Merge pull request #26 from brimsec/windows

Zeek v3.2.0-dev-551-gfda8b98ac for macOS, Linux, and Windows

.cirrus.yml

@@ -3,8 +3,8 @@ btest_jobs: &BTEST_JOBS 8
 btest_retries: &BTEST_RETRIES 2
 memory: &MEMORY 6GB
 
-config: &CONFIG --build-type=release
-memcheck_config: &MEMCHECK_CONFIG --build-type=debug --enable-perftools-debug
+config: &CONFIG --build-type=release --enable-cpp-tests  --disable-broker-tests
+memcheck_config: &MEMCHECK_CONFIG --build-type=debug --enable-cpp-tests --disable-broker-tests --sanitizers=address --enable-fuzzers
 
 resources_template: &RESOURCES_TEMPLATE
   cpu: *CPUS
@@ -77,6 +77,13 @@ debian9_task:
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
 
+debian9_32bit_task:
+  container:
+    # Debian 9 EOL: June 2022
+    dockerfile: ci/debian-9-32bit/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+
 ubuntu18_task:
   container:
     # Ubuntu 18.04 EOL: April 2023
@@ -123,8 +130,9 @@ memcheck_task:
     # Just uses a recent/common distro to run memory error/leak checks.
     dockerfile: ci/ubuntu-18.04/Dockerfile
     cpu: 8
+    # AddressSanitizer uses a lot more memory than a typical config.
     memory: 16GB
   << : *CI_TEMPLATE
+  test_fuzzers_script: ./ci/test-fuzzers.sh
   env:
-    ZEEK_CI_LEAK_CHECK: true
     ZEEK_CI_CONFIGURE_FLAGS: *MEMCHECK_CONFIG

.clang-tidy

@@ -1,40 +1,4 @@
-Checks: '*,
-         -abseil-string-find-startswith,
-         -bugprone-exception-escape,
-         -bugprone-macro-parentheses,
-         -bugprone-suspicious-semicolon,
-         -cert-err58-cpp,
-         -cppcoreguidelines-avoid-c-arrays,
-         -cppcoreguidelines-avoid-goto,
-         -cppcoreguidelines-avoid-magic-numbers,
-         -cppcoreguidelines-macro-usage,
-         -cppcoreguidelines-non-private-member-variables-in-classes,
-         -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
-         -cppcoreguidelines-pro-bounds-constant-array-index,
-         -cppcoreguidelines-pro-bounds-pointer-arithmetic,
-         -cppcoreguidelines-pro-type-const-cast,
-         -cppcoreguidelines-pro-type-reinterpret-cast,
-         -fuchsia-default-arguments,
-         -fuchsia-multiple-inheritance,
-         -fuchsia-overloaded-operator,
-         -fuchsia-statically-constructed-objects,
-         -fuchsia-trailing-return,
-         -google-build-using-namespace,
-         -google-explicit-constructor,
-         -google-readability-braces-around-statements,
-         -hicpp-avoid-c-arrays,
-         -hicpp-avoid-goto,
-         -hicpp-braces-around-statements,
-         -hicpp-explicit-conversions,
-         -hicpp-no-array-decay,
-         -llvm-header-guard,
-         -misc-macro-parentheses,
-         -misc-non-private-member-variables-in-classes,
-         -misc-suspicious-semicolon,
-         -misc-unused-parameters,
-         -modernize-avoid-c-arrays,
-         -modernize-use-nodiscard,
-         -readability-braces-around-statements,
-         -readability-container-size-empty,
-         -readability-implicit-bool-conversion,
-         -readability-magic-numbers'
+Checks: '-*,
+         bugprone-*,
+         clang-analyzer-*,
+         performance-*'

.gitattributes

@@ -0,0 +1,5 @@
+*.sig linguist-detectable=false
+*.pac linguist-detectable=false
+*.bif linguist-language=C++
+*.l linguist-language=Lex
+testing/btest/Baseline/** linguist-detectable=false

