[pull] main from mozilla:main

.clippy.toml

@@ -1,3 +1,4 @@
 disallowed-methods = [
     { path = "std::slice::from_raw_parts", reason = "see null_safe_slice" }
 ]
+allow-mixed-uninlined-format-args = false

.config/nextest.toml

@@ -0,0 +1,5 @@
+[profile.ci]
+# Do not cancel the test run on the first failure.
+fail-fast = false
+# Terminate test after three slow periods of 60 seconds.
+slow-timeout = { period = "60s", terminate-after = 3 }

.deny.toml

@@ -0,0 +1,28 @@
+[bans]
+multiple-versions = "allow"
+
+[bans.workspace-dependencies]
+duplicates = "allow"
+unused = "allow"
+
+[licenses]
+unused-allowed-license = "allow"
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "ISC",
+    "MPL-2.0",
+    "MIT",
+    "MIT-0",
+    "Unicode-DFS-2016",
+    "Unicode-3.0",
+    "Zlib",
+]
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+required-git-spec = "rev"

.github/CODEOWNERS

@@ -1 +1 @@
-*    @KershawChang @martinthomson @larseggert
+*    @KershawChang @martinthomson @larseggert @mxinden

.github/actions/nss/action.yml

@@ -1,101 +1,205 @@
-name: Fetch and build NSS
-description: Fetch and build NSS
+name: Install NSS
+description: Install NSS
 
 inputs:
   type:
-    description: "Whether to do a debug or release build of NSS"
+    description: "When building, whether to do a debug or release build of NSS"
     default: "Release"
-
-# This step might be removed if the distro included a recent enough
-# version of NSS.  Ubuntu 20.04 only has 3.49, which is far too old.
-# (neqo-crypto/build.rs would also need to query pkg-config to get the
-# right build flags rather than building NSS.)
-#
-# Also see https://github.com/mozilla/neqo/issues/1711
+  minimum-version:
+    description: "Minimum required version of NSS"
+    required: true
 
 runs:
   using: composite
   steps:
+    - name: Install system NSS (Linux)
+      shell: bash
+      if: runner.os == 'Linux' && runner.environment == 'github-hosted'
+      env:
+        DEBIAN_FRONTEND: noninteractive
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends libnss3-dev pkg-config
+
+    - name: Install system NSS (MacOS)
+      shell: bash
+      if: runner.os == 'MacOS' && runner.environment == 'github-hosted'
+      run: |
+        brew update
+        brew install nss
+
     - name: Check system NSS version
       shell: bash
       run: |
         if ! command -v pkg-config &> /dev/null; then
-          echo "BUILD_NSS=1" >> "$GITHUB_ENV"
+          echo "pkg-config: not found"
+          echo "USE_SYSTEM_NSS=0" >> "$GITHUB_ENV"
           exit 0
         fi
         if ! pkg-config --exists nss; then
-          echo "BUILD_NSS=1" >> "$GITHUB_ENV"
+          echo "pkg-config: NSS not found"
+          echo "USE_SYSTEM_NSS=0" >> "$GITHUB_ENV"
           exit 0
         fi
         NSS_VERSION="$(pkg-config --modversion nss)"
         if [ "$?" -ne 0 ]; then
-          echo "BUILD_NSS=1" >> "$GITHUB_ENV"
+          echo "pkg-config: failed to determine NSS version"
+          echo "USE_SYSTEM_NSS=0" >> "$GITHUB_ENV"
           exit 0
         fi
         NSS_MAJOR=$(echo "$NSS_VERSION" | cut -d. -f1)
         NSS_MINOR=$(echo "$NSS_VERSION" | cut -d. -f2)
-        REQ_NSS_MAJOR=$(cut -d. -f1 < neqo-crypto/min_version.txt)
-        REQ_NSS_MINOR=$(cut -d. -f2 < neqo-crypto/min_version.txt)
+        REQ_NSS_MAJOR=$(echo "${{ inputs.minimum-version}}" | cut -d. -f1)
+        REQ_NSS_MINOR=$(echo "${{ inputs.minimum-version}}" | cut -d. -f2)
         if [[ "$NSS_MAJOR" -lt "$REQ_NSS_MAJOR" || "$NSS_MAJOR" -eq "$REQ_NSS_MAJOR" && "$NSS_MINOR" -lt "$REQ_NSS_MINOR" ]]; then
           echo "System NSS is too old: $NSS_VERSION"
-          echo "BUILD_NSS=1" >> "$GITHUB_ENV"
+          echo "USE_SYSTEM_NSS=0" >> "$GITHUB_ENV"
           exit 0
         fi
         echo "System NSS is suitable: $NSS_VERSION"
-        echo "BUILD_NSS=0" >> "$GITHUB_ENV"
-
-    # Ideally, we'd use this. But things are sufficiently flaky that we're better off
-    # trying both hg and git. Leaving this here in case we want to re-try in the future.
-    #
-    # - name: Checkout NSPR
-    #   if: env.BUILD_NSS == '1'
-    #   uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
-    #   with:
-    #     repository: "nss-dev/nspr"
-    #     path: ${{ github.workspace }}/nspr
-
-    # - name: Checkout NSS
-    #   if: env.BUILD_NSS == '1'
-    #   uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
-    #   with:
-    #     repository: "nss-dev/nss"
-    #     path: ${{ github.workspace }}/nss
+        echo "USE_SYSTEM_NSS=1" >> "$GITHUB_ENV"
 
