Repository: randombit/botan
Pull request #3567 (2023-05-31 12:57:58)

Add nightly CI jobs: clang-tidy and full valgrind run


Patch:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 000000000..458ba19d4
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,53 @@
+
+# (C) 2023 Jack Lloyd
+#
+# Botan is released under the Simplified BSD License (see license.txt)
+
+name: nightly
+
+permissions:
+  contents: read
+  # implicitly all other scopes not listed become none
+
+on:
+  schedule:
+    # runs every day at 3:23 AM UTC
+    - cron:  '23 3 * * *'
+
+jobs:
+  clang_tidy:
+    name: "clang-tidy"
+
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Build Agent
+        uses: ./.github/actions/setup-build-agent
+        with:
+          target: clang-tidy
+          cache-key: linux-x86_64-clang-tidy
+
+      - name: Configure Build
+        run: python3 ./configure.py --cc=clang
+
+      - name: Run Clang Tidy
+        run: python3 ./src/scripts/dev_tools/run_clang_tidy.py --verbose
+
+  valgrind:
+    name: "valgrind"
+
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Build Agent
+        uses: ./.github/actions/setup-build-agent
+        with:
+          target: valgrind-full
+          cache-key: linux-x86_64-valgrind-full
+
+      - name: Valgrind Checks
+        run: python3 ./src/scripts/ci_build.py --cc=gcc --make-tool=make valgrind-full
diff --git a/src/lib/utils/os_utils.cpp b/src/lib/utils/os_utils.cpp
index 265c38e65..8f2f7d6b7 100644
--- a/src/lib/utils/os_utils.cpp
+++ b/src/lib/utils/os_utils.cpp
@@ -70,10 +70,6 @@ extern "C" char** environ;
 
 #if defined(BOTAN_TARGET_OS_HAS_PRCTL)
    #include <sys/prctl.h>
-   #if !defined(PR_SET_VMA)
-      #define PR_SET_VMA 0x53564d41
-      #define PR_SET_VMA_ANON_NAME 0
-   #endif
 #endif
 
 namespace Botan {
@@ -609,7 +605,7 @@ void OS::free_locked_pages(const std::vector<void*>& pages) {
 }
 
 void OS::page_named(void* page, size_t size) {
-#if defined(BOTAN_TARGET_OS_HAS_PRCTL)
+#if defined(BOTAN_TARGET_OS_HAS_PRCTL) && defined(PR_SET_VMA) && defined(PR_SET_VMA_ANON_NAME)
    static constexpr char name[] = "Botan mlock pool";
    int r = prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, reinterpret_cast<uintptr_t>(page), size, name);
    BOTAN_UNUSED(r);
diff --git a/src/scripts/ci/setup_gh_actions.sh b/src/scripts/ci/setup_gh_actions.sh
index 369e03382..d28784c96 100755
--- a/src/scripts/ci/setup_gh_actions.sh
+++ b/src/scripts/ci/setup_gh_actions.sh
@@ -20,7 +20,7 @@ if type -p "apt-get"; then
     sudo apt-get -qq update
     sudo apt-get -qq install ccache
 
-    if [ "$TARGET" = "valgrind" ]; then
+    if [ "$TARGET" = "valgrind" ] || [ "$TARGET" = "valgrind-full" ]; then
         sudo apt-get -qq install valgrind
 
     elif [ "$TARGET" = "shared" ] || [ "$TARGET" = "examples" ] ; then
diff --git a/src/scripts/ci_build.py b/src/scripts/ci_build.py
index 9a545b433..6e8f7b1d9 100755
--- a/src/scripts/ci_build.py
+++ b/src/scripts/ci_build.py
@@ -57,6 +57,7 @@ def known_targets():
         'shared',
         'static',
         'valgrind',
+        'valgrind-full',
     ]
 
 def build_targets(target, target_os):
@@ -185,23 +186,24 @@ def determine_flags(target, target_os, target_cpu, target_cc, cc_bin, ccache,
     if target in ['coverage', 'sanitizer', 'fuzzers']:
         flags += ['--terminate-on-asserts']
 
