test

.github/workflows/ci.yml

@@ -8,25 +8,18 @@
 
 name: CI
 
-on:
-  # Triggers the workflow on push or pull request events but only for the master branch
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-  # Allows running workflow manually
-  workflow_dispatch:
+on: [push, fork]
 
 jobs:
   POSIX:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
+        compiler: [gcc, clang]
         build_system: [autotools, cmake]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4.1.0
+      - uses: actions/[email protected].6
 
       ########################
       # Install Dependencies #
@@ -37,12 +30,12 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
         run: |
             sudo apt-get update
-            sudo apt-get install -y autoconf automake build-essential po4a autopoint gcc-multilib doxygen musl-tools valgrind
+            sudo apt-get install -y autoconf automake build-essential po4a autopoint ${{ matrix.compiler }} gcc-multilib doxygen musl-tools valgrind
 
       # Install Autotools on Mac
       - name: Install Dependencies
         if: ${{ matrix.os == 'macos-latest' && matrix.build_system == 'autotools' }}
-        run: brew install autoconf automake libtool po4a doxygen
+        run: brew install autoconf automake libtool po4a doxygen gcc llvm
 
       # Install CMake on Linux
       - name: Install Dependencies
@@ -70,33 +63,33 @@ jobs:
       # done first.
       - name: Build 32-bit
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
-        run: ./build-aux/ci_build.bash -b autotools -p build -f "-m32"
+        run: ./build-aux/ci_build.bash -b autotools -p build -m "${{ matrix.compiler }}" -f "-m32"
       - name: Test 32-bit
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
         run: |
-            ./build-aux/ci_build.bash -b autotools -p test -f "-m32" -n 32_bit
+            ./build-aux/ci_build.bash -b autotools -p test -m "${{ matrix.compiler }}" -f "-m32" -n 32_bit
             cd ../xz_build && make distclean
 
       # The sandbox must be disabled because it will prevent access to
       # the /proc/ filesystem on Linux, which is used by the sanitizer's
       # instrumentation.
       - name: Build with -fsanitize=address,undefined
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
-        run: ./build-aux/ci_build.bash -b autotools -p build -f "-fsanitize=address,undefined" -d sandbox
+        run: ./build-aux/ci_build.bash -b autotools -p build -m "${{ matrix.compiler }}" -f "-fsanitize=address,undefined" -d sandbox
       - name: Test with -fsanitize=address,undefined
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
         run: |
             export UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1
-            ./build-aux/ci_build.bash -b autotools -p test -f "-fsanitize=address,undefined" -d sandbox
+            ./build-aux/ci_build.bash -b autotools -p test -m "${{ matrix.compiler }}" -f "-fsanitize=address,undefined" -d sandbox
             cd ../xz_build && make distclean
 
       - name: Build with Valgrind
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
-        run: ./build-aux/ci_build.bash -b autotools -p build -d sandbox
+        run: ./build-aux/ci_build.bash -b autotools -p build -m "${{ matrix.compiler }}" -f "-gdwarf-4" -d sandbox
       - name: Test with Valgrind
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.build_system == 'autotools' }}
         run: |
-            ./build-aux/ci_build.bash -b autotools -p test -d sandbox -w "valgrind --quiet --trace-children=yes --exit-on-first-error=yes --error-exitcode=1"
+            ./build-aux/ci_build.bash -b autotools -p test -m "${{ matrix.compiler }}" -f "-gdwarf-4" -d sandbox -w "valgrind --quiet --trace-children=yes --trace-children-skip-by-arg=ls,cp,sed,grep,bash,sh --exit-on-first-error=yes --error-exitcode=1"
             cd ../xz_build && make distclean
 
       - name: Build with musl libc
@@ -111,52 +104,52 @@ jobs:
         run: cd ../xz_build && make distclean
 
       - name: Build with full features
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -p build
       - name: Test with full features
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -p test -n full_features
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -p test -n full_features
 
       - name: Build without encoders
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d encoders,shared -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d encoders,shared -p build
       - name: Test without encoders
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d encoders,shared -p test -n no_encoders
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d encoders,shared -p test -n no_encoders
 
