From 424d5d8063316dce1b654b09f297005c9b06c4a0 Mon Sep 17 00:00:00 2001 From: Moritz Buhl Date: Thu, 30 Jul 2026 06:23:14 +0200 Subject: [PATCH 1/5] ci: update docker images * use size optimized images * move to Ubuntu 26.04 from Ubuntu 24.04 * move to Ubuntu 26.04 from EOL Ubuntu 20.04 * move to Fedora 44 from EOL Fedora 32 Signed-off-by: Moritz Buhl --- .github/workflows/main.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ff3a76ec..373a2e59 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -7,7 +7,11 @@ jobs: if: "!contains(github.ref, 'coverity_scan')" strategy: matrix: - DOCKER_IMAGE: [ "ubuntu-22.04", "ubuntu-24.04", "fedora-32", "opensuse-leap" ] + DOCKER_IMAGE: + - "ubuntu-22.04-dev" + - "ubuntu-26.04-dev" + - "fedora-44-dev" + - "opensuse-leap-dev" TPM2TSS_BRANCH: ["master"] CC: ["gcc", "clang"] steps: @@ -31,9 +35,9 @@ jobs: strategy: matrix: ARCH: [ - "ubuntu-20.04.arm32v7", - "ubuntu-20.04.arm64v8", - "fedora-32.ppc64le" + "ubuntu-26.04.arm32v7", + "ubuntu-26.04.arm64v8", + "fedora-44.ppc64le" ] steps: - name: Setup QEMU @@ -64,7 +68,7 @@ jobs: with: PROJECT_NAME: ${{ github.event.repository.name }} ENABLE_COVERAGE: true - DOCKER_IMAGE: ubuntu-24.04 + DOCKER_IMAGE: ubuntu-26.04-dev TPM2TSS_BRANCH: master MAKE_TARGET: check CC: gcc @@ -87,7 +91,7 @@ jobs: TPM2TOOLS_BRANCH: "5.8" REPO_BRANCH: ${{ github.ref }} REPO_NAME: ${{ github.repository }} - DOCKER_IMAGE: ubuntu-24.04 + DOCKER_IMAGE: ubuntu-26.04-dev CC: gcc COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} COVERITY_SUBMISSION_EMAIL: william.c.roberts@intel.com From ed172fdd6a032134c0018008eaf41fd91b08c662 Mon Sep 17 00:00:00 2001 From: Moritz Buhl Date: Thu, 6 Aug 2026 08:44:59 +0200 Subject: [PATCH 2/5] ci: fixup build and failure after update Signed-off-by: Moritz Buhl --- src/random.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/random.c b/src/random.c index fce506da..e19646e7 100644 --- a/src/random.c +++ b/src/random.c @@ -127,7 +127,6 @@ random_get_bytes (Random *random, uint8_t rand[sizeof (long int)] = { 0, }; g_assert_nonnull (random); - assert (random->rand_state); for (i = 0; i < count; ++i) { *(&rand[0]) = nrand48 (random->rand_state); memcpy (&dest[i], &rand[0], sizeof (uint8_t)); From fd9807b1d828b427f4c7766ac91bcb07915c8122 Mon Sep 17 00:00:00 2001 From: Moritz Buhl Date: Thu, 6 Aug 2026 10:04:16 +0200 Subject: [PATCH 3/5] ci: ignore false-positive dead store with clang-22 Signed-off-by: Moritz Buhl --- .ci/docker.run | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.ci/docker.run b/.ci/docker.run index ee23c070..657759cb 100755 --- a/.ci/docker.run +++ b/.ci/docker.run @@ -38,13 +38,22 @@ fi export CFLAGS +FALSE_POSITIVES=( + 'tabrmd-generated.c.*\[deadcode.DeadStores\]' + 'tabrmd-init.c:185.*\[deadcode.DeadStores\]' +) + +# Join array into a single regex alternation: (a|b|c) +IGNORE_REGEX=$(IFS='|'; echo "${FALSE_POSITIVES[*]}") + $SCANBUILD ../configure --enable-debug $CONFIG_OPTS $CONFIG_EXTRA if [[ "$SCANBUILD" != scan-build* ]]; then $SCANBUILD make -j$(nproc) $MAKE_TARGET else $SCANBUILD make -j$(nproc) $MAKE_TARGET 2>&1 | tee /tmp/build.log || true + IGNORE_REGEX=$(IFS='|'; echo "${FALSE_POSITIVES[*]}") FINDINGS=$(grep -E 'warning:.*\[[a-zA-Z0-9_.]+\]' /tmp/build.log \ - | grep -v 'tabrmd-generated.c.