.gitlab-ci.yml

   1 # In the interest of reliability and performance, please avoid installing
   2 # external dependencies here, e.g. via tools/*-setup.sh, apt, dnf, or yum.
   3 # Do so in the appropriate Dockerfile at
   4 # https://gitlab.com/wireshark/wireshark-containers/ instead.
   5 # The resulting images can be found at
   6 # https://gitlab.com/wireshark/wireshark-containers/container_registry
   7
   8 stages:
   9   - build
  10   - analysis
  11   - test
  12   - fuzz-asan
  13   - fuzz-randpkt
  14   - fuzz-valgrind
  15
  16 variables:
  17   # Ensure that checkouts are a) fast and b) have a reachable tag. In a
  18   # brighter, more glorious future we might be able to use --shallow-since:
  19   # https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3460
  20   # In the mean time, fetching the last 5000 commits does the job.
  21   # Ensure that all variables are string
  22   GIT_DEPTH: "1"
  23   GIT_FETCH_EXTRA_FLAGS: "--depth=5000"
  24   CCACHE_DIR: "${CI_PROJECT_DIR}/ccache"
  25   # Enable color output in various tools.
  26   # CMake, Ninja, and others: https://bixense.com/clicolors/
  27   CLICOLOR_FORCE: "1"
  28   # pytest
  29   FORCE_COLOR: "1"
  30   # Homebrew
  31   HOMEBREW_COLOR: "1"
  32   # Skip irrelevant SAST scanners:
  33   SAST_EXCLUDED_ANALYZERS: "brakeman,eslint,security-code-scan,semgrep,spotbugs"
  34
  35 # Scheduled builds additionally set SCHEDULE_TYPE, which can be one of:
  36 # - 2x-daily: Twice daily at 07:00 and 19:00 UTC
  37 # - daily: Daily at 10:00 UTC
  38 # - weekly: Sunday at 14:00 UTC
  39 # - coverity-visual-c++: Monday, Wednesday, & Friday at 12:00 UTC
  40 # - coverity-gcc: Sunday, Tuesday, Thursday & Saturday at 12:00 UTC
  41
  42 # Common rule stanzas
  43 # These must currently be including using "!reference tags". "extends:" and
  44 # YAML anchors won't work:
  45 # https://gitlab.com/gitlab-org/gitlab/-/issues/322992
  46
  47 # Commits that have been approved and merged. Run automatically in the main
  48 # repo and allow manual runs in the web UI and in forks.
  49 # Release builds: CI_PIPELINE_SOURCE=api
  50 .if-merged:
  51   # Regular commits: CI_PIPELINE_SOURCE=push, CI_COMMIT_BRANCH=master
  52   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  53   # "Run pipeline" button commits, cherry picks
  54   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  55   # Tagged release builds: CI_PIPELINE_SOURCE=api (should be "web"?)
  56   - if: '$CI_PIPELINE_SOURCE == "api"'
  57   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_URL !~ /.*gitlab.com\/wireshark\/wireshark/'
  58     when: manual
  59 # Merged commits for runners which are only available in
  60 # wireshark/wireshark, e.g. wireshark-windows-*. Run automatically in
  61 # the main repo and allow manual runs in the web UI.
  62 .if-w-w-only-merged:
  63   - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  64   - if: '$CI_PIPELINE_SOURCE == "web" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  65   - if: '$CI_PIPELINE_SOURCE == "api"'
  66 # Incoming merge requests.
  67 .if-merge-request:
  68   - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  69 # Incoming non-detached merge requests. Must be used for runners which are only
  70 # available in wireshark/wireshark, e.g. wireshark-windows-*
  71 .if-w-w-only-merge-request:
  72   - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
  73 # Scheduled jobs. Care should be taken when changing this since the scheduler
  74 # often doesn't report errors.
  75 .if-weekly-schedule:
  76   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "weekly"'
  77 .if-daily-schedule:
  78   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily"'
  79 .if-2x-daily-schedule:
  80   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "2x-daily"'
  81 # Fuzz jobs. Care should be taken when changing this since the scheduler
  82 # often doesn't report errors.
  83 .if-fuzz-schedule:
  84   - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "fuzz"'
  85
  86 .build-linux:
  87   stage: build
  88   tags:
  89     - saas-linux-small-amd64
  90   before_script:
  91     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
  92     - env | grep ^CI | sort
  93     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
  94   after_script:
  95     - for builddir in build/packaging/rpm/BUILD/wireshark-*/build build/packaging/rpm/BUILD/wireshark-* build obj-*; do [ ! -d "$builddir/run" ] || break; done
  96     - if [[ "$CI_JOB_NAME" == "build:rpm-opensuse-"* ]]; then export LD_LIBRARY_PATH=$builddir/run; fi
  97     - if [ -f $builddir/run/tshark ]; then $builddir/run/tshark --version; fi
  98   needs: []
  99
 100 .test-linux:
 101   stage: test
 102   tags:
 103     - saas-linux-small-amd64
 104   variables:
 105     GIT_STRATEGY: none
 106
 107 .build-ubuntu:
 108   extends: .build-linux
 109   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 110   retry: 1
 111   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 112   cache:
 113     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 114     key: ${CI_JOB_NAME}-master
 115     paths:
 116       - ccache/
 117   before_script:
 118     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 119     - env | grep ^CI | sort
 120     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 121     - useradd user
 122     - export LANG=en_US.UTF-8
 123     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 124     - mkdir -p ccache
 125     - ccache --show-stats
 126     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 127     - export DH_QUIET=1
 128     - export MAKEFLAGS=--silent
 129     - NUM_COMMITS=$(curl --silent $CI_API_V4_URL/projects/$CI_MERGE_REQUEST_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/commits | jq length)
 130     - echo "$NUM_COMMITS commit(s) in this MR"
 131     - mkdir build
 132     - cd build
 133   script:
 134     # setcap restricts our library paths
 135     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 136     - CFLAGS=-Wl,-rpath=$(pwd)/run CXXFLAGS=-Wl,-rpath=$(pwd)/run cmake -GNinja -DENABLE_CCACHE=ON $CMAKE_ARGS ..
 137     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 138     - ninja
 139     - ninja install
 140   after_script:
 141     # The cache should be large enough to be useful but it shouldn't take
 142     # too long to restore+save each run.
 143     - cd "$CI_PROJECT_DIR"
 144     - ccache --max-size $( du --total --summarize --block-size=1M *build*/ | awk 'END {printf ("%dM", $1 * 1.5)}' )
 145
 146 .build-rpm:
 147   extends: .build-linux
 148   rules: !reference [.if-2x-daily-schedule]
 149   before_script:
 150     # Hack to let ninja make full use of the system on Fedora and Rocky.
 151     - export RPM_BUILD_NCPUS=$(( $( getconf _NPROCESSORS_ONLN ) + 2 ))
 152     - git config --global user.email "you@example.com"
 153     - git config --global user.name "Your Name"
 154     - mkdir build
 155     - cd build
 156     - ../tools/make-version.py --set-release ..
 157     - mv -v ../wireshark-*.tar.* .
 158   artifacts:
 159     paths:
 160       - build/packaging/rpm/RPMS
 161     expire_in: 3 days
 162   needs:
 163     - 'Source Package'
 164
 165 .test-rpm:
 166   extends: .test-linux
 167   rules: !reference [.if-2x-daily-schedule]
 168
 169 .build-windows:
 170   stage: build
 171   retry: 1
 172   before_script:
 173     - if (-Not (Test-Path C:\Development)) { New-Item -Path C:\Development -ItemType "directory" }
 174     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 175     - $env:Configuration = "RelWithDebInfo"
 176     - $env:Path += ";C:\Program Files\CMake\bin"
 177     - $env:CMAKE_PREFIX_PATH = "C:\qt\6.5.3\msvc2019_64"
 178     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 179     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set > %temp%\vcvars.txt"
 180     - Get-Content "$env:temp\vcvars.txt" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 181     # Testing / debugging only.
