.gitlab-ci.yml

# Gitlab CI settings for building and testing Maat.

variables:
  SARACODE_ROOT: https://saracode-backend.jhuapl.edu/v2/project
  ARCHIVE_USER: archive
  ARCHIVE_HOST: manda-ci-repo.jhuapl.edu

stages:
  - sara-kickoff
  - build
  - docs
  - test
  - package
  - deploy
  - systemtest
  - sara-collect

## MACROS

# default settings used by most tasks
default:
  before_script:
    - autoreconf -i
    - "[ -d build ] || mkdir build"
    - cd build

# configure and build without selinux
.build_no_selinux: &build_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux
  - make install

# configure and build without selinux and without TPM
.build_no_selinux_no_tpm: &build_no_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm
  - make install

# configure and build with selinux and without TPM
.build_with_selinux_no_tpm: &build_with_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-tpm
  - make install

# build documentation
.build_docs: &build_docs
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm
  - make docs
  - mv documentation/build ../maat-docs

# run check tests without selinux
.test_no_selinux: &test_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests
  - make check

# run check tests without selinux adn without TPM
.test_no_selinux_no_tpm: &test_no_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm
  - make check

# Run check tests with gcc address sanitizer enabled
.test_asan: &test_asan
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check

# Run check tests with gcc address sanitizer enabled without TPM
.test_asan_no_tpm: &test_asan_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm --enable-tests CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check

# Build debian packages for ${release} and ${arch}
.deb_build: &deb_build
  - /usr/bin/pbuilder-dist ${release} ${arch} create
  - /usr/bin/pbuilder-dist ${release} ${arch} update # is this necessary?
  - ../configure --prefix=/usr --disable-selinux --disable-tpm
  - make dist
  - mkdir staging
  - cp maat-*.tar.gz staging
  - mkdir tmp
  - cd tmp
  - tar xzf ../maat-*.tar.gz
  - sed -i.bak "s/-1)/-1${release}0)/g" maat-*/debian/changelog
  - dpkg-source -b maat-*
  - echo "PBUILDERSATISFYDEPENDSCMD=${PBSAT}" > .pbset-${release}-${arch}
  - /usr/bin/pbuilder-dist ${release} ${arch} build --buildresult $PWD/../staging/${release}-${arch}-results --configfile .pbset-${release}-${arch} maat*${release}*.dsc

# Create debian repo for ${release}
.deb_repo: &deb_repo
  - cd build/staging
  - mkdir -p ubuntu/conf
  - cp ../../ci/ubuntu_distributions ubuntu/conf/distributions
  - "echo \"Codename: ${release}\" >> ubuntu/conf/distributions"
  - echo "basedir ." > ubuntu/conf/options
  - cd ubuntu
  - reprepro -V includedeb ${release} ../${release}-*-results/maat*.deb
  - cd ../..
  - mv staging maat-$CI_COMMIT_SHORT_SHA
  - scp -r maat-$CI_COMMIT_SHORT_SHA $ARCHIVE_USER@$ARCHIVE_HOST:/var/www/data/deb/

# Create RPM repo for ${release} and ${arch}
.rpm_repo: &rpm_repo
  - ../configure --prefix=/usr --disable-selinux-libdir-mapping --disable-tpm
  - make dist
  - "[ -d SOURCES ] || mkdir SOURCES"
  - cp maat-*.tar.gz SOURCES/
  - mkdir -p staging/epel/${release}/${arch}
  - cd staging/epel/${release}/${arch}
  - createrepo -p -d -v .
  - cd ../../../../
  - cp /etc/mock/${distro}-${release}-${arch}.cfg .
  - mock -r ${distro}-${release}-${arch}.cfg --buildsrpm --spec ../rpm/maat.spec --sources SOURCES
  - rm -rf staging/epel/${release}/${arch}/maat-*.src.rpm
  - cp /var/lib/mock/${distro}-${release}-${arch}/result/maat-*.src.rpm staging/epel/${release}/${arch}
  - mock -v --no-clean -r ${distro}-${release}-${arch}.cfg --rebuild staging/epel/${release}/${arch}/maat-*.src.rpm
  - rm -f staging/epel/${release}/${arch}/maat-*.rpm
  - cp -v  /var/lib/mock/${distro}-${release}-${arch}/result/maat-*.rpm staging/epel/${release}/${arch}/
  - cd staging/epel/${release}/${arch}
  - createrepo -p -d -v .
  - cd ../../../
  - scp -r epel $ARCHIVE_USER@$ARCHIVE_HOST:/var/www/data/rpm/$CI_COMMIT_SHORT_SHA/

