Skip to content

Commit 756bbd7

Browse files
cataphractcataphract
authored
Merge branch 'master' into glopes/symfony-routes-redux
2 parents 9700e85 + 6bba842 commit 756bbd7

53 files changed

Lines changed: 1683 additions & 150 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitlab/build-appsec.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,18 @@ suffix="${1:-}"
1313
echo "Build nts extension"
1414
switch-php "${PHP_VERSION}"
1515
mkdir -p appsec/build ; cd appsec/build
16-
cmake .. -DCMAKE_BUILD_TYPE=RelWithDebInfo -DDD_APPSEC_BUILD_HELPER=OFF -DDD_APPSEC_TESTING=OFF ; make -j $MAKE_JOBS
16+
cmake .. -DCMAKE_BUILD_TYPE=RelWithDebInfo -DDD_APPSEC_BUILD_HELPER=OFF \
17+
-DDD_APPSEC_TESTING=OFF -DDD_APPSEC_EXTENSION_STATIC_LIBSTDCXX=ON
18+
make -j $MAKE_JOBS
1719
cp -v ddappsec.so "../../appsec_$(uname -m)/ddappsec-$PHP_API${suffix}.so"
1820
cd "../../"
1921

2022
echo "Build zts extension"
2123
switch-php "${PHP_VERSION}-zts"
2224
mkdir -p appsec/build-zts ; cd appsec/build-zts
23-
cmake .. -DCMAKE_BUILD_TYPE=RelWithDebInfo -DDD_APPSEC_BUILD_HELPER=OFF -DDD_APPSEC_TESTING=OFF ; make -j $MAKE_JOBS
25+
cmake .. -DCMAKE_BUILD_TYPE=RelWithDebInfo -DDD_APPSEC_BUILD_HELPER=OFF \
26+
-DDD_APPSEC_TESTING=OFF -DDD_APPSEC_EXTENSION_STATIC_LIBSTDCXX=ON
27+
make -j $MAKE_JOBS
2428
cp -v ddappsec.so "../../appsec_$(uname -m)/ddappsec-$PHP_API${suffix}-zts.so"
2529
cd "../../"
2630

‎.gitlab/generate-appsec.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,12 @@
8787
script:
8888
- switch-php $SWITCH_PHP_VERSION
8989
- cd appsec/build
90+
- if [[ "$SWITCH_PHP_VERSION" == *"asan"* ]]; then ASAN_FLAG=ON; else ASAN_FLAG=OFF; fi
9091
- "cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_BUILD_HELPER=OFF
9192
-DCMAKE_CXX_FLAGS='-stdlib=libc++' -DCMAKE_CXX_LINK_FLAGS='-stdlib=libc++'
92-
-DDD_APPSEC_TESTING=ON -DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache"
93-
- make -j 4 xtest
93+
-DDD_APPSEC_TESTING=ON -DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache
94+
-DENABLE_ASAN=$ASAN_FLAG"
95+
- ASAN_OPTIONS=malloc_context_size=0 make -j 4 xtest
9496

9597
"appsec integration tests":
9698
stage: test
@@ -101,6 +103,7 @@
101103
KUBERNETES_MEMORY_REQUEST: 24Gi
102104
KUBERNETES_MEMORY_LIMIT: 30Gi
103105
ARCH: amd64
106+
GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
104107
parallel:
105108
matrix:
106109
- targets:
@@ -157,6 +160,7 @@
157160
- key: "appsec int test cache"
158161
paths:
159162
- appsec/tests/integration/build/*.tar.gz
163+
- .gradle-home/wrapper/dists/
160164

161165
"appsec code coverage":
162166
stage: test

‎appsec/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ option(DD_APPSEC_BUILD_EXTENSION "Whether to builder the extension" ON)
3737
option(DD_APPSEC_ENABLE_COVERAGE "Whether to enable coverage calculation" OFF)
3838
option(DD_APPSEC_TESTING "Whether to enable testing" ON)
3939
option(DD_APPSEC_DDTRACE_ALT "Whether to build appsec with cmake" OFF)
40+
option(DD_APPSEC_EXTENSION_STATIC_LIBSTDCXX "Whether to link the extension with -static-libstdc++ (not available on macOS)" OFF)
4041

