.gitlab-ci.yml

   1 workflow:
   2   rules:
   3     - if: $CI_MERGE_REQUEST_IID
   4     - if: $CI_COMMIT_TAG
   5     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
   6
   7 image: debian:bullseye
   8
   9 before_script:
  10   - export DEBIAN_FRONTEND=noninteractive
  11   - apt-get update -qq
  12
  13 .prepare-lint-po: &prepare-lint-po
  14   - apt-get -qy install git i18nspector
  15   - git clone https://gitlab.tails.boum.org/tails/jenkins-tools.git /tmp/jenkins-tools
  16
  17 build-website:
  18   rules:
  19     - if: '$CI_COMMIT_BRANCH == "master"'
  20     - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
  21     - changes:
  22         - .gitlab-ci.yml
  23   script:
  24     - apt-get -qy install ikiwiki po4a libyaml-perl libyaml-libyaml-perl libyaml-syck-perl perlmagick
  25     - ./build-website
  26
  27 lint-po:
  28   image: debian:testing
  29   rules:
  30     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  31     - changes:
  32         - .gitlab-ci.yml
  33         - ./**.po
  34   script:
  35     - *prepare-lint-po
  36     - /tmp/jenkins-tools/slaves/lint_po
  37
  38 lint-latest-po:
  39   image: debian:testing
  40   rules:
  41     - if: '$CI_COMMIT_BRANCH == "stable"'
  42   script:
  43     - *prepare-lint-po
  44     - apt-get -qy install intltool
  45     - ./import-translations
  46     - /tmp/jenkins-tools/slaves/lint_po po/*.po
  47
  48 bandit:
  49   script:
  50   - apt-get -qy install python3-bandit file
  51   - bandit --version
  52   - './bin/bandit-tree --configfile .bandit.yml
  53                        -ll
  54                        --format xml
  55                        --output bandit.xml
  56                        .'
  57   artifacts:
  58     when: always
  59     reports:
  60       junit: bandit.xml
  61
  62 check-website-core-pages:
  63   script:
  64     - apt-get -qy install git
  65     - ./bin/check-core-pages
  66
  67 check-po-msgfmt:
  68   rules:
  69     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  70     - changes:
  71         - .gitlab-ci.yml
  72         - ./**.po
  73   script:
  74     - apt-get -qy install python3 gettext
  75     - ./bin/check-po-msgfmt
  76
  77 check-po-meta-date:
  78   rules:
  79     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  80     - changes:
  81         - .gitlab-ci.yml
  82         - ./**.po
  83   script:
  84     - apt-get -qy install git ruby
  85     - ./bin/sanity-check-website
  86
  87 check-translatable-live-website-urls:
  88   script:
  89     - apt-get -qy install python3-polib
  90     - ./bin/check-translatable-live-website-urls po/tails.pot
  91
  92 test-iuk:
  93   rules:
  94     - if: '$CI_COMMIT_BRANCH != "master"'
  95   script:
  96   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
  97          config/chroot_local-packageslists/tails-iuk.list
  98        | grep -E -v "^#"
  99        | xargs apt-get -qy install'
 100   - 'apt-get -qy install
 101        apt-file
 102        libdist-zilla-plugin-test-notabs-perl
 103        libdist-zilla-plugin-test-perl-critic-perl
 104        libdist-zilla-app-command-authordebs-perl
 105        libmodule-build-perl
 106        sudo
 107        attr
 108        libarchive-tools
 109        libdevice-cdio-perl
 110        faketime
 111        genisoimage
 112        gnutls-bin
 113        libdata-dumper-concise-perl
 114        libdatetime-perl
 115        libfile-copy-recursive-perl
 116        libtest-lwp-useragent-perl'
 117   - apt-get update -qq # Take into account APT configuration added by apt-file
 118   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 119   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 120   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/iuk
 121   - dzil authordebs --install
 122   - export SOURCE_DATE_EPOCH=$(date --utc +%s)
 123   - 'TAILS_GIT_CHECKOUT=$CI_PROJECT_DIR
 124      PERL5LIB=$CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib/lib
 125      LC_ALL=C.UTF-8
 126      dzil test --all'
 127
 128 test-perl5lib:
 129   rules:
 130     - if: '$CI_COMMIT_BRANCH != "master"'
 131   script:
 132   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
 133        | grep -E -v "^#"
 134        | xargs apt-get -qy install'
 135   - 'apt-get -qy install
 136        apt-file
 137        libdist-zilla-plugin-test-notabs-perl
 138        libdist-zilla-plugin-test-perl-critic-perl
 139        libdist-zilla-app-command-authordebs-perl
 140        libmodule-build-perl
 141        sudo'
 142   - apt-get update -qq # Take into account APT configuration added by apt-file
 143   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 144   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 145   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib
 146   - dzil authordebs --install
 147   - dzil test --all
 148
 149 shellcheck:
 150   image: debian:testing
 151   script:
 152   - apt-get -qy install python3 shellcheck xmlstarlet file
 153   - shellcheck --version
 154   - './bin/shellcheck-tree --format=checkstyle
 155        | xmlstarlet tr config/ci/shellcheck/checkstyle2junit.xslt
 156        > shellcheck.xml'
 157   artifacts:
 158     when: always
 159     reports:
