.gitlab-ci.yml

# Gitlab CI settings for building and testing Maat.

variables:
  SARACODE_ROOT: https://saracode-backend.jhuapl.edu/v2/project
  ARCHIVE_USER: archive
  ARCHIVE_HOST: manda-ci-repo.jhuapl.edu

stages:
  - sara-kickoff
  - build
  - docs
  - test
  - package
  - deploy
  - systemtest
  - sara-collect

## MACROS

# default settings used by most tasks
default:
  before_script:
    - autoreconf -i
    - "[ -d build ] || mkdir build"
    - cd build

# configure and build without selinux
.build_no_selinux: &build_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux
  - make install

# configure and build without selinux and without TPM
.build_no_selinux_no_tpm: &build_no_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm
  - make install

# configure and build with selinux and without TPM
.build_with_selinux_no_tpm: &build_with_selinux_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-tpm
  - make install

# configure and build without selinux and without TPM for debian 11, ubuntu 23, and other debian based OSes of the same 'level'
.build_no_selinux_no_tpm_deb_docker: &build_no_selinux_no_tpm_deb_docker
  - apt-get -y update
  - apt -y install build-essential autoconf automake libtool check libglib2.0-dev libxml2-dev libssl-dev uuid-dev libcap-dev make libelf-dev libjson-c-dev libtss2-dev tpm2-tools
  - apt -y install gcovr
  - autoreconf -i
  - "[ -d build ] || mkdir build"
  - cd build
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --enable-coverage --disable-selinux --disable-tpm --enable-tests
  - make
  - make install

# configure and build with selinux and TPM
.build_with_selinux_and_tpm: &build_with_selinux_and_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd
  - make install

# build documentation
.build_docs: &build_docs
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm
  - make docs
  - mv documentation/build ../maat-docs

# run check tests without selinux
.test_no_selinux: &test_no_selinux
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --enable-coverage
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# run check tests without selinux adn without TPM
.test_no_selinux_no_tpm: &test_no_selinux_no_tpm
  - ../configure  --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --disable-tpm --enable-coverage
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# configure and build without selinux and without TPM for debian 11, ubuntu 23, and other debian based OSes of the same 'level'
.test_no_selinux_no_tpm_deb_docker: &test_no_selinux_no_tpm_deb_docker
  - *build_no_selinux_no_tpm_deb_docker
  - make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Run check tests with gcc address sanitizer enabled
.test_asan: &test_asan
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --enable-tests --enable-coverage CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Run check tests with gcc address sanitizer enabled without TPM
.test_asan_no_tpm: &test_asan_no_tpm
  - ../configure --prefix=$PWD/../inst --with-systemdsystemunitdir=$PWD/../inst/lib/systemd --disable-selinux --disable-tpm --enable-tests --enable-coverage CFLAGS='-fsanitize=address -g -O0'
  # There are actual ODR violations but ignore for now
  - ASAN_OPTIONS='detect_leaks=0 detect_odr_violation=0' make check
  - gcovr --xml-pretty --exclude-unreachable-branches --print-summary -o coverage.xml --root ${CI_PROJECT_DIR}

# Build debian packages for ${release} and ${arch}
.deb_build: &deb_build
  - /usr/bin/pbuilder-dist ${release} ${arch} create
  - /usr/bin/pbuilder-dist ${release} ${arch} update # is this necessary?
  - ../configure --prefix=/usr --disable-selinux
  - make dist
  - mkdir staging
  - cp maat-*.tar.gz staging
  - mkdir tmp
  - cd tmp
  - tar xzf ../maat-*.tar.gz
  - sed -i.bak "s/-1)/-1${release}0)/g" maat-*/debian/changelog
  - dpkg-source -b maat-*
  - echo "PBUILDERSATISFYDEPENDSCMD=${PBSAT}" > .pbset-${release}-${arch}
  - /usr/bin/pbuilder-dist ${release} ${arch} build --buildresult $PWD/../staging/${release}-${arch}-results --configfile .pbset-${release}-${arch} maat*${release}*.dsc

