open62541/.github/workflows/build_linux.yml

name: Linux Build & Test

on:
  push:
    branches:
      - 'master'
      - '[0-9]+.[0-9]+'
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  # Only supersede runs of the same pull request, never pushes to master/1.x.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  mbedtls-compatibility:
    name: mbedTLS ${{ matrix.mbedtls-version }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        mbedtls-version: ["3.6.4", "4.2.0"]
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true
      - uses: actions/checkout@v7
        with:
          repository: Mbed-TLS/mbedtls
          ref: mbedtls-${{ matrix.mbedtls-version }}
          path: mbedtls-source
          submodules: recursive
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y -qq build-essential check cmake libsubunit-dev python3 valgrind libwebsockets-dev zlib1g-dev
      - name: Build mbedTLS
        run: |
          # The tests run clients and servers in separate threads. PSA crypto
          # needs mutexes even when the open62541 build uses UA_MULTITHREADING=0.
          python3 mbedtls-source/scripts/config.py set MBEDTLS_THREADING_C
          python3 mbedtls-source/scripts/config.py set MBEDTLS_THREADING_PTHREAD
          cmake -S mbedtls-source -B mbedtls-build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_INSTALL_PREFIX=${{ runner.temp }}/mbedtls \
            -DENABLE_PROGRAMS=OFF \
            -DENABLE_TESTING=OFF
          cmake --build mbedtls-build --parallel
          cmake --install mbedtls-build
      - name: Build and test open62541
        run: |
          cmake -S . -B build-mbedtls \
            -DCMAKE_BUILD_TYPE=Debug \
            -DMBEDTLS_FOLDER_INCLUDE=${{ runner.temp }}/mbedtls/include \
            -DMBEDTLS_FOLDER_LIBRARY=${{ runner.temp }}/mbedtls/lib \
            -DUA_BUILD_UNIT_TESTS=ON \
            -DUA_ENABLE_DRIVER_GDS_RECEIVER=ON \
            -DUA_ENABLE_ENCRYPTION=MBEDTLS \
            -DUA_ENABLE_JSON_ENCODING=ON \
            -DUA_ENABLE_LWS=ON \
            -DUA_ENABLE_HTTP_COMPRESSION=ON \
            -DUA_ENABLE_PUBSUB=ON \
            -DUA_FORCE_WERROR=ON \
            -DUA_NAMESPACE_ZERO=FULL
          cmake --build build-mbedtls --parallel
          ctest --test-dir build-mbedtls --output-on-failure \
            -R "(encrypt|decrypt|cert|crypto|ecc|auth|json_config|http)"
      - name: Check mbedTLS 4 ownership with Valgrind
        if: matrix.mbedtls-version == '4.2.0'
        working-directory: build-mbedtls/tests
        run: |
          valgrind --error-exitcode=1 --leak-check=full \
            ../bin/tests/check_client_authentication
          valgrind --error-exitcode=1 --leak-check=full \
            ../bin/tests/check_client_json_config

  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04, ubuntu-26.04]
        build:
          - name: "Debug Build & Unit Tests (gcc)"
            cmd_action: unit_tests
          - name: "Debug Build & Unit Tests (gcc, 32bit)"
            cmd_deps: |
              sudo dpkg --add-architecture i386
              sudo apt-get update
              sudo apt-get install -y -qq gcc-multilib libsubunit-dev:i386 check:i386 libxml2-dev:i386 libcrypt-dev:i386
            cmd_action: unit_tests_32

          - name: "Debug Build & Unit Tests without Subscriptions (gcc)"
            cmd_action: unit_tests_nosub

          - name: "Debug Build & Unit Tests with Diagnostics (gcc)"
            cmd_action: unit_tests_diag

          - name: "Debug Build & Unit Tests with multithreading (gcc)"
            cmd_action: unit_tests_mt

          - name: "Debug Build & Unit Tests with GLib EventLoop (gcc)"
            cmd_deps: sudo apt-get install -y -qq libglib2.0-dev
            cmd_action: unit_tests_glib

          - name: "Debug Build & Unit Tests with Alarms&Conditions (gcc)"
            cmd_action: unit_tests_alarms

