linux.yml

# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# SPDX-License-Identifier: curl

name: 'Linux'

'on':
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'
  pull_request:
    branches:
      - master
    paths-ignore:
      - '.circleci/**'
      - 'appveyor.*'
      - 'Dockerfile'
      - 'projects/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions: {}

env:
  MAKEFLAGS: -j 5
  CURL_CI: github
  CURL_TEST_MIN: 1620
  DO_NOT_TRACK: '1'
  # unhandled
  BEARSSL_VERSION: 0.6
  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
  NGHTTP2_VERSION: 1.69.0
  # renovate: datasource=github-releases depName=pizlonator/fil-c versioning=semver-coerced registryUrl=https://github.com
  FIL_C_VERSION: 0.678

jobs:
  linux:
    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
    runs-on: ${{ matrix.build.image || 'ubuntu-latest' }}
    container: ${{ matrix.build.container }}
    timeout-minutes: 15
    env:
      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
    strategy:
      fail-fast: false
      matrix:
        build:
          - name: 'bearssl'
            install_packages: libbearssl-dev zlib1g-dev
            install_steps: pytest
            configure: --with-bearssl --enable-debug

          - name: 'bearssl clang'
            install_packages: libbearssl-dev zlib1g-dev clang
            CC: clang
            configure: --with-bearssl --enable-debug

          - name: 'bearssl valgrind 1'
            image: ubuntu-24.04-arm
            install_packages: libbearssl-dev valgrind
            tflags: '--min=820 1 to 1000'
            generate: -DCURL_USE_BEARSSL=ON -DENABLE_DEBUG=ON -DCURL_DROP_UNUSED=ON

          - name: 'bearssl valgrind 2'
            image: ubuntu-24.04-arm
            install_packages: libbearssl-dev valgrind
            tflags: '--min=830 1001 to 9999'
            generate: -DCURL_USE_BEARSSL=ON -DENABLE_DEBUG=ON

          - name: 'bearssl intel C89'
            install_packages: libbearssl-dev libssh-dev
            install_steps: pytest
            configure: CFLAGS=-std=gnu89 --with-bearssl --with-libssh --enable-debug

          - name: 'bearssl arm C89'
            image: ubuntu-24.04-arm
            install_packages: libbearssl-dev libssh2-1-dev
            install_steps: pytest
            configure: CFLAGS=-std=gnu89 --with-bearssl --with-libssh2 --enable-debug --disable-verbose

          - name: 'bearssl !ipv6 !--libcurl !--digest-auth'
            image: ubuntu-24.04-arm
            install_packages: libbearssl-dev
            configure: --with-bearssl --disable-ipv6 --enable-debug --disable-unity --disable-libcurl-option --disable-digest-auth --enable-ntlm

          - name: 'curl_global_init_mem debug valgrind'
            image: ubuntu-24.04-arm
            install_packages: valgrind libbearssl-dev
            tflags: '--min=1600'
            configure: >-
              --enable-init-mem-debug
              --with-bearssl --disable-debug --enable-unity
              --enable-ntlm

          - name: 'bearssl https-only'
            image: ubuntu-24.04-arm
            install_packages: libbearssl-dev
            tflags: '--min=1130'
            configure: >-
              --with-bearssl --enable-debug --disable-unity
              --disable-dict --disable-gopher --disable-ldap --disable-telnet
              --disable-imap --disable-pop3 --disable-smtp
              --disable-rtsp
              --without-libssh2 --without-libssh
              --disable-tftp --disable-ftp --disable-file --disable-smb
              --enable-ntlm

          - name: 'bearssl torture 1'
            install_packages: libbearssl-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
            tflags: '-t --shallow=25 --min=870 1 to 1000'
            torture: true
            generate: -DCURL_USE_BEARSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON

          - name: 'bearssl torture 2'
            install_packages: libbearssl-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
            tflags: '-t --shallow=25 --min=915 1001 to 9999'
            torture: true
            generate: -DCURL_USE_BEARSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON -DCURL_ENABLE_NTLM=ON