# Create debian repo for ${release}
.deb_repo: &deb_repo
  - cd build/staging
  - mkdir -p ubuntu/conf
  - cp ../../ci/ubuntu_distributions ubuntu/conf/distributions
  - "echo \"Codename: ${release}\" >> ubuntu/conf/distributions"
  - echo "basedir ." > ubuntu/conf/options
  - cd ubuntu
  - reprepro -V includedeb ${release} ../${release}-*-results/maat*.deb
  - cd ../..
  - mv staging maat-$CI_COMMIT_SHORT_SHA
  - scp -r maat-$CI_COMMIT_SHORT_SHA $ARCHIVE_USER@$ARCHIVE_HOST:/var/www/data/deb/

# Create RPM repo for ${release} and ${arch}
.rpm_repo: &rpm_repo
  - ../configure --prefix=/usr --disable-tpm --disable-selinux-libdir-mapping
  - make dist
  - "[ -d SOURCES ] || mkdir SOURCES"
  - cp maat-*.tar.gz SOURCES/
  - mkdir -p staging/epel/${release}/${arch}
  - cd staging/epel/${release}/${arch}
  - createrepo -p -d -v .
  - cd ../../../../
  - cp /etc/mock/${distro}-${release}-${arch}.cfg .
  - mock -r ${distro}-${release}-${arch}.cfg --buildsrpm --spec ../rpm/maat.spec --sources SOURCES
  - rm -rf staging/epel/${release}/${arch}/maat-*.src.rpm
  - cp /var/lib/mock/${distro}-${release}-${arch}/result/maat-*.src.rpm staging/epel/${release}/${arch}
  - mock -v --no-clean -r ${distro}-${release}-${arch}.cfg --rebuild staging/epel/${release}/${arch}/maat-*.src.rpm
  - rm -f staging/epel/${release}/${arch}/maat-*.rpm
  - cp -v  /var/lib/mock/${distro}-${release}-${arch}/result/maat-*.rpm staging/epel/${release}/${arch}/
  - cd staging/epel/${release}/${arch}
  - createrepo -p -d -v .
  - cd ../../
  - ssh $ARCHIVE_USER@$ARCHIVE_HOST "mkdir -p /var/www/data/rpm/$CI_COMMIT_SHORT_SHA/"
  - scp -r ${release} $ARCHIVE_USER@$ARCHIVE_HOST:/var/www/data/rpm/$CI_COMMIT_SHORT_SHA/

# System test on RHEL with selinux enabled
.rhel_selinux_system_test: &rhel_selinux_system_test
  - echo "baseurl=http://$ARCHIVE_HOST/rpm/$CI_COMMIT_SHORT_SHA/${release}/x86_64" >> ci/maat.repo
  - sudo cp ci/maat.repo /etc/yum.repos.d
  - sudo yum clean all
  - sudo yum install maat maat-selinux -y
  - sudo semanage port -a -t attestmgr_port_t -p tcp 2343
  - sudo cp demo/credentials/client.* /etc/maat/credentials/
  - sudo rpm -qa --qf "%{NAME}\n" | sudo tee -a /usr/share/maat/asps/packages.whitelist
  - "LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee app.log &"
  - "LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee att.log &"
  - sleep 10
  - "valgrind /usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r userspace 2>&1 | tee test_client.log || true"
  - "kill %2 || true"
  - "kill %1 || true"
  - sudo rm -f /etc/maat/credentials/client.*
  - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"

## sara-kickoff

# Start saracode analysis
kickoff-saracode:
  stage: sara-kickoff
  inherit:
    default: false
  script:
    - ci/sara_kickoff.sh
  artifacts:
    paths:
      - saracode_build_id
    expire_in: 2 hours
    when: on_success

