Feat/build

.github/workflows/build.yml

@@ -6,14 +6,17 @@ on:
   pull_request:
   workflow_dispatch:
   push:
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: for pass test
-        run: |
-          echo "This is a test to check that the workflow is working. If you see this, the workflow is running and you can add more steps to it."
+    branches:
+      - main
+      - master
+
+# Avoid duplicate push + pull_request runs on PR branches, and cancel
+# superseded runs when new commits are pushed.
+concurrency:
+  group: buildtest-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
+jobs:
   build:
     runs-on: ${{ matrix.os || 'ubuntu-24.04' }}
     strategy:
@@ -28,85 +31,93 @@ jobs:
 
         # MULTI and NOWRITEV are passed as integers to the build
         include:
-          # - name: plain linux
-          #   upload_sizes: 1
-
-          # - name: multi binary
-          #   multi: 1
-          #   multilink: 1
-
-          # - name: multi binary, dropbearmulti argv0
-          #   multi: 1
-          #   multiwrapper: 1
-
-          # - name: client only
-          #   runcheck: 'no'
-          #   make_target: PROGRAMS=dbclient
-
-          # - name: server only
-          #   runcheck: 'no'
-          #   make_target: PROGRAMS=dropbear
-
-          # - name: bundled libtom, 22.04, no writev()
-          #   # test can use an older distro with bundled libtommath
-          #   os: ubuntu-22.04
-          #   configure_flags: --enable-bundled-libtom --enable-werror
-          #   # NOWRITEV is unrelated, test here to save a job
-          #   nowritev: 1
-          #   # our tests expect >= python3.7
-          #   runcheck: 'no'
-
-          # - name: linux clang
-          #   cc: clang
+          - name: plain linux
+            upload_sizes: 1
+
+          - name: multi binary
+            multi: 1
+            multilink: 1
+
+          - name: multi binary, dropbearmulti argv0
+            multi: 1
+            multiwrapper: 1
+
+          - name: client only
+            runcheck: 'no'
+            make_target: PROGRAMS=dbclient
+
+          - name: server only
+            runcheck: 'no'
+            make_target: PROGRAMS=dropbear
+
+          - name: bundled libtom, 22.04, no writev()
+            # test can use an older distro with bundled libtommath
+            os: ubuntu-22.04
+            configure_flags: --enable-bundled-libtom --enable-werror
+            # NOWRITEV is unrelated, test here to save a job
+            nowritev: 1
+            # our tests expect >= python3.7
+            runcheck: 'no'
+
+          - name: linux clang
+            cc: clang
 
           # Some platforms only have old compilers, we try to keep
           # compatibilty. For some reason -std=c89 doesn't enforce
           # early declarations so we specify it anyway.
-          # - name: c89
-          #   extracflags: -std=c89 -Wdeclaration-after-statement
-          #   # enable all options
-          #   nondefault: 1
-          #   configure_flags: --enable-pam
-          #   # sntrup761.c is not c89 compliant
-          #   localoptions: |
-          #     #define DROPBEAR_SNTRUP761 0
-          #     #define DROPBEAR_MLKEM768 0
-
-          # - name: macos 14
-          #   os: macos-14
-          #   cc: clang
-          #   # OS X says daemon() and utmp are deprecated.
-          #   # OS X tests for undefined TARGET_OS_EMBEDDED in libc headers
-          #   extracflags: -Wno-deprecated-declarations -Wno-undef
-          #   runcheck: 'no'
-          #   apt: 'no'
-          #   # fails with:
-          #   # .../ranlib: file: libtomcrypt.a(cbc_setiv.o) has no symbols
-          #   ranlib: ranlib -no_warning_for_no_symbols
-
-          # - name: macos 15
-          #   os: macos-15
-          #   cc: clang
-          #   # OS X says daemon() and utmp are deprecated.
-          #   # OS X tests for undefined TARGET_OS_EMBEDDED in libc headers
-          #   extracflags: -Wno-deprecated-declarations -Wno-undef
-          #   runcheck: 'no'
-          #   apt: 'no'
-          #   # fails with:
-          #   # .../ranlib: file: libtomcrypt.a(cbc_setiv.o) has no symbols
-          #   ranlib: ranlib -no_warning_for_no_symbols
+          - name: c89
+            extracflags: -std=c89 -Wdeclaration-after-statement
+            # enable all options
+            nondefault: 1
+            configure_flags: --enable-pam
+            # sntrup761.c is not c89 compliant
+            localoptions: |
+              #define DROPBEAR_SNTRUP761 0
+              #define DROPBEAR_MLKEM768 0
+
+          - name: macos 14
+            os: macos-14
+            cc: clang
+            # OS X says daemon() and utmp are deprecated.
+            # OS X tests for undefined TARGET_OS_EMBEDDED in libc headers
+            extracflags: -Wno-deprecated-declarations -Wno-undef
+            runcheck: 'no'
+            apt: 'no'
+            # fails with:
+            # .../ranlib: file: libtomcrypt.a(cbc_setiv.o) has no symbols
+            ranlib: ranlib -no_warning_for_no_symbols
+            # macos doesn't have setresgid
+            localoptions: |
+              #define DROPBEAR_SVR_DROP_PRIVS 0
+              #define DROPBEAR_SVR_LOCALSTREAMFWD 0
+
+          - name: macos 15
+            os: macos-15
+            cc: clang
+            # OS X says daemon() and utmp are deprecated.
+            # OS X tests for undefined TARGET_OS_EMBEDDED in libc headers
+            extracflags: -Wno-deprecated-declarations -Wno-undef
+            runcheck: 'no'
+            apt: 'no'
+            # fails with:
+            # .../ranlib: file: libtomcrypt.a(cbc_setiv.o) has no symbols
+            ranlib: ranlib -no_warning_for_no_symbols
+            # macos doesn't have setresgid
+            localoptions: |
+              #define DROPBEAR_SVR_DROP_PRIVS 0
+              #define DROPBEAR_SVR_LOCALSTREAMFWD 0
 
