mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-10-22 14:22:36 +00:00
Mounir IDRASSI
f18a599589
Volume::Open forces read-only protection on a partially encrypted system volume, but the FUSE backend used the requested protection and attached the loop device and mounted the filesystem read-write. Copy the effective protection into the mount options before choosing the backend. Run the linked mount test in CI, check raw writes and journal recovery in the VM test, and document that a filesystem needing journal recovery may refuse a read-only mount.
261 lines
10 KiB
YAML
261 lines
10 KiB
YAML
name: Build and test Linux
|
|
|
|
on:
|
|
push:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'src/Build/Include/Makefile.inc'
|
|
- 'src/Build/CMakeLists.txt'
|
|
- 'src/Build/build_cmake_deb.sh'
|
|
- 'src/Common/*.h'
|
|
- 'src/Common/*.cpp'
|
|
- 'src/Common/*.c'
|
|
- 'src/Common/Language.xml'
|
|
- 'src/Core/**'
|
|
- 'src/Crypto/**'
|
|
- 'src/Driver/Fuse/**'
|
|
- 'src/Main/**'
|
|
- 'src/PKCS11/**'
|
|
- 'src/Platform/**'
|
|
- 'src/Resources/**'
|
|
- 'src/Setup/Linux/**'
|
|
- 'src/Volume/**'
|
|
- 'src/Makefile'
|
|
- 'Tests/test_linux_privilege_helpers.py'
|
|
- 'Tests/test.*.hc'
|
|
- 'Tests/test_volume_read.py'
|
|
- 'Tests/volume_read_test.cpp'
|
|
- 'Tests/test_linux_mount_read_only.py'
|
|
- 'Tests/linux_mount_read_only_test.cpp'
|
|
- 'Tests/response_apdu_test.cpp'
|
|
- '.github/workflows/build-linux.yml'
|
|
pull_request:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'src/Build/Include/Makefile.inc'
|
|
- 'src/Build/CMakeLists.txt'
|
|
- 'src/Build/build_cmake_deb.sh'
|
|
- 'src/Common/*.h'
|
|
- 'src/Common/*.cpp'
|
|
- 'src/Common/*.c'
|
|
- 'src/Common/Language.xml'
|
|
- 'src/Core/**'
|
|
- 'src/Crypto/**'
|
|
- 'src/Driver/Fuse/**'
|
|
- 'src/Main/**'
|
|
- 'src/PKCS11/**'
|
|
- 'src/Platform/**'
|
|
- 'src/Resources/**'
|
|
- 'src/Setup/Linux/**'
|
|
- 'src/Volume/**'
|
|
- 'src/Makefile'
|
|
- 'Tests/test_linux_privilege_helpers.py'
|
|
- 'Tests/test.*.hc'
|
|
- 'Tests/test_volume_read.py'
|
|
- 'Tests/volume_read_test.cpp'
|
|
- 'Tests/test_linux_mount_read_only.py'
|
|
- 'Tests/linux_mount_read_only_test.cpp'
|
|
- 'Tests/response_apdu_test.cpp'
|
|
- '.github/workflows/build-linux.yml'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
WXWIDGETS_VERSION: 3.2.5
|
|
|
|
jobs:
|
|
ubuntu-build:
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-24.04, ubuntu-26.04]
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Generate cache key
|
|
id: cache-key
|
|
run: |
|
|
echo "cache_key=${{ matrix.os }}-${{ env.WXWIDGETS_VERSION }}-${{ hashFiles('src/Makefile', '.github/workflows/build-linux.yml') }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache wxBuildConsole
|
|
uses: actions/cache@v5
|
|
id: cache-wxbuildconsole
|
|
with:
|
|
path: /tmp/wxBuildConsole
|
|
key: wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Cache wxBuildGUI
|
|
if: matrix.os == 'ubuntu-24.04'
|
|
uses: actions/cache@v5
|
|
id: cache-wxbuildgui
|
|
with:
|
|
path: /tmp/wxBuildGUI
|
|
key: wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Cache wxWidgets
|
|
uses: actions/cache@v5
|
|
id: cache-wxwidgets
|
|
with:
|
|
path: /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
|
|
key: wxWidgets-${{ steps.cache-key.outputs.cache_key }}
|
|
|
|
- name: Install dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y wget tar libpcsclite-dev libfuse-dev yasm libgtk-3-dev libayatana-appindicator3-dev cmake debhelper
