mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-10-22 06:12:35 +00:00
Mounir IDRASSI
6e63041962
Look up NixOS helpers only when trusted system metadata identifies NixOS and each path component passes ownership and permission checks. Keep the existing helper search on other distributions. Detect NoNewPrivs before prompting for administrator credentials, with a clear error for restricted launchers. Add regression coverage to Linux CI and append the English fallback message to all language files. Refs #1911
232 lines
9.0 KiB
YAML
232 lines
9.0 KiB
YAML
name: Build and test Linux
|
|
|
|
on:
|
|
push:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'src/Build/Include/Makefile.inc'
|
|
- 'src/Build/CMakeLists.txt'
|
|
- 'src/Build/build_cmake_deb.sh'
|
|
- 'src/Common/*.h'
|
|
- 'src/Common/*.cpp'
|
|
- 'src/Common/*.c'
|
|
- 'src/Common/Language.xml'
|
|
- 'src/Core/**'
|
|
- 'src/Crypto/**'
|
|
- 'src/Driver/Fuse/**'
|
|
- 'src/Main/**'
|
|
- 'src/PKCS11/**'
|
|
- 'src/Platform/**'
|
|
- 'src/Resources/**'
|
|
- 'src/Setup/Linux/**'
|
|
- 'src/Volume/**'
|
|
- 'src/Makefile'
|
|
- 'Tests/test_linux_privilege_helpers.py'
|
|
- '.github/workflows/build-linux.yml'
|
|
pull_request:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'src/Build/Include/Makefile.inc'
|
|
- 'src/Build/CMakeLists.txt'
|
|
- 'src/Build/build_cmake_deb.sh'
|
|
- 'src/Common/*.h'
|
|
- 'src/Common/*.cpp'
|
|
- 'src/Common/*.c'
|
|
- 'src/Common/Language.xml'
|
|
- 'src/Core/**'
|
|
- 'src/Crypto/**'
|
|
- 'src/Driver/Fuse/**'
|
|
- 'src/Main/**'
|
|
- 'src/PKCS11/**'
|
|
- 'src/Platform/**'
|
|
- 'src/Resources/**'
|
|
- 'src/Setup/Linux/**'
|
|
- 'src/Volume/**'
|
|
- 'src/Makefile'
|
|
- 'Tests/test_linux_privilege_helpers.py'
|
|
- '.github/workflows/build-linux.yml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
WXWIDGETS_VERSION: 3.2.5
|
|
|
|
jobs:
|
|
ubuntu-build:
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-24.04, ubuntu-26.04]
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Generate cache key
|
|
id: cache-key
|
|
run: |
|
|
echo "cache_key=${{ matrix.os }}-${{ env.WXWIDGETS_VERSION }}-${{ hashFiles('src/Makefile', '.github/workflows/build-linux.yml') }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache wxBuildConsole
|
|
uses: actions/cache@v5
|
|
id: cache-wxbuildconsole
|
|
with:
|
|
path: /tmp/wxBuildConsole
|
|
key: wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Cache wxBuildGUI
|
|
if: matrix.os == 'ubuntu-24.04'
|
|
uses: actions/cache@v5
|
|
id: cache-wxbuildgui
|
|
with:
|
|
path: /tmp/wxBuildGUI
|
|
key: wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Cache wxWidgets
|
|
uses: actions/cache@v5
|
|
id: cache-wxwidgets
|
|
with:
|
|
path: /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
|
|
key: wxWidgets-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Install dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y wget tar libpcsclite-dev libfuse-dev yasm libgtk-3-dev libayatana-appindicator3-dev cmake debhelper
|
|
|
|
- name: Install system wxWidgets for GUI
|
|
if: matrix.os == 'ubuntu-26.04'
|
|
run: sudo apt-get install -y libwxgtk3.2-dev
|
|
|
|
- name: Download and extract wxWidgets to /tmp if build folders are missing
|
|
if: steps.cache-wxbuildconsole.outputs.cache-hit != 'true' || (matrix.os == 'ubuntu-24.04' && steps.cache-wxbuildgui.outputs.cache-hit != 'true') || steps.cache-wxwidgets.outputs.cache-hit != 'true'
|
|
run: |
|
|
wget https://github.com/wxWidgets/wxWidgets/releases/download/v${{ env.WXWIDGETS_VERSION }}/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -O /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2
|
|
mkdir -p /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
|
|
tar -xjf /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -C /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }} --strip-components=1
|
|
|
|
- name: Build VeraCrypt .deb packages
|
|
run: |
|
|
