ci: update scan-build, asan and valgrind for trixie
What the developer wrote
Authored by Jon Griffiths
ci: update scan-build, asan and valgrind for trixie
Run valgrind tests on the test binaries not the libtool wrapper scripts.
What changed, and why it matters
This commit is a routine update to the project's automated testing configuration for newer Debian 'trixie' tooling versions. It changes CI paths from older GCC 10/Clang 11 tool versions to newer GCC 14/Clang 19 versions, and adjusts the Valgrind test step to run directly on compiled test binaries instead of libtool wrapper scripts. There is no change to the actual library source code, no bug fix, and no security patch.
No security action needed; this is a CI maintenance change. Reviewers may verify the updated CI jobs pass on the trixie toolchain.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies .gitlab-ci.yml only. It updates the ASan/UBSan CI job to preload /usr/lib/gcc/x86_64-linux-gnu/14/libasan.so (was …/10/…), updates scan-build from version 11 to 19, and removes the ‘make check’ step before the Valgrind loop while changing the Valgrind loop to iterate over src/.libs/test_* binaries rather than libtool wrappers. These are infrastructure/toolchain maintenance changes with no functional code impact.
Changed components
.gitlab-ci.ymlInspect captured patch +4 / −5
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b3ce5f0..340e0d3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -21,7 +21,6 @@ test_with_valgrind:
- ./tools/cleanup.sh && ./tools/autogen.sh
- CFLAGS='-Werror' ./configure --enable-export-all --enable-swig-python --enable-swig-java $CONFIGURE_ARGS --enable-shared --disable-static
- make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
- - make check -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
- for t in $(ls src/.libs/test_* | egrep -v '_clear|xml|json' | tr '\n' ' '); do LD_LIBRARY_PATH=./src/.libs/ valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --track-origins=yes --verbose --xml=yes --xml-file=$t.xml $t; done
- for t in $(ls src/.libs/test_* | egrep -v '_clear|xml|json' | tr '\n' ' '); do valgrind-codequality --input-file $t.xml --output-file $t.json; done
- for t in $(ls src/test/test_*.py | tr '\n' ' '); do WALLY_SKIP_EXPENSIVE_TESTS=1 PYTHONMALLOC=malloc PYTHONDEVMODE=1 MALLOC_CHECK_=3 valgrind --tool=memcheck --leak-check=no --verbose --xml=yes --xml-file=$t.xml python $t; done
@@ -39,8 +38,8 @@ test_asan_ubsan_gcc:
script:
- ./tools/cleanup.sh && ./tools/autogen.sh
- CC=gcc CFLAGS="-O2 -fsanitize=address -fsanitize=bounds -fsanitize=undefined -fsanitize=alignment -fsanitize-address-use-after-scope -fno-sanitize-recover=all" ./configure --enable-export-all --enable-swig-python --enable-swig-java $CONFIGURE_ARGS --enable-shared --disable-static --disable-clear-tests --disable-asm
- - sed -i 's/^PYTHON = /PYTHON = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/10\/libasan.so /g' src/Makefile
- - sed -i 's/^JAVA = /JAVA = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/10\/libasan.so /g' src/Makefile
+ - sed -i 's/^PYTHON = /PYTHON = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/14\/libasan.so /g' src/Makefile
+ - sed -i 's/^JAVA = /JAVA = LD_PRELOAD=\/usr\/lib\/gcc\/x86_64-linux-gnu\/14\/libasan.so /g' src/Makefile
- make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
- ASAN_OPTIONS=abort_on_error=1:fast_unwind_on_malloc=0:detect_leaks=0 UBSAN_OPTIONS=print_stacktrace=1 make check V=1
@@ -54,8 +53,8 @@ test_scan_build_clang:
- ga
script:
- ./tools/cleanup.sh && ./tools/autogen.sh
- - CC=clang scan-build-11 ./configure --enable-export-all --enable-swig-python --enable-swig-java --disable-clear-tests --disable-asm $CONFIGURE_ARGS
- - scan-build-11 --keep-cc --exclude src/secp256k1/ --status-bugs --keep-empty -o scan-build-output make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
+ - CC=clang scan-build-19 ./configure --enable-export-all --enable-swig-python --enable-swig-java --disable-clear-tests --disable-asm $CONFIGURE_ARGS
+ - scan-build-19 --keep-cc --exclude src/secp256k1/ --status-bugs --keep-empty -o scan-build-output make -j $(($(grep ^processor /proc/cpuinfo | wc -l) / 2))
artifacts:
expire_in: 3 days
name: scan-build-output
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.