          - name: 'bearssl Fil-C'
            install_steps: filc bearssl-filc nghttp2-filc pytest
            tflags: '!776'  # adds 1-9 minutes to the test run step, and fails consistently
            CC: /home/runner/filc/build/bin/filcc
            PKG_CONFIG_PATH: /home/runner/nghttp2/lib/pkgconfig
            generate: >-
              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_UNITY_BUILD=OFF -DCURL_DISABLE_TYPECHECK=ON
              -DOPENSSL_ROOT_DIR=/home/runner/libressl -DCURL_USE_LIBPSL=OFF
              -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
              -DCURL_DISABLE_LDAP=ON -DUSE_LIBIDN2=OFF -DCURL_USE_LIBSSH2=OFF
              -DCURL_ENABLE_NTLM=ON

          - name: 'clang-tidy'
            install_packages: clang-20 clang-tidy-20 libbearssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev libgsasl-dev
            install_steps: skiprun
            CC: clang-20

            generate: >-
              -DCURL_USE_BEARSSL=ON
              -DCURL_USE_GSASL=ON
              -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON
              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20

          - name: 'address-sanitizer'
            install_packages: clang-20 libbearssl-dev libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
            install_steps: pytest randcurl
            CC: clang-20
            CFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined
              -fPIC

            LDFLAGS: >-
              -fsanitize=address,bounds,leak,signed-integer-overflow,undefined
              -fno-sanitize-recover=address,bounds,leak,signed-integer-overflow,undefined -ldl -lubsan

            generate: -DENABLE_DEBUG=ON -DCURL_USE_BEARSSL=ON -DCURL_USE_LIBSSH=ON

          - name: 'thread-sanitizer'
            install_packages: clang-20 libtsan2
            install_steps: pytest bearssl-tsan
            CC: clang-20
            CFLAGS: -fsanitize=thread -g
            LDFLAGS: -fsanitize=thread
            generate: -DBEARSSL_INCLUDE_DIR=/home/runner/bearssl/include -DBEARSSL_LIBRARY=/home/runner/bearssl/libbearssl.so -DUSE_ECH=ON -DENABLE_DEBUG=ON

          - name: 'event-based'
            install_packages: libssh-dev libbearssl-dev
            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-bearssl --enable-ntlm
            tflags: '-n --test-event --min=1320'

          - name: 'duphandle'
            image: ubuntu-24.04-arm
            install_packages: libssh-dev libbearssl-dev
            configure: --enable-debug --enable-static --disable-shared --disable-threaded-resolver --with-libssh --with-bearssl
            tflags: '-n --test-duphandle'

          - name: 'IntelC bearssl'
            install_packages: libbearssl-dev
            install_steps: intelc
            CC: icc
            configure: --enable-debug --with-bearssl

          - name: 'Alpine MUSL https-rr'
            configure: --enable-debug --with-bearssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --enable-threaded-resolver
            container: alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 # 3.23.4

          - name: 'Alpine MUSL https-rr c-ares'
            configure: --enable-debug --with-bearssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-httpsrr --enable-ares --disable-threaded-resolver
            container: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc # 3.20.10

    steps:
      - name: 'install prereqs'
        if: ${{ matrix.build.container == null }}
        timeout-minutes: 2
        env:
          INSTALL_PACKAGES: >-
            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4' || '' }}
            ${{ contains(matrix.build.install_steps, 'pytest') && 'apache2 apache2-dev libnghttp2-dev vsftpd dante-server' || '' }}

        run: |
          ls -l /etc/apt/sources.list.d
          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
          sudo apt-get -o Dpkg::Use-Pty=0 update
          sudo apt-get -o Dpkg::Use-Pty=0 install \
            libtool autoconf automake pkgconf \
            libpsl-dev zlib1g-dev libbrotli-dev libzstd-dev \
            ${INSTALL_PACKAGES} \
            ${MATRIX_INSTALL_PACKAGES}
          # Workaround for ubuntu-24.04-arm images having 0777 for /home/runner,
          # which breaks the test sshd server used in pytest.
          if [[ "$(uname -m)" = *'aarch64'* ]]; then
            ls -l /home
            chmod 0755 /home/runner
          fi

