.gitlab-ci.yml

# Gitlab CI settings for building and testing Maat.

variables:
  SARACODE_ROOT: https://saracode-backend.jhuapl.edu/v2/project
  ARCHIVE_USER: archive
  ARCHIVE_HOST: manda-ci-repo.jhuapl.edu
  MAAT_VERSION: 2.0-1
  IMAGE_PREFIX: artifactory.jhuapl.edu/maat

stages:
  - sara-kickoff
  - build
  - docs
  - test
  - package
  - deploy
  - systemtest
  - sara-collect

## MACROS

# default settings used by most tasks
default:
  before_script:
    - autoreconf -i
    - "[ -d build ] || mkdir build"
    - cd build

# configure and build without selinux
.build_no_selinux: &build_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux
  - make install

# configure and build without selinux and without TPM
.build_no_selinux_no_tpm: &build_no_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm
  - make install

# configure and build with selinux and without TPM
.build_with_selinux_no_tpm: &build_with_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-tpm
  - make install

# configure and build with selinux and without TPM for PhotonOS
.build_no_selinux_no_tpm_photonos5: &build_no_selinux_no_tpm_photonos5
  - cat /builds/JHUAPL-MS-Root-CA-05-21-2038-B64-text.cer >> /etc/pki/tls/certs/ca-bundle.crt
  - tdnf -y install autoconf automake libtool check-devel glib-devel gcc glibc-devel binutils make elfutils-devel json-c-devel selinux-policy-devel libselinux-devel libxml2-devel tpm2-tss tpm2-tss-devel tpm2-tools openssl-devel libcap-devel
  - tdnf -y install gcovr
  - autoreconf -i
  - "[ -d build ] || mkdir build"
  - cd build
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-tpm --disable-selinux --enable-coverage --enable-tests
  - make
  - make install

# configure and build with selinux and without TPM for PhotonOS
.build_with_selinux_no_tpm_photonos5: &build_with_selinux_no_tpm_photonos5
  - cat /builds/JHUAPL-MS-Root-CA-05-21-2038-B64-text.cer >> /etc/pki/tls/certs/ca-bundle.crt
  - tdnf -y install autoconf automake libtool check-devel glib-devel gcc glibc-devel binutils make elfutils-devel json-c-devel selinux-policy-devel libselinux-devel libxml2-devel tpm2-tss tpm2-tss-devel tpm2-tools openssl-devel libcap-devel
  - autoreconf -i
  - "[ -d build ] || mkdir build"
  - cd build
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-tpm --enable-coverage --enable-tests --enable-photon
  - make
  - make install

# configure and build with selinux and TPM
.build_with_selinux_and_tpm: &build_with_selinux_and_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd
  - make install

# build documentation
.build_docs: &build_docs
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm
  - make docs
  - mv documentation/build ../maat-docs

# run check tests without selinux
.test_no_selinux: &test_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --enable-coverage
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# run check tests without selinux adn without TPM
.test_no_selinux_no_tpm: &test_no_selinux_no_tpm
  - ../configure  --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm --enable-coverage
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# configure and build with selinux and without TPM for PhotonOS
.test_no_selinux_no_tpm_photonos5: &test_no_selinux_no_tpm_photonos5
  - *build_no_selinux_no_tpm_photonos5
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Run check tests with gcc address sanitizer enabled
.test_asan: &test_asan
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --enable-coverage CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Run check tests with gcc address sanitizer enabled without TPM
.test_asan_no_tpm: &test_asan_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm --enable-tests --enable-coverage CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Build debian packages for ${release} and ${arch}
.deb_build: &deb_build
  - /usr/bin/pbuilder-dist ${release} ${arch} create
  - /usr/bin/pbuilder-dist ${release} ${arch} update # is this necessary?
  - ../configure --prefix=/usr --disable-selinux
  - make dist
  - mkdir staging
  - cp maat-*.tar.gz staging
  - mkdir tmp
  - cd tmp
  - tar xzf ../maat-*.tar.gz
  - sed -i.bak "s/-1)/-1${release}0)/g" maat-*/debian/changelog
  - dpkg-source -b maat-*
  - echo "PBUILDERSATISFYDEPENDSCMD=${PBSAT}" > .pbset-${release}-${arch}
  - /usr/bin/pbuilder-dist ${release} ${arch} build --buildresult $PWD/../staging/${release}-${arch}-results --configfile .pbset-${release}-${arch} maat*${release}*.dsc

# Create debian repo for ${release}
.deb_repo: &deb_repo
  - cd build/staging
  - mkdir -p ubuntu/conf
  - cp ../../ci/ubuntu_distributions ubuntu/conf/distributions
  - "echo \"Codename: ${release}\" >> ubuntu/conf/distributions"
  - echo "basedir ." > ubuntu/conf/options
  - cd ubuntu
  - reprepro -V includedeb ${release} ../${release}-*-results/maat*.deb
  - cd ../..