-    if target == 'valgrind':
+    if target in ['valgrind', 'valgrind-full']:
         flags += ['--with-valgrind']
         test_prefix = ['valgrind', '--error-exitcode=9', '-v', '--leak-check=full', '--show-reachable=yes']
         # valgrind is single threaded anyway
         test_cmd += ['--test-threads=1']
 
-        # valgrind is slow
-        slow_tests = [
-            'argon2', 'bcrypt', 'bcrypt_pbkdf', 'compression', 'cryptobox',
-            'dh_invalid', 'dh_kat', 'dh_keygen', 'dl_group_gen', 'dlies',
-            'dsa_kat_verify', 'dsa_param', 'ecc_basemul', 'ecdsa_verify_wycheproof',
-            'ed25519_sign', 'elgamal_decrypt', 'elgamal_encrypt', 'elgamal_keygen',
-            'ffi_dsa', 'ffi_elgamal', 'mce_keygen', 'passhash9', 'pbkdf', 'rsa_encrypt',
-            'rsa_pss', 'rsa_pss_raw', 'scrypt', 'srp6_kat', 'x509_path_bsi',
-            'x509_path_rsa_pss', 'xmss_keygen', 'xmss_keygen_reference', 'xmss_sign']
+        if target != 'valgrind-full':
+            # valgrind is slow
+            slow_tests = [
+                'argon2', 'bcrypt', 'bcrypt_pbkdf', 'compression', 'cryptobox',
+                'dh_invalid', 'dh_kat', 'dh_keygen', 'dl_group_gen', 'dlies',
+                'dsa_kat_verify', 'dsa_param', 'ecc_basemul', 'ecdsa_verify_wycheproof',
+                'ed25519_sign', 'elgamal_decrypt', 'elgamal_encrypt', 'elgamal_keygen',
+                'ffi_dsa', 'ffi_elgamal', 'mce_keygen', 'passhash9', 'pbkdf', 'rsa_encrypt',
+                'rsa_pss', 'rsa_pss_raw', 'scrypt', 'srp6_kat', 'x509_path_bsi',
+                'x509_path_rsa_pss', 'xmss_keygen', 'xmss_keygen_reference', 'xmss_sign']
 
-        disabled_tests += slow_tests
+            disabled_tests += slow_tests
 
     if target == 'examples':
         flags += ['--with-boost']
@@ -221,7 +223,7 @@ def determine_flags(target, target_os, target_cpu, target_cc, cc_bin, ccache,
         else:
             flags += ['--enable-sanitizers=address']
 
-    if target in ['valgrind', 'sanitizer', 'fuzzers']:
+    if target in ['valgrind', 'valgrind-full', 'sanitizer', 'fuzzers']:
         flags += ['--disable-modules=locking_allocator']
 
     if target == 'emscripten':
diff --git a/src/scripts/dev_tools/run_clang_tidy.py b/src/scripts/dev_tools/run_clang_tidy.py
index 7797e8db6..8c2572871 100755
--- a/src/scripts/dev_tools/run_clang_tidy.py
+++ b/src/scripts/dev_tools/run_clang_tidy.py
@@ -38,8 +38,10 @@ disabled_checks_non_lib = [
     'performance-no-automatic-move',
 ]
 
-# these might be worth being clean for
+# these are ones that ideally we would be clean for, but
+# currently are not
 disabled_needs_work = [
+    'misc-non-private-member-variables-in-classes',
     '*-named-parameter',
     '*-member-init', # seems bad
     'bugprone-lambda-function-name', # should be an easy fix
@@ -51,6 +53,7 @@ disabled_needs_work = [
     'cppcoreguidelines-slicing', # private->public key slicing
     'hicpp-explicit-conversions',
     'misc-const-correctness', # pretty noisy
+    'misc-redundant-expression', # BigInt seems to confuse clang-tidy
     'misc-misplaced-const',
     'misc-confusable-identifiers',
     'modernize-avoid-bind', # used a lot in pkcs11
@@ -149,10 +152,14 @@ def run_clang_tidy(compile_commands_file,
     stdout = run_command(cmdline)
 
     if options.verbose:
-        print(source_file)
+        print("Checked", source_file)
+        sys.stdout.flush()
     if stdout != "":
         print(stdout)
         sys.stdout.flush()
+        return False
+
+    return True
 
 def file_matches(file, args):
     if args is None or len(args) == 0:
@@ -221,14 +228,20 @@ def main(args = None):
              file,
              options)))
 