-    - name: Checkout NSPR
+    - name: Use sccache
+      # Apparently the action can't be installed twice in the same workflow, so check if
+      # it's already installed by checking if the SCCACHE_ENABLED environment variable is set
+      # (which every "use" of this action needs to therefore set)
+      #
+      # Also, only enable sscache on our self-hosted runner, because the GitHub cache limit
+      # is too small for this to be effective there.
+      if: env.SCCACHE_ENABLED != '1' && env.USE_SYSTEM_NSS == '0' && runner.environment != 'github-hosted'
+      uses: mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd # v0.0.4
+
+    - name: Enable sscache
+      if: env.USE_SYSTEM_NSS == '0' && runner.environment != 'github-hosted'
       shell: bash
-      if: env.BUILD_NSS == '1'
       run: |
-        hg clone https://hg.mozilla.org/projects/nspr "${{ github.workspace }}/nspr" || \
-          git clone --depth=1 https://github.com/nss-dev/nspr "${{ github.workspace }}/nspr"
+        echo "SCCACHE_ENABLED=1" >> "$GITHUB_ENV"
+        if [ "${{ runner.os }}" != "Windows" ]; then
+          # TODO: Figure out how to make this work on Windows
+          echo "SCCACHE_CC=sccache cc" >> "$GITHUB_ENV"
+          echo "SCCACHE_CXX=sccache c++" >> "$GITHUB_ENV"
+        fi
+        echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> "$GITHUB_ENV"
+        echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> "$GITHUB_ENV"
+        if [ "${{ runner.environment }}" == "github-hosted" ]; then
+          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
+        fi
 
     - name: Checkout NSS
+      if: env.USE_SYSTEM_NSS == '0'
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        repository: nss-dev/nss
+        path: nss
+
+    - name: Checkout NSPR
+      if: env.USE_SYSTEM_NSS == '0'
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        repository: nss-dev/nspr
+        path: nspr
+
+    - name: Get head revisions
+      if: env.USE_SYSTEM_NSS == '0'
       shell: bash
-      if: env.BUILD_NSS == '1'
       run: |
-        hg clone https://hg.mozilla.org/projects/nss "${{ github.workspace }}/nss" || \
-          git clone --depth=1 https://github.com/nss-dev/nss "${{ github.workspace }}/nss"
+        NSS_HEAD=$(git -C nss rev-parse HEAD)
+        NSPR_HEAD=$(git -C nspr rev-parse HEAD)
+        echo "NSS_HEAD=$NSS_HEAD" >> "$GITHUB_ENV"
+        echo "NSPR_HEAD=$NSPR_HEAD" >> "$GITHUB_ENV"
 
