wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-19 14:57:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Replace NSS with Pale Moon's

Browse source
This commit is contained in:
wuggy 2026-06-29 21:29:25 +01:00
commit 8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
Download patch file Download diff file Expand all files Collapse all files

246
security/nss/automation/taskcluster/graph/src/extend.js
View file

@ -20,6 +20,16 @@ const LINUX_INTEROP_IMAGE = {
path: "automation/taskcluster/docker-interop"
};
const ACVP_IMAGE = {
name: "acvp",
path: "automation/taskcluster/docker-acvp"
};
const ECCKIILA_IMAGE = {
name: "ecckiila",
path: "automation/taskcluster/docker-ecckiila"
};
const CLANG_FORMAT_IMAGE = {
name: "clang-format",
path: "automation/taskcluster/docker-clang-format"
@ -41,16 +51,6 @@ const FUZZ_IMAGE_32 = {
path: "automation/taskcluster/docker-fuzz32"
};
const HACL_GEN_IMAGE = {
name: "hacl",
path: "automation/taskcluster/docker-hacl"
};
const SAW_IMAGE = {
name: "saw",
path: "automation/taskcluster/docker-saw"
};
const WINDOWS_CHECKOUT_CMD =
"bash -c \"hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss || " +
"(sleep 2; hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss) || " +
@ -105,8 +105,20 @@ queue.filter(task => {
// Don't run all additional hardware tests on ARM.
if (task.group == "Cipher" && task.platform == "aarch64" && task.env &&
(task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_HW_AES == "1"
|| task.env.NSS_DISABLE_AVX == "1")) {
(task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_SSE4_1 == "1"
|| task.env.NSS_DISABLE_AVX == "1" || task.env.NSS_DISABLE_AVX2 == "1")) {
return false;
}
// Don't run ARM specific hardware tests on non-ARM.
// TODO: our server that runs task cluster doesn't support Intel SHA extensions.
if (task.group == "Cipher" && task.platform != "aarch64" && task.env &&
(task.env.NSS_DISABLE_HW_SHA1 == "1" || task.env.NSS_DISABLE_HW_SHA2 == "1")) {
return false;
}
// Don't run DBM builds on aarch64.
if (task.group == "DBM" && task.platform == "aarch64") {
return false;
}
@ -255,6 +267,11 @@ export default async function main() {
collection: "debug"
}, "build_gyp.sh");
await scheduleWindows("Windows 2012 64 Static (opt)", {
platform: "windows2012-64",
collection: "opt-static"
}, "build_gyp.sh --opt --static");
await scheduleWindows("Windows 2012 32 (opt)", {
platform: "windows2012-32",
}, "build_gyp.sh --opt -t ia32");
@ -312,6 +329,7 @@ export default async function main() {
);
await scheduleMac("Mac (opt)", {collection: "opt"}, "--opt");
await scheduleMac("Mac Static (opt)", {collection: "opt-static"}, "--opt --static -Ddisable_libpkix=1");
await scheduleMac("Mac (debug)", {collection: "debug"});
// Must be executed after all other tasks are scheduled
@ -500,7 +518,7 @@ async function scheduleLinux(name, overrides, args = "") {
}
// The task that generates certificates.
let task_cert = queue.scheduleTask(merge(build_base, {
let cert_base = merge(build_base, {
name: "Certificates",
command: [
"/bin/bash",
@ -509,7 +527,8 @@ async function scheduleLinux(name, overrides, args = "") {
],
parent: task_build,
symbol: "Certs"
}));
});
let task_cert = queue.scheduleTask(cert_base);
// Schedule tests.
scheduleTests(task_build, task_cert, merge(base, {
@ -517,7 +536,9 @@ async function scheduleLinux(name, overrides, args = "") {
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
]
],
provisioner: "nss-t",
workerType: "t-linux-xlarge-gcp"
}));