+    fail_cnt = 0
     for result in results:
-        result.get()
+        if not result.get():
+            fail_cnt += 1
 
     time_consumed = time.time() - start_time
 
     print("Checked %d files in %d seconds" % (files_checked, time_consumed))
 
-    return 0
+    if fail_cnt == 0:
+        return 0
+    else:
+        print("Found clang-tidy errors in %d files" % (fail_cnt))
+        return 1
 
 if __name__ == '__main__':
     sys.exit(main())


Test patch:
diff --git a/src/tests/test_ffi.cpp b/src/tests/test_ffi.cpp
index c02bba5a7..7de13a9d3 100644
--- a/src/tests/test_ffi.cpp
+++ b/src/tests/test_ffi.cpp
@@ -2660,7 +2660,7 @@ class FFI_X25519_Test final : public FFI_Test {
 };
 
 int botan_ffi_view_u8_fn(void* ctx, const uint8_t buf[], size_t len) {
-   if(ctx == NULL || buf == NULL) {
+   if(!ctx || !buf) {
       return BOTAN_FFI_ERROR_NULL_POINTER;
    }
 
@@ -2682,8 +2682,9 @@ class FFI_Kyber512_Test final : public FFI_Test {
             "ee5c56d7490ae77a61b1c5951e359d2a89a946f200b1f647c0283de5d403282c693dfccca1c1b54804ab86f36e1f16550a77b75328916c770c225b142dfb750659ba6d532003f8b6d48825b122682051acda7c20f09117b3e5c93e8c1bd446672512947d964f0484a05b85af82f4401d323484d23373c0c6c8990a3fba70f8a2c13e7350ce945c8f4882b1929f10d18bb45a883c116d1ce06493a50580069743d26062da9171006405d27e2f7220a897024dca507b737a6c32ba3d925e15c9789589507a768ca075beb2fb17a17144c52810566a972dba60ad806a2ff15957a3bbd85a8f1ef34445d18cc668ca7a8ac5fc7545934221a4c92c60024069cc34d592ac30c88c3376bc133622e2b192e9b4b60a9a84e5304873e62d6f98103cc8c43f6024fb7739418cc2602b21416040220cb3ec588679c033d61a3c697c403463c17c13a63d7304044a9f024b907b440b39b7b6423723dda943447a900af0170144755d9a968f634e26f892ee19cd00a97b48d5041b4473ec8741e077126f85bbb8334b8b2cbd63429afa543a540740c1e56893f6b2f2f7c42a12bcd48c647726cca06841212656ff9b3d3e799e92c48414d653a61ca8dc2c49b7342469a868b7938db8d7844e6311134b2c30538ffa927ee3961a44e0a66438c5643aa1d13658fe8a7c2a84702a8211422831994ca1e801131ab88a25162d3cd988ebe09e6cb01ca7324256691635c536f576990664841b7c89b0dc325472271fdc2b0824a9514b5eb46a743f9734ee20648a407f5d505cc9614748f344a16950b5483e45516236d43afd1494d564c23e20b64a124593604404c879a776a5bd9399629600e86aa1a641be7a13418cda318bbc3af0c2a66c999841251a1c2868b05028f6a56a72c33d8a653c77f69af4247dc6f80d329921ce3355894605c35372ddf0c84cacb42d6ccbdf39a55b672a891749622a011747a01625764c788413f2c0fd877275c88fd5730fa9e87a3c783702223a4443525cc5b5381c976dd9cb08ac47490125ca5c70baac01ff9143bc40ceeb2a16c1529d70c07074a0013749656ff4b16d890868b26c99bf8461495793bbb1b12ca369c825cb31d68731326bf4764b416bb333");
 