## sara-kickoff

# Start saracode analysis
kickoff-saracode:
  stage: sara-kickoff
  inherit:
    default: false
  script:
    - ci/sara_kickoff.sh
  artifacts:
    paths:
      - saracode_build_id
    expire_in: 2 hours
    when: on_success

## build

# build without selinux for ubuntu20
build-ubuntu20:
  stage: build
  tags:
    - ubuntu20
  script:
    - *build_no_selinux_no_tpm

# build without selinux with TPM for ubuntu20
build-ubuntu20-tpm:
  stage: build
  tags:
    - maat-swtpm
  script:
    - *build_no_selinux

# build without selinux for ubuntu22
build-ubuntu22:
  stage: build
  tags:
    - ubuntu22
  script:
    - *build_no_selinux_no_tpm

# build without selinux for rhel7
build-rhel7-no-selinux:
  stage: build
  tags:
    - rhel7
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel7
build-rhel7-selinux:
  stage: build
  tags:
    - rhel7
  script:
    - *build_with_selinux_no_tpm
  after_script:
    - sudo semodule -r maat

# build without selinux for rhel8
build-rhel8-no-selinux:
  stage: build
  tags:
    - rhel8
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel8
build-rhel8-selinux:
  stage: build
  tags:
    - rhel8
  script:
    - *build_with_selinux_no_tpm
  after_script:
    - sudo semodule -r maat

# build without selinux for rhel9
build-rhel9-no-selinux:
  stage: build
  tags:
    - rhel9
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel9
build-rhel9-selinux:
  stage: build
  tags:
    - rhel9
  script:
    - *build_with_selinux_no_tpm
  after_script:
    - sudo semodule -r maat
  allow_failure: true # for now this is allowed because of an issue with flask header

## docs

# build docs on ubuntu20
docs-ubuntu:
  stage: docs
  tags:
    - ubuntu20
  script:
    - *build_docs
  artifacts:
    paths:
      - maat-docs
    expire_in: 2 weeks
    when: on_success

# build docs on rhel7
docs-rhel:
  stage: docs
  tags:
    - rhel7
  script:
    - *build_docs
  artifacts:
    paths:
      - maat-docs
    expire_in: 2 weeks
    when: on_success
  allow_failure: true # fails due to missing style

## test

# regular make check tests on ubuntu20
test-ubuntu20-basic:
  stage: test
  tags:
    - ubuntu20
  script:
    - *test_no_selinux_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# regular make check tests on ubuntu20 with TPM
test-ubuntu20-basic-tpm:
  stage: test
  tags:
    - maat-swtpm
  script:
    - *test_no_selinux
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan:
  stage: test
  tags:
    - ubuntu20
  script:
    - *test_asan_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan-tpm:
  stage: test
  tags:
    - maat-swtpm
  script:
    - *test_asan
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# regular make check tests on ubuntu22
test-ubuntu22-basic:
  stage: test
  tags:
    - ubuntu22
  script:
    - *test_no_selinux_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# make check tests with address sanitizer on ubuntu22
test-ubuntu22-asan:
  stage: test
  tags:
    - ubuntu22
  script:
    - *test_asan_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# regular make check tests without selinux on rhel7
test-rhel7-basic-no-selinux:
  stage: test
  tags:
    - rhel7
  script:
    - *test_no_selinux_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# make check tests with address sanitizer on rhel7
test-rhel7-asan:
  stage: test
  tags:
    - rhel7
  script:
    - *test_asan_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always
  allow_failure: true # for now fails due to configure saying C compiler not working

# make check tests without selinux on rhel8
test-rhel8-basic-no-selinux:
  stage: test
  tags:
    - rhel8
  script:
    - *test_no_selinux_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always