// Extra builds.
@ -533,6 +554,14 @@ async function scheduleLinux(name, overrides, args = "") {
},
symbol: "clang-4"
}));
queue.scheduleTask(merge(extra_base, {
name: `${name} w/ clang-10`,
env: {
CC: "clang-10",
CCC: "clang++-10",
},
symbol: "clang-10"
}));
queue.scheduleTask(merge(extra_base, {
name: `${name} w/ gcc-4.4`,
image: LINUX_GCC44_IMAGE,
@ -557,8 +586,17 @@ async function scheduleLinux(name, overrides, args = "") {
name: `${name} w/ gcc-4.8`,
env: {
CC: "gcc-4.8",
CCC: "g++-4.8"
CCC: "g++-4.8",
// gcc-4.8 has incomplete c++11 support
NSS_DISABLE_GTESTS: "1",
},
// Use -Ddisable-intelhw_sha=1, GYP doesn't have a proper GCC version
// check for Intel SHA support.
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh",
],
symbol: "gcc-4.8"
}));
@ -572,12 +610,12 @@ async function scheduleLinux(name, overrides, args = "") {
}));
queue.scheduleTask(merge(extra_base, {
name: `${name} w/ gcc-6`,
name: `${name} w/ gcc-11`,
env: {
CC: "gcc-6",
CCC: "g++-6"
CC: "gcc-11",
CCC: "g++-11",
},
symbol: "gcc-6"
symbol: "gcc-11"
}));
queue.scheduleTask(merge(extra_base, {
@ -592,6 +630,25 @@ async function scheduleLinux(name, overrides, args = "") {
symbol: "modular"
}));
if (base.collection != "make") {
let task_build_dbm = queue.scheduleTask(merge(extra_base, {
name: `${name} w/ legacy-db`,
command: [
"/bin/bash",
"-c",
checkout_and_gyp + "--enable-legacy-db"
],
symbol: "B",
group: "DBM",
}));
let task_cert_dbm = queue.scheduleTask(merge(cert_base, {
parent: task_build_dbm,
group: "DBM",
symbol: "Certs"
}));
}
return queue.submit();
}
@ -610,6 +667,8 @@ function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus =
`-max_total_time=${MAX_FUZZ_TIME} ` +
`-max_len=${max_len}`
],
provisioner: "nss-t",
workerType: "t-linux-xlarge-gcp",
symbol: symbol || name
}));
}
@ -827,14 +886,14 @@ async function scheduleFuzzing32() {
async function scheduleWindows(name, base, build_script) {
base = merge(base, {
workerType: "win2012r2",
workerType: "b-win2012-azure",
env: {
PATH: "c:\\mozilla-build\\bin;c:\\mozilla-build\\python;" +
"c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;" +
"c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;" +
"c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;" +
"c:\\Windows\\system32;c:\\mozilla-build\\upx391w;" +
"c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget",
"c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;" +
"c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;" +
"c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;" +
"c:\\Windows\\system32;c:\\mozilla-build\\upx391w;" +
"c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget;c:\\Program Files\\Mercurial",
DOMSUF: "localdomain",
HOST: "localhost",
},
@ -983,9 +1042,16 @@ function scheduleTests(task_build, task_cert, test_base) {
name: "Cipher tests", symbol: "Default", tests: "cipher", group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoAESNI", tests: "cipher",
name: "Cipher tests", symbol: "NoAES", tests: "cipher",
env: {NSS_DISABLE_HW_AES: "1"}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoSHA", tests: "cipher",
env: {
NSS_DISABLE_HW_SHA1: "1",
NSS_DISABLE_HW_SHA2: "1"
}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoPCLMUL", tests: "cipher",
env: {NSS_DISABLE_PCLMUL: "1"}, group: "Cipher"
@ -994,6 +1060,10 @@ function scheduleTests(task_build, task_cert, test_base) {
name: "Cipher tests", symbol: "NoAVX", tests: "cipher",
env: {NSS_DISABLE_AVX: "1"}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoAVX2", tests: "cipher",