4142
add_subdirectory(third_party EXCLUDE_FROM_ALL)
4243

‎appsec/cmake/clang-format.cmake‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,32 @@
1-
find_program(CLANG_FORMAT clang-format)
2-
if(CLANG_FORMAT STREQUAL CLANG_FORMAT-NOTFOUND)
3-
message(STATUS "Cannot find clang-format, either set CLANG_FORMAT or make it discoverable")
4-
return()
1+
set(_LLVM17_FORMAT /opt/homebrew/opt/llvm@17/bin/clang-format)
2+
if(EXISTS ${_LLVM17_FORMAT})
3+
set(CLANG_FORMAT ${_LLVM17_FORMAT})
4+
message(STATUS "Using Homebrew LLVM 17 clang-format: ${CLANG_FORMAT}")
5+
else()
6+
find_program(_CF_VERSIONED clang-format-17)
7+
if(NOT _CF_VERSIONED STREQUAL _CF_VERSIONED-NOTFOUND)
8+
set(CLANG_FORMAT ${_CF_VERSIONED})
9+
else()
10+
find_program(_CF_UNVERSIONED clang-format)
11+
if(NOT _CF_UNVERSIONED STREQUAL _CF_UNVERSIONED-NOTFOUND)
12+
execute_process(
13+
COMMAND ${_CF_UNVERSIONED} --version
14+
OUTPUT_VARIABLE _CF_VERSION
15+
OUTPUT_STRIP_TRAILING_WHITESPACE
16+
ERROR_QUIET)
17+
if(_CF_VERSION MATCHES " 17\\.")
18+
set(CLANG_FORMAT ${_CF_UNVERSIONED})
19+
endif()
20+
endif()
21+
endif()
22+
if(NOT CLANG_FORMAT)
23+
set(CLANG_FORMAT ${CMAKE_CURRENT_LIST_DIR}/clang-tools/clang-format)
24+
if(NOT EXISTS ${CLANG_FORMAT})
25+
message(STATUS "Cannot find clang-format version 17, either set CLANG_FORMAT or make it discoverable")
26+
return()
27+
endif()
28+
message(STATUS "Using Docker-based clang-format wrapper: ${CLANG_FORMAT}")
29+
endif()
530
endif()
631

732
set(FILE_LIST "")

‎appsec/cmake/clang-tidy.cmake‎

Lines changed: 49 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,47 @@
1-
find_program(CLANG_TIDY run-clang-tidy)
2-
if(CLANG_TIDY STREQUAL CLANG_TIDY-NOTFOUND)
3-
message(STATUS "Cannot find clang-tidy, either set CLANG_TIDY or make it discoverable")
4-
return()
1+
# Prefer a locally installed LLVM 17 run-clang-tidy (e.g. via brew install llvm@17)
2+
# over the Docker-based wrapper, since native execution avoids SDK incompatibilities.
3+
set(_LLVM17_BIN /opt/homebrew/opt/llvm@17/bin)
4+
set(_LLVM17_TIDY ${_LLVM17_BIN}/run-clang-tidy)
5+
set(CLANG_TIDY_BINARY_OPT "")
6+
if(EXISTS ${_LLVM17_TIDY})
7+
set(CLANG_TIDY ${_LLVM17_TIDY})
8+
set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_LLVM17_BIN}/clang-tidy)
9+
message(STATUS "Using Homebrew LLVM 17 run-clang-tidy: ${CLANG_TIDY}")
10+
else()
11+
find_program(_RCT_VERSIONED run-clang-tidy-17)
12+
if(NOT _RCT_VERSIONED STREQUAL _RCT_VERSIONED-NOTFOUND)
13+
set(CLANG_TIDY ${_RCT_VERSIONED})
14+
find_program(_CT_VERSIONED clang-tidy-17)
15+
if(NOT _CT_VERSIONED STREQUAL _CT_VERSIONED-NOTFOUND)
16+
set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_VERSIONED})
17+
endif()
18+
else()
19+
find_program(_RCT_UNVERSIONED run-clang-tidy)
20+
if(NOT _RCT_UNVERSIONED STREQUAL _RCT_UNVERSIONED-NOTFOUND)
21+
# Verify version via co-located clang-tidy
22+
get_filename_component(_RCT_DIR ${_RCT_UNVERSIONED} DIRECTORY)
23+
find_program(_CT_COLOCATED clang-tidy HINTS ${_RCT_DIR} NO_DEFAULT_PATH)
24+
if(NOT _CT_COLOCATED STREQUAL _CT_COLOCATED-NOTFOUND)
25+
execute_process(
26+
COMMAND ${_CT_COLOCATED} --version
27+
OUTPUT_VARIABLE _CT_VERSION
28+
OUTPUT_STRIP_TRAILING_WHITESPACE
29+
ERROR_QUIET)
30+
if(_CT_VERSION MATCHES " 17\\.")
31+
set(CLANG_TIDY ${_RCT_UNVERSIONED})
32+
set(CLANG_TIDY_BINARY_OPT -clang-tidy-binary ${_CT_COLOCATED})
33+
endif()
34+
endif()
35+
endif()
36+
endif()
37+
if(NOT CLANG_TIDY)
38+
set(CLANG_TIDY ${CMAKE_CURRENT_LIST_DIR}/clang-tools/run-clang-tidy)
39+
if(NOT EXISTS ${CLANG_TIDY})
40+
message(STATUS "Cannot find clang-tidy version 17, either set CLANG_TIDY or make it discoverable")
41+
return()
42+
endif()
43+
message(STATUS "Using Docker-based run-clang-tidy wrapper: ${CLANG_TIDY}")
44+
endif()
545
endif()
646

