.gitlab-ci.yml

   1 workflow:
   2   rules:
   3     - if: $CI_MERGE_REQUEST_IID
   4     - if: $CI_COMMIT_TAG
   5     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
   6
   7 image: debian:bullseye
   8
   9 before_script:
  10   - export DEBIAN_FRONTEND=noninteractive
  11   - apt-get update -qq
  12
  13 .prepare-lint-po: &prepare-lint-po
  14   - apt-get -qy install git i18nspector
  15   - git clone https://gitlab.tails.boum.org/tails/jenkins-tools.git /tmp/jenkins-tools
  16
  17 build-website:
  18   rules:
  19     - if: '$CI_COMMIT_BRANCH == "master"'
  20     - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
  21     - changes:
  22         - .gitlab-ci.yml
  23   script:
  24     - apt-get -qy install ikiwiki po4a libyaml-perl libyaml-libyaml-perl libyaml-syck-perl perlmagick
  25     - ./build-website
  26
  27 lint-po:
  28   image: debian:testing
  29   rules:
  30     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  31     - changes:
  32         - .gitlab-ci.yml
  33         - ./**.po
  34   script:
  35     - *prepare-lint-po
  36     - /tmp/jenkins-tools/slaves/lint_po
  37
  38 bandit:
  39   script:
  40   - apt-get -qy install python3-bandit file
  41   - bandit --version
  42   - './bin/bandit-tree --configfile .bandit.yml
  43                        -ll
  44                        --format xml
  45                        --output bandit.xml
  46                        .'
  47   artifacts:
  48     when: always
  49     reports:
  50       junit: bandit.xml
  51
  52 check-website-core-pages:
  53   script:
  54     - apt-get -qy install git
  55     - ./bin/check-core-pages
  56
  57 check-po-msgfmt:
  58   rules:
  59     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  60     - changes:
  61         - .gitlab-ci.yml
  62         - ./**.po
  63   script:
  64     - apt-get -qy install python3 gettext
  65     - ./bin/check-po-msgfmt
  66
  67 check-po-meta-date:
  68   rules:
  69     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  70     - changes:
  71         - .gitlab-ci.yml
  72         - ./**.po
  73   script:
  74     - apt-get -qy install git ruby
  75     - ./bin/sanity-check-website
  76
  77 check-translatable-live-website-urls:
  78   script:
  79     - apt-get -qy install python3-polib
  80     - ./bin/check-translatable-live-website-urls po/tails.pot
  81
  82 test-iuk:
  83   rules:
  84     - if: '$CI_COMMIT_BRANCH != "master"'
  85   script:
  86   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
  87          config/chroot_local-packageslists/tails-iuk.list
  88        | grep -E -v "^#"
  89        | xargs apt-get -qy install'
  90   - 'apt-get -qy install
  91        apt-file
  92        libdist-zilla-plugin-test-notabs-perl
  93        libdist-zilla-plugin-test-perl-critic-perl
  94        libdist-zilla-app-command-authordebs-perl
  95        libmodule-build-perl
  96        sudo
  97        attr
  98        libarchive-tools
  99        libdevice-cdio-perl
 100        faketime
 101        genisoimage
 102        gnutls-bin
 103        libdata-dumper-concise-perl
 104        libdatetime-perl
 105        libfile-copy-recursive-perl
 106        libtest-lwp-useragent-perl'
 107   - apt-get update -qq # Take into account APT configuration added by apt-file
 108   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 109   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 110   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/iuk
 111   - dzil authordebs --install
 112   - export SOURCE_DATE_EPOCH=$(date --utc +%s)
 113   - 'TAILS_GIT_CHECKOUT=$CI_PROJECT_DIR
 114      PERL5LIB=$CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib/lib
 115      LC_ALL=C.UTF-8
 116      dzil test --all'
 117
 118 test-perl5lib:
 119   rules:
 120     - if: '$CI_COMMIT_BRANCH != "master"'
 121   script:
 122   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
 123        | grep -E -v "^#"
 124        | xargs apt-get -qy install'
 125   - 'apt-get -qy install
 126        apt-file
 127        libdist-zilla-plugin-test-notabs-perl
 128        libdist-zilla-plugin-test-perl-critic-perl
 129        libdist-zilla-app-command-authordebs-perl
 130        libmodule-build-perl
 131        sudo'
 132   - apt-get update -qq # Take into account APT configuration added by apt-file
 133   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 134   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 135   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib
 136   - dzil authordebs --install
 137   - dzil test --all
 138
 139 shellcheck:
 140   image: debian:testing
 141   script:
 142   - apt-get -qy install python3 shellcheck xmlstarlet file
 143   - shellcheck --version
 144   - './bin/shellcheck-tree --format=checkstyle
 145        | xmlstarlet tr config/ci/shellcheck/checkstyle2junit.xslt
 146        > shellcheck.xml'
 147   artifacts:
 148     when: always
 149     reports:
 150       junit: shellcheck.xml
 151
 152 test-persistent-storage-config-file:
 153   script:
 154     - apt-get -qy install python3 python3-gi acl