# Create RPM repo for ${release} and ${arch}
.rpm_repo: &rpm_repo
  - ../configure --prefix=/usr --disable-tpm --disable-selinux-libdir-mapping
  - make rpm
  - cp /root/rpmbuild/RPMS/x86_64/*.rpm .

# System test on RHEL with selinux enabled
.rhel_selinux_system_test: &rhel_selinux_system_test
  - cd build
  - sudo yum install -y maat-${MAAT_VERSION}.el${release}.x86_64.rpm maat-selinux-${MAAT_VERSION}.el${release}.x86_64.rpm
  - cd ../
  - sudo semanage port -a -t attestmgr_port_t -p tcp 2343
  - sudo cp demo/credentials/client.* /etc/maat/credentials/
  - sudo rpm -qa --qf "%{NAME}\n" | sudo tee -a /usr/share/maat/asps/packages.whitelist
  - "LIBMAAT_LOG_SYSLOG=0 LIBMAAT_DEBUG_LEVEL=5 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee app.log &"
  - "LIBMAAT_LOG_SYSLOG=0 LIBMAAT_DEBUG_LEVEL=5 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee att.log &"
  - sleep 10
  - "valgrind /usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r userspace 2>&1 | tee test_client.log || true"
  - "kill %2 || true"
  - "kill %1 || true"
  - sudo rm -f /etc/maat/credentials/client.*
  - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"

## sara-kickoff

# Start saracode analysis
kickoff-saracode:
  stage: sara-kickoff
  tags:
    - new-docker
  inherit:
    default: false
  script:
    - ci/sara_kickoff.sh
  artifacts:
    paths:
      - saracode_build_id
    expire_in: 2 hours
    when: on_success

## build

# build without selinux for ubuntu20
build-ubuntu20:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu20:0.0.5
  script:
    - *build_no_selinux_no_tpm

# build without selinux with TPM for ubuntu20
build-ubuntu20-tpm:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu20:0.0.5
  script:
    - *build_no_selinux

# build without selinux for ubuntu22
build-ubuntu22:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu22:0.0.5
  script:
    - *build_no_selinux_no_tpm

# build without selinux with TPM for ubuntu22
build-ubuntu22-tpm:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu22:0.0.5
  script:
    - *build_no_selinux

# build without selinux for rhel8
build-rhel8-no-selinux:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel8
build-rhel8-selinux:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *build_with_selinux_no_tpm

# build with selinux and tpm support for rhel8
build-rhel8-selinux-tpm:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *build_with_selinux_and_tpm

# build without selinux for rhel9
build-rhel9-no-selinux:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel9:0.0.5
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel9
build-rhel9-selinux:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel9:0.0.5
  script:
    - *build_with_selinux_no_tpm

#build without selinux without TPM for ubuntu23
build-ubuntu23:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu23:0.0.6
  script:
    - *build_no_selinux_no_tpm

#build without selinux without TPM for debian 11
build-debian11:
  stage: build
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/debian11:0.0.1
  script:
    - *build_no_selinux_no_tpm

# build without selinux for PhotonOS 5.0
build-photonos5:
  stage: build
  inherit:
   default: false
  tags:
    - photonos5
  script:
    - *build_with_selinux_no_tpm_photonos5

## docs

# build docs on ubuntu20
docs-ubuntu:
  stage: docs
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu20:0.0.5
  script:
    - *build_docs
  artifacts:
    paths:
      - maat-docs
    expire_in: 2 weeks
    when: on_success

## test

# regular make check tests on ubuntu20
test-ubuntu20-basic:
  stage: test
  tags:
    - new-ubuntu20
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu20 with TPM
test-ubuntu20-basic-tpm:
  stage: test
  tags:
    - new-ubuntu20
    - new-tpm
  script:
    - *test_no_selinux
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan:
  stage: test
  tags:
    - new-ubuntu20
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan-tpm:
  stage: test
  tags:
    - new-ubuntu20
  script:
    - *test_asan
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu22
test-ubuntu22-basic:
  stage: test
  tags:
    - new-ubuntu22
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu22 with TPM
test-ubuntu22-basic-tpm:
  stage: test
  tags:
    - new-ubuntu22
    - new-tpm
  script:
    - *test_no_selinux
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu22
test-ubuntu22-asan:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu22:0.0.5
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# Disabled due to what may be a bug with gcc and/or libasan that only seems to
# occur on ubuntu22
# see https://github.com/actions/runner-images/issues/9524
# make check tests with address sanitizer on ubuntu22
# test-ubuntu22-asan-tpm:
#    stage: test
#    tags:
#      - ubuntu22
#      - tpm
#    script:
#      - *test_asan
#    coverage: /^\s*lines:\s*\d+.\d+\%/
#    artifacts:
#      paths:
#        - build/src/test/*.log
#        - build/lib/test/*.log
#      expire_in: 2 weeks
#      reports:
#        coverage_report:
#          coverage_format: cobertura
#          path: build/coverage.xml
#      when: always