          - name: "Debug Build & Unit Tests (tcc)"
            cmd_deps: sudo apt-get install -y -qq tcc
            cmd_action: CC=tcc unit_tests

          - name: "Encryption (MbedTLS) Build & Unit Tests (gcc)"
            mbedtls: true
            cmd_action: unit_tests_encryption MBEDTLS

          - name: "PubSub Encryption (MbedTLS) Build & Unit Tests (gcc)"
            mbedtls: true
            cmd_action: unit_tests_encryption_pubsub MBEDTLS

          - name: "PubSub SKS Build & Unit Tests (gcc)"
            mbedtls: true
            cmd_deps: sudo apt-get install -y -qq valgrind
            cmd_action: unit_tests_pubsub_sks MBEDTLS

          - name: "Encryption (OpenSSL) Build & Unit Tests (gcc)"
            cmd_deps: sudo apt-get install -y -qq openssl
            cmd_action: unit_tests_encryption OPENSSL

          - name: "PubSub Encryption (OpenSSL) Build & Unit Tests (gcc)"
            cmd_deps: sudo apt-get install -y -qq openssl
            cmd_action: unit_tests_encryption_pubsub OPENSSL

          - name: "PubSub SKS (OpenSSL) Build & Unit Tests (gcc)"
            cmd_deps: sudo apt-get install -y -qq openssl valgrind
            cmd_action: unit_tests_pubsub_sks OPENSSL

          - name: "Encryption (LibreSSL) Build & Unit Tests (gcc)"
            cmd_deps: |
              sudo apt-get install -y -qq curl
              curl https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.0.tar.gz --output libressl.tar.gz
              tar -xvz -f libressl.tar.gz
              cd libressl-4.1.0
              ./configure
              sudo make install
            cmd_action: unit_tests_encryption LIBRESSL

          - name: "Encryption (OpenSSL 4) Build & Unit Tests (gcc)"
            cmd_deps: |
              curl -L https://github.com/openssl/openssl/releases/download/openssl-4.0.2/openssl-4.0.2.tar.gz --output openssl.tar.gz
              tar -xz -f openssl.tar.gz
              cd openssl-4.0.2
              ./Configure --prefix=/usr/local --libdir=lib no-docs no-tests
              make -j$(nproc)
              sudo make install_sw
              sudo ldconfig
            cmd_action: OPENSSL_ROOT_DIR=/usr/local unit_tests_encryption OPENSSL

          - name: "Release Build"
            mbedtls: true
            cmd_action: build_release

          - name: "Amalgamation Build"
            cmd_action: build_amalgamation

          - name: "Amalgamation Build (MinGW cross)"
            cmd_deps: sudo apt-get install -y -qq gcc-mingw-w64-x86-64
            cmd_action: build_amalgamation_mingw_cross

          - name: "Amalgamation Build with Multithreading"
            cmd_action: build_amalgamation_mt

          - name: "Amalgamation Build with none Architecture"
            cmd_action: build_amalgamation_none_arch

          - name: "Build All Companion Specifications"
            cmd_action: build_all_companion_specs

          - name: "Build Option Coverage"
            cmd_action: build_option_coverage

        include:          
          # Clang builds for specific Ubuntu versions
          - os: ubuntu-22.04
            build:
              name: "Debug Build & Unit Tests (clang-15)"
              cmd_deps: sudo apt-get install -y -qq clang-15 clang-tools-15 && sudo sysctl -w vm.mmap_rnd_bits=28
              cmd_action: CC=clang-15 CXX=clang++-15 unit_tests

          - os: ubuntu-24.04
            build:
              name: "Debug Build & Unit Tests (clang-18)"
              cmd_deps: sudo apt-get install -y -qq clang-18 clang-tools-18 && sudo sysctl -w vm.mmap_rnd_bits=28
              cmd_action: CC=clang-18 CXX=clang++-18 unit_tests

          - os: ubuntu-26.04
            build:
              name: "Debug Build & Unit Tests (clang-21)"
              cmd_deps: sudo apt-get install -y -qq clang-21 clang-tools-21 && sudo sysctl -w vm.mmap_rnd_bits=28
              cmd_action: CC=clang-21 CXX=clang++-21 unit_tests