 182     # - cmd.exe /c "set CI_PIPELINE_SOURCE"
 183     # - cmd.exe /c "set CI_PROJECT_URL"
 184     #- dir c:\
 185     #- dir c:\qt
 186     #- $env:path.split(";")
 187     #- cmd.exe /c "set"
 188     #- Get-Location
 189     - mkdir build
 190     - cd build
 191   needs: []
 192
 193 # macOS runners are still beta:
 194 # https://about.gitlab.com/blog/2021/08/23/build-cloud-for-macos-beta/
 195 # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html#vm-images
 196 # https://gitlab.com/gitlab-org/ci-cd/shared-runners/images/macstadium/orka/-/blob/main/toolchain/monterey.yml
 197 .build-macos:
 198   stage: build
 199   tags: [ saas-macos-medium-m1 ] # https://docs.gitlab.com/ee/ci/runners/saas/macos/environment.html
 200   retry: 1
 201   # https://gould.cx/ted/blog/2017/06/10/ccache-for-Gitlab-CI/
 202   cache:
 203     key: ${CI_JOB_NAME}-master
 204     paths:
 205       - ccache/
 206   variables:
 207     HOMEBREW_NO_AUTO_UPDATE: "1"
 208     HOMEBREW_DISPLAY_INSTALL_TIMES: "1"
 209     HOMEBREW_NO_INSTALL_CLEANUP: "1"
 210     HOMEBREW_NO_INSTALL_UPGRADE: "1"
 211     HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: "1"
 212     HOMEBREW_NO_UPDATE_REPORT_NEW: "1"
 213   before_script:
 214     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 215     - env | grep ^CI | sort
 216     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 217     - export PATH=$PATH:$HOME/.python-env/bin
 218     - brew --version
 219     - printf "\e[0Ksection_start:%s:brew_section[collapsed=true]\r\e[0KInstalling prerequisites" "$( date +%s)"
 220     - ./tools/macos-setup-brew.sh --install-optional --install-test-deps
 221     - printf "\e[0Ksection_end:%s:brew_section\r\e[0K" "$( date +%s)"
 222     # Homebrew implemented PEP 668, so install Python packages using venv for now.
 223     - python3 -m venv $HOME/.python-env
 224     - $HOME/.python-env/bin/pip3 install pytest pytest-xdist
 225     - export PYTEST_ADDOPTS=--skip-missing-programs=dumpcap,rawshark
 226     - mkdir -p ccache
 227     - ccache --show-stats
 228     - mkdir build
 229     - cd build
 230   script:
 231     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 232     - cmake -G Ninja -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 233     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 234     - ninja
 235     - ninja test-programs
 236     - pytest
 237   after_script:
 238     # The cache should be large enough to be useful but it shouldn't take
 239     # too long to restore+save each run.
 240     - ccache --max-size $( gdu --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 241   needs: []
 242
 243 .build-mingw:
 244   stage: build
 245   image: registry.gitlab.com/wireshark/wireshark-containers/mingw-dev
 246   tags:
 247     - saas-linux-small-amd64
 248   cache:
 249     # XXX Use ${CI_JOB_NAME}-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} instead?
 250     key: ${CI_JOB_NAME}-master
 251     paths:
 252       - ccache/
 253   before_script:
 254     - printf "\e[0Ksection_start:%s:ci_env_section[collapsed=true]\r\e[0KCI environment variables" "$(date +%s)"
 255     - env | grep ^CI | sort
 256     - printf "\e[0Ksection_end:%s:ci_env_section\r\e[0K" "$(date +%s)"
 257     - mkdir -p ccache
 258     - ccache --show-stats
 259     - mkdir build
 260     - cd build
 261   script:
 262     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 263     - ninja
 264   after_script:
 265     # The cache should be large enough to be useful but it shouldn't take
 266     # too long to restore+save each run.
 267     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 268   needs: []
 269
 270 Source Package:
 271   extends: .build-ubuntu
 272   stage: .pre
 273   rules:
 274     - !reference [.if-w-w-only-merged]
 275     - !reference [.if-2x-daily-schedule]
 276   script:
 277     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 278     - ../tools/update-appdata.py
 279     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 280     - cmake -G Ninja $CMAKE_ARGS ..
 281     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 282     - cd $CI_PROJECT_DIR
 283     - build/packaging/source/git-export-release.sh -d .
 284     - cd build
 285     - ninja release_notes
 286     - WIRESHARK_VERSION=$(< wireshark_version.txt)
 287     - cp -v doc/release-notes.html ../release-notes-${WIRESHARK_VERSION}.html
 288     - cp -v doc/release-notes.txt ../release-notes-${WIRESHARK_VERSION}.txt
 289   after_script:
 290     # - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
 291     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 292     - if [ -n "$SCHEDULE_TYPE" ] ; then exit 0 ; fi
 293     - stat --format="%n %s bytes" wireshark-*.tar.*
 294     - for digest in sha512 sha256 sha1 ; do openssl $digest wireshark-*.tar.* ; done
 295     # This will break if we produce multiple tarballs, which is arguably a good thing.
 296     - if [ -n "$S3_DESTINATION_DIST" ] ; then aws s3 cp wireshark-*.tar.* "$S3_DESTINATION_DIST/" ; fi
 297     - |
 298       if [ -n "$S3_DESTINATION_RELEASE" ] ; then
 299         aws s3 cp release-notes-*.txt "$S3_DESTINATION_RELEASE/"
 300         aws s3 cp release-notes-*.html "$S3_DESTINATION_RELEASE/"
 301       fi
 302   artifacts:
 303     paths:
 304       - wireshark-*.tar.*
 305       - release-notes-*.html
 306       - release-notes-*.txt
 307
 308 # Job to generate packages for Debian stable
 309 Debian Stable APT Package:
 310   extends: .build-linux
 311   rules: !reference [.if-2x-daily-schedule]
 312   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 313   script:
 314     - ln --symbolic --no-dereference --force packaging/debian
 315     - tools/make-version.py --set-release .
 316     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 317     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 318     - export DEB_BUILD_OPTIONS="nocheck parallel=$(( $(getconf _NPROCESSORS_ONLN) + 2 ))"
 319     - export DH_QUIET=1
 320     - export MAKEFLAGS=--silent
 321     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ dpkg-buildpackage -b --no-sign -jauto -zfast
 322     # Please don't add a Lintian step unless you can guarantee that someone
 323     # will fix any breakages that invariably pop up.
 324     - mkdir debian-packages
 325     - mv -v ../*.deb debian-packages/
 326   artifacts:
 327     paths:
 328       - debian-packages/*.deb
 329     expire_in: 3 days
 330
 331 Debian Stable APT Test:
 332   extends: .test-linux
 333   rules: !reference [.if-2x-daily-schedule]
 334   image: registry.gitlab.com/wireshark/wireshark-containers/debian-stable-dev
 335   stage: test
 336   script:
 337     - DEBIAN_FRONTEND=noninteractive apt-get install ./debian-packages/*.deb -y
 338     - tshark --version
 339   variables:
 340     GIT_STRATEGY: none
 341   needs: [ 'Debian Stable APT Package' ]
 342
 343 Fedora RPM Package:
 344   extends: .build-rpm
 345   image: registry.gitlab.com/wireshark/wireshark-containers/fedora-dev
 346   script:
 347     # Shared GitLab runners limit the log size to 4M, so reduce verbosity. See
 348     # https://gitlab.com/gitlab-com/support-forum/issues/2790
 349     - export FORCE_CMAKE_NINJA_NON_VERBOSE=1
 350     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 351     - cmake3 -G Ninja ..