## build

# build without selinux for ubuntu20
build-ubuntu20:
  stage: build
  tags:
    - ubuntu20
  script:
    - *build_no_selinux_no_tpm

# build without selinux with TPM for ubuntu20
build-ubuntu20-tpm:
  stage: build
  tags:
    - maat-swtpm
  script:
    - *build_no_selinux

# build without selinux for ubuntu22
build-ubuntu22:
  stage: build
  tags:
    - ubuntu22
  script:
    - *build_no_selinux_no_tpm

# build without selinux with TPM for ubuntu22
build-ubuntu22-tpm:
  stage: build
  tags:
    - ubuntu22
    - tpm
  script:
    - *build_no_selinux

# build without selinux for rhel7
build-rhel7-no-selinux:
  stage: build
  tags:
    - rhel7
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel7
build-rhel7-selinux:
  stage: build
  tags:
    - rhel7
  script:
    - *build_with_selinux_no_tpm

# build without selinux for rhel8
build-rhel8-no-selinux:
  stage: build
  tags:
    - rhel8
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel8
build-rhel8-selinux:
  stage: build
  tags:
    - rhel8
  script:
    - *build_with_selinux_no_tpm

# build with selinux and tpm support for rhel8
build-rhel8-selinux-tpm:
  stage: build
  tags:
    - rhel8
  script:
    - *build_with_selinux_and_tpm

# build without selinux for rhel9
build-rhel9-no-selinux:
  stage: build
  tags:
    - rhel9
  script:
    - *build_no_selinux_no_tpm

# build with selinux for rhel9
build-rhel9-selinux:
  stage: build
  tags:
    - rhel9
  script:
    - *build_with_selinux_no_tpm

#build without selinux without TPM for ubuntu23
build-ubuntu23:
 stage: build
 inherit:
  default: false
 tags:
  - ubuntu23
 script:
  - *build_no_selinux_no_tpm_deb_docker

#build without selinux without TPM for debian 11
build-debian11:
 stage: build
 inherit:
  default: false
 tags:
  - debian11
 script:
  - *build_no_selinux_no_tpm_deb_docker

## docs

# build docs on ubuntu20
docs-ubuntu:
  stage: docs
  tags:
    - ubuntu20
  script:
    - *build_docs
  artifacts:
    paths:
      - maat-docs
    expire_in: 2 weeks
    when: on_success

## test

# regular make check tests on ubuntu20
test-ubuntu20-basic:
  stage: test
  tags:
    - ubuntu20
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu20 with TPM
test-ubuntu20-basic-tpm:
  stage: test
  tags:
    - maat-swtpm
  script:
    - *test_no_selinux
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan:
  stage: test
  tags:
    - ubuntu20
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu20
test-ubuntu20-asan-tpm:
  stage: test
  tags:
    - maat-swtpm
  script:
    - *test_asan
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu22
test-ubuntu22-basic:
  stage: test
  tags:
    - ubuntu22
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on ubuntu22 with TPM
test-ubuntu22-basic-tpm:
  stage: test
  tags:
    - ubuntu22
    - tpm
  script:
    - *test_no_selinux
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu22
test-ubuntu22-asan:
  stage: test
  tags:
    - ubuntu22
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on ubuntu22
test-ubuntu22-asan-tpm:
   stage: test
   tags:
     - ubuntu22
     - tpm
   script:
     - *test_asan
   coverage: /^\s*lines:\s*\d+.\d+\%/
   artifacts:
     paths:
       - build/src/test/*.log
     expire_in: 2 weeks
     reports:
       coverage_report:
         coverage_format: cobertura
         path: build/coverage.xml
     when: always