|
|
|
|
# Checks with synthetic data that APDU responses are erased before their
|
|
# storage is released; no smart card is required.
|
|
- name: Check APDU response erasure
|
|
run: |
|
|
c++ -std=c++11 -O2 -Isrc Tests/response_apdu_test.cpp src/Common/ResponseAPDU.cpp src/Common/TLVParser.cpp -o /tmp/response_apdu_test
|
|
/tmp/response_apdu_test
|
|
|
|
- name: Install system wxWidgets for GUI
|
|
if: matrix.os == 'ubuntu-26.04'
|
|
run: sudo apt-get install -y libwxgtk3.2-dev
|
|
|
|
- name: Download and extract wxWidgets to /tmp if build folders are missing
|
|
if: steps.cache-wxbuildconsole.outputs.cache-hit != 'true' || (matrix.os == 'ubuntu-24.04' && steps.cache-wxbuildgui.outputs.cache-hit != 'true') || steps.cache-wxwidgets.outputs.cache-hit != 'true'
|
|
run: |
|
|
wget https://github.com/wxWidgets/wxWidgets/releases/download/v${{ env.WXWIDGETS_VERSION }}/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -O /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2
|
|
mkdir -p /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}
|
|
tar -xjf /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }}.tar.bz2 -C /tmp/wxWidgets-${{ env.WXWIDGETS_VERSION }} --strip-components=1
|
|
|
|
- name: Build VeraCrypt .deb packages
|
|
run: |
|
|
chmod +x src/Build/build_cmake_deb.sh
|
|
if [ "${{ matrix.os }}" = "ubuntu-26.04" ]; then
|
|
src/Build/build_cmake_deb.sh INDICATOR
|
|
else
|
|
src/Build/build_cmake_deb.sh WXSTATIC INDICATOR
|
|
fi
|
|
|
|
- name: Upload GUI .deb packages
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veracrypt-gui-debs-${{ matrix.os }}
|
|
path: /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.*
|
|
|
|
- name: Upload Console .deb packages
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: veracrypt-console-debs-${{ matrix.os }}
|
|
path: /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.*
|
|
|
|
# Decrypts the Tests/*.hc volumes through Volume::ReadSectors, without
|
|
# mounting, using the archives that the last build above (the console
|
|
# version) left in src, and checks known data.
|
|
- name: Read known data from the test volumes
|
|
run: python3 Tests/test_volume_read.py --build-dir src --require-thread-pool
|
|
|
|
# The package build above defaults to FUSE2 and leaves matching archives.
|
|
- name: Check Linux mount protection and fallback
|
|
run: python3 Tests/test_linux_mount_read_only.py --build-dir src --fuse-package=fuse
|
|
|
|
- name: Install and test VeraCrypt GUI .deb packages
|
|
run: |
|
|
sudo apt install -y /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.deb
|
|
python3 Tests/test_linux_privilege_helpers.py --veracrypt "$(command -v veracrypt)"
|
|
veracrypt --text --test && veracrypt --text --version
|
|
sudo veracrypt --text --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
|
|
sudo veracrypt --text --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
|
|
sudo veracrypt --text --list
|
|
echo -n "Dummy" > /tmp/expected_content.txt
|
|
if cmp -s /media/veracrypt1/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha256.hc is valid."
|
|
else
|
|
echo "Content of test.sha256.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt2/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha512.hc is valid."
|
|
else
|
|
echo "Content of test.sha512.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt3/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.streebog.hc is valid."
|
|
else
|
|
echo "Content of test.streebog.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt4/Dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.whirlpool.hc is valid."
|
|
else
|
|
echo "Content of test.whirlpool.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
sudo veracrypt -d
|
|
sudo apt remove -y veracrypt
|
|
|
|
- name: Install and test VeraCrypt Console .deb packages
|
|
run: |
|
|
sudo apt install -y /tmp/VeraCrypt_Packaging/Console/Packaging/veracrypt-console-*.deb
|
|
veracrypt --test && veracrypt --version
|
|
sudo veracrypt --non-interactive Tests/test.sha256.hc --hash sha256 --slot 1 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.sha512.hc --hash sha512 --slot 2 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.streebog.hc --hash streebog --slot 3 --password test --mount-options=ro
|
|
sudo veracrypt --non-interactive Tests/test.whirlpool.hc --hash whirlpool --slot 4 --password test --mount-options=ro
|
|
sudo veracrypt --list
|
|
echo -n "Dummy" > /tmp/expected_content.txt
|
|
if cmp -s /media/veracrypt1/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha256.hc is valid."
|
|
else
|
|
echo "Content of test.sha256.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt2/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.sha512.hc is valid."
|
|
else
|
|
echo "Content of test.sha512.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt3/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.streebog.hc is valid."
|
|
else
|
|
echo "Content of test.streebog.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
if cmp -s /media/veracrypt4/dummy.txt /tmp/expected_content.txt; then
|
|
echo "Content of test.whirlpool.hc is valid."
|
|
else
|
|
echo "Content of test.whirlpool.hc is invalid!"
|
|
exit 1
|
|
fi
|
|
sudo veracrypt -d
|
|
sudo apt remove -y veracrypt-console
|
|
|
|
- name: Cleanup old caches
|
|
uses: actions/github-script@v8
|
|
if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const caches = await github.rest.actions.getActionsCacheList({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
})
|
|
for (const cache of caches.data.actions_caches) {
|
|
if (cache.key.startsWith('wxBuildConsole-${{ matrix.os }}-') || cache.key.startsWith('wxBuildGUI-${{ matrix.os }}-') || cache.key.startsWith('wxWidgets-${{ matrix.os }}-')) {
|
|
if (cache.key !== `wxBuildConsole-${{ steps.cache-key.outputs.cache_key }}` &&
|
|
cache.key !== `wxBuildGUI-${{ steps.cache-key.outputs.cache_key }}` &&
|
|
cache.key !== `wxWidgets-${{ steps.cache-key.outputs.cache_key }}`) {
|
|
console.log(`Deleting cache with key: ${cache.key}`)
|
|
await github.rest.actions.deleteActionsCacheById({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
cache_id: cache.id,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|