          botan_privkey_t b_priv;
-         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 1632)))
+         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 1632))) {
             return;
+         }
 
          std::vector<uint8_t> privkey_read(1632);
          TEST_FFI_OK(botan_privkey_view_kyber_raw_key, (b_priv, privkey_read.data(), botan_ffi_view_u8_fn));
@@ -2720,8 +2721,9 @@ class FFI_Kyber768_Test final : public FFI_Test {
             "f9490f1755c744d9988ed60475e6ae44355ed15c7b549366f29581ec2721fd6704e0ca3f878812805675141c0a15a7b7ac35a9e3f8b2a010bc184981c57852895b2695d56131e32326717f6b101df1bc82b3ba0222d52656d118538c4ca3416be1c76ba37a9901a36e4883be6c541f2bbb561818cd2f136b98f658250545c1fa5bcfdc04374016db1c5132447fd6d568866451c25412f72967de868eaeb9c546fb40ea88cd84a1a586ca51c74bc9c3e56e104323afb658d1ac003151bdc35879a4b6762648bff0caa682f1b3319805d2326d5a46af832aacefbaa1ea820568ea3925870e9b6577eb93898e1b0cfbd1c995cb4cd6cabb979813819749b40a9952f50e97c4365e777dcfe9084219294c205acb350e07db9c98f53444546460962e2bf5aa1cc12273d882fcc215a7397b3f9b307c56b9a0429b30f88453a2376669b28b4bc4b84b51714b6652b7a1a0b53e9ec61b55ca51cdb38243239ee5f18243e515f178768a888f475b3d9060136bb22ee355b3da02c16ad83bdbb4aaa13809cb4bcd5bb53710737d3883632f9254e3336af61621a376720572450e3937c0d930e349adbfa7642ff822b9135e18f943e0178617604d10e0c09ffb3e09783c09d12cbe93311757af9857b77d1488ed39321ca97c3745c5bc176ca81274c8321bcb2029938b32bbd01aec137032f9760849701649120050b50d8353c36b8bb7724a67e7660fc93324065d63912c35a86d8fe60683067bbd2685c552ad8c65c77c57c937676fd61595c453174bf996e9d3a9ccb837b25464115c1ba3343ac097b80735aed3225091167cd8f841ffe49c5e698ef542124253084623179394433a4b61547b9ee09c98c2736ea086bd69d1bc7ae68a6ae5ce682a215860006b4604dee45a3e212f97643acb77a79a880382e483537c5198d4483a176d25aac9c3670a3f30956f18ad441904776bcd48131c7d6465bce0c133010f3176c92ec962f5c6b84d4c3ae949619cf48172997ca3b1ccf5c8cc7a67923e1295801048a3d40ac4f2c6467c750fc71314a0c1fc22637dd52e7ea50907ea973d765a6a9bb2b11aa405b9187f72026696710e61af3e41c33da1a05eb65e6523704f078e74e32f10e00247967aee3a8c6546889ef67cd613ad7236583f2104122ac6c6a40a84dc96d81c569e76a952c0a25f396e48337a4fe029a4c91cc7406872706a55573b75f160a4facad7c85fab141c63454bf48990729096ce9965604c7cc1e60ae6868dcc41bc3df71c3e5593f0488b0c6a3063e817f9f4bacb17599c8666ff3591126b4891fb7f5d29660bab60cf5007043a4311d41ab3b29787184f3d3c9ab7cc247f635145b67e970505ba44ad0e06b11ec5cda4175295199d19d660204cbdc17947cc66442d3a2cd408a20fe98174f31ee4e5bb3fa8bcd102bedc26527e9bae836442978a6ccbe510f93ab77569ab1f09d0e6312dd0cc0bcaf095fa8a52a7212d14714a7bf852416c9b026301bd965c30a43d24d97298346a46b2c4bc814ba4059653358b03c9456c60bf0193932eaa2f24ea8e4b010a5a4425ce4540fbab90d8e55c97ac2687f15ff5299278824a08d4743e1a62e1c6619cd3278cd75a97a5b4e3a38668b26c99bf8461495793bbb1b12ca369c825cb31d68731326bf4764b416bb333");
 
