Draft: Refactor testsuite

.gitattributes

@@ -0,0 +1,3 @@
+.gitattributes export-ignore
+.github/** export-ignore
+.gitignore export-ignore

.github/workflows/coverage.yaml

@@ -0,0 +1,53 @@
+name: Deploy static content to Pages
+
+on:
+  push:
+    branches: ["master"]
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checking out the code
+        uses: actions/checkout@v3
+      - name: Cache musl toolchain
+        uses: actions/cache@v3
+        id: cache-musl
+        with:
+          path: x86_64-linux-musl-native
+          key: musl
+      - name: Downloading musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: wget --quiet https://musl.cc/x86_64-linux-musl-native.tgz
+      - name: Extracting musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: tar xzf ./x86_64-linux-musl-native.tgz
+      - name: Installing lcov
+        run: sudo apt install lcov
+      - name: Running the testsuite
+        run: make -C tests clean coverage run
+      - name: Setup Pages
+        uses: actions/configure-pages@v3
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v1
+        with:
+          # Upload entire repository
+          path: './tests/coverage/'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v2
+

.github/workflows/coverity.yaml

@@ -0,0 +1,51 @@
+name: Coverity scan
+on:
+  schedule:
+    - cron: '0 18 * * 1' # Weekly at 18:00 UTC on Mondays
+
+jobs:
+  latest:
+    runs-on: ubuntu-latest
+    container: debian:stable
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Install dependencies
+        run: |
+          apt update
+          DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends curl ca-certificates make wget
+      - name: Cache musl toolchain
+        uses: actions/cache@v3
+        id: cache-musl
+        with:
+          path: x86_64-linux-musl-native
+          key: musl
+      - name: Downloading musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: wget --quiet https://musl.cc/x86_64-linux-musl-native.tgz
+      - name: Extracting musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: tar xzf ./x86_64-linux-musl-native.tgz
+
+      - name: Download Coverity Build Tool
+        run: |
+          curl https://scan.coverity.com/download/linux64 --form token=$TOKEN --form project=jvoisin/fortify-headers -o cov-analysis-linux64.tar.gz
+          mkdir cov-analysis-linux64
+          tar xzf cov-analysis-linux64.tar.gz --strip-components=1 -C cov-analysis-linux64
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
+      - name: Build with cov-build
+        run: ./cov-analysis-linux64/bin/cov-build --dir cov-int make -C tests gcc
+      - name: Submit the result to Coverity Scan
+        run: |
+          tar czf fortify-headers.tgz cov-int
+          curl \
+            --form project=jvoisin/fortify-headers \
+            --form token=$TOKEN \
+            --form file=@fortify-headers.tgz \
+            --form version=master \
+            --form email=julien.voisin+coverity@dustri.org \
+            --form description=master \
+            https://scan.coverity.com/builds?project=jvoisin/fortify-headers
+        env:
+          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}

.github/workflows/documentation.yaml

@@ -0,0 +1,18 @@
+name: Check that the README is up to date
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  latest:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checking out the code
+        uses: actions/checkout@v3
+      - run: |
+          for function in $(find include/ -type f -exec sed -n 's/^_FORTIFY_FN(\([^)]\+\)).*/\1/p' '{}' ';' | sort | uniq)
+          do
+          	grep "\`$function\`" README.md || (echo "Please add \`$function\` to the README.md file." && exit 1)
+          done
+