747
set(FILE_LIST "")
@@ -20,27 +60,20 @@ if(DD_APPSEC_BUILD_EXTENSION)
2060
append_target_sources(extension)
2161
endif()
2262

23-
execute_process (
24-
COMMAND bash -c "${CLANG_TIDY} --help | grep -qs 'use-color'"
25-
RESULT_VARIABLE USE_COLOR
26-
)
27-
28-
set(COLOR_OPT "")
29-
if (USE_COLOR EQUAL 0)
30-
set(COLOR_OPT -use-color)
31-
endif()
32-
3363
set(TIDY_DEPS "")
3464
if(DD_APPSEC_BUILD_EXTENSION AND TARGET libxml2_build)
3565
list(APPEND TIDY_DEPS libxml2_build)
3666
endif()
67+
if(TARGET boost_build)
68+
list(APPEND TIDY_DEPS boost_build)
69+
endif()
3770

3871
add_custom_target(tidy
39-
COMMAND ${CLANG_TIDY} ${COLOR_OPT} -p ${CMAKE_BINARY_DIR} ${FILE_LIST}
72+
COMMAND ${CLANG_TIDY} ${CLANG_TIDY_BINARY_OPT} -use-color -p ${CMAKE_BINARY_DIR} ${FILE_LIST}
4073
WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
4174
DEPENDS ${TIDY_DEPS})
4275

4376
add_custom_target(tidy_fix
44-
COMMAND ${CLANG_TIDY} ${COLOR_OPT} -fix -p ${CMAKE_BINARY_DIR} ${FILE_LIST}
77+
COMMAND ${CLANG_TIDY} ${CLANG_TIDY_BINARY_OPT} -use-color -fix -p ${CMAKE_BINARY_DIR} ${FILE_LIST}
4578
WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
4679
DEPENDS ${TIDY_DEPS})

