3 - if: $CI_MERGE_REQUEST_IID
5 - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
10 - export DEBIAN_FRONTEND=noninteractive
13 .prepare-lint-po: &prepare-lint-po
14 - apt-get -qy install git i18nspector
15 - git clone https://gitlab.tails.boum.org/tails/jenkins-tools.git /tmp/jenkins-tools
19 - if: '$CI_COMMIT_BRANCH == "master"'
20 - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
24 - apt-get -qy install ikiwiki po4a libyaml-perl libyaml-libyaml-perl libyaml-syck-perl perlmagick
30 - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
36 - /tmp/jenkins-tools/slaves/lint_po
40 - apt-get -qy install python3-bandit file
42 - './bin/bandit-tree --configfile .bandit.yml
52 check-website-core-pages:
54 - apt-get -qy install git
55 - ./bin/check-core-pages
59 - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
64 - apt-get -qy install python3 gettext
65 - ./bin/check-po-msgfmt
69 - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
74 - apt-get -qy install git ruby
75 - ./bin/sanity-check-website
77 check-translatable-live-website-urls:
79 - apt-get -qy install python3-polib
80 - ./bin/check-translatable-live-website-urls po/tails.pot
84 - if: '$CI_COMMIT_BRANCH != "master"'
86 - 'cat config/chroot_local-packageslists/tails-perl5lib.list
87 config/chroot_local-packageslists/tails-iuk.list
89 | xargs apt-get -qy install'
90 - 'apt-get -qy install
92 libdist-zilla-plugin-test-notabs-perl
93 libdist-zilla-plugin-test-perl-critic-perl
94 libdist-zilla-app-command-authordebs-perl
103 libdata-dumper-concise-perl
105 libfile-copy-recursive-perl
106 libtest-lwp-useragent-perl'
107 - apt-get update -qq # Take into account APT configuration added by apt-file
108 # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
109 - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
110 - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/iuk
111 - dzil authordebs --install
112 - export SOURCE_DATE_EPOCH=$(date --utc +%s)
113 - 'TAILS_GIT_CHECKOUT=$CI_PROJECT_DIR
114 PERL5LIB=$CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib/lib
120 - if: '$CI_COMMIT_BRANCH != "master"'
122 - 'cat config/chroot_local-packageslists/tails-perl5lib.list
124 | xargs apt-get -qy install'
125 - 'apt-get -qy install
127 libdist-zilla-plugin-test-notabs-perl
128 libdist-zilla-plugin-test-perl-critic-perl
129 libdist-zilla-app-command-authordebs-perl
132 - apt-get update -qq # Take into account APT configuration added by apt-file
133 # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
134 - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
135 - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib
136 - dzil authordebs --install
140 image: debian:testing
142 - apt-get -qy install python3 shellcheck xmlstarlet file
143 - shellcheck --version
144 - './bin/shellcheck-tree --format=checkstyle
145 | xmlstarlet tr config/ci/shellcheck/checkstyle2junit.xslt
150 junit: shellcheck.xml
152 test-persistent-storage-config-file:
154 - apt-get -qy install python3 python3-gi acl
155 - config/chroot_local-includes/usr/lib/python3/dist-packages/tps/configuration/config_file_test.py
159 - apt-get -qy install python3 python3-sh
160 - config/chroot_local-includes/usr/local/lib/tails-gdm-error-message doctest --verbose
161 - env PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages python3 config/chroot_local-includes/usr/local/bin/tails-documentation --doctest
165 - if: '$CI_COMMIT_BRANCH != "master"'
167 - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
169 | xargs apt-get -qy install'
170 - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tca -name "*.py" -print0 | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
174 - if: '$CI_COMMIT_BRANCH != "master"'
176 - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
178 | xargs apt-get -qy install'
179 - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages env python3 ./config/chroot_local-includes/usr/local/lib/tca-portal --doctest-only --log-level DEBUG'
184 - if: '$CI_COMMIT_BRANCH != "master"'
186 - apt-get -qy install python3 python3-atomicwrites python3-sh git
187 - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tailslib -name "*.py" -print0 | grep --null-data -v -e netnsdrop.py -e gnome.py | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
191 - if: '$CI_COMMIT_BRANCH != "master"'
193 - 'cat config/chroot_local-packageslists/whisperback.list | grep -E -v "^#"
194 | xargs apt-get -qy install'
195 - apt-get -qy install python3-pytest
196 - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages
197 pytest-3 --verbose --junit-xml=report.xml
198 config/chroot_local-includes/usr/lib/python3/dist-packages/whisperBack/test.py'
204 apt-snapshots-expiry:
206 - apt-get -qy install curl git
207 - ./bin/apt-snapshots-expiry
209 - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
212 - config/APT_snapshots.d/*/serial
213 - vagrant/definitions/tails-builder/config/APT_snapshots.d/*/serial
215 .install-https-get-expired-build-deps: &install-https-get-expired-build-deps
216 - apt-get -qy install --no-install-recommends golang-go ca-certificates
218 .build-https-get-expired: &build-https-get-expired
219 - go build -o ./https-get-expired config/chroot_local-includes/usr/src/https-get-expired.go
221 .test-https-get-expired: &test-https-get-expired
222 - echo "Basic check:"
223 - ./https-get-expired -reject-expired https://tails.boum.org/
224 - echo "Let's pretend we are in the past. Then, this certificate is still good."
225 - ./https-get-expired -current-time 2000-01-01 -reject-expired https://tails.boum.org/
226 - echo "Let's pretend we are in the future. Then, this certificate is expired"
227 - "! ./https-get-expired -current-time 2090-01-01 -reject-expired https://tails.boum.org/"
228 - "! ./https-get-expired -reject-expired https://wrong.host.badssl.com/"
229 - "! ./https-get-expired -reject-expired https://self-signed.badssl.com/"
230 - "! ./https-get-expired -reject-expired https://untrusted-root.badssl.com/"
231 - "! ./https-get-expired -reject-expired https://expired.badssl.com/"
232 - echo "Invalid host"
233 - "! ./https-get-expired -reject-expired https://nxdomain.tails.boum.org/"
234 - "( . config/chroot_local-includes/etc/default/htpdate.pools; err=0; for url in $(echo $HTP_POOL_1 $HTP_POOL_2 $HTP_POOL_3 | tr ',' ' '); do echo $url; if ! ./https-get-expired -reject-expired https://$url; then echo ERROR on $url; err=1; fi; done; exit $err; )"
238 - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
241 - config/chroot_local-includes/usr/src/https-get-expired.go
242 - config/chroot_local-includes/etc/default/htpdate.pools
244 - *install-https-get-expired-build-deps
245 - *build-https-get-expired
246 - *test-https-get-expired
248 https-get-expired-sid:
249 # this job gives us results using a future version of Golang compared to the one we actually use
252 - if: '$CI_COMMIT_BRANCH == "devel"'
255 - config/chroot_local-includes/usr/src/https-get-expired.go
256 - config/chroot_local-includes/etc/default/htpdate.pools
258 - *install-https-get-expired-build-deps
259 - *build-https-get-expired
260 - *test-https-get-expired