTFOUND/-lscap_platform -lscap_platform_util/g' $WIRESHARK_PREFIX/lib/pkgconfig/libscap.pc
 475     - popd
 476     - export CMAKE_PREFIX_PATH=$WIRESHARK_PREFIX
 477     - mkdir build
 478     - cd build
 479     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 480     - cmake -G Ninja -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS="/tmp/falco-plugins/plugins/cloudtrail/libcloudtrail.so;/tmp/falco-plugins/plugins/gcpaudit/libgcpaudit.so" -DCMAKE_INSTALL_PREFIX=$WIRESHARK_PREFIX ..
 481     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 482     - ninja
 483     - ninja install
 484     - install -v -D -m 755 -t $WIRESHARK_PREFIX/lib/stratoshark/plugins/4.5/epan run/plugins/4.5/epan/falco-bridge.so
 485     - install -v -D -m 755 -t $WIRESHARK_PREFIX/lib/stratoshark/plugins/falco run/plugins/falco/*.so
 486     # XXX Need to add an install prereqs script
 487     - tar -C / -cJf $CI_PROJECT_DIR/wireshark-arch-$WIRESHARK_VERSION.tar.xz opt/wireshark-$WIRESHARK_VERSION
 488   artifacts:
 489     paths:
 490       - $CI_PROJECT_DIR/wireshark-arch-*.tar.xz
 491
 492 Windows x64 Package:
 493   extends: .build-windows
 494   rules: !reference [.if-w-w-only-merged]
 495   tags:
 496     - wireshark-windows-x64-package
 497   before_script:
 498     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 499     - $env:Configuration = "RelWithDebInfo"
 500     - $env:CMAKE_PREFIX_PATH = "C:\Qt\$($env:WINDOWS_QT_VERSION)\msvc2022_64"
 501     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 502     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 503     - mkdir build
 504     - cd build
 505   script:
 506     - C:\Windows\py.exe ..\tools\make-version.py --set-release --wireshark-version-file=wireshark_version.txt --stratoshark-version-file=stratoshark_version.txt ..
 507     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DENABLE_SIGNED_NSIS=on ..
 508     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 509     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 510     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 511     - msbuild /verbosity:minimal /maxcpucount stratoshark_nsis_prep.vcxproj
 512     - msbuild /verbosity:minimal /maxcpucount wireshark_wix_prep.vcxproj
 513     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 514     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 515     - msbuild /verbosity:minimal stratoshark_nsis.vcxproj
 516     # No need for explicit signing of NSIS installer here. The signing is done by makensis.
 517     - msbuild /verbosity:minimal wireshark_wix.vcxproj
 518     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\wix\Wireshark-*.msi
 519     - msbuild /verbosity:minimal wireshark_portableapps.vcxproj
 520     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\portableapps\WiresharkPortable*.exe
 521     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-x64.exe packaging\nsis\Stratoshark-*-x64.exe packaging\wix\Wireshark-*-x64.msi packaging\portableapps\WiresharkPortable??_*.paf.exe
 522     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 523     - C:\gitlab-builds\bin\mse-scan.ps1
 524     - run\RelWithDebInfo\tshark --version
 525     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-x64.exe", "packaging\nsis\Stratoshark-*-x64.exe", "packaging\wix\Wireshark-*-x64.msi", "packaging\portableapps\WiresharkPortable??_*.paf.exe", "Wireshark-pdb-*x64.zip"
 526     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 527     - if (Test-Path env:MC_DESTINATION_WINDOWS_X64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_X64/" }
 528     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 529     - $wiresharkNsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-x64.exe).Hash
 530     - Set-Content -Path wireshark-release-info-$($wiresharkVersion)-windows-x64.ini -Value ("[DEFAULT]`nnsis_sha256 = $wiresharkNsisSha256")
 531     - $stratosharkVersion = Get-Content .\stratoshark_version.txt
 532     - $stratosharkNsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Stratoshark-*-x64.exe).Hash
 533     - Set-Content -Path stratoshark-release-info-$($stratosharkVersion)-windows-x64.ini -Value ("[DEFAULT]`nnsis_sha256 = $stratosharkNsisSha256")
 534     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp $(Get-ChildItem "*shark-release-info-*-windows-*.ini") "$env:MC_DESTINATION_RELEASE/" }
 535     - C:\Windows\py.exe -m pytest
 536   artifacts:
 537     paths:
 538       - build/*shark-release-info-*-windows-*.ini
 539
 540 Windows Arm64 Package:
 541   extends: .build-windows
 542   rules: !reference [.if-w-w-only-merged]
 543   tags:
 544     - wireshark-windows-arm64-package
 545   before_script:
 546     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 547     - $env:Configuration = "RelWithDebInfo"
 548     - $env:CMAKE_PREFIX_PATH = "C:\Qt\$($env:WINDOWS_QT_VERSION)\msvc2022_arm64"
 549     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 550     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsarm64.bat`" && set" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 551     - mkdir build
 552     - cd build
 553   script:
 554     - C:\Windows\py.exe ..\tools\make-version.py --set-release --wireshark-version-file=wireshark_version.txt --stratoshark-version-file=stratoshark_version.txt ..
 555     - cmake -G "Visual Studio 17 2022" -A arm64 -DENABLE_LTO=off -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DENABLE_SIGNED_NSIS=on ..
