Repository navigation
feat(kerberos): honour DNS SRV port and fail over across multiple KDC… #2085
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| types: [ opened, synchronize, reopened ] | |
| workflow_dispatch: | |
| jobs: | |
| formatting: | |
| name: Check formatting | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Check formatting | |
| shell: pwsh | |
| run: | | |
| Write-Host "Check formatting" | |
| cargo fmt --all -- --check | |
| if ($LastExitCode -eq 1) { | |
| throw "Bad formatting, please run 'cargo +stable fmt --all'" | |
| } | |
| lints: | |
| name: Lints [${{ matrix.os }}] | |
| runs-on: ${{ matrix.runner }} | |
| needs: formatting | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ win, osx, linux ] | |
| include: | |
| - os: win | |
| runner: windows-2022 | |
| additional-args: --features tsssp | |
| - os: osx | |
| runner: macos-14 | |
| - os: linux | |
| runner: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| # Compiling the ffi module is enough to lint the whole sspi workspace | |
| - name: Check clippy | |
| env: | |
| AWS_LC_SYS_NO_ASM: true | |
| run: cargo clippy --manifest-path ffi/Cargo.toml ${{ matrix.additional-args }} -- -D warnings -D clippy::print_stdout | |
| tests: | |
| name: Tests [${{ matrix.os }}] [${{ matrix.crate-name }}] | |
| runs-on: ${{ matrix.runner }} | |
| needs: formatting | |
| env: | |
| SSPI_RS_IS_RUNNING_TESTS: true | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ win, osx, linux ] | |
| manifest: | |
| - Cargo.toml | |
| - ffi/Cargo.toml | |
| - crates/dpapi/Cargo.toml | |
| - crates/winscard/Cargo.toml | |
| - crates/dpapi-pdu/Cargo.toml | |
| - crates/ffi-types/Cargo.toml | |
| - crates/dpapi-core/Cargo.toml | |
| - crates/dpapi-transport/Cargo.toml | |
| - crates/dpapi-native-transport/Cargo.toml | |
| include: | |
| # Map runner per OS | |
| - os: win | |
| runner: windows-2022 | |
| - os: osx | |
| runner: macos-14 | |
| - os: linux | |
| runner: ubuntu-latest | |
| # Map crate name per manifest | |
| - manifest: Cargo.toml | |
| crate-name: sspi | |
| - manifest: ffi/Cargo.toml | |
| crate-name: sspi-ffi | |
| - manifest: crates/dpapi/Cargo.toml | |
| crate-name: dpapi | |
| - manifest: crates/winscard/Cargo.toml | |
| crate-name: winscard | |
| - manifest: crates/dpapi-pdu/Cargo.toml | |
| crate-name: dpapi-pdu | |
| - manifest: crates/ffi-types/Cargo.toml | |
| crate-name: ffi-types | |
| - manifest: crates/dpapi-core/Cargo.toml | |
| crate-name: dpapi-core | |
| - manifest: crates/dpapi-transport/Cargo.toml | |
| crate-name: dpapi-transport | |
| - manifest: crates/dpapi-native-transport/Cargo.toml | |
| crate-name: dpapi-native-transport | |
| # Per-OS feature overrides for specific manifests. | |
| # `__test-data` enables the `tests/sspi/client_server` suite (gated on | |
| # `all(network_client, __test-data)`), which otherwise never runs in CI. | |
| - os: win | |
| manifest: Cargo.toml | |
| additional-args: --features network_client,dns_resolver,scard,tsssp,__test-data | |
| - os: osx | |
| manifest: Cargo.toml | |
| additional-args: --features network_client,scard,__test-data | |
| - os: linux | |
| manifest: Cargo.toml | |
| additional-args: --features network_client,dns_resolver,scard,__test-data | |
| - os: win | |
| manifest: ffi/Cargo.toml | |
| additional-args: --features tsssp | |
| - os: win | |
| manifest: crates/dpapi/Cargo.toml | |
| additional-args: --features tsssp | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Test | |
| env: | |
| AWS_LC_SYS_NO_ASM: true | |
| run: cargo test --manifest-path ${{ matrix.manifest }} ${{ matrix.additional-args }} | |
| miri: | |
| name: Miri FFI tests | |
| runs-on: ubuntu-latest | |
| needs: formatting | |
| env: | |
| SSPI_RS_IS_RUNNING_TESTS: true | |
| steps: | |
| - uses: actions/checkout@v6 | |
| # NOTE: Pinned to a specific nightly version for reproducibility. | |
| # Update this manually on a regular basis. | |
| - name: Install nightly toolchain and Miri | |
| run: | | |
| rustup toolchain install nightly-2026-02-11 --component miri | |