 352     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 353     - ninja wireshark_rpm
 354
 355 # Fedora RPM Test:
 356 #   extends: .test-rpm
 357 #   image: fedora
 358 #   script:
 359 #     - dnf install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 360 #     - tshark --version
 361 #  needs: [ 'Fedora RPM Package' ]
 362
 363 openSUSE 15.5 RPM Package:
 364   extends: .build-rpm
 365   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.5-dev
 366   script:
 367     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 368     - cmake -G Ninja -DUSE_qt6=OFF ..
 369     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 370     - ninja wireshark_rpm
 371
 372 openSUSE 15.5 RPM Test:
 373   extends: .test-rpm
 374   image: registry.gitlab.com/wireshark/wireshark-containers/opensuse-15.5-dev
 375   script:
 376     - zypper --no-gpg-checks --no-remote install -y build/packaging/rpm/RPMS/x86_64/*.rpm
 377     - tshark --version
 378   needs: [ 'openSUSE 15.5 RPM Package' ]
 379
 380 Rocky Linux 9 RPM Package:
 381   extends: .build-rpm
 382   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 383   script:
 384     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 385     - cmake -G Ninja -DUSE_qt6=OFF ..
 386     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 387     - ninja wireshark_rpm
 388
 389 Rocky Linux 9 RPM Test:
 390   extends: .test-rpm
 391   image: registry.gitlab.com/wireshark/wireshark-containers/rockylinux-9-dev
 392   script:
 393     - dnf --nogpgcheck localinstall -y build/packaging/rpm/RPMS/x86_64/*.rpm
 394     - tshark --version
 395   needs: [ 'Rocky Linux 9 RPM Package' ]
 396
 397 Ubuntu APT Package:
 398   extends: .build-ubuntu
 399   rules: !reference [.if-2x-daily-schedule]
 400   script:
 401     # build-ubuntu puts us in `build`.
 402     - cd ..
 403     - ln --symbolic --no-dereference --force packaging/debian
 404     - CC=/usr/lib/ccache/gcc CXX=/usr/lib/ccache/g++ MAKE=ninja dpkg-buildpackage -us -uc -rfakeroot -jauto -zfast
 405     # Please don't add a Lintian step unless you can guarantee that someone
 406     # will fix any breakages that invariably pop up.
 407     - mkdir ubuntu-packages
 408     - mv ../*.deb ubuntu-packages/
 409   after_script:
 410     # dpkg-buildpackage builds in obj-<triplet>, so we need to override
 411     # .build-ubuntu. We also build more stuff, so decrease our multiplier.
 412     - ccache --max-size $( du --summarize --block-size=1M --total "$CI_PROJECT_DIR"/obj-* | awk '/total$/ {printf ("%dM", $1 * 1.25)}' )
 413   artifacts:
 414     paths:
 415       - ubuntu-packages/*.deb
 416     expire_in: 3 days
 417
 418 Ubuntu APT Test:
 419   extends: .test-linux
 420   rules: !reference [.if-2x-daily-schedule]
 421   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 422   stage: test
 423   script:
 424     - DEBIAN_FRONTEND=noninteractive apt-get install ./ubuntu-packages/*.deb -y
 425     - tshark --version
 426   variables:
 427     GIT_STRATEGY: none
 428   needs: [ 'Ubuntu APT Package' ]
 429
 430 Windows x64 Package:
 431   extends: .build-windows
 432   rules: !reference [.if-w-w-only-merged]
 433   tags:
 434     - wireshark-windows-x64-package
 435   before_script:
 436     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 437     - $env:Configuration = "RelWithDebInfo"
 438     - $env:CMAKE_PREFIX_PATH = "C:\Qt\6.5.3\msvc2019_64"
 439     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 440     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvars64.bat`" && set > %temp%\vcvars.txt"
 441     - Get-Content "$env:temp\vcvars.txt" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 442     - mkdir build
 443     - cd build
 444   script:
 445     - C:\Windows\py.exe ..\tools\make-version.py --set-release --version-file=wireshark_version.txt ..
 446     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off -DENABLE_SIGNED_NSIS=on ..
 447     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 448     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 449     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 450     - msbuild /verbosity:minimal /maxcpucount wireshark_wix_prep.vcxproj
 451     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 452     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 453     # No need for explicit signing of NSIS installer here. The signing is done by makensis.
 454     - msbuild /verbosity:minimal wireshark_wix.vcxproj
 455     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\wix\Wireshark-*.msi
 456     - msbuild /verbosity:minimal wireshark_portableapps.vcxproj
 457     - C:\gitlab-builds\bin\sign-files.ps1 -Path packaging\portableapps\WiresharkPortable*.exe
 458     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-x64.exe packaging\wix\Wireshark-*-x64.msi packaging\portableapps\WiresharkPortable??_*.paf.exe
 459     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 460     - C:\gitlab-builds\bin\mse-scan.ps1
 461     - run\RelWithDebInfo\tshark --version
 462     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-x64.exe", "packaging\wix\Wireshark-*-x64.msi", "packaging\portableapps\WiresharkPortable??_*.paf.exe", "Wireshark-pdb-*x64.zip"
 463     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 464     - if (Test-Path env:MC_DESTINATION_WINDOWS_X64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_X64/" }
 465     - $nsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-x64.exe).Hash
 466     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 467     - Set-Content -Path release-info-$($wiresharkVersion)-windows-x64.ini -Value ("[DEFAULT]`nnsis_sha256 = $nsisSha256")
 468     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp release-info-$($wiresharkVersion)-windows-x64.ini "$env:MC_DESTINATION_RELEASE/" }
 469     - C:\Windows\py.exe -m pytest
 470   artifacts:
 471     paths:
 472       - build/release-info-*.ini
 473
 474 Windows Arm64 Package:
 475   extends: .build-windows
 476   rules: !reference [.if-w-w-only-merged]
 477   tags:
 478     - wireshark-windows-arm64-package
 479   before_script:
 480     - $env:WIRESHARK_BASE_DIR = "C:\Development"
 481     - $env:Configuration = "RelWithDebInfo"
 482     - $env:CMAKE_PREFIX_PATH = "C:\Qt\6.5.3\msvc2019_arm64"
 483     # https://help.appveyor.com/discussions/questions/18777-how-to-use-vcvars64bat-from-powershell
 484     - cmd.exe /c "call `"C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsarm64.bat`" && set > %temp%\vcvars.txt"
 485     - Get-Content "$env:temp\vcvars.txt" | Foreach-Object { if ($_ -match "^(.*?)=(.*)$") { Set-Content "env:\$($matches[1])" $matches[2] } }
 486     - mkdir build
 487     - cd build
 488   script:
 489     - C:\Windows\py.exe ..\tools\make-version.py --set-release --version-file=wireshark_version.txt ..
 490     - cmake -G "Visual Studio 17 2022" -A arm64 -DENABLE_LTO=off -DENABLE_SIGNED_NSIS=on ..