 556     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 557     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 558     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 559     - msbuild /verbosity:minimal /maxcpucount stratoshark_nsis_prep.vcxproj
 560     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 561     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 562     - msbuild /verbosity:minimal stratoshark_nsis.vcxproj
 563     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-arm64.exe packaging\nsis\Stratoshark-*-arm64.exe
 564     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 565     - C:\gitlab-builds\bin\mse-scan.ps1
 566     - run\RelWithDebInfo\tshark --version
 567     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-arm64.exe", "packaging\nsis\Stratoshark-*-arm64.exe", "Wireshark-pdb-*arm64.zip"
 568     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 569     - if (Test-Path env:MC_DESTINATION_WINDOWS_ARM64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_ARM64/" }
 570     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 571     - $wiresharkNsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-arm64.exe).Hash
 572     - Set-Content -Path wireshark-release-info-$($wiresharkVersion)-windows-arm64.ini -Value ("[DEFAULT]`nnsis_sha256 = $wiresharkNsisSha256")
 573     - $stratosharkVersion = Get-Content .\stratoshark_version.txt
 574     - $stratosharkNsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Stratoshark-*-arm64.exe).Hash
 575     - Set-Content -Path stratoshark-release-info-$($stratosharkVersion)-windows-arm64.ini -Value ("[DEFAULT]`nnsis_sha256 = $stratosharkNsisSha256")
 576     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp $(Get-ChildItem "*shark-release-info-*-windows-*.ini") "$env:MC_DESTINATION_RELEASE/" }
 577     - C:\Windows\py.exe -m pytest
 578   artifacts:
 579     paths:
 580       - build/*shark-release-info-*-windows-*.ini
 581
 582 Windows MinGW-w64 Package:
 583   extends: .build-mingw
 584   rules: !reference [.if-w-w-only-merged]
 585   script:
 586     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 587     - ninja
 588     - ninja user_guide_html
 589     - ninja wireshark_nsis_prep
 590     - ninja wireshark_nsis
 591   artifacts:
 592     paths:
 593       - build/packaging/nsis/wireshark-*.exe
 594     expire_in: 3 days
 595
 596 macOS Arm Package:
 597   stage: build
 598   rules: !reference [.if-w-w-only-merged]
 599   variables:
 600     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 601   tags:
 602     - wireshark-macos-arm-package
 603   retry: 1
 604   script:
 605     - export CMAKE_PREFIX_PATH=/usr/local/Qt-$MACOS_QT_VERSION
 606     # Not needed for Falco libs 0.19?
 607     - export CXXFLAGS="-isystem /usr/local/include/falcosecurity"
 608     - export PATH="$PATH:$HOME/bin"
 609     - mkdir build
 610     - cd build
 611     - ../tools/make-version.py --set-release --wireshark-version-file=wireshark_version.txt --stratoshark-version-file=stratoshark_version.txt ..
 612     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 613     - cmake -DENABLE_CCACHE=ON -DCMAKE_APPLE_SILICON_PROCESSOR=arm64 -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DCMAKE_OSX_ARCHITECTURES=arm64 -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS=/usr/local/lib/falco-plugins/libcloudtrail.so -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 614     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 615     - ninja
 616     - codesign-prep
 617     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 618     - ninja wireshark_dmg
 619     - ninja stratoshark_dmg
 620     - cd run
 621     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 622     - xcrun stapler staple Wireshark?[1-9]*.dmg
 623     - xcrun notarytool submit Stratoshark?[0-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 624     - xcrun stapler staple Stratoshark?[0-9]*.dmg
 625     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg Stratoshark?[0-9]*.dmg
 626     - stat -f "%N %z bytes" Wireshark*.dmg Stratoshark*.dmg
 627     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg Stratoshark*.dmg ; done
 628     - |
 629       if [ -n "$S3_DESTINATION_MACOS_ARM64" ] ; then
 630         aws s3 cp Wireshark?[1-9]*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 631         aws s3 cp Wireshark?dSYM*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 632         aws s3 cp Stratoshark?[0-9]*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 633         aws s3 cp Stratoshark?dSYM*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 634       fi
 635     - $CI_PROJECT_DIR/build/run/tshark --version
 636     - WIRESHARK_SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 637     - WIRESHARK_DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 638     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 639     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$WIRESHARK_SPARKLE_SIGNATURE" "$WIRESHARK_DMG_SHA256" > wireshark-release-info-${WIRESHARK_VERSION}-macos-arm64.ini
 640     - STRATOSHARK_SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Stratoshark?[0-9]*.dmg )
 641     - STRATOSHARK_DMG_SHA256=$( shasum --algorithm 256 Stratoshark?[0-9]*.dmg | awk '{print $1}' )
 642     - STRATOSHARK_VERSION=$(< ../stratoshark_version.txt)
 643     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$STRATOSHARK_SPARKLE_SIGNATURE" "$STRATOSHARK_DMG_SHA256" > stratoshark-release-info-${STRATOSHARK_VERSION}-macos-arm64.ini
 644     - |
 645       if [ -n "$S3_DESTINATION_RELEASE" ] ; then
 646         aws s3 cp wireshark-release-info-*-macos-*.ini "$S3_DESTINATION_RELEASE/"
 647         aws s3 cp stratoshark-release-info-*-macos-*.ini "$S3_DESTINATION_RELEASE/"
 648       fi
 649     - cd ..