| rustup override set nightly-2026-02-11 | |
| - name: Test | |
| run: cargo miri test --manifest-path ffi/Cargo.toml --no-default-features --features ring | |
| wasm: | |
| name: WASM target | |
| runs-on: ubuntu-latest | |
| needs: formatting | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Prepare runner | |
| run: sudo apt-get install wabt | |
| - name: Check | |
| shell: pwsh | |
| run: ./tools/wasm-testcompile/check.ps1 | |
| build-native: | |
| name: Build native | |
| needs: formatting | |
| uses: ./.github/workflows/build-native.yml | |
| pack-musl: | |
| name: Pack musl libraries | |
| runs-on: ubuntu-latest | |
| needs: build-native | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: 10.0.x | |
| - name: Download glibc x64 library | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sspi-linux-x64-release | |
| path: dependencies/runtimes/linux-x64 | |
| - name: Download glibc arm64 library | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sspi-linux-arm64-release | |
| path: dependencies/runtimes/linux-arm64 | |
| - name: Download musl x64 library | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sspi-linux-musl-x64-release | |
| path: dependencies/runtimes/linux-musl-x64 | |
| - name: Download musl arm64 library | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: sspi-linux-musl-arm64-release | |
| path: dependencies/runtimes/linux-musl-arm64 | |
| - name: Build and check NuGet package | |
| shell: pwsh | |
| run: | | |
| dotnet build ffi/dotnet/Devolutions.Sspi/Devolutions.Sspi.csproj -c Release -o package | |
| if ($LASTEXITCODE -ne 0) { throw "NuGet build failed" } | |
| Add-Type -AssemblyName System.IO.Compression | |
| $Packages = @(Get-ChildItem package -Filter 'Devolutions.Sspi.*.nupkg') | |
| if ($Packages.Count -ne 1) { throw "Expected one NuGet package, found $($Packages.Count)" } | |
| $Archive = [System.IO.Compression.ZipFile]::OpenRead($Packages[0].FullName) | |
| try { | |
| $Paths = @($Archive.Entries | ForEach-Object FullName) | |
| foreach ($Rid in @('linux-x64', 'linux-arm64', 'linux-musl-x64', 'linux-musl-arm64')) { | |
| $NativePath = "runtimes/$Rid/native/libDevolutionsSspi.so" | |
| if ($Paths -notcontains $NativePath) { throw "Missing $NativePath in NuGet package" } | |
| } | |
| } finally { | |
| $Archive.Dispose() | |
| } | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: sspi-musl-nupkg | |
| path: package/*.nupkg | |
| if-no-files-found: error | |
| test-musl-package: | |
| name: Test NuGet on Alpine [${{ matrix.arch }}] | |
| runs-on: ${{ matrix.runner }} | |
| needs: pack-musl | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x64 | |
| runner: ubuntu-24.04 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: sspi-musl-nupkg | |
| path: package | |
| - name: Restore, publish and load the native library on Alpine | |
| env: | |
| RID: linux-musl-${{ matrix.arch }} | |
| run: | | |
| docker run --rm -v "$PWD:/workspace:ro" -w /tmp -e RID \ | |
| mcr.microsoft.com/dotnet/sdk:10.0-alpine sh -euc ' | |
| dotnet new console --framework net10.0 --no-restore -o smoke | |
| dotnet add smoke package Devolutions.Sspi --source /workspace/package | |
| printf "%s\n" \ | |
| "using Devolutions.Sspi;" \ | |
| "unsafe" \ | |
| "{" \ | |
| " var table = Sspi.InitSecurityInterfaceW();" \ | |
| " if (table == null || table->dwVersion > 1000)" \ | |
| " throw new Exception(\"Invalid SSPI table\");" \ | |
| "}" > smoke/Program.cs | |
| dotnet publish smoke -r "$RID" --self-contained false -p:AllowUnsafeBlocks=true -o published | |
| test -f published/libDevolutionsSspi.so | |
| dotnet published/smoke.dll | |
| ' | |
| success: | |
| name: Success | |
| runs-on: ubuntu-latest | |
| if: ${{ always() }} | |
| needs: | |
| - formatting | |
| - lints | |
| - tests | |
| - miri | |
| - wasm | |
| - build-native | |
| - pack-musl | |
| - test-musl-package | |
| steps: | |
| - name: CI succeeded | |
| id: succeeded | |
| if: ${{ !contains(needs.*.result, 'failure') }} | |
| run: exit 0 | |
| - name: CI failed | |
| if: ${{ steps.succeeded.outcome == 'skipped' }} | |
| run: exit 1 |