 491     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount Wireshark.sln
 492     - msbuild /verbosity:minimal /maxcpucount test-programs.vcxproj
 493     - msbuild /verbosity:minimal /maxcpucount wireshark_nsis_prep.vcxproj
 494     - C:\gitlab-builds\bin\sign-files.ps1 -Recurse -Path run\RelWithDebInfo
 495     - msbuild /verbosity:minimal wireshark_nsis.vcxproj
 496     - $plugins = Get-ChildItem run\RelWithDebInfo\plugins\*\*.dll ; signtool verify /q /pa /all run\RelWithDebInfo\*.exe run\RelWithDebInfo\extcap\wireshark\*.exe $plugins run\RelWithDebInfo\libwireshark.dll run\RelWithDebInfo\libwiretap.dll run\RelWithDebInfo\libwsutil.dll packaging\nsis\Wireshark-*-arm64.exe
 497     - msbuild /verbosity:minimal pdb_zip_package.vcxproj
 498     - C:\gitlab-builds\bin\mse-scan.ps1
 499     - run\RelWithDebInfo\tshark --version
 500     - $packages = Get-ChildItem "packaging\nsis\Wireshark-*-arm64.exe", "Wireshark-pdb-*arm64.zip"
 501     - foreach ($package in $packages) { Write-Host $package.name $(Get-Filehash -Algorithm SHA256 $package).Hash $package.length "bytes" }
 502     - if (Test-Path env:MC_DESTINATION_WINDOWS_ARM64) { C:\gitlab-builds\bin\mc --quiet cp $packages "$env:MC_DESTINATION_WINDOWS_ARM64/" }
 503     - $nsisSha256 = (Get-FileHash -Algorithm SHA256 .\packaging\nsis\Wireshark-*-arm64.exe).Hash
 504     - $wiresharkVersion = Get-Content .\wireshark_version.txt
 505     - Set-Content -Path release-info-$($wiresharkVersion)-windows-arm64.ini -Value ("[DEFAULT]`nnsis_sha256 = $nsisSha256")
 506     - if (Test-Path env:MC_DESTINATION_RELEASE) { C:\gitlab-builds\bin\mc --quiet cp release-info-$($wiresharkVersion)-windows-arm64.ini "$env:MC_DESTINATION_RELEASE/" }
 507     - C:\Windows\py.exe -m pytest
 508   artifacts:
 509     paths:
 510       - build/release-info-*.ini
 511
 512 Windows MinGW-w64 Package:
 513   extends: .build-mingw
 514   rules: !reference [.if-w-w-only-merged]
 515   script:
 516     - mingw64-cmake -G Ninja -DENABLE_CCACHE=Yes -DFETCH_lua=Yes ..
 517     - ninja
 518     - ninja user_guide_html
 519     - ninja wireshark_nsis_prep
 520     - ninja wireshark_nsis
 521   artifacts:
 522     paths:
 523       - build/packaging/nsis/wireshark-*.exe
 524     expire_in: 3 days
 525
 526 macOS Arm Package:
 527   stage: build
 528   rules: !reference [.if-w-w-only-merged]
 529   variables:
 530     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 531   tags:
 532     - wireshark-macos-arm-package
 533   retry: 1
 534   script:
 535     - export CMAKE_PREFIX_PATH=/usr/local/Qt-6.5.3
 536     - export PATH="$PATH:$HOME/bin"
 537     - mkdir build
 538     - cd build
 539     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 540     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 541     - cmake -DENABLE_CCACHE=ON -DCMAKE_APPLE_SILICON_PROCESSOR=arm64 -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DCMAKE_OSX_ARCHITECTURES=arm64 -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 542     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 543     - ninja
 544     - codesign-prep
 545     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 546     - ninja wireshark_dmg
 547     - cd run
 548     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 549     - xcrun stapler staple Wireshark?[1-9]*.dmg
 550     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg
 551     - stat -f "%N %z bytes" Wireshark*.dmg
 552     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg ; done
 553     - |
 554       if [ -n "$S3_DESTINATION_MACOS_ARM64" ] ; then
 555         aws s3 cp Wireshark?[1-9]*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 556         aws s3 cp Wireshark?dSYM*Arm*.dmg "$S3_DESTINATION_MACOS_ARM64/"
 557       fi
 558     - SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 559     - $CI_PROJECT_DIR/build/run/tshark --version
 560     - DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 561     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 562     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$SPARKLE_SIGNATURE" "$DMG_SHA256" > release-info-${WIRESHARK_VERSION}-macos-arm64.ini
 563     - if [[ -n "$S3_DESTINATION_RELEASE" ]] ; then aws s3 cp release-info-${WIRESHARK_VERSION}-macos-arm64.ini "$S3_DESTINATION_RELEASE/" ; fi
 564     - cd ..
 565     - ninja test-programs
 566     - python3 -m pytest
 567   artifacts:
 568     paths:
 569       - build/run/release-info-*.ini
 570   needs: []
 571
 572 macOS Intel Package:
 573   stage: build
 574   rules: !reference [.if-w-w-only-merged]
 575   variables:
 576     CODE_SIGN_IDENTITY: "Wireshark Foundation"
 577   tags:
 578     - wireshark-macos-intel-package
 579   retry: 1
 580   script:
 581     - export CMAKE_PREFIX_PATH=/usr/local/Qt-6.5.3
 582     - export PATH="$PATH:$HOME/bin"
 583     - mkdir build
 584     - cd build
 585     - ../tools/make-version.py --set-release --version-file=wireshark_version.txt ..
 586     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 587     - cmake -DENABLE_CCACHE=ON -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DTEST_EXTRA_ARGS=--enable-release -G Ninja ..
 588     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 589     - ninja
 590     - codesign-prep
 591     - security find-identity -v -s "$CODE_SIGN_IDENTITY"
 592     - ninja wireshark_dmg
 593     - cd run
 594     - xcrun notarytool submit Wireshark?[1-9]*.dmg --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD" --wait --timeout 10m
 595     - xcrun stapler staple Wireshark?[1-9]*.dmg
 596     - spctl --assess --type open --context context:primary-signature --verbose=2 Wireshark?[1-9]*.dmg
 597     - stat -f "%N %z bytes" Wireshark*.dmg
 598     - for digest in sha512 sha256 sha1 ; do openssl $digest Wireshark*.dmg ; done
 599     - |
 600       if [ -n "$S3_DESTINATION_MACOS_INTEL64" ] ; then
 601         aws s3 cp Wireshark?[1-9]*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 602         aws s3 cp Wireshark?dSYM*Intel*.dmg "$S3_DESTINATION_MACOS_INTEL64/"
 603       fi
 604     - SPARKLE_SIGNATURE=$( age --decrypt --identity="$MACOS_AGE_IDENTITY" "$MACOS_SPARKLE_BLOB" | /usr/local/Sparkle-2.2.2/bin/sign_update --ed-key-file - Wireshark?[1-9]*.dmg )
 605     - $CI_PROJECT_DIR/build/run/tshark --version
 606     - DMG_SHA256=$( shasum --algorithm 256 Wireshark?[1-9]*.dmg | awk '{print $1}' )
 607     - WIRESHARK_VERSION=$(< ../wireshark_version.txt)
 608     - printf '[DEFAULT]\nsparkle_signature = %s\ndmg_sha256 = %s\n' "$SPARKLE_SIGNATURE" "$DMG_SHA256" > release-info-${WIRESHARK_VERSION}-macos-intel64.ini
 609     - if [[ -n "$S3_DESTINATION_RELEASE" ]] ; then aws s3 cp release-info-${WIRESHARK_VERSION}-macos-intel64.ini "$S3_DESTINATION_RELEASE/" ; fi
 610     - cd ..
 611     - ninja test-programs
 612     - python3 -m pytest
 613   artifacts:
 614     paths:
 615       - build/run/release-info-*.ini
 616   needs: []
 617
 618 # Build the User's Guide and Developer's Guide
 619 Documentation:
 620   extends: .build-linux
 621   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 622   rules:
 623     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
 624       changes:
 625         - "docbook/**/*"
 626         - "epan/wslua/**/*"
 627     - if: '$CI_PIPELINE_SOURCE == "push"'
 628       when: manual
 629       allow_failure: true
 630   script:
 631     # XXX We might want to move this to wireshark-ubuntu-dev or debian-setup.sh.