 650     - ninja test
 651   artifacts:
 652     paths:
 653       - build/run/*shark-release-info-*-macos-*.ini
 654   needs: []
 655
 656 macOS Intel Package:
 657   stage: build
 658   rules: !reference [.if-w-w-only-merged]
 659   variables:
 660     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 661   tags:
 662     - wireshark-macos-intel-package
 663   retry: 1
 664   script:
 665     - export CMAKE_PREFIX_PATH=/usr/local/Qt-$MACOS_QT_VERSION
 666     # Not needed for Falco libs 0.19?
 667     - export CXXFLAGS="-isystem /usr/local/include/falcosecurity"
 668     - export PATH="$PATH:$HOME/bin"
 669     - mkdir build
 670     - cd build
 671     - ../tools/make-version.py --set-release --wireshark-version-file=wireshark_version.txt --stratoshark-version-file=stratoshark_version.txt ..
 672     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 673     - cmake -DENABLE_CCACHE=ON -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DBUILD_stratoshark=on -DBUILD_sshdig=on -DBUILD_falcodump=on -DFALCO_PLUGINS=/usr/local/lib/falco-plugins/libcloudtrail.so -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 674     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 675     - ninja
 676     - codesign-prep
 677     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 678     - ninja wireshark_dmg
 679     - ninja stratoshark_dmg
 680     - cd run
 681     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 682     - xcrun stapler staple Wireshark?[1-9]*.dmg
 683     - xcrun notarytool submit Stratoshark?[0-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 684     - xcrun stapler staple Stratoshark?[0-9]*.dmg
 685     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg Stratoshark?[0-9]*.dmg
 686     - stat -f "%N %z bytes" Wireshark*.dmg Stratoshark*.dmg
 687     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg Stratoshark*.dmg ; done
 688     - |
 689       if [ -n "$S3_DESTINATION_MACOS_INTEL64" ] ; then
 690         aws s3 cp Wireshark?[1-9]*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 691         aws s3 cp Wireshark?dSYM*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 692         aws s3 cp Stratoshark?[0-9]*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 693         aws s3 cp Stratoshark?dSYM*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 694       fi
 695     - $CI_PROJECT_DIR/build/run/tshark --version
 696     - WIRESHARK_SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 697     - WIRESHARK_DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 698     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 699     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$WIRESHARK_SPARKLE_SIGNATURE" "$WIRESHARK_DMG_SHA256" > wireshark-release-info-${WIRESHARK_VERSION}-macos-intel64.ini
 700     - STRATOSHARK_SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Stratoshark?[0-9]*.dmg )
 701     - STRATOSHARK_DMG_SHA256=$( shasum --algorithm 256 Stratoshark?[0-9]*.dmg | awk '{print $1}' )
 702     - STRATOSHARK_VERSION=$(< ../stratoshark_version.txt)
 703     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$STRATOSHARK_SPARKLE_SIGNATURE" "$STRATOSHARK_DMG_SHA256" > stratoshark-release-info-${STRATOSHARK_VERSION}-macos-intel64.ini
 704     - |
 705       if [ -n "$S3_DESTINATION_RELEASE" ] ; then
 706         aws s3 cp wireshark-release-info-*-macos-*.ini "$S3_DESTINATION_RELEASE/"
 707         aws s3 cp stratoshark-release-info-*-macos-*.ini "$S3_DESTINATION_RELEASE/"
 708       fi
 709     - cd ..
 710     - ninja test
 711   artifacts:
 712     paths:
 713       - build/run/*shark-release-info-*-macos-*.ini
 714   needs: []
 715
 716 # Build the User's Guide and Developer's Guide
 717 Documentation:
 718   extends: .build-linux
 719   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 720   rules:
 721     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
 722       changes:
 723         - "doc/**/*"
 724         - "epan/wslua/**/*"
 725     - if: '$CI_PIPELINE_SOURCE == "push"'
 726       when: manual
 727       allow_failure: true
 728   script:
 729     # XXX We might want to move this to wireshark-ubuntu-dev or debian-setup.sh.
 730     - DEBIAN_FRONTEND=noninteractive apt-get update
 731     - DEBIAN_FRONTEND=noninteractive apt-get --yes install ruby-asciidoctor-pdf ruby-coderay ruby-dev
 732     - NOKOGIRI_USE_SYSTEM_LIBRARIES=1 gem install asciidoctor-epub3
 733     - mkdir build
 734     - cd build
 735     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 736     - cmake -GNinja ..
 737     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 738     - ninja all_guides
 739     - cd doc
 740     - for HTML_DIR in ws[ud]g_html{,_chunked} ; do zip -9 -r "$HTML_DIR.zip" "$HTML_DIR" ; done
 741     - if [ -n "$MC_DESTINATION_DOCS" ] ; then mc --quiet cp ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} "$MC_DESTINATION_DOCS/" ; fi
 742     - mv -v ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} ../..
 743   after_script:
 744     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 745   artifacts:
 746     paths:
 747       - wsug_html.zip
 748       - wsug_html_chunked.zip
 749       - wsdg_html.zip
 750       - wsdg_html_chunked.zip
 751       - "Wireshark User's Guide.pdf"
 752       - "Wireshark Developer's Guide.pdf"
 753       - "Wireshark User's Guide.epub"
 754       - "Wireshark Developer's Guide.epub"
 755   needs: []
 756
 757
 758 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#linux-shared-runners
 759
 760 Commit Check:
 761   extends: .build-ubuntu
 762   rules: !reference [.if-merge-request]
 763   script:
 764     # build-ubuntu puts us in `build`.
