.gitlab-ci.yml

   1 workflow:
   2   rules:
   3     - if: $CI_MERGE_REQUEST_IID
   4     - if: $CI_COMMIT_TAG
   5     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
   6
   7 image: debian:bullseye
   8
   9 before_script:
  10   - export DEBIAN_FRONTEND=noninteractive
  11   - apt-get update -qq
  12
  13 .prepare-lint-po: &prepare-lint-po
  14   - apt-get -qy install git i18nspector
  15   - git clone https://gitlab.tails.boum.org/tails/jenkins-tools.git /tmp/jenkins-tools
  16
  17 build-website:
  18   rules:
  19     - if: '$CI_COMMIT_BRANCH == "master"'
  20     - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master"'
  21     - changes:
  22         - .gitlab-ci.yml
  23   script:
  24     - apt-get -qy install ikiwiki po4a libyaml-perl libyaml-libyaml-perl libyaml-syck-perl perlmagick
  25     - ./build-website
  26
  27 lint-po:
  28   image: debian:testing
  29   rules:
  30     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  31     - changes:
  32         - .gitlab-ci.yml
  33         - ./**.po
  34   script:
  35     - *prepare-lint-po
  36     - /tmp/jenkins-tools/slaves/lint_po
  37
  38 lint-latest-po:
  39   image: debian:testing
  40   rules:
  41     - if: '$CI_COMMIT_BRANCH == "stable"'
  42   script:
  43     - *prepare-lint-po
  44     - apt-get -qy install intltool
  45     - ./import-translations
  46     - /tmp/jenkins-tools/slaves/lint_po po/*.po
  47
  48 bandit:
  49   script:
  50   - apt-get -qy install python3-bandit file
  51   - bandit --version
  52   - './bin/bandit-tree --configfile .bandit.yml
  53                        -ll
  54                        --format xml
  55                        --output bandit.xml
  56                        .'
  57   artifacts:
  58     when: always
  59     reports:
  60       junit: bandit.xml
  61
  62 check-website-core-pages:
  63   script:
  64     - apt-get -qy install git
  65     - ./bin/check-core-pages
  66
  67 check-po-msgfmt:
  68   rules:
  69     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  70     - changes:
  71         - .gitlab-ci.yml
  72         - ./**.po
  73   script:
  74     - apt-get -qy install python3 gettext
  75     - ./bin/check-po-msgfmt
  76
  77 check-po-meta-date:
  78   rules:
  79     - if: '$CI_COMMIT_BRANCH =~ /^master|stable|testing|devel$/'
  80     - changes:
  81         - .gitlab-ci.yml
  82         - ./**.po
  83   script:
  84     - apt-get -qy install git ruby
  85     - ./bin/sanity-check-website
  86
  87 check-translatable-live-website-urls:
  88   script:
  89     - apt-get -qy install python3-polib
  90     - ./bin/check-translatable-live-website-urls po/tails.pot
  91
  92 test-iuk:
  93   rules:
  94     - if: '$CI_COMMIT_BRANCH != "master"'
  95   script:
  96   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
  97          config/chroot_local-packageslists/tails-iuk.list
  98        | grep -E -v "^#"
  99        | xargs apt-get -qy install'
 100   - 'apt-get -qy install
 101        apt-file
 102        libdist-zilla-plugin-test-notabs-perl
 103        libdist-zilla-plugin-test-perl-critic-perl
 104        libdist-zilla-app-command-authordebs-perl
 105        libmodule-build-perl
 106        sudo
 107        attr
 108        libarchive-tools
 109        libdevice-cdio-perl
 110        faketime
 111        genisoimage
 112        gnutls-bin
 113        libdata-dumper-concise-perl
 114        libdatetime-perl
 115        libfile-copy-recursive-perl
 116        libtest-lwp-useragent-perl'
 117   - apt-get update -qq # Take into account APT configuration added by apt-file
 118   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 119   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 120   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/iuk
 121   - dzil authordebs --install
 122   - export SOURCE_DATE_EPOCH=$(date --utc +%s)
 123   - 'TAILS_GIT_CHECKOUT=$CI_PROJECT_DIR
 124      NODE_PATH=$CI_PROJECT_DIR/submodules/mirror-pool-dispatcher/lib/js
 125      PATH=$CI_PROJECT_DIR/submodules/mirror-pool-dispatcher/bin:$PATH
 126      PERL5LIB=$CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib/lib
 127      LC_ALL=C.UTF-8
 128      dzil test --all'
 129
 130 test-perl5lib:
 131   rules:
 132     - if: '$CI_COMMIT_BRANCH != "master"'
 133   script:
 134   - 'cat config/chroot_local-packageslists/tails-perl5lib.list
 135        | grep -E -v "^#"
 136        | xargs apt-get -qy install'
 137   - 'apt-get -qy install
 138        apt-file
 139        libdist-zilla-plugin-test-notabs-perl
 140        libdist-zilla-plugin-test-perl-critic-perl
 141        libdist-zilla-app-command-authordebs-perl
 142        libmodule-build-perl
 143        sudo'
 144   - apt-get update -qq # Take into account APT configuration added by apt-file
 145   # Otherwise, apt-get called by "dzil authordebs --install" asks confirmation
 146   - echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/yes
 147   - cd $CI_PROJECT_DIR/config/chroot_local-includes/usr/src/perl5lib
 148   - dzil authordebs --install
 149   - dzil test --all
 150
 151 shellcheck:
 152   image: debian:testing
 153   script:
 154   - apt-get -qy install python3 shellcheck xmlstarlet file
 155   - shellcheck --version
 156   - './bin/shellcheck-tree --format=checkstyle
 157        | xmlstarlet tr config/ci/shellcheck/checkstyle2junit.xslt
 158        > shellcheck.xml'