# regular make check tests on ubuntu23
test-ubuntu23-basic:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/ubuntu23:0.0.6
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on debian 11
test-debian11-basic:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/debian11:0.0.1
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on photonos
test-photonos5-basic:
  stage: test
  inherit:
    default: false
  tags:
    - photonos5
  script:
    - *test_no_selinux_no_tpm_photonos5
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests without selinux on rhel8
test-rhel8-basic-no-selinux:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on rhel8
test-rhel8-asan:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests without selinux on rhel9
test-rhel9-basic-no-selinux:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel9:0.0.5
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on rhel9
test-rhel9-asan:
  stage: test
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel9:0.0.5
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
      - build/lib/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

## package

# package ubuntu20 focal deb
package-ubuntu20-amd64-deb:
  stage: package
  tags:
    - new-ubuntu20
  variables:
    release: focal
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package ubuntu22 jammy deb
package-ubuntu22-amd64-deb:
  stage: package
  tags:
    - new-ubuntu22
  variables:
    release: jammy
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel8 rpm
package-rhel8-x86_64-rpm:
  stage: package
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel8:0.0.5
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/*.rpm
    expire_in: 2 weeks

# package rhel9 rpm
package-rhel9-x86_64-rpm:
  stage: package
  tags:
    - new-docker
  image: ${IMAGE_PREFIX}/rhel9:0.0.5
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/*.rpm
    expire_in: 2 weeks

## deploy

# create ubuntu20 focal repo
create-ubuntu20-repo:
  stage: deploy
  tags:
    - new-ubuntu20
  needs:
    - package-ubuntu20-amd64-deb
  inherit:
    default: false
  variables:
    release: focal
  script:
    - *deb_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# create ubuntu22 jammy repo
create-ubuntu22-repo:
  stage: deploy
  tags:
    - new-ubuntu22
  needs:
    - package-ubuntu22-amd64-deb
  inherit:
    default: false
  variables:
    release: jammy
  script:
    - *deb_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

## systemtest

# system test on rhel8
system-test-rhel8:
  stage: systemtest
  tags:
    - new-rhel8
  inherit:
    default: false
  timeout: 2 hours
  variables:
    release: 8
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
    - sudo semanage port -d -t attestmgr_port_t -p tcp 2343 || true
    - sudo yum remove maat maat-selinux -y || true
  script:
    *rhel_selinux_system_test
  artifacts:
    paths:
      - "*.log"
    expire_in: 2 weeks
    when: always

# system test on rhel9
system-test-rhel9:
  stage: systemtest
  tags:
    - new-rhel9
  inherit:
    default: false
  variables:
    release: 9
  timeout: 2 hours
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
    - sudo semanage port -d -t attestmgr_port_t -p tcp 2343 || true
    - sudo yum remove maat maat-selinux -y || true
  script:
    *rhel_selinux_system_test
  artifacts:
    paths:
      - "*.log"
    expire_in: 2 weeks
    when: always

# system test on ubuntu20 with valgrind
system-test-ubuntu20-valgrind:
  stage: systemtest
  tags:
    - new-ubuntu20
  inherit:
    default: false
  needs:
    - create-ubuntu20-repo
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee app.log &
    - LIBMAAT_LOG_SYSLOG=0 valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee att.log &
    - sleep 10
    - "valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes 2>&1 | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - app.log
      - att.log
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail:
  stage: systemtest
  tags:
    - new-ubuntu20
  inherit:
    default: false
  needs:
    - create-ubuntu20-repo
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu20
system-test-ubuntu20-tpm:
  stage: systemtest
  tags:
    - new-ubuntu20
    - new-tpm
  inherit:
    default: false
  needs:
    - create-ubuntu20-repo
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/ak*
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail-tpm:
  stage: systemtest
  tags:
    - new-ubuntu20
    - new-tpm
  inherit:
    default: false
  needs:
    - create-ubuntu20-repo
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/ak*"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu22
system-test-ubuntu22-tpm:
  stage: systemtest
  tags:
    - new-ubuntu22
    - new-tpm
  inherit:
    default: false
  needs:
    - create-ubuntu22-repo
  variables:
    release: jammy
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/ak*
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt22 that is expected to fail
system-test-ubuntu22-fail-tpm:
  stage: systemtest
  tags:
    - new-ubuntu22
    - new-tpm
  inherit:
    default: false
  needs:
    - create-ubuntu22-repo
  variables:
    release: jammy
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - rm -rf ~/maat-deb
    - mkdir ~/maat-deb
    - cp -r build/staging/* ~/maat-deb/
    - echo -n "deb [allow-insecure=yes] file:/home/gitlab-runner/maat-deb/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/ak*"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

## sara-collect

# collect results from saracode
collect-saracode:
  stage: sara-collect
  tags:
    - new-docker
  dependencies:
    - kickoff-saracode
  inherit:
    default: false
  script:
    - ci/sara_collect.sh
  artifacts:
    paths:
      - console.txt
      - issues.csv
    expire_in: 2 weeks
    when: always