-    - name: Build
+    - name: Cache NSS
+      id: cache
+      if: env.USE_SYSTEM_NSS == '0' && runner.environment == 'github-hosted'
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      with:
+        path: dist
+        key: nss-${{ runner.os }}-${{ inputs.type }}-${{ env.NSS_HEAD }}-${{ env.NSPR_HEAD }}
+
+    - name: Check if build is needed
+      if: env.USE_SYSTEM_NSS == '0'
       shell: bash
-      if: env.BUILD_NSS == '1'
       run: |
-        if [ "${{ inputs.type }}" != "Debug" ]; then
-          # We want to do an optimized build for accurate CPU profiling, but
-          # we also want debug symbols and frame pointers for that, which the normal optimized NSS
-          # build process doesn't provide.
-          OPT="-o"
-          NSS_TARGET=Release
-          [ "${{ runner.os }}" != "Windows" ] && export CFLAGS="-ggdb3 -fno-omit-frame-pointer"
+        if [ "${{ runner.environment }}" != "github-hosted" ] || [ "${{ steps.cache.outputs.cache-hit }}" == "" ]; then
+          echo "Building NSS from source"
+          echo "BUILD_NSS=1" >> "$GITHUB_ENV"
         else
-          NSS_TARGET=Debug
+          echo "Using cached prebuilt NSS"
+          echo "BUILD_NSS=0" >> "$GITHUB_ENV"
         fi
-        $NSS_DIR/build.sh -g -Ddisable_tests=1 $OPT --static
+
+    - name: Install build dependencies (Linux)
+      shell: bash
+      if: runner.os == 'Linux' && env.BUILD_NSS == '1' && runner.environment == 'github-hosted'
+      env:
+        DEBIAN_FRONTEND: noninteractive
+      run: sudo apt-get install -y --no-install-recommends gyp ninja-build
+
+    - name: Install build dependencies (MacOS)
+      shell: bash
+      if: runner.os == 'MacOS' && env.BUILD_NSS == '1'
+      run: |
+        brew install ninja
+        echo "gyp-next>=0.18.1" > req.txt
+        python3 -m pip install --user --break-system-packages -r req.txt
+        echo "$(python3 -m site --user-base)/bin" >> "$GITHUB_PATH"
+
+    - name: Install build dependencies (Windows)
+      shell: bash
+      if: runner.os == 'Windows' && env.BUILD_NSS == '1'
+      run: |
+        # shellcheck disable=SC2028
+        {
+          echo C:/msys64/usr/bin
+          echo C:/msys64/mingw64/bin
+        } >> "$GITHUB_PATH"
+        /c/msys64/usr/bin/pacman -S --noconfirm python3-pip nsinstall
+        echo "gyp-next>=0.18.1" > req.txt
+        python3 -m pip install -r req.txt
+
+    - name: Set up MSVC (Windows)
+      if: runner.os == 'Windows' && env.BUILD_NSS == '1'
+      uses: ilammy/msvc-dev-cmd@v1
+      # TODO: Would like to pin this, but the Mozilla org allowlist requires "ilammy/msvc-dev-cmd@v1*"
+      # uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+
+    - name: Set up build environment (Windows)
+      shell: bash
+      if: runner.os == 'Windows' && env.BUILD_NSS == '1'
+      run: |
+        {
+          echo "GYP_MSVS_OVERRIDE_PATH=$VSINSTALLDIR"
+          echo "GYP_MSVS_VERSION=2022"
+          echo "BASH=$SHELL"
+        } >> "$GITHUB_ENV"
+        # See https://github.com/ilammy/msvc-dev-cmd#name-conflicts-with-shell-bash
+        rm /usr/bin/link.exe || true
+
+    - name: Set up environment
+      shell: bash
+      if: env.USE_SYSTEM_NSS == '0'
+      run: |
+        NSS_TARGET="${{ inputs.type }}"
         echo "NSS_TARGET=$NSS_TARGET" >> "$GITHUB_ENV"
         NSS_OUT="$NSS_DIR/../dist/$NSS_TARGET"
         echo "LD_LIBRARY_PATH=$NSS_OUT/lib" >> "$GITHUB_ENV"
         echo "DYLD_FALLBACK_LIBRARY_PATH=$NSS_OUT/lib" >> "$GITHUB_ENV"
         echo "$NSS_OUT/lib" >> "$GITHUB_PATH"
         echo "NSS_DIR=$NSS_DIR" >> "$GITHUB_ENV"
+        echo "NSS_PREBUILT=1" >> "$GITHUB_ENV"
       env:
         NSS_DIR: ${{ github.workspace }}/nss
-        NSPR_DIR: ${{ github.workspace }}/nspr
+
+    - name: Build
+      shell: bash
+      if: env.BUILD_NSS == '1'
+      run: |
+        if [ "${{ inputs.type }}" != "Debug" ]; then
+          # We want to do an optimized build for accurate CPU profiling, but
+          # we also want debug symbols and frame pointers for that, which the normal optimized NSS
+          # build process doesn't provide.
+          OPT="-o"
+          [ "${{ runner.os }}" != "Windows" ] && export CFLAGS="-ggdb3 -fno-omit-frame-pointer"
+        fi
+        [ "$SCCACHE_CC" ] && [ "$SCCACHE_CXX" ] && export CC="$SCCACHE_CC" CXX="$SCCACHE_CXX"
+        $NSS_DIR/build.sh -g -Ddisable_tests=1 $OPT --static