 765     - cd ..
 766     - git status
 767     # We have the following options for displaying information in a merge request
 768     # from a pipleline job:
 769     #
 770     # - The Notes API, which requires a valid GitLab CI_JOB_TOKEN variable, which
 771     #   isn't available for outside projects:
 772     #   https://gitlab.com/gitlab-org/gitlab/-/issues/464591.
 773     #
 774     # - Code Quality, which requires extra configuration, using a special container
 775     #   image, and writing a custom plugin:
 776     #   https://docs.gitlab.com/ee/ci/testing/code_quality.html.
 777     #
 778     # - Unit test reports, which must be formatted as JUnit XML:
 779     #   https://docs.gitlab.com/ee/ci/testing/unit_test_reports.html
 780     #   https://www.ibm.com/docs/en/developer-for-zos/14.2?topic=formats-junit-xml-format
 781     #
 782     # Let's generate a unit test report using tools/wrap-ci-test.py.
 783     - REPORT_FILE=commit_checks.xml
 784     - TEST_SUITE=commit_checks
 785     - EXIT_CODE=0
 786     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case num_commits --command "[ $NUM_COMMITS -lt 2 ] || (echo 'ℹ️ This merge request has more than one commit. Please squash any trivial ones:\n'; git log --oneline --no-decorate --max-count=$NUM_COMMITS ; false)" || true
 787     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/pre-commit ./tools/pre-commit $( git log --max-count=$NUM_COMMITS --pretty=format:%h ) || EXIT_CODE=1
 788     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/validate-commit ./tools/validate-commit.py $( git log --max-count=$NUM_COMMITS --pretty=format:%h ) || EXIT_CODE=1
 789     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/checklicenses ./tools/checklicenses.py || EXIT_CODE=1
 790     - ./tools/wrap-ci-test.py --file $REPORT_FILE --suite $TEST_SUITE --case tools/check_help_urls ./tools/check_help_urls.py || EXIT_CODE=1
 791     - exit $EXIT_CODE
 792   artifacts:
 793     when: always
 794     paths:
 795       - commit_checks.xml
 796     reports:
 797       junit: commit_checks.xml
 798
 799 Ubuntu GCC Build:
 800   extends: .build-ubuntu
 801   rules: !reference [.if-merge-request]
 802   variables:
 803     CC: "gcc"
 804     CXX: "g++"
 805   needs: [ 'Commit Check' ]
 806   script:
 807     - source /gcc-latest.env
 808     # build-ubuntu puts us in `build`.
 809     - cd ..
 810     - mv build "🦈 build 🦈"
 811     - cd "🦈 build 🦈"
 812     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 813     # Test release build.
 814     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=on ..
 815     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 816     - script --command ninja --flush --quiet --return ../gcc_report.txt
 817     - ansi2html < ../gcc_report.txt > ../gcc_report.html
 818     - ninja test-programs
 819     - chown -R user .
 820     - if [ -f run/dumpcap ]; then setcap cap_net_raw,cap_net_admin+eip run/dumpcap; fi
 821     - if [ -f run/dumpcap ]; then su user -c "run/dumpcap -D" ; fi
 822     - su user -c "pytest-3 --junitxml=../ubuntu_tests.xml"
 823     # Test CMake install code and CPack config code. Select any one of the archive generators.
 824     - ninja user_guide_html
 825     - ninja developer_guide_html
 826     - cpack -G TZST .
 827     - ls wireshark-*.tar.zst{,.sha256}
 828   artifacts:
 829     when: always
 830     paths:
 831       - gcc_report.html
 832     reports:
 833       junit: ubuntu_tests.xml
 834
 835 Ubuntu Qt5 Build:
 836   extends: .build-ubuntu
 837   rules:
 838     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 839       interruptible: true
 840       changes:
 841         - "ui/**/*"
 842     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 843       when: manual
 844       allow_failure: true
 845   needs: [ 'Commit Check' ]
 846   script:
 847     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 848     - cmake -G Ninja -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -DUSE_qt6=OFF ..
 849     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 850     - ninja
 851     - run/wireshark -v
 852
 853 Fedora MinGW Build:
 854   extends: .build-mingw
 855   rules: !reference [.if-merge-request]
 856   needs: [ 'Commit Check' ]
 857
 858 Clang + Code Checks:
 859   extends: .build-ubuntu
 860   tags:
 861     - saas-linux-medium-amd64
 862   rules: !reference [.if-merge-request]
 863   needs: [ 'Commit Check' ]
 864   script:
 865     - source /clang-latest.env
 866     - apt-get update && apt-get --yes install python3-venv
 867     - python3 -m venv $CI_PROJECT_DIR/.venv
 868     - source $CI_PROJECT_DIR/.venv/bin/activate
 869     # build-ubuntu puts us in `build`.
 870     - cd ..
 871     - mkdir cppcheck
 872     - ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS | tee cppcheck/cppcheck_report.txt
 873     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS -x > cppcheck/cppcheck_report.xml ; fi
 874     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then cppcheck-htmlreport --file cppcheck/cppcheck_report.xml  --report-dir cppcheck ; fi
 875     - cd build
 876     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 877     # We don't have an "All options" job, so build fuzzshark and tfshark here.