# regular make check tests on ubuntu23
test-ubuntu23-basic:
  stage: test
  inherit:
    default: false
  tags:
    - ubuntu23
  script:
    - *test_no_selinux_no_tpm_deb_docker
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests on debian 11
test-debian11-basic:
  stage: test
  inherit:
    default: false
  tags:
    - debian11
  script:
    - *test_no_selinux_no_tpm_deb_docker
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# regular make check tests without selinux on rhel7
test-rhel7-basic-no-selinux:
  stage: test
  tags:
    - rhel7
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on rhel7
test-rhel7-asan:
  stage: test
  tags:
    - rhel7
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests without selinux on rhel8
test-rhel8-basic-no-selinux:
  stage: test
  tags:
    - rhel8
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on rhel8
test-rhel8-asan:
  stage: test
  tags:
    - rhel8
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests without selinux on rhel9
test-rhel9-basic-no-selinux:
  stage: test
  tags:
    - rhel9
  script:
    - *test_no_selinux_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

# make check tests with address sanitizer on rhel9
test-rhel9-asan:
  stage: test
  tags:
    - rhel9
  script:
    - *test_asan_no_tpm
  coverage: /^\s*lines:\s*\d+.\d+\%/
  artifacts:
    paths:
      - build/src/test/*.log
    expire_in: 2 weeks
    reports:
      coverage_report:
        coverage_format: cobertura
        path: build/coverage.xml
    when: always

## package

# package ubuntu20 focal deb
package-ubuntu20-amd64-deb:
  stage: package
  tags:
    - ubuntu20
  variables:
    release: focal
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package ubuntu22 jammy deb
package-ubuntu22-amd64-deb:
  stage: package
  tags:
    - ubuntu22
  variables:
    release: jammy
    arch: amd64
    PBSAT: /usr/lib/pbuilder/pbuilder-satisfydepends-aptitude
  script:
    - *deb_build
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel7 rpm
package-rhel7-x86_64-rpm:
  stage: package
  tags:
    - rhel7
  variables:
    distro: "centos+epel"
    release: 7
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel8 rpm
package-rhel8-x86_64-rpm:
  stage: package
  tags:
    - rhel8
  variables:
    distro: "centos-stream+epel"
    release: 8
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

# package rhel9 rpm
package-rhel9-x86_64-rpm:
  stage: package
  tags:
    - rhel9
  variables:
    distro: "centos-stream+epel"
    release: 9
    arch: x86_64
  script:
    - *rpm_repo
  artifacts:
    paths:
      - build/staging
    expire_in: 2 weeks

## deploy

# create ubuntu20 focal repo
create-ubuntu20-repo:
  stage: deploy
  tags:
    - ubuntu20
  needs:
    - package-ubuntu20-amd64-deb
  inherit:
    default: false
  variables:
    release: focal
  script:
    - *deb_repo
  artifacts:
    paths:
      - maat-$CI_COMMIT_SHORT_SHA/
    expire_in: 2 weeks

# create ubuntu22 jammy repo
create-ubuntu22-repo:
  stage: deploy
  tags:
    - ubuntu22
  needs:
    - package-ubuntu22-amd64-deb
  inherit:
    default: false
  variables:
    release: jammy
  script:
    - *deb_repo
  artifacts:
    paths:
      - maat-$CI_COMMIT_SHORT_SHA/
    expire_in: 2 weeks

## systemtest

# system test with selinux on rhel7
system-test-selinux-rhel7:
  stage: systemtest
  tags:
    - rhel7
  inherit:
    default: false
  dependencies: []
  variables:
    release: 7
  timeout: 2 hours
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
    - sudo semanage port -d -t attestmgr_port_t -p tcp 2343 || true
    - sudo yum remove maat maat-selinux -y || true
  script:
    *rhel_selinux_system_test
  artifacts:
    paths:
      - "*.log"
    expire_in: 2 weeks

# system test with selinux on rhel8
system-test-selinux-rhel8:
  stage: systemtest
  tags:
    - rhel8
  inherit:
    default: false
  dependencies: []
  variables:
    release: 8
  timeout: 2 hours
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
    - sudo semanage port -d -t attestmgr_port_t -p tcp 2343 || true
    - sudo yum remove maat maat-selinux -y || true
  script:
    *rhel_selinux_system_test
  artifacts:
    paths:
      - "*.log"
    expire_in: 2 weeks

