README (3519B)
1 GNU libmicrohttpd -- containerised CI jobs 2 ========================================== 3 4 Each job is a directory under contrib/ci/jobs/. It holds a config.ini 5 describing the container to use and an executable job.sh that is the 6 entry point inside that container. contrib/ci/ci.sh is the driver. 7 8 Requirements 9 ------------ 10 11 podman (the driver calls it directly, not docker) 12 qemu-user-static only for foreign architectures; without it 13 "podman run --arch ..." fails in creative ways. 14 See https://wiki.archlinux.org/title/Podman#Foreign_architectures 15 16 Nothing else has to be installed on the host: every job builds and runs 17 inside a debian:trixie container described by contrib/ci/Containerfile 18 (or contrib/ci/<arch>.Containerfile, if one exists for the architecture 19 the job asks for). 20 21 Running 22 ------- 23 24 One job, from the top of the source tree: 25 26 contrib/ci/ci.sh 2-test 27 28 All of them, in numeric order: 29 30 contrib/ci/run-all-jobs 31 32 The source tree is bind-mounted into the container at /workdir, so the 33 jobs build in your checkout and leave their output there. 34 35 The jobs 36 -------- 37 38 0-codespell spell check. Runs in nixery.dev/shell/codespell, does 39 not build a container. Advisory only 40 (HALT_ON_FAILURE = False). 41 1-build ./bootstrap && ./configure && make. The smoke build: 42 default configuration, nothing enabled. 43 2-test --enable-asserts --enable-sanitizers=address,undefined 44 plus the full "make check". Dumps the logs of every 45 failing test. 46 3-build-matrix the build-configuration matrix: asserts on/off x 47 sanitizers on/off x six digest/auth configurations x 48 {64-bit, 32-bit}. Clean out-of-tree build and 49 "make check" per combination, with a summary table at 50 the end. 51 4-fuzz a few seconds per harness of the structure-aware 52 fuzzers in src/fuzz, plus a replay of the whole 53 committed corpus. 54 5-zzuf src/testzzuf, the bit-level fuzzing suite, over a 55 moderate sweep of zzuf seeds. 56 6-coverage --enable-coverage build, full "make check", lcov + 57 genhtml. Writes the HTML report to 58 contrib/ci/artifacts/coverage/$CI_COMMIT_REF/html/ and 59 prints the path; it uploads nowhere. 60 61 Every push, and nightly 62 ----------------------- 63 64 Run on every push: 65 66 0-codespell, 1-build, 2-test, 4-fuzz 67 68 That is the "--enable-asserts --enable-sanitizers" configuration that 69 TESTING.md proposal P3 asks for on every push, plus a bounded fuzz run so 70 a regression is caught in the pull request. 71 72 Run nightly: 73 74 3-build-matrix, 5-zzuf, 6-coverage 75 76 These are the expensive ones. 3-build-matrix is 48 builds; 5-zzuf and 77 6-coverage each run the heavy-test suite. 78 79 Why 3-build-matrix exists 80 ------------------------- 81 82 MAX_DIGEST in src/microhttpd/digestauth.c is 16 in an MD5-only build and 83 32 otherwise, so the out-of-bounds write fixed in commit 5a73c1ae 84 overflows by a different amount - or not at all - depending only on 85 configure flags. Testing one configuration cannot answer whether a fix 86 holds in every build a distribution ships. See TESTING.md, proposal P3. 87 88 Not part of CI: OSS-Fuzz 89 ------------------------ 90 91 contrib/oss-fuzz/ holds the OSS-Fuzz integration. It is a separate, 92 externally driven path and is deliberately not run from these jobs.