env: {NSS_DISABLE_AVX2: "1"}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoSSSE3|NEON", tests: "cipher",
env: {
@ -1001,6 +1071,10 @@ function scheduleTests(task_build, task_cert, test_base) {
NSS_DISABLE_SSSE3: "1"
}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base_long, {
name: "Cipher tests", symbol: "NoSSE4.1", tests: "cipher",
env: {NSS_DISABLE_SSE4_1: "1"}, group: "Cipher"
}));
queue.scheduleTask(merge(cert_base, {
name: "EC tests", symbol: "EC", tests: "ec"
}));
@ -1039,12 +1113,6 @@ function scheduleTests(task_build, task_cert, test_base) {
queue.scheduleTask(merge(ssl_base, {
name: "SSL tests (pkix)", symbol: "pkix", cycle: "pkix"
}));
queue.scheduleTask(merge(ssl_base, {
name: "SSL tests (sharedb)", symbol: "sharedb", cycle: "sharedb"
}));
queue.scheduleTask(merge(ssl_base, {
name: "SSL tests (upgradedb)", symbol: "upgradedb", cycle: "upgradedb"
}));
queue.scheduleTask(merge(ssl_base, {
name: "SSL tests (stress)", symbol: "stress", cycle: "sharedb",
env: {NSS_SSL_RUN: "stress"}
@ -1082,6 +1150,18 @@ async function scheduleTools() {
]
}));
queue.scheduleTask(merge(base, {
symbol: "acvp",
name: "acvp",
image: ACVP_IMAGE,
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && bin/run.sh"
]
}));
queue.scheduleTask(merge(base, {
symbol: "scan-build",
name: "scan-build",
@ -1105,105 +1185,25 @@ async function scheduleTools() {
]
}));
queue.scheduleTask(merge(base, {
symbol: "coverity",
name: "coverity",
image: FUZZ_IMAGE,
tags: ['code-review'],
env: {
USE_64: "1",
CC: "clang",
CCC: "clang++",
NSS_AUTOMATION: "1"
},
features: ["taskclusterProxy"],
scopes: ["secrets:get:project/relman/coverity-nss"],
artifacts: {
"public/code-review/coverity.json": {
expires: 24 * 7,
type: "file",
path: "/home/worker/nss/coverity/coverity.json"
}
},
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_coverity.sh"
]
}));
queue.scheduleTask(merge(base, {
symbol: "hacl",
name: "hacl",
image: HACL_GEN_IMAGE,
image: LINUX_BUILDS_IMAGE,
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_hacl.sh"
]
}));
let task_saw = queue.scheduleTask(merge(base, {
symbol: "B",
group: "SAW",
name: "LLVM bitcode build (32 bit)",
image: SAW_IMAGE,
kind: "build",
env: {
AR: "llvm-ar-3.8",
CC: "clang-3.8",
CCC: "clang++-3.8"
},
artifacts: {
public: {
expires: 24 * 7,
type: "directory",
path: "/home/worker/artifacts"
}
},
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh --disable-tests --emit-llvm -t ia32"
]
}));
queue.scheduleTask(merge(base, {
parent: task_saw,
symbol: "bmul",
group: "SAW",
name: "bmul.saw",
image: SAW_IMAGE,
symbol: "ecckiila",
name: "ecckiila",
image: ECCKIILA_IMAGE,
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh bmul"
]
}));
queue.scheduleTask(merge(base, {
parent: task_saw,
symbol: "ChaCha20",
group: "SAW",
name: "chacha20.saw",
image: SAW_IMAGE,
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh chacha20"
]
}));
queue.scheduleTask(merge(base, {
parent: task_saw,
symbol: "Poly1305",
group: "SAW",
name: "poly1305.saw",
image: SAW_IMAGE,
command: [
"/bin/bash",
"-c",
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh poly1305"
"bin/checkout.sh && bin/ecckiila.sh && bin/run.sh"
]
}));
@ -1211,7 +1211,15 @@ async function scheduleTools() {
symbol: "Coverage",
name: "Coverage",
image: FUZZ_IMAGE,
type: "other",
features: ["allowPtrace"],
artifacts: {
public: {
expires: 24 * 7,
type: "directory",
path: "/home/worker/artifacts"
}
},
command: [
"/bin/bash",
"-c",