          botan_privkey_t b_priv;
-         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 2400)))
+         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 2400))) {
             return;
+         }
 
          std::vector<uint8_t> privkey_read(2400);
          TEST_FFI_OK(botan_privkey_view_kyber_raw_key, (b_priv, privkey_read.data(), botan_ffi_view_u8_fn));
@@ -2758,8 +2760,9 @@ class FFI_Kyber1024_Test final : public FFI_Test {
             "93bc837be699d5279dac78c9d49818ebc91d4ff6cb54b294e4c378d8eb584f561d21ca87b7c77b1c551f52112ba72c4b6514bb286856e89b48b0a62bad093894474b246a515f849056c9aeb572060ee11b93e236204a8ff1784ede0c3f4c0cd0cdb2a50bd4bcb1225c0dd2caa8a129fdcb01f0e1a75da465b6b8742e4946dbe3ab21ca6c4e592d398a5700375b7b770c17e117663b51313824854585ece4a1520c59a513555f548afdc6748eb9b770b7af8adc9b3c1861efc00ebde93f91fa1539c3411ec9b154c93d1f508b9714cdd0aaabcb436951aa54978b84faa8bd838c29a12657a6389fa658237326bf80e44cff183d9c9107d30c7b4df83908a8badbc1bb5328ae61e6451291710408196261bb913b285c168fe5c7456cd74970377330139beb4c8b4c00c5954254a748308bc30f3a1ccabed83628422e5515b294e80bfed024902a81518c0e6827caa13230016b72aec10d31aab9f9b072652486c3b779c845804d001b223b4065667a5e318b4e0b27c41a099168ce763ac245c1c26354cfc8214cacf01dc8c99c5fc855639cb7486a7a6b71766d62369ee6349f521591344fb8026099fc055c3a0ca2002271c9361f52acaf4675a97b3593f3447b284ad69a9711501411e14e48f080e2a0bceba07a02f79dc15c3c971c1e671a66bf7144395a94d08c46603c4369b25b38d924693492f6500745cb1d2a037e2cd814fac70d8254aea4526e061648d227350dec1ba6305299a45bde4029a9f63e4f62acb5246ba8b54208a37b98fa77e4b720f02b18969635cc16cb6e236ff78111b621cab0339c60b529a9207c94a74925aa3d177636a6d205d72b429f614d452358b98582e42c2f3a32c94202a8625a760483807bbac74c083a7a786ae7b46aff3810a5318e3f479e67e83b4c94587d345ffda17273a55e0432281c670e36b76539263636445e4d110fa1c92b2e65b1ee993b26c41c8c66b181206ff559728993503e7611fa0ca24156642d29a52cbb6aeff88fa1bb790b4344472503ae77967d11a904550a95cc47c3435f1e44b4b890cf5dc4cbd7486a6cab60d1a6622e40c67e854ed0e6a0c4c2aa92a29731e69bc6b3ca9e83893df4bdb37338055bc16bc7cd875b0691d0212109b77236b10b0c72b7a76e9ce346061028be3271c480435e2482d3d2733ed619c2d3698d29a3225a7731a62db4f214a0b11569e91895fbccb8a92d18f94d307a542ff96d2ce8c2bbaa8fab948c83365162268124cabe934b3a5e6530b7f74397a980c243bdce2989747565dd9ba65a7498aa7c3ee711c3be239e93cb45134c082a900cc951756afa42e74a65001822cab95f41798fdef89ea8a751740842e2f7a271e98dbd5158d7455fe9b9cdcd0a0f68c91e59b00979673a1deabf8d213971f994c0bb08899a91e0b896319b9fc69651e3453b14d1cc94462341548fc81c643ab0b10303c7be2c3458b226d0e45f58b21658a853b84615ac5234da9bc5699646fc53c0df907f9a3c598dab6c409b7884a7a84e1a51c2caa80779cd86b77314dabae85caa28972bb6503273a82eb96ab24af6bb0ad0c9ba07ce24216696e265206abc9e147ceef1ad2e343d17aabbc4803496366c7afb53f604c92323c70be5c1e3f601c215c888f3ab239c72aba0634a2901a71891f5d072d41b524e410c7f276ff1109878d7196b5615f1f50c13976257600a821909cb36cf8d2857a2f801cf258913f56a5153234640b9e61bbd4e7b69f83a1eb8ac6b92cb841e808b700aa784a733451048211797563cccc748c9fbb54b3b65445cba676149c7ae9a9a2ecab6599b8505bc561ad85d8c052ed9669e50e684270c86f1cb4fd6708a6746c643392c8a088477dc8bf58ba4a54a8b79e523fc19a28bd47d7e5a334d8296ec86c7f52b7e73b475a0716422953cdd8a8aed0b3a84dc8425145c240c55870240a23977215b364c5596286bc496728717c329dd4b5d0b310980bc0b3f591a2d5cb2c9eaccfa1c7d3a096fc11091a4007a0f23a59782699c3171da53bc7b914f26c95391d6445073a1bd7a44691bafab9c9aceccc7ec389255c3a0ff24c71b30b6bf80c010803383485a7b295991d759cefbae257bbdee1806818565ebd09bf814c98686bbf44a0b14d28735f79ca2261bf9a31b2ca090c7667168b26c99bf8461495793bbb1b12ca369c825cb31d68731326bf4764b416bb333");
 