 632     - DEBIAN_FRONTEND=noninteractive apt-get update
 633     - DEBIAN_FRONTEND=noninteractive apt-get --yes install ruby-asciidoctor-pdf ruby-coderay ruby-dev
 634     - NOKOGIRI_USE_SYSTEM_LIBRARIES=1 gem install asciidoctor-epub3
 635     - mkdir build
 636     - cd build
 637     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 638     - cmake -GNinja ..
 639     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 640     - ninja all_guides
 641     - cd docbook
 642     - for HTML_DIR in ws[ud]g_html{,_chunked} ; do zip -9 -r "$HTML_DIR.zip" "$HTML_DIR" ; done
 643     - |
 644       if [ -n "$S3_DESTINATION_DOCS" ] ; then
 645         for DOC_FILE in ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} ; do
 646           aws s3 cp "$DOC_FILE" "$S3_DESTINATION_DOCS/"
 647         done
 648       fi
 649     - mv -v ws[ud]g_html{,_chunked}.zip Wireshark*Guide.{epub,pdf} ../..
 650   after_script:
 651     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
 652   artifacts:
 653     paths:
 654       - wsug_html.zip
 655       - wsug_html_chunked.zip
 656       - wsdg_html.zip
 657       - wsdg_html_chunked.zip
 658       - "Wireshark User's Guide.pdf"
 659       - "Wireshark Developer's Guide.pdf"
 660       - "Wireshark User's Guide.epub"
 661       - "Wireshark Developer's Guide.epub"
 662   needs: []
 663
 664
 665 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#linux-shared-runners
 666
 667 Commit Check:
 668   extends: .build-ubuntu
 669   rules: !reference [.if-merge-request]
 670   variables:
 671     GITLAB_REPO: "$CI_MERGE_REQUEST_PROJECT_URL"
 672   script:
 673     # glab depends on a valid GITALB_TOKEN variable. It will fail when run under outside projects.
 674     - if ! command -V glab 2> /dev/null ; then (cd /tmp ; curl -JLO https://gitlab.com/gitlab-org/cli/-/releases/v1.34.0/downloads/glab_1.34.0_Linux_x86_64.deb ; dpkg --install /tmp/glab_1.34.0_Linux_x86_64.deb ) ; fi
 675     - glab auth status
 676     - >
 677       if [[ $NUM_COMMITS > 1 ]] ; then
 678         MESSAGE="ℹ️ This merge request has more than one commit. Please squash any trivial ones:
 679         ~~~
 680         $(git log --oneline --no-decorate "${CI_COMMIT_SHA}~$NUM_COMMITS..${CI_COMMIT_SHA}")
 681         ~~~
 682         "
 683         glab mr note $CI_MERGE_REQUEST_IID --unique --message "$MESSAGE" || echo "$MESSAGE"
 684       fi
 685     # build-ubuntu puts us in `build`.
 686     - cd ..
 687     - git status
 688     - PC_EXIT_CODE=0
 689     - ANALYSIS_MESSAGE=$( ./tools/pre-commit "${CI_COMMIT_SHA}~$NUM_COMMITS" ) || PC_EXIT_CODE=1
 690     - >
 691       if [ -n "$ANALYSIS_MESSAGE" ] ; then
 692         MESSAGE="Pre-commit check results:
 693         ~~~
 694         $ANALYSIS_MESSAGE
 695         ~~~
 696         "
 697         glab mr note $CI_MERGE_REQUEST_IID --unique --message "$MESSAGE" || echo "$MESSAGE"
 698       fi
 699     - VC_EXIT_CODE=0
 700     - ANALYSIS_MESSAGE=$( tools/validate-commit.py ) || VC_EXIT_CODE=1
 701     - >
 702       if [[ $VC_EXIT_CODE != 0 ]] ; then
 703         MESSAGE="Commit validation failure:
 704         ~~~
 705         $ANALYSIS_MESSAGE
 706         ~~~
 707         "
 708         glab mr note $CI_MERGE_REQUEST_IID --unique --message "$MESSAGE" || echo "$MESSAGE"
 709       fi
 710     - LC_EXIT_CODE=0
 711     - ANALYSIS_MESSAGE=$( python3 tools/checklicenses.py ) || LC_EXIT_CODE=1
 712     - >
 713       if [[ $LC_EXIT_CODE != 0 ]] ; then
 714         MESSAGE="License check failure:
 715         ~~~
 716         $ANALYSIS_MESSAGE
 717         ~~~
 718         "
 719         glab mr note $CI_MERGE_REQUEST_IID --unique --message "$MESSAGE" || echo "$MESSAGE"
 720       fi
 721     - HC_EXIT_CODE=0
 722     - ANALYSIS_MESSAGE=$( python3 tools/check_help_urls.py ) || HC_EXIT_CODE=1
 723     - >
 724       if [[ $HC_EXIT_CODE != 0 ]] ; then
 725         MESSAGE="Help URL check failure:
 726         ~~~
 727         $ANALYSIS_MESSAGE
 728         ~~~
 729         "
 730         glab mr note $CI_MERGE_REQUEST_IID --unique --message "$MESSAGE" || echo "$MESSAGE"
 731       fi
 732     - exit $(( PC_EXIT_CODE || VC_EXIT_CODE || LC_EXIT_CODE || HC_EXIT_CODE ))
 733
 734 Ubuntu GCC Build:
 735   extends: .build-ubuntu
 736   rules: !reference [.if-merge-request]
 737   variables:
 738     CC: "gcc"
 739     CXX: "g++"
 740   needs: [ 'Commit Check' ]
 741   script:
 742     # build-ubuntu puts us in `build`.
 743     - cd ..
 744     - mv build "🦈 build 🦈"
 745     - cd "🦈 build 🦈"
 746     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 747     # Test release build.
 748     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=on ..
 749     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 750     - script --command ninja --flush --quiet --return ../gcc_report.txt
 751     - ansi2html < ../gcc_report.txt > ../gcc_report.html
 752     - ninja test-programs
 753     - chown -R user .
 754     - if [ -f run/dumpcap ]; then setcap cap_net_raw,cap_net_admin+eip run/dumpcap; fi
 755     - if [ -f run/dumpcap ]; then su user -c "run/dumpcap -D" ; fi
 756     - su user -c pytest-3
 757     # Test CMake install code and CPack config code. Select any one of the archive generators.
 758     - ninja user_guide_html
 759     - ninja developer_guide_html
 760     - cpack -G TZST .
 761     - ls wireshark-*.tar.zst{,.sha256}
 762   artifacts:
 763     paths:
 764       - gcc_report.html
 765
 766 Fedora MinGW Build:
 767   extends: .build-mingw
 768   rules: !reference [.if-merge-request]
 769   needs: [ 'Commit Check' ]
 770
 771 Clang + Code Checks:
 772   extends: .build-ubuntu
 773   tags:
 774     - saas-linux-medium-amd64
 775   rules: !reference [.if-merge-request]
 776   needs: [ 'Commit Check' ]
 777   script:
 778     - source /clang-latest.env
 779     # build-ubuntu puts us in `build`.
 780     - cd ..
 781     - mkdir cppcheck
 782     - ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS | tee cppcheck/cppcheck_report.txt
 783     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then ./tools/cppcheck/cppcheck.sh -l $NUM_COMMITS -x > cppcheck/cppcheck_report.xml ; fi
 784     - if [[ -s "cppcheck/cppcheck_report.txt" ]]; then cppcheck-htmlreport --file cppcheck/cppcheck_report.xml  --report-dir cppcheck ; fi
 785     - cd build
 786     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 787     # We don't have an "All options" job, so build fuzzshark and tfshark here.
 788     - cmake -DENABLE_CHECKHF_CONFLICT=on -DCMAKE_EXPORT_COMPILE_COMMANDS=on -DCMAKE_C_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DCMAKE_CXX_CLANG_TIDY=clang-tidy-$CLANG_VERSION -DBUILD_fuzzshark=ON -DBUILD_tfshark=On -DBUILD_logray=ON -DENABLE_DEBUG=ON -DENABLE_CCACHE=ON -DENABLE_WERROR=ON -G Ninja ..