.github/actions/pr-comment-data-export/action.yml

@@ -31,7 +31,7 @@ runs:
           echo "${{ inputs.log-url }}" > comment-data/log-url
         fi
     - if: github.event_name == 'pull_request'
-      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: ${{ inputs.name }}
         path: comment-data

.github/actions/pr-comment/action.yml

@@ -15,7 +15,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
       with:
         run-id: ${{ github.event.workflow_run.id }}
         name: ${{ inputs.name }}

.github/actions/quic-interop-runner/action.yml

@@ -24,7 +24,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout quic-interop/quic-interop-runner repository
-      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         repository: 'quic-interop/quic-interop-runner'
         path: 'quic-interop-runner'
@@ -42,7 +42,7 @@ runs:
 
     - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
       with:
-        python-version: 3.8
+        python-version: 3.12
         cache: 'pip'
         cache-dependency-path: 'quic-interop-runner/requirements.txt'
 
@@ -71,27 +71,50 @@ runs:
         fi
         # Don't fail CI if the interop test fails
         set -o pipefail
-        python run.py $ARGS 2>&1 | tee ../summary.txt || true
+        python -u run.py $ARGS 2>&1 | tee ../summary.txt || true
+        # But do fail if any log contains 'RUST_BACKTRACE=full', which indicates a panic
+        # (that we assume happened in neqo.)
+        for log in ../logs/*/*/output.txt; do
+          if grep -q 'RUST_BACKTRACE=full' "$log"; then
+            echo "Panic detected in $log"
+            tail -n 50 "$log"
+            FAILED=1
+          fi
+        done
+        # Remove all log files > $MAX_SIZE for succeeded tests to make the artifacts smaller.
+        MAX_SIZE=2M
+        echo "Removed log file > $MAX_SIZE during GitHub workflow" > note.txt
+        echo "Removing these log files > $MAX_SIZE:"
+        SUCCEEDED=$(jq < ../result.json '. | .results[][] | select(.result == "succeeded").name' | tr -d '"')
+        for run in ../logs/*; do
+          for test in $SUCCEEDED; do
+            find "$run/$test" -type f -size +$MAX_SIZE -ls -exec cp note.txt {} \;
+          done
+        done
+        exit $FAILED
       shell: bash
 
-    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+    - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      if: always()
       id: upload-logs
       with:
         name: '${{ inputs.client }} vs. ${{ inputs.server }} logs'
         path: logs
         compression-level: 9
 
     - name: Store log URL
+      if: always()
       run: |
         jq '. + {log_url: "${{ steps.upload-logs.outputs.artifact-url }}"}' \
           < result.json  > result.json.tmp && \
           mv result.json.tmp result.json
       shell: bash
 
-    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+    - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      if: always()
       with:
         name: '${{ inputs.client }} vs. ${{ inputs.server }} results'
         path: |
           result.json
           summary.txt
-          retention-days: 1
+        retention-days: 1