           # Check that debug code doesn't bitrot
-          # - name: DEBUG_TRACE
-          #   nondefault: 1
-          #   configure_flags: --enable-pam
-          #   localoptions: |
-          #     #define DEBUG_TRACE 5
+          - name: DEBUG_TRACE
+            nondefault: 1
+            configure_flags: --enable-pam
+            localoptions: |
+              #define DEBUG_TRACE 5
 
           # Check off-by-default options don't bitrot
-          # - name: nondefault options
-          #   nondefault: 1
-          #   configure_flags: --enable-pam
+          - name: nondefault options
+            nondefault: 1
+            configure_flags: --enable-pam
 
           - name: most options disabled
             configure_flags: --disable-harden --disable-zlib --disable-openpty --disable-lastlog
@@ -145,25 +156,25 @@ jobs:
               #define DROPBEAR_USE_PASSWORD_ENV 0
               #define DROPBEAR_SFTPSERVER 0
 
-          # - name: no sha1
-          #   runcheck: 'no'
-          #   # disables all sha1
-          #   localoptions: |
-          #     #define DROPBEAR_SHA1_HMAC 0
-          #     #define DROPBEAR_RSA_SHA1 0
-          #     #define DROPBEAR_DH_GROUP14_SHA1 0
-          #     #define DROPBEAR_ECDSA 0
-          #     #define DROPBEAR_ED25519 0
-          #     #define DROPBEAR_SK_KEYS 0
-          #     #define DROPBEAR_ENABLE_GCM_MODE 1
-          #     #define DROPBEAR_3DES 1
-          #     #define DROPBEAR_DH_GROUP16 1
-          #     #define DROPBEAR_SHA2_512_HMAC 1
-          #     #define DROPBEAR_CLI_PUBKEY_AUTH 0
-
-          # - name: pq, no plain x25519
-          #   localoptions: |
-          #     #define DROPBEAR_CURVE25519 0
+          - name: no sha1
+            runcheck: 'no'
+            # disables all sha1
+            localoptions: |
+              #define DROPBEAR_SHA1_HMAC 0
+              #define DROPBEAR_RSA_SHA1 0
+              #define DROPBEAR_DH_GROUP14_SHA1 0
+              #define DROPBEAR_ECDSA 0
+              #define DROPBEAR_ED25519 0
+              #define DROPBEAR_SK_KEYS 0
+              #define DROPBEAR_ENABLE_GCM_MODE 1
+              #define DROPBEAR_3DES 1
+              #define DROPBEAR_DH_GROUP16 1
+              #define DROPBEAR_SHA2_512_HMAC 1
+              #define DROPBEAR_CLI_PUBKEY_AUTH 0
+
+          - name: pq, no plain x25519
+            localoptions: |
+              #define DROPBEAR_CURVE25519 0
 
           # # Fuzzers run standalone. A bit superfluous with cifuzz, but
           # # good to run the whole corpus to keep it working.
@@ -228,7 +239,7 @@ jobs:
         if: ${{ matrix.nondefault }}
         run: |
           # Turn on anything that's off by default. Rough but seems sufficient
-          grep ' 0$' src/default_options.h | sed 's/0$/1/' >> localoptions.h
+          grep ' 0$' src/default_options.h | grep -v DROPBEAR_SVR_OTP_PASSWORD | sed 's/0$/1/' >> localoptions.h
           # PAM clashes with password
           echo "#define DROPBEAR_SVR_PASSWORD_AUTH 0" >> localoptions.h
           # 1 second timeout is too short

.github/workflows/cifuzz.yml

@@ -7,25 +7,29 @@ on:
   push:
     branches:
       - master
+# Cancel superseded runs on the same ref so pushes don't pile up.
+concurrency:
+  group: cifuzz-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
     steps:
-    - name: Build Fuzzers
-      id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
-      with:
-        oss-fuzz-project-name: 'dropbear'
-        dry-run: false
-    - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
-      with:
-        oss-fuzz-project-name: 'dropbear'
-        fuzz-seconds: 1200
-        dry-run: false
-    - name: Upload Crash
-      uses: actions/upload-artifact@v4
-      if: failure() && steps.build.outcome == 'success'
-      with:
-        name: artifacts
-        path: ./out/artifacts
+      - name: Build Fuzzers
+        id: build
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+        with:
+          oss-fuzz-project-name: "dropbear"
+          dry-run: false
+      - name: Run Fuzzers
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        with:
+          oss-fuzz-project-name: "dropbear"
+          fuzz-seconds: 300
+          dry-run: false
+      - name: Upload Crash
+        uses: actions/upload-artifact@v4
+        if: failure() && steps.build.outcome == 'success'
+        with:
+          name: artifacts
+          path: ./out/artifacts