 878     - cmake -DENABLE_CHECKHF_CONFLICT=on -DCMAKE_EXPORT_COMPILE_COMMANDS=on -DCMAKE_C_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DCMAKE_CXX_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DBUILD_fuzzshark=ON -DBUILD_tfshark=On -DBUILD_stratoshark=ON -DENABLE_DEBUG=ON -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -G Ninja ..
 879     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 880     - printf "\e[0Ksection_start:%s:asn1_section[collapsed=false]\r\e[0KRegenerating ASN.1 dissectors" "$( date +%s)"
 881     - ninja --quiet asn1
 882     - git diff --exit-code ${CI_COMMIT_SHA} ..
 883     - printf "\e[0Ksection_end:%s:asn1_section\r\e[0K" "$( date +%s)"
 884     - printf "\e[0Ksection_start:%s:pidl_section[collapsed=true]\r\e[0KRegenerating PIDL dissectors" "$( date +%s)"
 885     - ninja pidl-dissectors
 886     - ninja idl2wrs-dissectors
 887     - git diff --exit-code ${CI_COMMIT_SHA} ..
 888     - printf "\e[0Ksection_end:%s:pidl_section\r\e[0K" "$( date +%s)"
 889     - mkdir ../html
 890     - script --command ninja --flush --quiet --return ../tmp_clang_report.txt
 891     - ansi2txt < ../tmp_clang_report.txt > ../clang_report.txt
 892     - ansi2html < ../tmp_clang_report.txt > ../html/clang_report.html
 893     - ./run/tshark -v 2> >(tee ../checkhf_conflict.txt)
 894     - ../tools/validate-clang-check.sh -c $CLANG_VERSION 2> >(tee ../tmp_clang_analyzer_check.txt)
 895     - ansi2txt < ../tmp_clang_analyzer_check.txt > ../clang_analyzer_check.txt
 896     - ansi2html < ../tmp_clang_analyzer_check.txt > ../html/clang_analyzer_check.html
 897     - ninja checkAPI
 898     - ninja shellcheck
 899     - cd ..
 900     - pip3 install pyspellchecker
 901     - ./tools/check_spelling.py --no-wikipedia --comments --commits $NUM_COMMITS | tee spelling_check.txt
 902     - ./tools/check_typed_item_calls.py --consecutive --label --mask --check-bitmask-fields --commits $NUM_COMMITS | tee item_calls_check.txt
 903     - ./tools/check_tfs.py --check-value-strings --commits $NUM_COMMITS | tee tfs_check.txt
 904     - ./tools/check_val_to_str.py --commits $NUM_COMMITS | tee val_to_str_check.txt
 905     - ./tools/check_col_apis.py --commits $NUM_COMMITS | tee col_apis_check.txt
 906   artifacts:
 907     paths:
 908       - clang_report.txt
 909       - clang_analyzer_check.txt
 910       - cppcheck
 911       - spelling_check.txt
 912       - item_calls_check.txt
 913       - tfs_check.txt
 914       - val_to_str_check.txt
 915       - col_apis_check.txt
 916       - checkhf_conflict.txt
 917       - html/
 918
 919 No options:
 920   extends: .build-ubuntu
 921   rules: !reference [.if-merge-request]
 922   needs: [ 'Commit Check' ]
 923   script: |
 924     cmake -GNinja -DENABLE_CCACHE=ON \
 925       -DENABLE_BROTLI=OFF -DENABLE_CAP=OFF -DENABLE_CHECKHF_CONFLICT=ON -DENABLE_GNUTLS=OFF \
 926       -DENABLE_KERBEROS=OFF -DENABLE_LIBXML2=OFF -DENABLE_ILBC=OFF -DENABLE_LUA=OFF -DENABLE_LZ4=OFF \
 927       -DENABLE_MINIZIP=OFF -DENABLE_NETLINK=OFF -DENABLE_NGHTTP2=OFF -DENABLE_NGHTTP3=OFF \
 928       -DENABLE_BCG729=OFF -DENABLE_OPUS=OFF -DENABLE_PCAP=OFF -DENABLE_PLUGIN_IFDEMO=ON \
 929       -DENABLE_PLUGINS=OFF -DENABLE_SBC=OFF -DENABLE_SMI=OFF -DENABLE_SNAPPY=OFF -DENABLE_SPANDSP=OFF \
 930       -DENABLE_ZLIB=OFF -DENABLE_ZSTD=OFF -DBUILD_mmdbresolve=OFF ..
 931     ninja
 932
 933 # Windows runners are still beta, at least technically:
 934 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
 935 Windows Build:
 936   extends: .build-windows
 937   rules: !reference [.if-w-w-only-merge-request]
 938   tags:
 939     - wireshark-windows-merge-req
 940   needs: [ 'Commit Check' ]
 941   script:
 942     # lib{sinsp,scap} don't support Configuration=Debug, so we can't enable
 943     # BUILD_stratoshark or BUILD_falcodump here just yet.