 789     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 790     - printf "\e[0Ksection_start:%s:asn1_section[collapsed=true]\r\e[0KRegenerating ASN.1 dissectors" "$( date +%s)"
 791     - ninja asn1
 792     - git diff --exit-code ${CI_COMMIT_SHA} ..
 793     - printf "\e[0Ksection_end:%s:asn1_section\r\e[0K" "$( date +%s)"
 794     - printf "\e[0Ksection_start:%s:pidl_section[collapsed=true]\r\e[0KRegenerating PIDL dissectors" "$( date +%s)"
 795     - ninja pidl-dissectors
 796     - git diff --exit-code ${CI_COMMIT_SHA} ..
 797     - printf "\e[0Ksection_end:%s:pidl_section\r\e[0K" "$( date +%s)"
 798     - mkdir ../html
 799     - script --command ninja --flush --quiet --return ../tmp_clang_report.txt
 800     - ansi2txt < ../tmp_clang_report.txt > ../clang_report.txt
 801     - ansi2html < ../tmp_clang_report.txt > ../html/clang_report.html
 802     - ./run/tshark -v 2> >(tee ../checkhf_conflict.txt)
 803     - ../tools/validate-clang-check.sh -c $CLANG_VERSION 2> >(tee ../tmp_clang_analyzer_check.txt)
 804     - ansi2txt < ../tmp_clang_analyzer_check.txt > ../clang_analyzer_check.txt
 805     - ansi2html < ../tmp_clang_analyzer_check.txt > ../html/clang_analyzer_check.html
 806     - ninja checkAPI
 807     - ninja shellcheck
 808     - cd ..
 809     - ./tools/check_typed_item_calls.py --consecutive --label --mask --check-bitmask-fields --commits $NUM_COMMITS | tee item_calls_check.txt
 810     - ./tools/check_tfs.py --check-value-strings --commits $NUM_COMMITS | tee tfs_check.txt
 811     - ./tools/check_val_to_str.py --commits $NUM_COMMITS | tee val_to_str_check.txt
 812   artifacts:
 813     paths:
 814       - clang_report.txt
 815       - clang_analyzer_check.txt
 816       - cppcheck
 817       - item_calls_check.txt
 818       - tfs_check.txt
 819       - val_to_str_check.txt
 820       - checkhf_conflict.txt
 821       - html/
 822
 823 No options:
 824   extends: .build-ubuntu
 825   rules: !reference [.if-merge-request]
 826   needs: [ 'Commit Check' ]
 827   script: |
 828     cmake -GNinja -DENABLE_CCACHE=ON \
 829       -DENABLE_BROTLI=OFF -DENABLE_CAP=OFF -DENABLE_CHECKHF_CONFLICT=ON -DENABLE_GNUTLS=OFF \
 830       -DENABLE_KERBEROS=OFF -DENABLE_LIBXML2=OFF -DENABLE_ILBC=OFF -DENABLE_LUA=OFF -DENABLE_LZ4=OFF \
 831       -DENABLE_MINIZIP=OFF -DENABLE_NETLINK=OFF -DENABLE_NGHTTP2=OFF -DENABLE_NGHTTP3=OFF \
 832       -DENABLE_BCG729=OFF -DENABLE_OPUS=OFF -DENABLE_PCAP=OFF -DENABLE_PLUGIN_IFDEMO=ON \
 833       -DENABLE_PLUGINS=OFF -DENABLE_SBC=OFF -DENABLE_SMI=OFF -DENABLE_SNAPPY=OFF -DENABLE_SPANDSP=OFF \
 834       -DENABLE_ZLIB=OFF -DENABLE_ZSTD=OFF -DBUILD_mmdbresolve=OFF ..
 835     ninja
 836
 837 # Windows runners are still beta, at least technically:
 838 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
 839 Windows Build:
 840   extends: .build-windows
 841   rules: !reference [.if-w-w-only-merge-request]
 842   tags:
 843     - wireshark-windows-merge-req
 844   needs: [ 'Commit Check' ]
 845   script:
 846     - cmake -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
 847     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug Wireshark.sln
 848     - msbuild /verbosity:minimal /maxcpucount /property:Configuration=Debug test-programs.vcxproj
 849     - C:\Windows\py.exe -m pytest --disable-gui --build-type=Debug
 850
 851
 852 Windows Qt5 Build:
 853   extends: .build-windows
 854   rules:
 855     - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
 856       changes:
 857         - "ui/**/*"
 858     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 859       when: manual
 860       allow_failure: true
 861   tags:
 862     - wireshark-windows-merge-req
 863   needs: [ 'Commit Check' ]
 864   script:
 865     - $env:CMAKE_PREFIX_PATH = "C:\qt\5.15.2\msvc2019_64"
 866     - cmake -G "Visual Studio 17 2022" -A x64 -DUSE_qt6=OFF -DENABLE_LTO=off ..
 867     - msbuild /verbosity:minimal /maxcpucount ui\qt\qtui.vcxproj
 868
 869 macOS Build:
 870   extends: .build-macos
 871   rules: !reference [.if-w-w-only-merge-request]
 872   script:
 873     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
 874     - cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_CCACHE=ON -DTEST_EXTRA_ARGS=--disable-capture ..
 875     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
 876     - ninja
 877     - ninja test-programs
 878     - pytest
 879   needs: [ 'Commit Check' ]
 880
 881 # Adapted from https://www.synopsys.com/blogs/software-security/integrating-coverity-scan-with-gitlab-ci/
 882 # and https://gitlab.gnome.org/GNOME/glib/-/blob/8f57a5b9/.gitlab-ci.yml#L481
 883 Coverity GCC Scan:
 884   image: registry.gitlab.com/wireshark/wireshark-containers/ubuntu-dev
 885   rules:
 886     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
 887   stage: analysis
 888   needs: []
 889   variables:
 890     CC: gcc
 891     CXX: g++
 892     # cov-build doesn’t handle GLIB_DEPRECATED_ENUMERATOR
 893     CFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 894     CXXFLAGS: '-DGLIB_DISABLE_DEPRECATION_WARNINGS'
 895   script:
 896     - curl --output /tmp/cov-analysis-linux64.tar.gz --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/linux64
 897     - tar --directory=/tmp --extract --gzip --file /tmp/cov-analysis-linux64.tar.gz
 898     - mkdir build
 899     - cd build
 900     - cmake -G Ninja ..
 901     - /tmp/cov-analysis-linux64-*/bin/cov-build --return-emit-failures --dir ../cov-int ninja
 902     - cd ..
 903     - tar --create --gzip --file cov-int.tar.gz cov-int
 904     - echo "export ARTIFACT_JOB_URL=$CI_JOB_URL" > job_environment_variables.sh
 905     - echo "export GIT_DESCRIPTION=$( git describe --tags )" >> job_environment_variables.sh
 906   artifacts:
 907     paths:
 908       - cov-int.tar.gz
 909       - job_environment_variables.sh
 910
 911 Coverity GCC Submit:
 912   image: curlimages/curl
 913   rules:
 914     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-gcc"'
 915   stage: .post
 916   script:
 917     - . job_environment_variables.sh
 918     - echo $ARTIFACT_JOB_URL
 919     - echo $GIT_DESCRIPTION
 920     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.tar.gz&version=$GIT_DESCRIPTION&description=Ubuntu $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
 921   needs: [ 'Coverity GCC Scan' ]
 922
 923 Coverity Visual C++ Scan:
 924   extends: .build-windows
 925   rules:
 926     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
 927   tags:
 928     - wireshark-windows-merge-req
 929   stage: analysis
 930   needs: []
 931   script:
 932     - $gitDescription = (( git describe --tags ) | Out-String).Trim()
 933     - C:\Windows\System32\curl --output $env:temp\cov-analysis-win64.zip --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN https://scan.coverity.com/download/win64
 934     - C:\ProgramData\chocolatey\tools\7z x "$env:temp\cov-analysis-win64.zip" -y -r -o"$env:temp"
 935     - cmake -DTEST_EXTRA_ARGS=--enable-release -DENABLE_LTO=off -G "Visual Studio 17 2022" -A x64 ..