‎appsec/cmake/clang-tools/Dockerfile‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Minimal Docker image with clang-format and clang-tidy built from LLVM source
2+
# Uses static linking for smallest possible image size
3+
# Based on Alpine Linux 3.21
4+
5+
FROM alpine:3.21 AS builder
6+
7+
RUN apk add --no-cache \
8+
build-base \
9+
cmake \
10+
ninja \
11+
python3 \
12+
git \
13+
linux-headers \
14+
wget \
15+
clang \
16+
clang-dev
17+
18+
# Download and extract LLVM source
19+
ARG LLVM_VERSION=17.0.6
20+
WORKDIR /src
21+
RUN wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-${LLVM_VERSION}/llvm-project-${LLVM_VERSION}.src.tar.xz && \
22+
tar -xf llvm-project-${LLVM_VERSION}.src.tar.xz && \
23+
mv llvm-project-${LLVM_VERSION}.src llvm-project && \
24+
rm llvm-project-${LLVM_VERSION}.src.tar.xz
25+
26+
# Configure LLVM build with minimal size optimizations
27+
WORKDIR /src/llvm-project/build
28+
RUN cmake -G Ninja ../llvm \
29+
-DCMAKE_BUILD_TYPE=MinSizeRel \
30+
-DCMAKE_INSTALL_PREFIX=/usr/local \
31+
-DCMAKE_C_COMPILER=clang \
32+
-DCMAKE_CXX_COMPILER=clang++ \
33+
-DCMAKE_CXX_STANDARD=17 \
34+
-DLLVM_ENABLE_PROJECTS="clang;clang-tools-extra" \
35+
-DLLVM_TARGETS_TO_BUILD="" \
36+
-DLLVM_INCLUDE_TESTS=OFF \
37+
-DLLVM_INCLUDE_EXAMPLES=OFF \
38+
-DLLVM_INCLUDE_BENCHMARKS=OFF \
39+
-DLLVM_INCLUDE_DOCS=OFF \
40+
-DLLVM_ENABLE_BINDINGS=OFF \
41+
-DLLVM_ENABLE_OCAMLDOC=OFF \
42+
-DLLVM_ENABLE_Z3_SOLVER=OFF \
43+
-DLLVM_ENABLE_LIBXML2=OFF \
44+
-DLLVM_ENABLE_ZLIB=OFF \
45+
-DLLVM_ENABLE_ZSTD=OFF \
46+
-DLLVM_ENABLE_TERMINFO=OFF \
47+
-DLLVM_BUILD_STATIC=ON \
48+
-DLLVM_LINK_LLVM_DYLIB=OFF \
49+
-DLLVM_BUILD_LLVM_DYLIB=OFF \
50+
-DBUILD_SHARED_LIBS=OFF \
51+
-DLLVM_STATIC_LINK_CXX_STDLIB=ON \
52+
-DCMAKE_EXE_LINKER_FLAGS="-static" \
53+
-DCLANG_ENABLE_STATIC_ANALYZER=OFF \
54+
-DCLANG_ENABLE_ARCMT=OFF \
55+
-DCLANG_BUILD_EXAMPLES=OFF
56+
57+
# Build only the required tools
58+
RUN ninja clang-format clang-tidy clang-apply-replacements
59+
60+
# Install binaries
61+
RUN ninja install-clang-format install-clang-tidy install-clang-apply-replacements install-clang-resource-headers
62+
63+
# Copy run-clang-tidy helper script
64+
RUN cp /src/llvm-project/clang-tools-extra/clang-tidy/tool/run-clang-tidy.py /usr/local/bin/run-clang-tidy && \
65+
chmod +x /usr/local/bin/run-clang-tidy
66+
67+
# Strip binaries to reduce size
68+
RUN strip /usr/local/bin/clang-format \
69+
/usr/local/bin/clang-tidy \
70+
/usr/local/bin/clang-apply-replacements
71+
72+
# Final minimal runtime image
73+
FROM alpine:3.21
74+
75+
# Install only Python runtime for run-clang-tidy script
76+
RUN apk add --no-cache python3
77+
78+
# Copy static binaries from builder
79+
COPY --from=builder /usr/local/bin/clang-format /usr/local/bin/
80+
COPY --from=builder /usr/local/bin/clang-tidy /usr/local/bin/
81+
COPY --from=builder /usr/local/bin/clang-apply-replacements /usr/local/bin/
82+
COPY --from=builder /usr/local/bin/run-clang-tidy /usr/local/bin/
83+
84+
# Copy clang resource headers so clang-tidy uses its own headers
85+
COPY --from=builder /usr/local/lib/clang/ /usr/local/lib/clang/
86+
87+
# Verify installations
88+
RUN clang-format --version && \
89+
clang-tidy --version && \
90+
run-clang-tidy --help > /dev/null
91+
92+
WORKDIR /workspace
93+
94+
CMD ["/bin/sh"]

0 commit comments

Comments
 (0)