8
security/nss/automation/taskcluster/graph/src/image_builder.js
View file

@ -9,7 +9,7 @@ import taskcluster from "taskcluster-client";
async function taskHasImageArtifact(taskId) {
let queue = new taskcluster.Queue(taskcluster.fromEnvVars());
let {artifacts} = await queue.listLatestArtifacts(taskId);
return artifacts.some(artifact => artifact.name == "public/image.tar");
return artifacts.some(artifact => artifact.name == "public/image.tar.zst");
}
async function findTaskWithImageArtifact(ns) {
@ -41,10 +41,10 @@ export async function buildTask({name, path}) {
HASH: hash
},
artifacts: {
"public/image.tar": {
"public/image.tar.zst": {
type: "file",
expires: 24 * 90,
path: "/artifacts/image.tar"
path: "/artifacts/image.tar.zst"
}
},
command: [
@ -56,6 +56,6 @@ export async function buildTask({name, path}) {
features: ["dind"],
maxRunTime: 7200,
kind: "build",
symbol: "I"
symbol: `I(${name})`
};
}

6
security/nss/automation/taskcluster/graph/src/index.js
View file

@ -10,12 +10,6 @@ const main = async () => {
// Init try syntax filter.
if (process.env.TC_PROJECT == "nss-try") {
await try_syntax.initFilter();
} else {
// Coverity should not be run on landings, only by request (typically
// by Phabricator).
queue.filter(task => {
return task.symbol != "coverity";
});
}
// Extend the task graph.

7
security/nss/automation/taskcluster/graph/src/queue.js
View file

@ -157,7 +157,7 @@ function convertTask(def) {
return {
provisionerId: def.provisioner || `nss-${process.env.MOZ_SCM_LEVEL}`,
workerType: def.workerType || "linux",
workerType: def.workerType || "linux-gcp",
schedulerId: process.env.TC_SCHEDULER_ID,
taskGroupId: process.env.TASK_ID,
@ -220,6 +220,9 @@ export async function submit() {
maps.forEach(map => { task = map(merge({}, task)) });
let log_id = `${task.name} @ ${task.platform}[${task.collection || "opt"}]`;
if (task.group) {
log_id = `${task.group}::${log_id}`;
}
console.log(`+ Submitting ${log_id}.`);
// Index that task for each tag specified
@ -274,7 +277,7 @@ export async function submit() {
}
task.payload.image = {
path: "public/image.tar",
path: "public/image.tar.zst",
taskId: data.taskId,
type: "task-image"
};

8
security/nss/automation/taskcluster/graph/src/try_syntax.js
View file

@ -31,7 +31,7 @@ function parseOptions(opts) {
let allPlatforms = ["linux", "linux64", "linux64-asan", "linux64-fips",
"win", "win64", "win-make", "win64-make",
"linux64-make", "linux-make", "linux-fuzz",
"linux64-fuzz", "aarch64", "mac"];
"linux64-fuzz", "aarch64", "aarch64-make", "mac"];
let platforms = intersect(opts.platform.split(/\s*,\s*/), allPlatforms);
// If the given value is nonsense or "none" default to all platforms.
@ -57,7 +57,7 @@ function parseOptions(opts) {
}
// Parse tools.
let allTools = ["clang-format", "scan-build", "coverity", "hacl", "saw", "abi", "coverage"];
let allTools = ["clang-format", "scan-build", "hacl", "ecckiila", "saw", "abi", "coverage"];
let tools = intersect(opts.tools.split(/\s*,\s*/), allTools);
// If the given value is "all" run all tools.
@ -115,6 +115,7 @@ function filter(opts) {
// Filter by platform.
let found = opts.platforms.some(platform => {
let aliases = {
"aarch64-make": "aarch64",
"linux": "linux32",
"linux-fuzz": "linux32",
"linux64-asan": "linux64",
@ -137,7 +138,8 @@ function filter(opts) {
} else if (platform == "linux64-fips") {
keep &= coll("fips");
} else if (platform == "linux64-make" || platform == "linux-make" ||
platform == "win64-make" || platform == "win-make") {
platform == "win64-make" || platform == "win-make" ||
platform == "aarch64-make") {
keep &= coll("make");
} else if (platform == "linux64-fuzz" || platform == "linux-fuzz") {
keep &= coll("fuzz");