 944     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
 945     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug Wireshark.sln
 946     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug test-programs.vcxproj
 947     - C:\Windows\py.exe -m pytest --disable-gui --build-type=Debug --junitxml=../windows_tests.xml
 948   artifacts:
 949     when: always
 950     reports:
 951       junit: windows_tests.xml
 952
 953 macOS Build:
 954   extends: .build-macos
 955   rules: !reference [.if-w-w-only-merge-request]
 956   script:
 957     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 958     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 959     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 960     - ninja
 961     - ninja test-programs
 962     - pytest --disable-capture --junitxml=../macos_tests.xml
 963   artifacts:
 964     when: always
 965     reports:
 966       junit: macos_tests.xml
 967   needs: [ 'Commit Check' ]
 968
 969 # Adapted from https://www.synopsys.com/blogs/software-security/integrating-coverity-scan-with-gitlab-ci/
 970 # and https://gitlab.gnome.org/GNOME/glib/-/blob/8f57a5b9/.gitlab-ci.yml#L481
 971 Coverity GCC Scan:
 972   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 973   rules:
 974     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
 975   stage: analysis
 976   needs: []
 977   variables:
 978     CC: gcc
 979     CXX: g++
 980     # cov-build doesn’t handle GLIB_DEPRECATED_ENUMERATOR
 981     CFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 982     CXXFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 983   script:
 984     - curl --output /tmp/cov-analysis-linux64.tar.gz --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/linux64
 985     - tar --directory=/tmp --extract --gzip --file /tmp/cov-analysis-linux64.tar.gz
 986     - mkdir build
 987     - cd build
 988     - cmake -G Ninja ..
 989     - /tmp/cov-analysis-linux64-*/bin/cov-build --return-emit-failures --dir ../cov-int ninja
 990     - cd ..
 991     - tar --create --gzip --file cov-int.tar.gz cov-int
 992     - echo "export ARTIFACT_JOB_URL=$CI_JOB_URL" > job_environment_variables.sh
 993     - echo "export GIT_DESCRIPTION=$( git describe --tags --match "v[1-9]*" )" >> job_environment_variables.sh
 994   artifacts:
 995     paths:
 996       - cov-int.tar.gz
 997       - job_environment_variables.sh
 998
 999 Coverity GCC Submit:
1000   image: curlimages/curl
1001   rules:
1002     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
1003   stage: .post
1004   script:
1005     - . job_environment_variables.sh
1006     - echo $ARTIFACT_JOB_URL
1007     - echo $GIT_DESCRIPTION
1008     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.tar.gz&version=$GIT_DESCRIPTION&description=Ubuntu $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
1009   needs: [ 'Coverity GCC Scan' ]
1010
1011 Coverity Visual C++ Scan:
1012   extends: .build-windows
1013   rules:
1014     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
1015   tags:
1016     - wireshark-windows-merge-req
1017   stage: analysis
1018   needs: []
1019   script:
1020     - $gitDescription = (( git describe --tags ) | Out-String).Trim()
1021     - C:\Windows\System32\curl --output $env:temp\cov-analysis-win64.zip --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/win64
1022     - C:\ProgramData\chocolatey\tools\7z x "$env:temp\cov-analysis-win64.zip" -y -r -o"$env:temp"
1023     - cmake -DTEST_EXTRA_ARGS=--enable-release -DENABLE_LTO=off -G "Visual Studio 17 2022" -A x64 ..
1024     - $covAnalysisWin64 = (Get-ChildItem -Path $env:temp -Filter "cov-analysis-win64-*" -Directory)[0].FullName
1025     - Invoke-Expression "& $covAnalysisWin64\bin\cov-build.exe --return-emit-failures --dir ..\cov-int msbuild /verbosity:minimal `"/consoleloggerparameters:PerformanceSummary;NoSummary`" /maxcpucount:1 Wireshark.sln"
1026     - cd ..
1027     - C:\ProgramData\chocolatey\tools\7z a -tzip cov-int.zip cov-int
1028     - '"export ARTIFACT_JOB_URL=$env:CI_JOB_URL" | Out-File -Encoding ascii job_environment_variables.sh'
1029     - '"export GIT_DESCRIPTION=$gitDescription" | Out-File -Encoding ascii -Append job_environment_variables.sh'
1030   artifacts:
1031     paths:
1032       - cov-int.zip
1033       - job_environment_variables.sh
1034
1035 Coverity Visual C++ Submit:
1036   image: curlimages/curl
1037   rules:
1038     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
1039   stage: .post
1040   script:
1041     - sed -i -e 's/\r//' job_environment_variables.sh
1042     - . job_environment_variables.sh
1043     - echo $ARTIFACT_JOB_URL
1044     - echo $GIT_DESCRIPTION
1045     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.zip&version=$GIT_DESCRIPTION&description=Windows $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
1046   needs: [ 'Coverity Visual C++ Scan' ]
1047
1048 Clang Static Analyzer:
1049   extends: .build-ubuntu
1050   rules: !reference [.if-daily-schedule]
1051   stage: analysis
1052   needs: []
1053   script:
1054     - source /clang-latest.env
1055     - scan-build-${CLANG_VERSION} --exclude tools cmake -DCMAKE_BUILD_TYPE=Debug -DENABLE_WERROR=OFF -G Ninja ..
1056     - scan-build-${CLANG_VERSION} --exclude tools -o ../sbout ninja
1057     - cd ../sbout
1058     - RAW_DIR=$( find ../sbout -type d -name "20??-??-??-*" -printf "%P\n" | head )
1059     - SB_DIR="scan-build-$RAW_DIR"
1060     - mv "$RAW_DIR" "$SB_DIR"
1061     - if [ -d logs ] ; then mv logs $SB_DIR ; fi
1062     - chmod -R u=rwX,go=rX "$SB_DIR"
1063     - zip -9 -r "${SB_DIR}.zip" "$SB_DIR"
1064     - if [ -n "$MC_DESTINATION_ANALYSIS" ] ; then mc --quiet cp "${SB_DIR}.zip" "$MC_DESTINATION_ANALYSIS/" ; fi
1065
1066 # Windows runners are still beta, at least technically:
1067 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
1068 Visual Studio Code Analysis:
1069   extends: .build-windows
1070   tags:
1071     - wireshark-windows-dev
1072   rules:
1073     # The wireshark-windows-* tags are only available in wireshark/wireshark.