.github/workflows/brim.yml

@@ -0,0 +1,68 @@
+name: Brim
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+    tags:
+      - v*brim*
+
+defaults:
+ run:
+   shell: bash
+
+jobs:
+  release:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [macos-10.15, ubuntu-18.04, windows-2019]
+    steps:
+      # Use MSYS2's bash.exe in subsequent "shell: bash" steps.
+      - if: startsWith(matrix.os, 'windows-')
+        run: echo '::add-path::C:\msys64\usr\bin'
+
+      # actions/checkout@v2 chokes on Windows because Git for Windows'
+      # git.exe can't handle Zeek's aux directory.  Use MSYS2's git.exe
+      # on Windows until the aux directory is renamed.
+      - if: startsWith(matrix.os, 'windows-')
+        name: Windows alternative for actions/checkout@v2
+        run: |
+          set -x
+          # '-Sdd' since we need none of Git's many, heavy dependencies.
+          pacman -Sdd --needed --noconfirm git
+          git clone --depth=1 --no-checkout --single-branch git://github.com/$GITHUB_REPOSITORY .
+          git fetch --depth=1 origin $GITHUB_REF
+          git checkout FETCH_HEAD
+          git submodule update --depth=1 --init --jobs $NUMBER_OF_PROCESSORS --recursive
+      - if: "!startsWith(matrix.os, 'windows-')"
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+
+      # Remove DLLs that break Zeek's OPENSSL_CORRECT_VERSION_NUMBER
+      # CMake test by shadowing DLLs in /mingw64/bin.
+      - if: startsWith(matrix.os, 'windows-')
+        run: rm $SYSTEMROOT/system32/libcrypto-1_1-x64.dll $SYSTEMROOT/system32/libssl-1_1-x64.dll
+
+      - if: startsWith(matrix.os, 'windows-')
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.13
+
+      - run: ./brim/release
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ${{ matrix.os }}
+          path: zeek-*.zip
+
+      - if: startsWith(github.event.ref, 'refs/tags/')
+        uses: svenstaro/upload-release-action@1.1.0
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: zeek-*.zip
+          file_glob: true
+          tag: ${{ github.ref }}
+          overwrite: true

.github/workflows/ci-notification.yml

@@ -4,12 +4,14 @@ on:
     types: [completed]
 jobs:
   notify:
+    if: github.repository == 'zeek/zeek'
     runs-on: ubuntu-latest
     steps:
       - name: Send CI Email Notification
         uses: zeek/ci-email-action@master
         env:
           CI_APP_NAME: "Cirrus CI"
+          BRANCH_WHITELIST: "master|release/.*"
           SMTP_HOST: ${{ secrets.SMTP_HOST }}
           SMTP_PORT: ${{ secrets.SMTP_PORT }}
           SMTP_USER: ${{ secrets.SMTP_USER }}

.github/workflows/coverity-scan.yml

@@ -0,0 +1,84 @@
+name: Coverity Scan Cron Job
+
+on:
+  schedule:
+    - cron: '0 0 * * 1,3,5'
+
+jobs:
+  scan:
+    if: github.repository == 'zeek/zeek'
+    runs-on: ubuntu-18.04
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Update Submodules
+        shell: bash
+        run: |
+          auth_header="$(git config --local --get http.https://github.com/.extraheader)"
+          git submodule sync --recursive
+          git -c "http.extraheader=$auth_header" -c protocol.version=2 \
+            submodule update --init --force --recursive --depth=1
+
+      - name: Fetch Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install \
+            git \
+            cmake \
+            make \
+            gcc \
+            g++ \
+            flex \
+            bison \
+            libpcap-dev \
+            libssl-dev \
+            python3 \
+            python3-dev \
+            python3-pip\
+            swig \
+            zlib1g-dev \
+            libkrb5-dev \
+            bsdmainutils \
+            sqlite3 \
+            curl \
+            wget
+          # Many distros adhere to PEP 394's recommendation for `python` =
+          # `python2` so this is a simple workaround until we drop Python 2
+          # support and explicitly use `python3` for all invocations.
+          sudo ln -sf /usr/bin/python3 /usr/local/bin/python
+
+      - name: Fetch Coverity Tools
+        env:
+          COVERITY_TOKEN: ${{ secrets.COVERITY_TOKEN }}
+        run: |
+          wget \
+            -nv https://scan.coverity.com/download/cxx/linux64 \
+            --post-data "token=${COVERITY_TOKEN}&project=Bro" \
+            -O coverity_tool.tgz
+          tar xzf coverity_tool.tgz
+          rm coverity_tool.tgz
+          mv cov-analysis* coverity-tools
+
+      - name: Configure
+        run: ./configure --build-type=debug
+
+      - name: Build
+        run: |
+          export PATH=`pwd`/coverity-tools/bin:$PATH
+          ( cd build && cov-build --dir cov-int make -j 3 )
+          cat build/cov-int/build-log.txt
+
+      - name: Submit
+        env:
+          COVERITY_TOKEN: ${{ secrets.COVERITY_TOKEN }}
+        run: |
+          cd build
+          tar czf myproject.tgz cov-int
+          curl \
+            --form token=${COVERITY_TOKEN} \
+            --form email=zeek-commits-internal@zeek.org \
+            --form file=@myproject.tgz \
+            --form "version=`cat ../VERSION`" \
+            --form "description=`git rev-parse HEAD`" \
+            https://scan.coverity.com/builds?project=Bro

.gitmodules

@@ -31,3 +31,12 @@
 [submodule "aux/paraglob"]
 	path = aux/paraglob
 	url = https://github.com/zeek/paraglob
+[submodule "aux/rapidjson"]
+	path = aux/rapidjson
+	url = https://github.com/zeek/rapidjson
+[submodule "aux/libkqueue"]
+	path = aux/libkqueue
+	url = https://github.com/brimsec/libkqueue
+[submodule "aux/highwayhash"]
+	path = aux/highwayhash
+	url = https://github.com/zeek/highwayhash