      - name: 'install prereqs (alpine)'
        if: ${{ startsWith(matrix.build.container, 'alpine') }}
        run: |
          apk add --no-cache build-base autoconf automake libtool perl bearssl-dev \
            libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
            krb5-dev libpsl-dev c-ares-dev \
            py3-impacket py3-asn1 py3-six py3-pycryptodomex \
            perl-time-hires openssh stunnel sudo git openssl

      - name: 'install Fil-C'
        if: ${{ contains(matrix.build.install_steps, 'filc') }}
        run: |
          cd /home/runner
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/pizlonator/fil-c/releases/download/v${FIL_C_VERSION}/filc-${FIL_C_VERSION}-linux-x86_64.tar.xz" --output pkg.bin
          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin && mv "filc-${FIL_C_VERSION}-linux-x86_64" filc
          cd filc
          ./setup.sh

      - name: 'cache bearssl (filc)'
        if: ${{ contains(matrix.build.install_steps, 'bearssl-filc') }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-bearssl-filc
        env:
          cache-name: cache-bearssl-filc
        with:
          path: ~/bearssl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BEARSSL_VERSION }}-${{ env.FIL_C_VERSION }}

      - name: 'build bearssl (filc)'
        if: ${{ contains(matrix.build.install_steps, 'bearssl-filc') && steps.cache-bearssl-filc.outputs.cache-hit != 'true' }}
        run: |
          curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
            --location "https://bearssl.org/bearssl-${BEARSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xf pkg.bin && rm -f pkg.bin
          cd "bearssl-${BEARSSL_VERSION}"
          make CC=/home/runner/filc/build/bin/filcc 'LD=$(CC)' 'LDDLL=$(CC)'
          mkdir -p ~/bearssl/lib ~/bearssl/include
          cp inc/*.h ~/bearssl/include
          cp build/libbearssl.* ~/bearssl/lib

      - name: 'cache nghttp2 (filc)'
        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-nghttp2-filc
        env:
          cache-name: cache-nghttp2-filc
        with:
          path: ~/nghttp2
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.FIL_C_VERSION }}

      - name: 'build nghttp2 (filc)'
        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') && steps.cache-nghttp2-filc.outputs.cache-hit != 'true' }}
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://github.com/nghttp2/nghttp2/releases/download/v${NGHTTP2_VERSION}/nghttp2-${NGHTTP2_VERSION}.tar.xz" --output pkg.bin
          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
          cd "nghttp2-${NGHTTP2_VERSION}"
          cmake -B . -G Ninja -DENABLE_LIB_ONLY=ON -DBUILD_TESTING=OFF -DENABLE_DOC=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/nghttp2 \
            -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF \
            -DCMAKE_C_COMPILER=/home/runner/filc/build/bin/filcc
          cmake --build .
          cmake --install .

      - name: 'cache bearssl (thread sanitizer)'
        if: ${{ contains(matrix.build.install_steps, 'bearssl-tsan') }}
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        id: cache-bearssl-tsan
        env:
          cache-name: cache-bearssl-tsan
        with:
          path: ~/bearssl
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BEARSSL_VERSION }}

      - name: 'build bearssl (thread sanitizer)'
        if: ${{ contains(matrix.build.install_steps, 'bearssl-tsan') && steps.cache-bearssl-tsan.outputs.cache-hit != 'true' }}
        run: |
          curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
            --location "https://bearssl.org/bearssl-${BEARSSL_VERSION}.tar.gz" --output pkg.bin
          sha256sum pkg.bin && tar -xf pkg.bin && rm -f pkg.bin
          cd "bearssl-${BEARSSL_VERSION}"
          make CC=clang 'LD=$(CC)' 'LDDLL=$(CC)' CFLAGS='-fsanitize=thread' LDFLAGS='-fsanitize=thread' LDDLLFLAGS='-shared -fsanitize=thread'
          mkdir -p ~/bearssl/lib ~/bearssl/include
          cp inc/*.h ~/bearssl/include
          cp build/libbearssl.* ~/bearssl/lib