 936     - $covAnalysisWin64 = (Get-ChildItem -Path $env:temp -Filter "cov-analysis-win64-*" -Directory)[0].FullName
 937     - Invoke-Expression "& $covAnalysisWin64\bin\cov-build.exe --return-emit-failures --dir ..\cov-int msbuild /verbosity:minimal `"/consoleloggerparameters:PerformanceSummary;NoSummary`" /maxcpucount:1 Wireshark.sln"
 938     - cd ..
 939     - C:\ProgramData\chocolatey\tools\7z a -tzip cov-int.zip cov-int
 940     - '"export ARTIFACT_JOB_URL=$env:CI_JOB_URL" | Out-File -Encoding ascii job_environment_variables.sh'
 941     - '"export GIT_DESCRIPTION=$gitDescription" | Out-File -Encoding ascii -Append job_environment_variables.sh'
 942   artifacts:
 943     paths:
 944       - cov-int.zip
 945       - job_environment_variables.sh
 946
 947 Coverity Visual C++ Submit:
 948   image: curlimages/curl
 949   rules:
 950     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "coverity-visual-c++"'
 951   stage: .post
 952   script:
 953     - sed -i -e 's/\r//' job_environment_variables.sh
 954     - . job_environment_variables.sh
 955     - echo $ARTIFACT_JOB_URL
 956     - echo $GIT_DESCRIPTION
 957     - curl --fail --data "project=$COVERITY_SCAN_PROJECT_NAME&token=$COVERITY_SCAN_TOKEN&email=$GITLAB_USER_EMAIL&url=$ARTIFACT_JOB_URL/artifacts/raw/cov-int.zip&version=$GIT_DESCRIPTION&description=Windows $GIT_DESCRIPTION $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID" https://scan.coverity.com/builds
 958   needs: [ 'Coverity Visual C++ Scan' ]
 959
 960 Clang Static Analyzer:
 961   extends: .build-ubuntu
 962   rules: !reference [.if-daily-schedule]
 963   stage: analysis
 964   needs: []
 965   script:
 966     - source /clang-latest.env
 967     - scan-build-${CLANG_VERSION} cmake -DCMAKE_BUILD_TYPE=Debug -DENABLE_WERROR=OFF -G Ninja ..
 968     - scan-build-${CLANG_VERSION} -o ../sbout ninja
 969     - cd ../sbout
 970     - RAW_DIR=$( find ../sbout -type d -name "20??-??-??-*" -printf "%P\n" | head )
 971     - SB_DIR="scan-build-$RAW_DIR"
 972     - mv "$RAW_DIR" "$SB_DIR"
 973     - if [ -d logs ] ; then mv logs $SB_DIR ; fi
 974     - chmod -R u=rwX,go=rX "$SB_DIR"
 975     - zip -9 -r "${SB_DIR}.zip" "$SB_DIR"
 976     - if [ -n "$S3_DESTINATION_ANALYSIS" ] ; then aws s3 cp "${SB_DIR}.zip" "$S3_DESTINATION_ANALYSIS/" ; fi
 977
 978 # Windows runners are still beta, at least technically:
 979 # https://docs.gitlab.com/ee/user/gitlab_com/index.html#windows-shared-runners-beta
 980 Visual Studio Code Analysis:
 981   extends: .build-windows
 982   tags:
 983     - wireshark-windows-dev
 984   rules:
 985     # The wireshark-windows-* tags are only available in wireshark/wireshark.
 986     - if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "daily" && $CI_PROJECT_URL =~ /.*gitlab.com\/wireshark\/wireshark/'
 987   script:
 988     - py -m venv sarif-tools.venv
 989     - sarif-tools.venv\Scripts\pip.exe install sarif-tools
 990     - msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi
 991     - $env:Path += ";C:\Program Files\Amazon\AWSCLIV2"
 992     - $env:caexcludepath = "C:\Qt;$env:INCLUDE"
 993     - cmake -DENABLE_CODE_ANALYSIS=ON -G "Visual Studio 17 2022" -A x64 -DENABLE_LTO=off ..
 994     - msbuild /verbosity:minimal "/consoleloggerparameters:PerformanceSummary;NoSummary" /maxcpucount:2 Wireshark.sln
 995     - $report = "visual-c++-analyze-" + (Get-Date -format "yyyy-MM-dd") + ".html"
 996     - sarif-tools.venv\Scripts\sarif html --output $report
 997     - |
 998       if (Test-Path env:S3_DESTINATION_ANALYSIS) {
 999         aws s3 cp "$report" "$env:S3_DESTINATION_ANALYSIS/"
1000       }
1001
1002 # Build all doxygen docs
1003 API Reference:
1004   extends: .build-ubuntu
1005   rules: !reference [.if-daily-schedule]
1006   script:
1007     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1008     - cmake -GNinja ..
1009     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1010     - ninja wsar_html_zip 2>&1 > doxygen_output.txt | tee doxygen_errors.txt
1011     - mv wsar_html.zip doxygen_{output,errors}.txt ..
1012     - cd ..
1013     - |
1014       if [ -n "$S3_DESTINATION_DOCS" ] ; then
1015         aws s3 cp wsar_html.zip "$S3_DESTINATION_DOCS/"
1016       fi
1017   after_script:
1018     - if [ "$CI_JOB_STATUS" != "success" ]; then exit 0 ; fi
1019   artifacts:
1020     paths:
1021     - doxygen_errors.txt
1022     - doxygen_output.txt
1023     - wsar_html.zip
1024   needs: []
1025
1026 Code Lines and Data:
1027   extends: .build-ubuntu
1028   rules: !reference [.if-daily-schedule]
1029   stage: analysis
1030   variables:
1031     CLOC_OUT: /tmp/cloc.txt
1032     SCC_OUT: /tmp/scc.txt
1033     SLOC_OUT: /tmp/sloccount.txt
1034     TOKEI_OUT: /tmp/tokei.txt
1035   script:
1036     - DEBIAN_FRONTEND=noninteractive apt-get update
1037     - DEBIAN_FRONTEND=noninteractive apt-get --yes install sloccount cloc curl unzip
1038     - pushd /tmp
1039     - curl -L -O https://github.com/boyter/scc/releases/download/v3.0.0/scc-3.0.0-x86_64-unknown-linux.zip
1040     - unzip scc-3.0.0-x86_64-unknown-linux.zip
1041     - curl -L -O https://github.com/XAMPPRocky/tokei/releases/download/v12.1.2/tokei-x86_64-unknown-linux-gnu.tar.gz
1042     - tar -xf tokei-x86_64-unknown-linux-gnu.tar.gz
1043     - popd
1044     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1045     - cmake -G Ninja ..
1046     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1047     - ninja
1048     - cd ..