 160       junit: shellcheck.xml
 161
 162 test-persistent-storage-config-file:
 163   script:
 164     - apt-get -qy install python3 python3-gi acl
 165     - config/chroot_local-includes/usr/lib/python3/dist-packages/tps/configuration/config_file_test.py
 166
 167 test-python-doctest:
 168   script:
 169     - apt-get -qy install python3 python3-sh
 170     - config/chroot_local-includes/usr/local/lib/tails-gdm-error-message doctest --verbose
 171     - env PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages python3 config/chroot_local-includes/usr/local/bin/tails-documentation --doctest
 172
 173 test-tca:
 174   rules:
 175     - if: '$CI_COMMIT_BRANCH != "master"'
 176   script:
 177     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 178        | grep -E -v "^#"
 179        | xargs apt-get -qy install'
 180     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tca -name "*.py" -print0 | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 181
 182 test-tca-portal:
 183   rules:
 184     - if: '$CI_COMMIT_BRANCH != "master"'
 185   script:
 186     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 187        | grep -E -v "^#"
 188        | xargs apt-get -qy install'
 189     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages env python3 ./config/chroot_local-includes/usr/local/lib/tca-portal --doctest-only --log-level DEBUG'
 190
 191
 192 test-tailslib:
 193   rules:
 194     - if: '$CI_COMMIT_BRANCH != "master"'
 195   script:
 196     - apt-get -qy install python3 python3-atomicwrites python3-sh git
 197     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tailslib -name "*.py" -print0 | grep --null-data -v -e netnsdrop.py -e gnome.py | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 198
 199 test-whisperback:
 200   rules:
 201     - if: '$CI_COMMIT_BRANCH != "master"'
 202   script:
 203     - 'cat config/chroot_local-packageslists/whisperback.list | grep -E -v "^#"
 204          | xargs apt-get -qy install'
 205     - apt-get -qy install python3-pytest
 206     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages
 207          pytest-3 --verbose --junit-xml=report.xml
 208          config/chroot_local-includes/usr/lib/python3/dist-packages/whisperBack/test.py'
 209   artifacts:
 210     when: always
 211     reports:
 212       junit: report.xml
 213
 214 apt-snapshots-expiry:
 215   script:
 216     - apt-get -qy install curl git
 217     - ./bin/apt-snapshots-expiry
 218   rules:
 219     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 220     - changes:
 221         - .gitlab-ci.yml
 222         - config/APT_snapshots.d/*/serial
 223         - vagrant/definitions/tails-builder/config/APT_snapshots.d/*/serial
 224
 225 .install-https-get-expired-build-deps: &install-https-get-expired-build-deps
 226   - apt-get -qy install --no-install-recommends golang-go ca-certificates
 227
 228 .build-https-get-expired: &build-https-get-expired
 229   - go build -o ./https-get-expired config/chroot_local-includes/usr/src/https-get-expired.go
 230
 231 .test-https-get-expired: &test-https-get-expired
 232   - echo "Basic check:"
 233   - ./https-get-expired -reject-expired https://tails.boum.org/
 234   - echo "Let's pretend we are in the past. Then, this certificate is still good."
 235   - ./https-get-expired -current-time 2000-01-01 -reject-expired https://tails.boum.org/
 236   - echo "Let's pretend we are in the future. Then, this certificate is expired"
 237   - "! ./https-get-expired -current-time 2090-01-01 -reject-expired https://tails.boum.org/"
 238   - "! ./https-get-expired -reject-expired https://wrong.host.badssl.com/"
 239   - "! ./https-get-expired -reject-expired https://self-signed.badssl.com/"
 240   - "! ./https-get-expired -reject-expired https://untrusted-root.badssl.com/"
 241   - "! ./https-get-expired -reject-expired https://expired.badssl.com/"
 242   - echo "Invalid host"
 243   - "! ./https-get-expired -reject-expired https://nxdomain.tails.boum.org/"
 244   - "( . config/chroot_local-includes/etc/default/htpdate.pools; err=0; for url in $(echo $HTP_POOL_1 $HTP_POOL_2 $HTP_POOL_3 | tr ',' ' '); do echo $url; if ! ./https-get-expired -reject-expired https://$url; then echo ERROR on $url; err=1; fi; done; exit $err; )"
 245
 246 https-get-expired:
 247   rules:
 248     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 249     - changes:
 250         - .gitlab-ci.yml
 251         - config/chroot_local-includes/usr/src/https-get-expired.go
 252         - config/chroot_local-includes/etc/default/htpdate.pools
 253   script:
 254     - *install-https-get-expired-build-deps
 255     - *build-https-get-expired
 256     - *test-https-get-expired
 257
 258 https-get-expired-sid:
 259   # this job gives us results using a future version of Golang compared to the one we actually use
 260   image: debian:sid
 261   rules:
 262     - if: '$CI_COMMIT_BRANCH == "devel"'
 263     - changes:
 264         - .gitlab-ci.yml
 265         - config/chroot_local-includes/usr/src/https-get-expired.go
 266         - config/chroot_local-includes/etc/default/htpdate.pools
 267   script:
 268     - *install-https-get-expired-build-deps
 269     - *build-https-get-expired
 270     - *test-https-get-expired