Tests/response_apdu_test.cpp was not run by any workflow. Build and run
it in the Linux workflow before the packages are built, and start the
workflow when the test changes. Changes to the code it covers already
start it.
The Linux workflow checks the content of the Tests/*.hc volumes by
mounting them, which needs root, FUSE and the installed package, and so
only runs on x86_64. Add a test that recovers the same data through the
volume layer instead, so it also runs on other architectures, e.g. on the
big-endian cross build under qemu-user.
Tests/volume_read_test.cpp opens a volume read-only and reads its data
area with Volume::ReadSectors: in one call, as multi-sector ranges at
nonzero offsets with odd sector counts, again with the encryption thread
pool running, and one sector at a time; every read must match the first.
CPU features are detected as in the application, and the character set
is taken from the environment (LC_CTYPE) so that paths with non-ASCII
characters work; if that locale is unavailable, the test continues in the
C locale and says so.
Tests/test_volume_read.py builds it against Volume.a and Platform.a of a
finished standard Linux build (CXX and NM can be set for a cross build)
and checks the plaintext of every Tests/test.*.hc volume: the FAT boot
sector, DUMMY.TXT with the content "Dummy" at the cluster given by the
root directory, and a known SHA-256 digest of the whole data area. A
volume without a digest, or a digest without a volume, is an error.
It runs in the Linux workflow after the .deb build and in the build job
of the big-endian workflow (test.sha512.hc only in the automatic check,
all volumes in the full run), and requires the thread pool there.
Signed-off-by: Ville Takio <ville+git@takio.fi>
Look up NixOS helpers only when trusted system metadata identifies NixOS
and each path component passes ownership and permission checks. Keep the
existing helper search on other distributions.
Detect NoNewPrivs before prompting for administrator credentials, with a
clear error for restricted launchers. Add regression coverage to Linux CI
and append the English fallback message to all language files.
Refs #1911
* CI: build and test on big-endian (s390x) and across byte orders
The Linux workflow only builds and tests on x86_64, so code that assumes
a little-endian host (see #1899) is not caught. Add a workflow that
cross-builds the console version for s390x and runs it under qemu-user:
- the algorithm self-tests (--test),
- the Tests/test.*.hc volumes, created on little-endian, must open and
accept a password change,
- volumes created on s390x open on a native amd64 build and the other
way round, for every encryption algorithm and cascade, with every PRF
(new Tests/test_byte_order_interop.py, also usable on its own).
The wxWidgets console build is cached per architecture, like in the
existing Linux workflow.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* CI: quick big-endian check on pull requests, full suite on request
Address review:
- Pull requests and pushes run only the s390x build, the algorithm
self-tests and the Tests/*.hc volumes. The full suite (amd64 build,
volumes on both builds, interoperability in both directions) runs
when started manually, with the volume and interoperability tests in
separate jobs that run concurrently.
- Pass the KDF with --hash; one interoperability case per direction
still uses autodetection.
- Use separate current and new PIM values: the Tests/*.hc volumes are
opened with PIM 0, but the new headers use PIM 1, so only the first
key derivation is expensive.
- Open each Tests/*.hc volume again with the new password before
removing it.
- Run VeraCrypt with LANG and LC_ALL set to C and an empty
XDG_CONFIG_HOME, so the "Incorrect password" check does not depend on
the user's language settings.
- Fail instead of reporting success when nothing would be tested:
--skip-official without a second binary, or no (or a missing
requested) Tests/*.hc volume. Add --fixture to select volumes.
- Print how long each check takes.
* CI: keep the automatic big-endian check short
- Open only Tests/test.sha512.hc in the automatic check (all five
volumes took 154 s of the 327 s s390x job); the full suite still
opens all of them.
- Cover KDF autodetection in the automatic check too: the first volume
is opened with the new password (PIM 1) without --hash. The
interoperability case without --hash now uses sha256, since sha512
is tried first anyway.
- Include the event name in the concurrency group, so a push does not
cancel a manual full run.
- Print the elapsed time for failed checks too.
(The previous commit message should say that XDG_CONFIG_HOME points to
an empty temporary directory.)
* CI: use actions/cache@v5 in the big-endian workflow
Match build-linux.yml, which moved to the Node 24 runtime in 9d9fda20.
---------
Signed-off-by: Ville Takio <ville+git@takio.fi>
Replace the deprecated 22.04 runner with independent jobs for both releases.
Use system wxWidgets for the 26.04 GUI to match package dependencies;
keep static wxWidgets for 24.04 and both console builds.
Isolate caches, cleanup and artifacts by release. Update cache and cleanup
actions to Node 24 runtimes.
Fixes#1871
Add English fallbacks for 12 missing keys in 41 language files.
Report all missing keys and XML errors before failing validation.
Run four regression tests in CI. All tests and 43 XML files pass.
* Linux/MacOSX: during build, fallback to /tmp if wxWidgets sources not found in parent directory
* Linux: Add Github workflow to build .deb files and test generated binaries
* Linux: fix wrong wxWidgets extract path in yaml
* fix: fix wrong wxWidgets extract path in yaml
* Linux: harmonize content of test volumes and update Github workflow for this
* Fix corrupted test container
* Linux: optimize Github workflow by caching wxBuildConsole and wxBuildGUI folders
We also modify build script to detect the presence of wxBuildConsole and wxBuildGUI folders and reuse them
* Remove files mistakenly added
* Linux: Fix wrong test for Github workflow
* Linux: use static build of wxWidgets for GUI in Github workflow
* Linux: upload also .deb SHA256SUM file if it is generated in Github workflow
* Linux: fix detection logic of parent folder in build scripts
* Github workflow: add build_cmake_deb.sh as trigger to build-linux.yml
* Github workflow: add wxWidgets source code to the cache of workflow
* *: source files should not be executable
* *: make sure files have final newline
* *: remove BOM from text files
* translations: unify headers
* *: fix typos
* *: trim excess whitespace
this commit will add a sponsor button to the repository,
pointing to the donation page of the veracrypt website.
more information on github documentation under https://git.io/JL9e6
Mounir IDRASSI
Mounir IDRASSI
Ville TakioandGitHub
JertzukkaandGitHub
a1346054andGitHub
Andreas BeckerandGitHub