 155     - config/chroot_local-includes/usr/lib/python3/dist-packages/tps/configuration/config_file_test.py
 156
 157 test-python-doctest:
 158   script:
 159     - apt-get -qy install python3 python3-sh
 160     - config/chroot_local-includes/usr/local/lib/tails-gdm-error-message doctest --verbose
 161     - env PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages python3 config/chroot_local-includes/usr/local/bin/tails-documentation --doctest
 162
 163 test-tca:
 164   rules:
 165     - if: '$CI_COMMIT_BRANCH != "master"'
 166   script:
 167     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 168        | grep -E -v "^#"
 169        | xargs apt-get -qy install'
 170     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tca -name "*.py" -print0 | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 171
 172 test-tca-portal:
 173   rules:
 174     - if: '$CI_COMMIT_BRANCH != "master"'
 175   script:
 176     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 177        | grep -E -v "^#"
 178        | xargs apt-get -qy install'
 179     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages env python3 ./config/chroot_local-includes/usr/local/lib/tca-portal --doctest-only --log-level DEBUG'
 180
 181
 182 test-tailslib:
 183   rules:
 184     - if: '$CI_COMMIT_BRANCH != "master"'
 185   script:
 186     - apt-get -qy install python3 python3-atomicwrites python3-sh git
 187     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tailslib -name "*.py" -print0 | grep --null-data -v -e netnsdrop.py -e gnome.py | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 188
 189 test-whisperback:
 190   rules:
 191     - if: '$CI_COMMIT_BRANCH != "master"'
 192   script:
 193     - 'cat config/chroot_local-packageslists/whisperback.list | grep -E -v "^#"
 194          | xargs apt-get -qy install'
 195     - apt-get -qy install python3-pytest
 196     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages
 197          pytest-3 --verbose --junit-xml=report.xml
 198          config/chroot_local-includes/usr/lib/python3/dist-packages/whisperBack/test.py'
 199   artifacts:
 200     when: always
 201     reports:
 202       junit: report.xml
 203
 204 apt-snapshots-expiry:
 205   script:
 206     - apt-get -qy install curl git
 207     - ./bin/apt-snapshots-expiry
 208   rules:
 209     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 210     - changes:
 211         - .gitlab-ci.yml
 212         - config/APT_snapshots.d/*/serial
 213         - vagrant/definitions/tails-builder/config/APT_snapshots.d/*/serial
 214
 215 .install-https-get-expired-build-deps: &install-https-get-expired-build-deps
 216   - apt-get -qy install --no-install-recommends golang-go ca-certificates
 217
 218 .build-https-get-expired: &build-https-get-expired
 219   - go build -o ./https-get-expired config/chroot_local-includes/usr/src/https-get-expired.go
 220
 221 .test-https-get-expired: &test-https-get-expired
 222   - echo "Basic check:"
 223   - ./https-get-expired -reject-expired https://tails.boum.org/
 224   - echo "Let's pretend we are in the past. Then, this certificate is still good."
 225   - ./https-get-expired -current-time 2000-01-01 -reject-expired https://tails.boum.org/
 226   - echo "Let's pretend we are in the future. Then, this certificate is expired"
 227   - "! ./https-get-expired -current-time 2090-01-01 -reject-expired https://tails.boum.org/"
 228   - "! ./https-get-expired -reject-expired https://wrong.host.badssl.com/"
 229   - "! ./https-get-expired -reject-expired https://self-signed.badssl.com/"
 230   - "! ./https-get-expired -reject-expired https://untrusted-root.badssl.com/"
 231   - "! ./https-get-expired -reject-expired https://expired.badssl.com/"
 232   - echo "Invalid host"
 233   - "! ./https-get-expired -reject-expired https://nxdomain.tails.boum.org/"
 234   - "( . config/chroot_local-includes/etc/default/htpdate.pools; err=0; for url in $(echo $HTP_POOL_1 $HTP_POOL_2 $HTP_POOL_3 | tr ',' ' '); do echo $url; if ! ./https-get-expired -reject-expired https://$url; then echo ERROR on $url; err=1; fi; done; exit $err; )"
 235
 236 https-get-expired:
 237   rules:
 238     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 239     - changes:
 240         - .gitlab-ci.yml
 241         - config/chroot_local-includes/usr/src/https-get-expired.go
 242         - config/chroot_local-includes/etc/default/htpdate.pools
 243   script:
 244     - *install-https-get-expired-build-deps
 245     - *build-https-get-expired
 246     - *test-https-get-expired
 247
 248 https-get-expired-sid:
 249   # this job gives us results using a future version of Golang compared to the one we actually use
 250   image: debian:sid
 251   rules:
 252     - if: '$CI_COMMIT_BRANCH == "devel"'
 253     - changes:
 254         - .gitlab-ci.yml
 255         - config/chroot_local-includes/usr/src/https-get-expired.go
 256         - config/chroot_local-includes/etc/default/htpdate.pools
 257   script:
 258     - *install-https-get-expired-build-deps
 259     - *build-https-get-expired
 260     - *test-https-get-expired