1074     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
1075   script:
1076     - py -m venv sarif-tools.venv
1077     - sarif-tools.venv\Scripts\pip.exe install sarif-tools
1078     - New-Item -Path C:\MinIO -Type "directory"
1079     - Invoke-Webrequest -OutFile C:\MinIO\mc.exe https://dl.min.io/client/mc/release/windows-amd64/archive/mc.RELEASE.2024-07-03T20-17-25Z
1080     - if ($( Get-FileHash -Algorithm SHA256 -Path C:\MinIO\mc.exe ).Hash -ne "A379139FB32C0ADDB6C05786782602B5106D13402759AC1B4A88285A4D5EAAD3" ) { Exit 1 }
1081     - $env:caexcludepath = "C:\Qt;$env:INCLUDE"
1082     - cmake -DENABLE_CODE_ANALYSIS=ON -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
1083     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount:2 Wireshark.sln
1084     - $report = "visual-c++-analyze-" + (Get-Date -format "yyyy-MM-dd") + ".html"
1085     - sarif-tools.venv\Scripts\sarif html --output $report
1086     - if (Test-Path env:MC_DESTINATION_ANALYSIS) { C:\MinIO\mc --quiet cp "$report" "$env:MC_DESTINATION_ANALYSIS/" }
1087
1088 # Build all doxygen docs
1089 API Reference:
1090   extends: .build-ubuntu
1091   rules: !reference [.if-daily-schedule]
1092   script:
1093     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1094     - cmake -GNinja ..
1095     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1096     - ninja wsar_html_zip 2>&1 > doxygen_output.txt | tee doxygen_errors.txt
1097     - mv wsar_html.zip doxygen_{output,errors}.txt ..
1098     - cd ..
1099     - if [ -n "$MC_DESTINATION_DOCS" ] ; then mc --quiet cp wsar_html.zip "$MC_DESTINATION_DOCS/" ; fi
1100   after_script:
1101     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
1102   artifacts:
1103     paths:
1104     - doxygen_errors.txt
1105     - doxygen_output.txt
1106     - wsar_html.zip
1107   needs: []
1108
1109 Code Lines and Data:
1110   extends: .build-ubuntu
1111   rules: !reference [.if-daily-schedule]
1112   stage: analysis
1113   variables:
1114     CLOC_OUT: /tmp/cloc.txt
1115     SCC_OUT: /tmp/scc.txt
1116     SLOC_OUT: /tmp/sloccount.txt
1117     TOKEI_OUT: /tmp/tokei.txt
1118   script:
1119     - DEBIAN_FRONTEND=noninteractive apt-get update
1120     - DEBIAN_FRONTEND=noninteractive apt-get --yes install sloccount cloc curl unzip
1121     - pushd /tmp
1122     - curl -L -O https://github.com/boyter/scc/releases/download/v3.0.0/scc-3.0.0-x86_64-unknown-linux.zip
1123     - unzip scc-3.0.0-x86_64-unknown-linux.zip
1124     - curl -L -O https://github.com/XAMPPRocky/tokei/releases/download/v12.1.2/tokei-x86_64-unknown-linux-gnu.tar.gz
1125     - tar -xf tokei-x86_64-unknown-linux-gnu.tar.gz
1126     - popd
1127     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1128     - cmake -G Ninja ..
1129     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1130     - ninja
1131     - cd ..
1132     - echo -n "cloc version:\ "
1133     - cloc --version
1134     - cloc --quiet . | tee $CLOC_OUT
1135     - /tmp/scc --version
1136     - /tmp/scc --not-match 'qt/.*.ts' . | tee $SCC_OUT
1137     - echo -n "SLOCCount version:\ "
1138     - sloccount --version
1139     - sloccount . | awk "/^Computing results/ { results=1 } { if (results) print }" | tee $SLOC_OUT
1140     - /tmp/tokei --version
1141     - /tmp/tokei --exclude 'qt/*.ts' . | tee $TOKEI_OUT
1142     - |
1143       cat > manuf <<FIN
1144       # This file was generated by TShark $(git describe --tags | sed -e 's/^v//') with the
1145       # command \`tshark -G manuf\`. Its canonical location is
1146       #
1147       # https://www.wireshark.org/download/automated/data/manuf.gz
1148       #
1149       # The first column contains the MAC address block (24, 28 or 36 bits wide,
1150       # per IEEE allocation sizes), the second column contains the shortened name
1151       # used by Wireshark for address name resolution and the third column contains the
1152       # full vendor name from the registry.
1153       #
1154       FIN
1155     - build/run/tshark -G manuf | sed -e 's,:00:00:00/24,,' >> manuf
1156     - gzip --best --keep manuf
1157     - if [ -n "$MC_DESTINATION_ANALYSIS" ] ; then mc --quiet cp "$CLOC_OUT" "$SCC_OUT" "$SLOC_OUT" "$TOKEI_OUT" "$MC_DESTINATION_ANALYSIS/" ; fi
1158     - if [ -n "$MC_DESTINATION_DATA" ] ; then mc --quiet cp manuf manuf.gz "$MC_DESTINATION_DATA/" ; fi
1159   artifacts:
1160     paths:
1161     - manuf
1162     - manuf.gz
1163   needs: []
1164
1165 # Fuzz TShark using ASAN and valgrind.