 159   artifacts:
 160     when: always
 161     reports:
 162       junit: shellcheck.xml
 163
 164 test-persistent-storage-config-file:
 165   script:
 166     - apt-get -qy install python3 python3-gi acl
 167     - config/chroot_local-includes/usr/lib/python3/dist-packages/tps/configuration/config_file_test.py
 168
 169 test-python-doctest:
 170   script:
 171     - apt-get -qy install python3 python3-sh
 172     - config/chroot_local-includes/usr/local/lib/tails-gdm-error-message doctest --verbose
 173     - env PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages python3 config/chroot_local-includes/usr/local/bin/tails-documentation --doctest
 174
 175 test-tca:
 176   rules:
 177     - if: '$CI_COMMIT_BRANCH != "master"'
 178   script:
 179     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 180        | grep -E -v "^#"
 181        | xargs apt-get -qy install'
 182     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tca -name "*.py" -print0 | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 183
 184 test-tca-portal:
 185   rules:
 186     - if: '$CI_COMMIT_BRANCH != "master"'
 187   script:
 188     - 'cat config/chroot_local-packageslists/tor-connection-assistant.list
 189        | grep -E -v "^#"
 190        | xargs apt-get -qy install'
 191     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages env python3 ./config/chroot_local-includes/usr/local/lib/tca-portal --doctest-only --log-level DEBUG'
 192
 193
 194 test-tailslib:
 195   rules:
 196     - if: '$CI_COMMIT_BRANCH != "master"'
 197   script:
 198     - apt-get -qy install python3 python3-atomicwrites python3-sh git
 199     - 'cd config/chroot_local-includes/usr/lib/python3/dist-packages ; find tailslib -name "*.py" -print0 | grep --null-data -v -e netnsdrop.py -e gnome.py | xargs -0 -L1 env PYTHONPATH=. python3 -m doctest'
 200
 201 test-whisperback:
 202   rules:
 203     - if: '$CI_COMMIT_BRANCH != "master"'
 204   script:
 205     - 'cat config/chroot_local-packageslists/whisperback.list | grep -E -v "^#"
 206          | xargs apt-get -qy install'
 207     - apt-get -qy install python3-pytest
 208     - 'PYTHONPATH=config/chroot_local-includes/usr/lib/python3/dist-packages
 209          pytest-3 --verbose --junit-xml=report.xml
 210          config/chroot_local-includes/usr/lib/python3/dist-packages/whisperBack/test.py'
 211   artifacts:
 212     when: always
 213     reports:
 214       junit: report.xml
 215
 216 apt-snapshots-expiry:
 217   script:
 218     - apt-get -qy install curl git
 219     - ./bin/apt-snapshots-expiry
 220   rules:
 221     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 222     - changes:
 223         - .gitlab-ci.yml
 224         - config/APT_snapshots.d/*/serial
 225         - vagrant/definitions/tails-builder/config/APT_snapshots.d/*/serial
 226
 227 .install-https-get-expired-build-deps: &install-https-get-expired-build-deps
 228   - apt-get -qy install --no-install-recommends golang-go ca-certificates
 229
 230 .build-https-get-expired: &build-https-get-expired
 231   - go build -o ./https-get-expired config/chroot_local-includes/usr/src/https-get-expired.go
 232
 233 .test-https-get-expired: &test-https-get-expired
 234   - echo "Basic check:"
 235   - ./https-get-expired -reject-expired https://tails.boum.org/
 236   - echo "Let's pretend we are in the past. Then, this certificate is still good."
 237   - ./https-get-expired -current-time 2000-01-01 -reject-expired https://tails.boum.org/
 238   - echo "Let's pretend we are in the future. Then, this certificate is expired"
 239   - "! ./https-get-expired -current-time 2090-01-01 -reject-expired https://tails.boum.org/"
 240   - "! ./https-get-expired -reject-expired https://wrong.host.badssl.com/"
 241   - "! ./https-get-expired -reject-expired https://self-signed.badssl.com/"
 242   - "! ./https-get-expired -reject-expired https://untrusted-root.badssl.com/"
 243   - "! ./https-get-expired -reject-expired https://expired.badssl.com/"
 244   - echo "Invalid host"
 245   - "! ./https-get-expired -reject-expired https://nxdomain.tails.boum.org/"
 246   - "( . config/chroot_local-includes/etc/default/htpdate.pools; err=0; for url in $(echo $HTP_POOL_1 $HTP_POOL_2 $HTP_POOL_3 | tr ',' ' '); do echo $url; if ! ./https-get-expired -reject-expired https://$url; then echo ERROR on $url; err=1; fi; done; exit $err; )"
 247
 248 https-get-expired:
 249   rules:
 250     - if: '$CI_COMMIT_BRANCH =~ /^stable|testing|devel$/'
 251     - changes:
 252         - .gitlab-ci.yml
 253         - config/chroot_local-includes/usr/src/https-get-expired.go
 254         - config/chroot_local-includes/etc/default/htpdate.pools
 255   script:
 256     - *install-https-get-expired-build-deps
 257     - *build-https-get-expired
 258     - *test-https-get-expired
 259
 260 https-get-expired-sid:
 261   # this job gives us results using a future version of Golang compared to the one we actually use
 262   image: debian:sid
 263   rules:
 264     - if: '$CI_COMMIT_BRANCH == "devel"'
 265     - changes:
 266         - .gitlab-ci.yml
 267         - config/chroot_local-includes/usr/src/https-get-expired.go
 268         - config/chroot_local-includes/etc/default/htpdate.pools
 269   script:
 270     - *install-https-get-expired-build-deps
 271     - *build-https-get-expired
 272     - *test-https-get-expired