          botan_privkey_t b_priv;
-         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 3168)))
+         if(!TEST_FFI_INIT(botan_privkey_load_kyber, (&b_priv, b_priv_bits.data(), 3168))) {
             return;
+         }
 
          std::vector<uint8_t> privkey_read(3168);
          TEST_FFI_OK(botan_privkey_view_kyber_raw_key, (b_priv, privkey_read.data(), botan_ffi_view_u8_fn));
diff --git a/src/tests/test_strong_type.cpp b/src/tests/test_strong_type.cpp
index 229144ee6..53bdd12a8 100644
--- a/src/tests/test_strong_type.cpp
+++ b/src/tests/test_strong_type.cpp
@@ -357,11 +357,11 @@ std::vector<Test::Result> test_integer_strong_type() {
 using Test_Foo = Botan::Strong<std::vector<uint8_t>, struct Test_Foo_>;
 using Test_Bar = Botan::Strong<std::vector<uint8_t>, struct Test_Bar_>;
 
-[[maybe_unused]] int test_strong_helper(Botan::StrongSpan<Test_Foo>) { return 0; }
+[[maybe_unused]] int test_strong_helper(const Botan::StrongSpan<Test_Foo>&) { return 0; }
 
-[[maybe_unused]] int test_strong_helper(Botan::StrongSpan<const Test_Foo>) { return 1; }
+[[maybe_unused]] int test_strong_helper(const Botan::StrongSpan<const Test_Foo>&) { return 1; }
 
-[[maybe_unused]] int test_strong_helper(Botan::StrongSpan<Test_Bar>) { return 2; }
+[[maybe_unused]] int test_strong_helper(const Botan::StrongSpan<Test_Bar>&) { return 2; }
 
 Test::Result test_strong_span() {
    Test::Result result("StrongSpan<>");
diff --git a/src/tests/test_tests.cpp b/src/tests/test_tests.cpp
index 8098792e5..5efb5e323 100644
--- a/src/tests/test_tests.cpp
+++ b/src/tests/test_tests.cpp
@@ -146,8 +146,9 @@ class Test_Tests final : public Test {
          {
             Test::Result test_result(testcase_name);
             test_result.test_throws("test_throws", "expected msg", []() {
+               // NOLINTNEXTLINE(hicpp-exception-baseclass)
                throw std::string("not even a std::exception");
-            });  // NOLINT(hicpp-exception-baseclass)
+            });
             verify_failure("test_throws 3", result, test_result);
          }