# make check tests with address sanitizer on rhel8
test-rhel8-asan:
  stage: test
  tags:
    - rhel8
  script:
    - *test_asan_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always
  allow_failure: true # for now fails due to configure saying C compiler not working

# make check tests without selinux on rhel9
test-rhel9-basic-no-selinux:
  stage: test
  tags:
    - rhel9
  script:
    - *test_no_selinux_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always
  allow_failure: true # fails due to using sha1 digest which is disabled by default

# make check tests with address sanitizer on rhel9
test-rhel9-asan:
  stage: test
  tags:
    - rhel9
  script:
    - *test_asan_no_tpm
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    when: always
  allow_failure: true # for now fails due to configure saying C compiler not working

## package

# package ubuntu20 focal deb
package-ubuntu20-amd64-deb:
  stage: package
  tags:
    - ubuntu20
  variables:
    release: focal
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package ubuntu22 jammy deb
package-ubuntu22-amd64-deb:
  stage: package
  tags:
    - ubuntu22
  variables:
    release: jammy
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel7 rpm
package-rhel7-x86_64-rpm:
  stage: package
  tags:
    - rhel7
  variables:
    distro: "centos+epel"
    release: 7
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel8 rpm
package-rhel8-x86_64-rpm:
  stage: package
  tags:
    - rhel8
  variables:
    distro: "centos-stream+epel"
    release: 8
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks
  allow_failure: True # fails due to underlying mock image not including systemd

# package rhel9 rpm
package-rhel9-x86_64-rpm:
  stage: package
  tags:
    - rhel9
  variables:
    distro: "centos-stream+epel"
    release: 9
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks
  allow_failure: true # for now this is allowed because of an issue with flask header

## deploy

# create ubuntu20 focal repo
create-ubuntu20-repo:
  stage: deploy
  tags:
    - ubuntu20
  needs:
    - package-ubuntu20-amd64-deb
  inherit:
    default: false
  variables:
    release: focal
  script:
    - *deb_repo
  artifacts:
    paths:
      - maat-$CI_COMMIT_SHORT_SHA/
    expire_in: 2 weeks

# create ubuntu22 jammy repo
create-ubuntu22-repo:
  stage: deploy
  tags:
    - ubuntu22
  needs:
    - package-ubuntu22-amd64-deb
  inherit:
    default: false
  variables:
    release: jammy
  script:
    - *deb_repo
  artifacts:
    paths:
      - maat-$CI_COMMIT_SHORT_SHA/
    expire_in: 2 weeks

## systemtest

# system test with selinux on rhel7
system-test-selinux-rhel7:
  stage: systemtest
  tags:
    - rhel7
  inherit:
    default: false
  dependencies: []
  timeout: 2 hours
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
    - sudo semanage port -d -t attestmgr_port_t -p tcp 2343 || true
    - sudo yum remove maat maat-selinux -y || true
  script:
    - echo "baseurl=http://$ARCHIVE_HOST/rpm/$CI_COMMIT_SHORT_SHA/7/x86_64" >> ci/maat.repo
    - sudo cp ci/maat.repo /etc/yum.repos.d
    - sudo yum clean all
    - sudo yum install maat maat-selinux -y
    - sudo semanage port -a -t attestmgr_port_t -p tcp 2343
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - sudo rpm -qa --qf "%{NAME}\n" | sudo tee -a /usr/share/maat/asps/packages.whitelist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r userspace | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
    - cat test_client.log
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu20
system-test-ubuntu20:
  stage: systemtest
  tags:
    - ubuntu20
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail:
  stage: systemtest
  tags:
    - ubuntu20
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu20
system-test-ubuntu20-tpm:
  stage: systemtest
  tags:
    - maat-swtpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/ak*
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail-tpm:
  stage: systemtest
  tags:
    - maat-swtpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/ak*"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

## sara-collect

# collect results from saracode
collect-saracode:
  stage: sara-collect
  dependencies:
    - kickoff-saracode
  inherit:
    default: false
  script:
    - ci/sara_collect.sh
  artifacts:
    paths:
      - console.txt
      - issues.csv
    expire_in: 2 weeks
    when: always