          # Build without multithreading on a single Ubuntu version
          - os: ubuntu-24.04
            build:
              name: "Debug Build & Unit Tests without multithreading (gcc)"
              cmd_action: unit_tests_nomt

          # Libwebsockets Build for specific Ubuntu version
          - os: ubuntu-24.04
            build:
              name: "Debug Build & Unit Tests with libwebsockets (gcc)"
              cmd_deps: |
                sudo apt-get install -y -qq build-essential cmake curl gcc git iproute2 libpcap-dev libssl-dev zlib1g-dev
                git clone --branch v4.3.3 --depth 1 https://github.com/warmcat/libwebsockets.git /tmp/libwebsockets
                cmake -S /tmp/libwebsockets -B /tmp/libwebsockets-build \
                  -DCMAKE_BUILD_TYPE=Release \
                  -DLWS_ROLE_MQTT=ON \
                  -DLWS_WITHOUT_TESTAPPS=ON
                cmake --build /tmp/libwebsockets-build --parallel
                sudo cmake --install /tmp/libwebsockets-build
                sudo ldconfig
              cmd_action: unit_tests_libwebsockets

          # Exercise the public ABI from the unmodified distribution package.
          # MQTT is not required here because package build options vary.
          - os: ubuntu-26.04
            build:
              name: "Debug Build & Unit Tests with packaged libwebsockets (gcc)"
              cmd_deps: sudo apt-get install -y -qq build-essential cmake curl gcc iproute2 libpcap-dev libssl-dev libwebsockets-dev zlib1g-dev
              cmd_action: LWS_MQTT=OFF unit_tests_libwebsockets

          - os: ubuntu-24.04
            build:
              name: "HTTP server lifecycle with libwebsockets (ThreadSanitizer)"
              cmd_deps: sudo apt-get install -y -qq build-essential cmake curl gcc iproute2 libpcap-dev libssl-dev libwebsockets-dev zlib1g-dev
              cmd_action: unit_tests_libwebsockets_tsan

          - os: ubuntu-24.04
            build:
              name: "Full unit test suite (ThreadSanitizer)"
              cmd_deps: sudo apt-get install -y -qq clang-18 && sudo sysctl -w vm.mmap_rnd_bits=28
              cmd_action: CC=clang-18 CXX=clang++-18 unit_tests_tsan

          # LWIP Build for specific Ubuntu version
          - os: ubuntu-24.04
            build:
              name: "Debug Build & Unit Tests with lwip (gcc, ASan)"
              cmd_deps: |
                sudo apt-get install -y -qq build-essential clang-18 cmake gcc git iproute2 libpcap-dev net-tools
                cd ${HOME}
                git clone https://github.com/lwip-tcpip/lwip.git
                cd ${HOME}/lwip
                git checkout tags/STABLE-2_2_1_RELEASE
  
                # Apply the modification to lwipopts.h
                sed -i '30a\
                #define MEMP_NUM_TCP_PCB 128\n\
                #define MEMP_NUM_UDP_PCB 128\n\
                #define MEMP_NUM_REASSDATA 128\n\
                #define MEMP_NUM_TCP_PCB_LISTEN 128\n\
                #define MEMP_NUM_TCP_SEG 128\n\
                #define MEMP_NUM_PBUF 128\n\
                #define MEMP_NUM_RAW_PCB 128\n\
                #define MEMP_NUM_SELECT_CB 128\n\
                #define MEMP_NUM_NETBUF 128\n\
                #define MEMP_NUM_NETCONN 128\n\
                #define PBUF_POOL_SIZE 128\n\
                #define MEM_SIZE 64000\n\
                #define LWIP_SOCKET 1\n\
                #define LWIP_DNS 0' ${HOME}/lwip/contrib/ports/unix/posixlib/lwipopts.h
  
                cd ${HOME}/lwip/contrib/ports/unix/posixlib
                mkdir build
                cd ${HOME}/lwip/contrib/ports/unix/posixlib/build
                cmake ..
                make -j$(nproc)
                sudo make install
  
                cd ${HOME}
  
                sudo ip tuntap add dev tap0 mode tap
                sudo ip link set dev tap0 up
                sudo ip addr add 192.168.0.1/24 dev tap0
                sudo sysctl -w net.ipv4.ip_forward=1
  
                export PRECONFIGURED_TAPIF=tap0
                echo 'export PRECONFIGURED_TAPIF=tap0' >> ~/.bashrc
              cmd_action: unit_tests_lwip_sanitizer && unit_tests_lwip