       - name: Build without decoders
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d decoders,shared -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d decoders,shared -p build
       - name: Test without decoders
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d decoders,shared -p test -n no_decoders
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d decoders,shared -p test -n no_decoders
 
       - name: Build without threads
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d threads,shared -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d threads,shared -p build
       - name: Test without threads
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d threads,shared -p test -n no_threads
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d threads,shared -p test -n no_threads
 
       - name: Build without BCJ filters
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d bcj,shared,nls -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d bcj,shared,nls -p build
       - name: Test without BCJ filters
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d bcj,shared,nls -p test -n no_bcj
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d bcj,shared,nls -p test -n no_bcj
 
       - name: Build without Delta filters
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d delta,shared,nls -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d delta,shared,nls -p build
       - name: Test without Delta filters
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d delta,shared,nls -p test -n no_delta
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d delta,shared,nls -p test -n no_delta
 
       - name: Build without sha256 check
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -c crc32,crc64 -d shared,nls -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -c crc32,crc64 -d shared,nls -p build
       - name: Test without sha256 check
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -c crc32,crc64 -d shared,nls -p test -n no_sha256
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -c crc32,crc64 -d shared,nls -p test -n no_sha256
 
       - name: Build without crc64 check
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -c crc32,sha256 -d shared,nls -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -c crc32,sha256 -d shared,nls -p build
       - name: Test without crc64 check
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -c crc32,sha256 -d shared,nls -p test -n no_crc64
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -c crc32,sha256 -d shared,nls -p test -n no_crc64
 
       - name: Build small
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d small -p build
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d small -p build
       - name: Test small
-        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d small -p test -n small
+        run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -m "${{ matrix.compiler }}" -d small -p test -n small
 
       # Attempt to upload the test logs as artifacts if any step has failed
-      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 #v4.0.0
+      - uses: actions/upload-artifact@v4.3.3
         if: ${{ failure() }}
         with:
           name: ${{ matrix.os }} ${{ matrix.build_system }} Test Logs

.github/workflows/cifuzz.yml

@@ -0,0 +1,42 @@
+# https://google.github.io/oss-fuzz/getting-started/continuous-integration/
+name: CIFuzz
+on: [push, pull_request]
+permissions: {}
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined, memory]
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'xz'
+        language: c++
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'xz'
+        language: c++
+        fuzz-seconds: 600
+        sanitizer: ${{ matrix.sanitizer }}
+        output-sarif: true
+    - name: Upload Crash
+      uses: actions/upload-artifact@v3
+      if: steps.build.outcome == 'success'
+      with:
+        name: ${{ matrix.sanitizer }}-artifacts
+        path: ./out/artifacts
+    - name: Upload Sarif
+      if: always() && steps.build.outcome == 'success'
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        # Path to SARIF file relative to the root of the repository
+        sarif_file: cifuzz-sarif/results.sarif
+        checkout_path: cifuzz-sarif

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: "CodeQL"
+
+on:
+  push:
+    #branches: [ "master" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    #branches: [ "master" ]
+  schedule:
+    - cron: '45 12 * * 5'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'c' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        queries: +security-extended,security-and-quality
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update -q
+        sudo apt-get install -q -y build-essential cmake
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/freebsd.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Test xz on FreeBSD
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4
+    - uses: actions/checkout@v4.1.6
     - name: Test in FreeBSD
       id: test
       uses: vmactions/FreeBSD-vm@f8be330398166d1eb0601f01353839d4052367b2 #v1.0.7
@@ -23,8 +23,20 @@ jobs:
         prepare: |
          pkg install -y autoconf automake gmake gettext-tools gtar libtool m4 po4a
         run: |
+          set -e
           export LC_ALL=C LANG=C
-          uname -a
+
+          printf "Dumping system information\n"
+          for cmd in 'freebsd-version' 'cat /etc/release' 'uname -a' 'cc --version' \
+            'gcc --version' 'clang --version' 'ld --version' \
+            'autoconf --version' 'automake --version' 'libtool --version' \
+            'gettext --version' 'm4 --version' \
+            'sed --version' 'awk --version' ; do
+            printf "Running cmd: %s\n" ${cmd}
+            ${cmd} || true
+          done
+          printf "\n\n"
+
           ./autogen.sh
           ./configure --enable-werror
           make