chmod +x src/Build/build_cmake_deb.sh
|
|
if [ "${{ matrix.os }}" = "ubuntu-26.04" ]; then
|
|
src/Build/build_cmake_deb.sh INDICATOR
|
|
else
|
|
src/Build/build_cmake_deb.sh WXSTATIC INDICATOR
|
|
fi
|
|
|
|
- name: Upload GUI .deb packages
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veracrypt-gui-debs-${{ matrix.os }}
|
|
path: /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.*
|
|
|
|
- name: Upload Console .deb packages
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veracrypt-console-debs-${{ matrix.os }}
|
|
path: /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.*
|
|
|
|
- name: Install and test VeraCrypt GUI .deb packages
|
|
run: |
|
|
sudo apt install -y /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.deb
|
|
python3 Tests/test_linux_privilege_helpers.py --veracrypt "$(command -v veracrypt)"
|
|
veracrypt --text --test && veracrypt --text --version
|
|
sudo veracrypt --text --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
|
|
sudo veracrypt --text --list
|
|
echo -n "Dummy" > /tmp/expected_content.txt
|
|
if cmp -s /media/veracrypt1/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha256.hc is valid."
|
|
else
|
|
echo "Content of test.sha256.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt2/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha512.hc is valid."
|
|
else
|
|
echo "Content of test.sha512.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt3/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.streebog.hc is valid."
|
|
else
|
|
echo "Content of test.streebog.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt4/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.whirlpool.hc is valid."
|
|
else
|
|
echo "Content of test.whirlpool.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
sudo veracrypt -d
|
|
sudo apt remove -y veracrypt
|
|
|
|
- name: Install and test VeraCrypt Console .deb packages
|
|
run: |
|
|
sudo apt install -y /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.deb
|
|
veracrypt --test && veracrypt --version
|
|
sudo veracrypt --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
|
|
sudo veracrypt --list
|
|
echo -n "Dummy" > /tmp/expected_content.txt
|
|
if cmp -s /media/veracrypt1/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha256.hc is valid."
|
|
else
|
|
echo "Content of test.sha256.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt2/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha512.hc is valid."
|
|
else
|
|
echo "Content of test.sha512.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt3/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.streebog.hc is valid."
|
|
else
|
|
echo "Content of test.streebog.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt4/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.whirlpool.hc is valid."
|
|
else
|
|
echo "Content of test.whirlpool.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
sudo veracrypt -d
|
|
sudo apt remove -y veracrypt-console
|
|
|
|
- name: Cleanup old caches
|
|
uses: actions/github-script@v8
|
|
if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const caches = await github.rest.actions.getActionsCacheList({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
})
|
|
for (const cache of caches.data.actions_caches) {
|
|
if (cache.key.startsWith('wxBuildConsole-${{ matrix.os }}-') || cache.key.startsWith('wxBuildGUI-${{ matrix.os }}-') || cache.key.startsWith('wxWidgets-${{ matrix.os }}-')) {
|
|
if (cache.key !== `wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}` &&
|
|
cache.key !== `wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}` &&
|
|
cache.key !== `wxWidgets-${{ steps.cache-key.outputs.cache_key }}`) {
|
|
console.log(`Deleting cache with key: ${cache.key}`)
|
|
await github.rest.actions.deleteActionsCacheById({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
cache_id: cache.id,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|