1049     - echo -n "cloc version:\ "
1050     - cloc --version
1051     - cloc --quiet . | tee $CLOC_OUT
1052     - /tmp/scc --version
1053     - /tmp/scc --not-match 'qt/.*.ts' . | tee $SCC_OUT
1054     - echo -n "SLOCCount version:\ "
1055     - sloccount --version
1056     - sloccount . | awk "/^Computing results/ { results=1 } { if (results) print }" | tee $SLOC_OUT
1057     - /tmp/tokei --version
1058     - /tmp/tokei --exclude 'qt/*.ts' . | tee $TOKEI_OUT
1059     - |
1060       cat > manuf <<FIN
1061       # This file was generated by TShark $(git describe --tags | sed -e 's/^v//') with the
1062       # command \`tshark -G manuf\`. Its canonical location is
1063       #
1064       # https://www.wireshark.org/download/automated/data/manuf
1065       #
1066       # The first column contains the MAC address block (24, 28 or 36 bits wide,
1067       # per IEEE allocation sizes), the second column contains the shortened name
1068       # used by Wireshark for address name resolution and the third column contains the
1069       # full vendor name from the registry.
1070       #
1071       FIN
1072     - build/run/tshark -G manuf | sed -e 's,:00:00:00/24,,' >> manuf
1073     - |
1074       if [ -n "$S3_DESTINATION_ANALYSIS" ] ; then
1075         aws s3 cp "$CLOC_OUT" "$S3_DESTINATION_ANALYSIS/"
1076         aws s3 cp "$SCC_OUT" "$S3_DESTINATION_ANALYSIS/"
1077         aws s3 cp "$SLOC_OUT" "$S3_DESTINATION_ANALYSIS/"
1078         aws s3 cp "$TOKEI_OUT" "$S3_DESTINATION_ANALYSIS/"
1079       fi
1080     - |
1081       if [ -n "$S3_DESTINATION_DATA" ] ; then
1082         for DATA_FILE in manuf ; do
1083           aws s3 cp "$DATA_FILE" "$S3_DESTINATION_DATA/"
1084         done
1085       fi
1086   artifacts:
1087     paths:
1088     - manuf
1089   needs: []
1090
1091 # Fuzz TShark using ASAN and valgrind.
1092 .fuzz-ubuntu:
1093   extends: .build-ubuntu
1094   retry: 0
1095   rules: !reference [.if-fuzz-schedule]
1096   tags:
1097     - wireshark-ubuntu-fuzz
1098   resource_group: fuzz-master
1099   variables:
1100     INSTALL_PREFIX: "$CI_PROJECT_DIR/_install"
1101     MIN_PLUGINS: 10
1102     MAX_PASSES: 15
1103   before_script:
1104     - source /clang-latest.env
1105     - DEBIAN_FRONTEND=noninteractive apt-get update
1106     # Use DPkg::options::="--force-overwrite" until
1107     # https://bugs.launchpad.net/ubuntu/+source/llvm-toolchain-15/+bug/2008755
1108     # https://github.com/llvm/llvm-project/issues/62104
1109     # are fixed.
1110     - DEBIAN_FRONTEND=noninteractive apt-get --yes --option DPkg::options::="--force-overwrite" install llvm-$CLANG_VERSION
1111     - mkdir -p ccache
1112     - mkdir /tmp/fuzz
1113     - mkdir build
1114     - cd build
1115   after_script:
1116     # The cache should be large enough to be useful but it shouldn't take
1117     # too long to restore+save each run.
1118     - ccache --max-size $( du --summarize --block-size=1M "$CI_PROJECT_DIR/build" | awk '{printf ("%dM", $1 * 1.5)}' )
1119     - if [ "$CI_JOB_STATUS" == "canceled" ]; then exit 0 ; fi
1120     - . /tmp/fuzz_result.sh
1121     - if $FUZZ_PASSED ; then exit 0 ; fi
1122     - echo Fuzzing failed. Generating report.
1123     - FUZZ_CAPTURE=$( find /tmp/fuzz -name "fuzz-*.pcap" -o -name "randpkt-*.pcap" | head -n 1 )
1124     - FUZZ_ERRORS="/tmp/fuzz/$( basename "$FUZZ_CAPTURE" .pcap ).err"
1125     - printf "\nfuzz-test.sh stderr:\n" >> "$FUZZ_ERRORS"
1126     - cat fuzz-test.err >> "$FUZZ_ERRORS"
1127     - |
1128       if [ -n "$S3_DESTINATION_FUZZ" ] ; then
1129         aws s3 cp "$FUZZ_CAPTURE" "$S3_DESTINATION_FUZZ/"
1130         aws s3 cp "$FUZZ_ERRORS" "$S3_DESTINATION_FUZZ/"
1131       fi
1132
1133 ASan Menagerie Fuzz:
1134   extends: .fuzz-ubuntu
1135   stage: fuzz-asan
1136   variables:
1137     WIRESHARK_LOG_FATAL: "critical"
1138   script:
1139     - MAX_SECONDS=$(( 6 * 60 * 60 ))
1140     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1141     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1142     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1143     - ninja
1144     - ninja install
1145     - cd ..
1146     - FUZZ_PASSED=true
1147     # /var/menagerie contains captures harvested from wireshark.org's mailing list, wiki, issues, etc.
1148     # We have more captures than we can fuzz in $MAX_SECONDS, so we shuffle them each run.
1149     - ./tools/fuzz-test.sh -a -2 -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1150     # Signal after_script, which runs in its own shell.
1151     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1152     - $FUZZ_PASSED
1153
1154 ASan randpkt Fuzz:
1155   extends: .fuzz-ubuntu
1156   stage: fuzz-randpkt
1157   variables:
1158     WIRESHARK_LOG_FATAL: "critical"
1159   script:
1160     # XXX Reuse fuzz-asan?
1161     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1162     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1163     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1164     - ninja
1165     - ninja install
1166     - cd ..
1167     - FUZZ_PASSED=true
1168     - ./tools/randpkt-test.sh -a -b $INSTALL_PREFIX/bin -d /tmp/fuzz -p $MAX_PASSES 2> fuzz-test.err || FUZZ_PASSED=false
1169     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1170     - $FUZZ_PASSED
1171   needs: [ 'ASan Menagerie Fuzz' ]
1172
1173 Valgrind Menagerie Fuzz:
1174   extends: .fuzz-ubuntu
1175   stage: fuzz-valgrind
1176   resource_group: fuzz-master-valgrind
1177   variables:
1178     # Use DWARF-4 debug info. Valgrind does not support Clang 14 with DWARF-5.
1179     # https://gitlab.com/wireshark/wireshark/-/issues/18191
1180     # https://www.mail-archive.com/valgrind-users@lists.sourceforge.net/msg07239.html
1181     CFLAGS: "-gdwarf-4"
1182     WIRESHARK_LOG_FATAL: "critical"
1183   script:
1184     - DEBIAN_FRONTEND=noninteractive apt-get update
1185     - DEBIAN_FRONTEND=noninteractive apt-get --yes install valgrind
1186     - MAX_SECONDS=$(( 3 * 60 * 60 ))
1187     - printf "\e[0Ksection_start:%s:cmake_section[collapsed=true]\r\e[0KRunning CMake" "$( date +%s)"
1188     - cmake -G Ninja -DBUILD_wireshark=OFF -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=OFF -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX -DENABLE_CCACHE=ON -DENABLE_WERROR=Off ..
1189     - printf "\e[0Ksection_end:%s:cmake_section\r\e[0K" "$( date +%s)"
1190     - ninja
1191     - ninja install
1192     - cd ..
1193     - FUZZ_PASSED=true
1194     - ./tools/fuzz-test.sh -g -P $MIN_PLUGINS -b $INSTALL_PREFIX/bin -d /tmp/fuzz -t $MAX_SECONDS $( shuf -e /var/menagerie/*/* ) 2> fuzz-test.err || FUZZ_PASSED=false
1195     - echo "export FUZZ_PASSED=$FUZZ_PASSED" > /tmp/fuzz_result.sh
1196     - $FUZZ_PASSED
1197   needs: [ 'ASan randpkt Fuzz' ]
1198
1199
1200 include:
1201   - template: Security/SAST.gitlab-ci.yml