.github/workflows/netbsd.yml

@@ -14,17 +14,29 @@ jobs:
     runs-on: ubuntu-latest
     name: Test xz on NetBSD
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4
+    - uses: actions/checkout@v4.1.6
     - name: Test in NetBSD
       id: test
       uses: vmactions/NetBSD-vm@da9ed4d7cd0fb64f330e2342ac5c77ba529b6a11 #v1.0.7
       with:
         usesh: true
         prepare: |
-          /usr/sbin/pkg_add -v autoconf automake gmake gettext-tools gtar-base libtool-base m4
+          /usr/sbin/pkg_add -v autoconf automake gmake gettext-tools gtar-base libtool-base m4 po4a
         run: |
+          set -e
           export LC_ALL=C LANG=C
-          uname -a
+
+          printf "Dumping system information\n"
+          for cmd in 'freebsd-version' 'cat /etc/release' 'uname -a' 'cc --version' \
+            'gcc --version' 'clang --version' 'ld --version' \
+            'autoconf --version' 'automake --version' 'libtool --version' \
+            'gettext --version' 'm4 --version' \
+            'sed --version' 'awk --version' ; do
+            printf "Running cmd: %s\n" ${cmd}
+            ${cmd} || true
+          done
+          printf "\n\n"
+
           ./autogen.sh
           ./configure --enable-werror
           make

.github/workflows/openbsd.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Test xz on OpenBSD
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v4
+    - uses: actions/checkout@v4.1.6
     - name: Test in OpenBSD
       id: test
       uses: vmactions/OpenBSD-vm@eaa3d3f695a5a52971c23958f6dd4cd3397f959d #v1.0.8
@@ -23,11 +23,24 @@ jobs:
         prepare: |
           /usr/sbin/pkg_add -I -v autoconf-2.71 automake-1.16.5 gmake gettext-tools gtar libtool m4
         run: |
+          set -e
           export LC_ALL=C LANG=C
           export AUTOCONF_VERSION=2.71
           export AUTOMAKE_VERSION=1.16
-          uname -a
-          ./autogen.sh
+
+          printf "Dumping system information\n"
+          for cmd in 'freebsd-version' 'cat /etc/release' 'uname -a' 'cc --version' \
+            'gcc --version' 'clang --version' 'ld --version' \
+            'autoconf --version' 'automake --version' 'libtool --version' \
+            'gettext --version' 'm4 --version' \
+            'sed --version' 'awk --version' ; do
+            printf "Running cmd: %s\n" ${cmd}
+            ${cmd} || true
+          done
+          printf "\n\n"
+
+          # OpenBSD ports lack po4a
+          ./autogen.sh --no-po4a
           ./configure --enable-werror
           make
           make check VERBOSE=1

.github/workflows/solaris.yml

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: 0BSD
+
+name: Solaris
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+jobs:
+  solaris-test:
+    runs-on: ubuntu-latest
+    name: Test xz on Solaris
+    steps:
+    - uses: actions/[email protected]
+    - name: Test in Solaris
+      id: test
+      uses: vmactions/solaris-vm@548f790d1bc2b9342a76cbb47ddbb85875605559 #v1.0.2
+      with:
+        usesh: true
+        prepare: |
+          pkg install bash libtool automake gnu-m4 tree wget gcc autoconf
+        run: |
+          export LC_ALL=C LANG=C
+
+          printf "Dumping system information\n"
+          for cmd in 'freebsd-version' 'cat /etc/release' 'uname -a' 'cc --version' \
+            'gcc --version' 'clang --version' 'ld --version' \
+            'autoconf --version' 'automake --version' 'libtool --version' \
+            'gettext --version' ; do
+            printf "Running cmd: %s\n" ${cmd}
+            ${cmd} || true
+          done
+          printf "\n\n"
+
+          ./autogen.sh
+          ./configure --enable-werror
+          make
+          make check VERBOSE=1