1166 .fuzz-ubuntu:
1167   extends: .build-ubuntu
1168   retry: 0
1169   rules: !reference [.if-fuzz-schedule]
1170   tags:
1171     - wireshark-ubuntu-fuzz
1172   resource_group: fuzz-master
1173   variables:
1174     INSTALL_PREFIX: "$CI_PROJECT_DIR/_install"
1175     MIN_PLUGINS: 10
1176     MAX_PASSES: 15
1177   before_script:
1178     - source /clang-latest.env
1179     - DEBIAN_FRONTEND=noninteractive apt-get update
1180     # Use DPkg::options::="--force-overwrite" until
1181     # https://bugs.launchpad.net/ubuntu/+source/llvm-toolchain-15/+bug/2008755
1182     # https://github.com/llvm/llvm-project/issues/62104
1183     # are fixed.
1184     - DEBIAN_FRONTEND=noninteractive apt-get --yes --option DPkg::options::="--force-overwrite" install llvm-$CLANG_VERSION
1185     - mkdir -p ccache
1186     - mkdir /tmp/fuzz
1187     - mkdir build
1188     - cd build
1189   after_script:
1190     # The cache should be large enough to be useful but it shouldn't take
1191     # too long to restore+save each run.
1192     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
1193     - if [ "$CI_JOB_STATUS" == "canceled" ]; then exit 0 ; fi
1194     - . /tmp/fuzz_result.sh
1195     - if $FUZZ_PASSED ; then exit 0 ; fi
1196     - echo Fuzzing failed. Generating report.
1197     - FUZZ_CAPTURE=$( find /tmp/fuzz -name "fuzz-*.pcap" -o -name "randpkt-*.pcap" | head -n 1 )
1198     - FUZZ_ERRORS="/tmp/fuzz/$( basename "$FUZZ_CAPTURE" .pcap ).err"
1199     - printf "\nfuzz-test.sh stderr:\n" >> "$FUZZ_ERRORS"
1200     - cat fuzz-test.err >> "$FUZZ_ERRORS"
1201     - if [ -n "$MC_DESTINATION_FUZZ" ] ; then mc --quiet cp "$FUZZ_CAPTURE" "$FUZZ_ERRORS" "$MC_DESTINATION_FUZZ/" ; fi
1202
1203 ASan Menagerie Fuzz:
1204   extends: .fuzz-ubuntu
1205   stage: fuzz-asan
1206   variables:
1207     WIRESHARK_LOG_FATAL: "critical"
1208   script:
1209     - MAX_SECONDS=$(( 6 * 60 * 60 ))
1210     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1211     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1212     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1213     - ninja
1214     - ninja install
1215     - cd ..
1216     - FUZZ_PASSED=true
1217     # /var/menagerie contains captures harvested from wireshark.org's mailing list, wiki, issues, etc.
1218     # We have more captures than we can fuzz in $MAX_SECONDS, so we shuffle them each run.
1219     - ./tools/fuzz-test.sh -a -2 -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1220     # Signal after_script, which runs in its own shell.
1221     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1222     - $FUZZ_PASSED
1223
1224 ASan randpkt Fuzz:
1225   extends: .fuzz-ubuntu
1226   stage: fuzz-randpkt
1227   variables:
1228     WIRESHARK_LOG_FATAL: "critical"
1229   script:
1230     # XXX Reuse fuzz-asan?
1231     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1232     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1233     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1234     - ninja
1235     - ninja install
1236     - cd ..
1237     - FUZZ_PASSED=true
1238     - ./tools/randpkt-test.sh -a -b $INSTALL_PREFIX/bin -d /tmp/fuzz -p $MAX_PASSES 2> fuzz-test.err || FUZZ_PASSED=false
1239     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1240     - $FUZZ_PASSED
1241   needs: [ 'ASan Menagerie Fuzz' ]
1242
1243 Valgrind Menagerie Fuzz:
1244   extends: .fuzz-ubuntu
1245   stage: fuzz-valgrind
1246   resource_group: fuzz-master-valgrind
1247   variables:
1248     # Use DWARF-4 debug info. Valgrind does not support Clang 14 with DWARF-5.
1249     # https://gitlab.com/wireshark/wireshark/-/issues/18191
1250     # https://www.mail-archive.com/valgrind-users@lists.sourceforge.net/msg07239.html
1251     CFLAGS: "-gdwarf-4"
1252     WIRESHARK_LOG_FATAL: "critical"
1253   script:
1254     - DEBIAN_FRONTEND=noninteractive apt-get update
1255     - DEBIAN_FRONTEND=noninteractive apt-get --yes install valgrind
1256     - MAX_SECONDS=$(( 3 * 60 * 60 ))
1257     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1258     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=OFF -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1259     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1260     - ninja
1261     - ninja install
1262     - cd ..
1263     - FUZZ_PASSED=true
1264     - ./tools/fuzz-test.sh -g -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1265     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1266     - $FUZZ_PASSED
1267   needs: [ 'ASan randpkt Fuzz' ]
1268
1269
1270 include:
1271   - template: Security/SAST.gitlab-ci.yml