.github/workflows/testsuite.yaml

@@ -0,0 +1,113 @@
+name: Test suite
+on:
+  pull_request:
+  push:
+  schedule:
+    - cron: '0 16 * * 5'
+
+jobs:
+  gcc:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        version: [9, 10, 11, 12, 13]
+        use_native_chk: [true, false]
+    env:
+      CC: ../x86_64-linux-musl-native/bin/gcc
+      SYS_INCLUDES: -I/usr/include/x86_64-linux-musl -I../x86_64-linux-musl-native/include/ -Ix86_64-linux-musl-native/include/
+    steps:
+      - name: Checking out the code
+        uses: actions/checkout@v3
+      - name: Cache musl toolchain
+        uses: actions/cache@v3
+        id: cache-musl
+        with:
+          path: x86_64-linux-musl-native
+          key: musl
+      - name: Downloading musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: wget --quiet https://musl.cc/x86_64-linux-musl-native.tgz
+      - name: Extracting musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: tar xzf ./x86_64-linux-musl-native.tgz
+      - name: Setting up gcc version
+        run: |
+          sudo add-apt-repository ppa:ubuntu-toolchain-r/test
+          sudo apt update
+          sudo apt install -y --no-install-recommends gcc-${{ matrix.version }} g++-${{ matrix.version }}
+          sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-${{ matrix.version }} 100
+          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${{ matrix.version }} 100
+      - name: Build with native chk
+        if: ${{ matrix.use_native_chk == true }}
+        run: make TARGET_DIR=out.gcc.native_chk CFLAGS=-DFORTIFY_USE_NATIVE_CHK -C tests
+      - name: Build without native chk, and run the testsuite
+        if: ${{ matrix.use_native_chk == false }}
+        shell: bash
+        run: |
+          make -C tests check > ./results.txt
+          grep -zvq 'FAIL' ./results.txt
+
+  clang:
+    runs-on: ubuntu-latest
+    env:
+      SYS_INCLUDES: -I/usr/include/x86_64-linux-musl -I../x86_64-linux-musl-native/include/ -Ix86_64-linux-musl-native/include/
+      CC: clang
+    strategy:
+      matrix:
+        version: [13, 14, 15]
+        use_native_chk: [true, false]
+    steps:
+      - name: Checking out the code
+        uses: actions/checkout@v3
+      - name: Cache musl toolchain
+        uses: actions/cache@v3
+        id: cache-musl
+        with:
+          path: x86_64-linux-musl-native
+          key: musl
+      - name: Downloading musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: wget --quiet https://musl.cc/x86_64-linux-musl-native.tgz
+      - name: Extracting musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: tar xzf ./x86_64-linux-musl-native.tgz
+      - name: Setting up clang version
+        run: |
+          sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${{ matrix.version }} 100
+          sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${{ matrix.version }} 100
+      - name: Build with native chk
+        if: ${{ matrix.use_native_chk == true }}
+        run: make CFLAGS=-DFORTIFY_USE_NATIVE_CHK SYS_INCLUDES="$SYS_INCLUDES" CC=clang -C tests clang
+      - name: Building and running without native chk
+        if: ${{ matrix.use_native_chk == false }}
+        shell: bash
+        run: |
+          make SYS_INCLUDES="$SYS_INCLUDES" CC=clang TARGET_DIR=out.clang -C tests check > ./results.txt
+          grep -zvq 'FAIL' ./results.txt
+
+  c_versions:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        version: ["c89", "c99", "c11", "c17"]
+    steps:
+      - name: Checking out the code
+        uses: actions/checkout@v3
+      - name: Cache musl toolchain
+        uses: actions/cache@v3
+        id: cache-musl
+        with:
+          path: x86_64-linux-musl-native
+          key: musl
+      - name: Downloading musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: wget --quiet https://musl.cc/x86_64-linux-musl-native.tgz
+      - name: Extracting musl-based toolchain
+        if: steps.cache-musl.outputs.cache-hit != 'true'
+        run: tar xzf ./x86_64-linux-musl-native.tgz
+      - name: Building with clang
+        shell: bash
+        run: make CFLAGS=-std=${{ matrix.version }} -C tests clean clang
+      - name: Building with gcc
+        shell: bash
+        run: make CFLAGS=-std=${{ matrix.version }} -C tests clean gcc

.gitignore

@@ -0,0 +1,5 @@
+x86_64-linux-musl-native
+x86_64-linux-musl-native.tgz
+tests/*
+!tests/*.c
+!tests/Makefile

Makefile

@@ -1,9 +1,11 @@
-VERSION = 1.1
+VERSION = 2.1
 PREFIX = /usr/local
 
 install:
-	mkdir -p $(DESTDIR)$(PREFIX)/include/fortify
-	cp -R include/* $(DESTDIR)$(PREFIX)/include/fortify
+	install -D -t $(DESTDIR)$(PREFIX)/include/fortify \
+		include/*.h
+	install -D -t $(DESTDIR)$(PREFIX)/include/fortify/sys \
+		include/sys/*.h
 
 uninstall:
 	rm -rf $(DESTDIR)$(PREFIX)/include/fortify
@@ -15,6 +17,8 @@ dist: clean
 	gzip fortify-headers-$(VERSION).tar
 	rm -rf fortify-headers-$(VERSION)
 
+check:
+	$(MAKE) -C tests check
 clean:
 	rm -f fortify-headers-$(VERSION).tar.gz