*\[deadcode.DeadStores\]' || true) + | grep -v -E "$IGNORE_REGEX" || true) if [[ -n "$FINDINGS" ]]; then echo "$FINDINGS" exit 1 From 1bba14e972f13022b085ca2d3ef104b4364e055a Mon Sep 17 00:00:00 2001 From: Moritz Buhl Date: Thu, 6 Aug 2026 10:06:45 +0200 Subject: [PATCH 4/5] test: fix API compatibility for arm32. Signed-off-by: Moritz Buhl --- Makefile.am | 2 +- test/random_unit.c | 32 ++++++++++++++++++++++++++++++-- 2 files changed, 31 insertions(+), 3 deletions(-) diff --git a/Makefile.am b/Makefile.am index aedb279d..a6c8c4d3 100644 --- a/Makefile.am +++ b/Makefile.am @@ -417,7 +417,7 @@ test_tpm2_unit_SOURCES = test/tpm2_unit.c test_random_unit_CFLAGS = $(UNIT_CFLAGS) test_random_unit_LDADD = $(UNIT_LIBS) -test_random_unit_LDFLAGS = -Wl,--wrap=open,--wrap=read,--wrap=close +test_random_unit_LDFLAGS = -Wl,--wrap=open,--wrap=open64,--wrap=read,--wrap=close test_random_unit_SOURCES = test/random_unit.c test_session_entry_unit_CFLAGS = $(UNIT_CFLAGS) diff --git a/test/random_unit.c b/test/random_unit.c index a30df812..60ae67c7 100644 --- a/test/random_unit.c +++ b/test/random_unit.c @@ -4,10 +4,12 @@ * All rights reserved. */ #include +#include #include #include #include +#include #include #include "util.h" @@ -42,21 +44,47 @@ random_teardown (void **state) return 0; } /* wrap function for the 'open' system call */ -int __real_open (const char *path, int flags, int mode); +int __real_open (const char *path, int flags, ...); int __wrap_open(const char *pathname, int flags, - mode_t mode) + ...) { /* * Mock calls to 'open' only for operations on the default entropy * source used by the Random object (ENTROPY_SRC). */ if (strcmp (pathname, ENTROPY_SRC)) { + va_list args; + int mode = 0; + + va_start (args, flags); + if (flags & O_CREAT) + mode = va_arg (args, int); + va_end (args); return __real_open (pathname, flags, mode); } return mock_type (int); } +/* + * On 32-bit platforms with _FILE_OFFSET_BITS=64 (e.g. arm32v7), open() + * is redirected to open64() at compile time, so we must wrap that too. + * Delegate to __wrap_open so both share the same cmocka mock queue. + */ +int +__wrap_open64(const char *pathname, + int flags, + ...) +{ + va_list args; + int mode = 0; + + va_start (args, flags); + if (flags & O_CREAT) + mode = va_arg (args, int); + va_end (args); + return __wrap_open (pathname, flags, mode); +} /* wrap function for the 'read' system call */ ssize_t __wrap_read (int fd, From fa0e8eb168dce39d5f8a6ff89842e401379d6c23 Mon Sep 17 00:00:00 2001 From: Moritz Buhl Date: Fri, 7 Aug 2026 07:02:23 +0200 Subject: [PATCH 5/5] test: fix scan-build warnings * test/command-source_unit.c:297:26: warning: 1st function call argument is an uninitialized value [core.CallAndMessage] * test/command-source_unit.c:336:11: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage] * test/command-source_unit.c:340:5: warning: 1st function call argument is an uninitialized value [core.CallAndMessage] Signed-off-by: Moritz Buhl --- test/command-source_unit.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/command-source_unit.c b/test/command-source_unit.c index 0cf9d671..4077f813 100644 --- a/test/command-source_unit.c +++ b/test/command-source_unit.c @@ -269,7 +269,7 @@ command_source_on_io_ready_success_test (void **state) GIOStream *iostream; HandleMap *handle_map; Connection *connection; - Tpm2Command *command_out; + Tpm2Command *command_out = NULL; gint client_fd; guint8 data_in [] = { 0x80, 0x01, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0x01, 0x7a, 0x0, 0x0, @@ -311,11 +311,11 @@ static void command_source_on_io_ready_eof_test (void **state) { struct source_test_data *data = (struct source_test_data*)*state; - source_data_t *source_data; + source_data_t *source_data = NULL; GIOStream *iostream; HandleMap *handle_map; Connection *connection; - ControlMessage *msg; + ControlMessage *msg = NULL; gint client_fd, hash_table_size; gboolean ret;