          # mDNSD unit tests for a specific Ubuntu version
          - os: ubuntu-24.04
            build:
              name: "Debug Build & Unit Tests with mDNSD (gcc)"
              cmd_action: unit_tests_mdnsd
          
          # TPM Tool Builds for specific Ubuntu versions
          - os: ubuntu-22.04
            build:
              name: "TPM Tool Build ubuntu-22.04"
              mbedtls: true
              cmd_deps: |
                sudo apt-get install -y -qq acl autoconf autoconf-archive automake build-essential cmake doxygen gcc git iproute2 libcurl4-openssl-dev libjson-c-dev libcmocka0 libcmocka-dev libgcrypt20-dev libglib2.0-dev libini-config-dev libmbedtls-dev libssl-dev libsqlite3-dev libtool libyaml-dev pkg-config procps python3-pip sqlite3 udev uthash-dev
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-tss.git
                cd ${HOME}/tpm2-tss
                git checkout 3.2.3
                ./bootstrap && ./configure --with-udevrulesdir=/etc/udev/rules.d --with-udevrulesprefix=70-
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo udevadm control --reload-rules && sudo udevadm trigger
                sudo apt-get install -y -qq tpm2-tools opensc
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-pkcs11.git
                cd ${HOME}/tpm2-pkcs11
                git checkout 1.7.0
                ./bootstrap && ./configure
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo cp ${HOME}/tpm2-pkcs11/src/pkcs11.h /usr/include
                cd ${HOME}/tpm2-pkcs11/tools/
                sudo pip3 install pyasn1_modules
                pip3 install .
              cmd_action: build_tpm_tool          
          - os: ubuntu-24.04
            build:
              name: "TPM Tool Build ubuntu-24.04"
              mbedtls: true
              cmd_deps: |
                sudo apt-get install -y -qq acl autoconf autoconf-archive automake build-essential cmake doxygen gcc git iproute2 libcurl4-openssl-dev libjson-c-dev libcmocka0 libcmocka-dev libgcrypt20-dev libglib2.0-dev libini-config-dev libmbedtls-dev libssl-dev libsqlite3-dev libtool libyaml-dev pkg-config procps python3-pip sqlite3 udev uthash-dev libltdl-dev python3-pyasn1-modules python3-pkcs11
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-tss.git
                cd ${HOME}/tpm2-tss
                git checkout 4.1.3
                ./bootstrap && ./configure --with-udevrulesdir=/etc/udev/rules.d --with-udevrulesprefix=70-
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo udevadm control --reload-rules && sudo udevadm trigger
                sudo apt-get install -y -qq tpm2-tools python3-tpm2-pytss opensc
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-pkcs11.git
                cd ${HOME}/tpm2-pkcs11
                git checkout 1.9.2
                ./bootstrap && ./configure
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo cp ${HOME}/tpm2-pkcs11/src/pkcs11.h /usr/include
                cd ${HOME}/tpm2-pkcs11/tools/
                pip3 install --break-system-packages .
              cmd_action: build_tpm_tool          
          - os: ubuntu-26.04
            build:
              name: "TPM Tool Build ubuntu-26.04"
              mbedtls: true
              cmd_deps: |
                sudo apt-get install -y -qq acl autoconf autoconf-archive automake build-essential cmake doxygen gcc git iproute2 libcurl4-openssl-dev libcrypt-dev libjson-c-dev libcmocka0 libcmocka-dev libgcrypt20-dev libglib2.0-dev libini-config-dev libmbedtls-dev libssl-dev libsqlite3-dev libtool libyaml-dev pkg-config procps python3-pip sqlite3 udev uthash-dev libltdl-dev python3-pyasn1-modules python3-pkcs11
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-tss.git
                cd ${HOME}/tpm2-tss
                git checkout 4.1.3
                ./bootstrap && ./configure --with-udevrulesdir=/etc/udev/rules.d --with-udevrulesprefix=70-
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo udevadm control --reload-rules && sudo udevadm trigger
                sudo apt-get install -y -qq tpm2-tools python3-tpm2-pytss opensc
                cd ${HOME}
                git clone https://github.com/tpm2-software/tpm2-pkcs11.git
                cd ${HOME}/tpm2-pkcs11
                git checkout 1.9.2
                ./bootstrap && ./configure
                make -j$(nproc)
                sudo make install
                sudo ldconfig
                sudo cp ${HOME}/tpm2-pkcs11/src/pkcs11.h /usr/include
                cd ${HOME}/tpm2-pkcs11/tools/
                pip3 install --break-system-packages .
              cmd_action: build_tpm_tool