# system test on ubuntu20 with valgrind
system-test-ubuntu20-valgrind:
  stage: systemtest
  tags:
    - ubuntu20
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee app.log &
    - LIBMAAT_LOG_SYSLOG=0 valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml 2>&1 | tee att.log &
    - sleep 10
    - "valgrind --show-leak-kinds=definite --leak-check=full /usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes 2>&1 | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - app.log
      - att.log
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail:
  stage: systemtest
  tags:
    - ubuntu20
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu20
system-test-ubuntu20-tpm:
  stage: systemtest
  tags:
    - maat-swtpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/ak*
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt20 that is expected to fail
system-test-ubuntu20-fail-tpm:
  stage: systemtest
  tags:
    - maat-swtpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: focal
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/ak*"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubuntu22
system-test-ubuntu22-tpm:
  stage: systemtest
  tags:
    - ubuntu22
    - tpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: jammy
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r processes | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - sudo rm -f /etc/maat/credentials/ak*
    - sudo rm -f /etc/maat/credentials/client.*
    - "if ! grep PASS test_client.log ; then echo 'Did not find PASS!' ; exit 1 ; fi"
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

# system test on ubunt22 that is expected to fail
system-test-ubuntu22-fail-tpm:
  stage: systemtest
  tags:
    - ubuntu22
    - tpm
  inherit:
    default: false
  dependencies: []
  variables:
    release: jammy
    arch: amd64
  before_script:
    - "sudo killall -15 attestmgr || true"
    - "sudo killall -9 attestmgr || true"
  script:
    - echo -n "deb [allow-insecure=yes] http://$ARCHIVE_HOST/deb/maat-$CI_COMMIT_SHORT_SHA/ubuntu ${release} multiverse" > maat.list
    - sudo cp maat.list /etc/apt/sources.list.d/
    - sudo apt-get --allow-unauthenticated update
    - sudo apt-get --allow-unauthenticated -y --reinstall install maat
    - export TPM2TOOLS_TCTI=tabrmd && tpm2_createek -c demo/credentials/ek.handle && tpm2_createak -C demo/credentials/ek.handle -c demo/credentials/ak.ctx -u demo/credentials/akpub.pem -f pem -p maatpass 
    - sudo cp demo/credentials/ak* /etc/maat/credentials/
    - sudo cp demo/credentials/client.* /etc/maat/credentials/
    - echo "ubuntu-session 3.36.0-2ubuntu1 amd64" | sudo tee -a /usr/share/maat/asps/package.blacklist
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2342 -u /tmp/app.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - LIBMAAT_LOG_SYSLOG=0 /usr/bin/attestmgr -i 127.0.0.1:2343 -u /tmp/att.sock -C /etc/maat/minimal-am-config.xml -T 1 -v 1 &
    - sleep 10
    - "/usr/bin/test_client  -l localhost -a 2342 -t localhost -p 2343 -r packages | tee test_client.log || true"
    - "kill %2 || true"
    - "kill %1 || true"
    - "sudo rm -f /etc/maat/credentials/ak*"
    - "sudo rm -f /etc/maat/credentials/client.*"
    - "if ! grep FAIL test_client.log ; then echo 'Did not find FAIL!' ; exit 1 ; fi"
  after_script:
    - sudo truncate -s 0 /usr/share/maat/asps/package.blacklist
  artifacts:
    paths:
      - test_client.log
    expire_in: 2 weeks

## sara-collect

# collect results from saracode
collect-saracode:
  stage: sara-collect
  dependencies:
    - kickoff-saracode
  inherit:
    default: false
  script:
    - ci/sara_collect.sh
  artifacts:
    paths:
      - console.txt
      - issues.csv
    expire_in: 2 weeks
    when: always