      - name: 'install Intel compilers'
        if: ${{ contains(matrix.build.install_steps, 'intelc') }}
        timeout-minutes: 2
        run: |
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | \
            sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
          sudo add-apt-repository 'deb https://apt.repos.intel.com/oneapi all main'
          sudo apt-get -o Dpkg::Use-Pty=0 install intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
          source /opt/intel/oneapi/setvars.sh
          printenv >> "$GITHUB_ENV"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'autoreconf'
        if: ${{ matrix.build.configure }}
        run: autoreconf -fi

      - name: 'configure'
        env:
          CC: '${{ matrix.build.CC }}'
          CFLAGS: '${{ matrix.build.CFLAGS }}'
          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
          MATRIX_GENERATE: '${{ matrix.build.generate }}'
          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
        run: |
          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake -B bld -G Ninja \
              -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-pc-linux-gnu" -DBUILD_STATIC_LIBS=ON \
              -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
              ${MATRIX_GENERATE}
          else
            mkdir bld && cd bld && \
            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
              ${MATRIX_CONFIGURE}
          fi

      - name: 'configure log'
        if: ${{ !cancelled() }}
        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true

      - name: 'curl_config.h'
        run: |
          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
          grep -F '#define' bld/lib/curl_config.h | sort || true

      - name: 'test configs'
        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true

      - name: 'build'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose
          else
            make -C bld V=1
          fi

      - name: 'single-use function check'
        if: ${{ (contains(matrix.build.configure, '--disable-unity') || contains(matrix.build.generate, '-DCMAKE_UNITY_BUILD=OFF')) && !contains(matrix.build.install_steps, 'filc') }}
        run: |
          git config --global --add safe.directory "*"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            libcurla=bld/lib/libcurl.a
          else
            libcurla=bld/lib/.libs/libcurl.a
          fi
          ./scripts/singleuse.pl --unit "${libcurla}"

      - name: 'curl -V'
        run: |
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
          bld/src/curl --disable -V

      - name: 'curl install'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --install bld --strip
          else
            make -C bld V=1 install
          fi

      - name: 'build tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target testdeps
          else
            make -C bld V=1 -C tests
          fi

      - name: 'install test prereqs'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && matrix.build.container == null }}
        run: |
          python3 -m venv ~/venv
          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
          fi

      - name: 'run tests'
        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
        timeout-minutes: ${{ contains(matrix.build.install_packages, 'valgrind') && 20 || 10 }}
        env:
          TEST_TARGET: ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
          TFLAGS: '${{ matrix.build.tflags }}'
        run: |
          if [ "${TEST_TARGET}" = 'test-ci' ] && [[ "${MATRIX_INSTALL_PACKAGES}" = *'valgrind'* ]]; then
            TFLAGS+=' -j6'
            TFLAGS+=' !776'  # skip long-running flaky test
            if [[ "${MATRIX_INSTALL_PACKAGES}" = *'libgss-dev'* ]]; then
              TFLAGS+=' ~2077 ~2078'  # memory leaks from Curl_auth_decode_spnego_message() -> gss_init_sec_context()
            fi
          elif [ "${TEST_TARGET}" != 'test-ci' ]; then
            TFLAGS+=' --buildinfo'  # only test-ci sets this by default, set it manually for test-torture
          fi
          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
          if [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test'* ]]; then
            locale || true
            export LC_ALL=C
            export LC_CTYPE=C
            export LC_NUMERIC=fr_FR.UTF-8
          fi
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target "${TEST_TARGET}"
          else
            make -C bld V=1 "${TEST_TARGET}"
          fi

      - name: 'install pytest prereqs'
        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
        run: |
          [ -d ~/venv ] || python3 -m venv ~/venv
          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt

      - name: 'run pytest'
        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
        env:
          PYTEST_ADDOPTS: '--color=yes'
          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
        run: |
          [ -f ~/venv/bin/activate ] && source ~/venv/bin/activate
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --verbose --target curl-pytest-ci
          else
            make -C bld V=1 pytest-ci
          fi

      - name: 'randcurl'
        if: ${{ contains(matrix.build.install_steps, 'randcurl') }}
        run: |
          mkdir run
          cd run
          ../.github/scripts/randcurl.pl 60 ../bld/src/curl