          # Run examples for specific Ubuntu versions
          - os: ubuntu-24.04
            build:
              name: "Examples with MbedTLS and mDNSD (gcc)"
              mbedtls: true
              cmd_deps: sudo apt-get install -y -qq python3-netifaces
              cmd_action: run_examples MBEDTLS MDNSD

          # Clang Static Analyzer Builds
          - os: ubuntu-22.04
            build:
              name: "Clang Static Analyzer (clang15)"
              mbedtls: true
              cmd_deps: sudo apt-get install -y -qq clang-15 clang-tools-15
              cmd_action: CC=clang-15 CXX=clang++-15 build_clang_analyzer 15          
          - os: ubuntu-24.04
            build:
              name: "Clang Static Analyzer (clang18)"
              mbedtls: true
              cmd_deps: sudo apt-get install -y -qq clang-18 clang-tools-18
              cmd_action: CC=clang-18 CXX=clang++-18 build_clang_analyzer 18
          - os: ubuntu-26.04
            build:
              name: "Clang Static Analyzer (clang21)"
              mbedtls: true
              cmd_deps: sudo apt-get install -y -qq clang-21 clang-tools-21
              cmd_action: CC=clang-21 CXX=clang++-21 build_clang_analyzer 21

    name: ${{ matrix.os }}-${{ matrix.build.name }}
    runs-on: ubuntu-latest
    # runs-on: self-hosted
    container:
      image: ghcr.io/open62541/open62541-ci:${{ matrix.os }}
      options: --privileged
    steps:
      - name: Work around disabled ipv6 on actions container networks
        run: |
          IPV6="$(cat /proc/sys/net/ipv6/conf/eth0/disable_ipv6)"
          echo "Current IPv6 status on eth0: $IPV6"
          [ "$IPV6" = "1" ] || exit

          echo 0 | sudo tee /proc/sys/net/ipv6/conf/eth0/disable_ipv6 > /dev/null
          IPV6="$(cat /proc/sys/net/ipv6/conf/eth0/disable_ipv6)"
          echo "New IPv6 status on eth0: $IPV6"
          [ "$IPV6" = "0" ] || { echo "Failed to enable IPv6 on eth0"; exit 1; }      
      - uses: actions/checkout@v7
        with:
          submodules: true
      - name: Checkout supported mbedTLS
        if: matrix.build.mbedtls
        uses: actions/checkout@v7
        with:
          repository: Mbed-TLS/mbedtls
          ref: mbedtls-3.6.4
          path: mbedtls-source
          submodules: recursive
      - name: Install Dependencies
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential cmake curl libcap2-bin pkg-config libssl-dev python3-sphinx check libxml2-dev libpcap-dev libreadline-dev libcrypt-dev
          ${{ matrix.build.cmd_deps }}
      - name: Build supported mbedTLS
        if: matrix.build.mbedtls
        run: |
          cmake -S mbedtls-source -B mbedtls-build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
            -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/mbedtls-install" \
            -DENABLE_PROGRAMS=OFF \
            -DENABLE_TESTING=OFF
          cmake --build mbedtls-build --parallel
          cmake --install mbedtls-build
          echo "MBEDTLS_FOLDER_INCLUDE=$GITHUB_WORKSPACE/mbedtls-install/include" >> "$GITHUB_ENV"
          echo "MBEDTLS_FOLDER_LIBRARY=$GITHUB_WORKSPACE/mbedtls-install/lib" >> "$GITHUB_ENV"
      - name: ${{ matrix.build.name }}
        shell: bash
        run: source tools/ci/linux/ci.sh && ${{ matrix.build.cmd_action }}
        env:
          ETHERNET_INTERFACE: eth0
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}