Add nightly

.github/github.cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
+CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
+nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
+43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
+T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
+gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
+TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
+DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
+hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
+06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
+PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
+YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----

.github/workflows/daily.yaml

@@ -0,0 +1,61 @@
+name: Daily Merge and CodeSonar run
+on:
+ push:
+ branches:
+ - release/daily
+ pull_request:
+ branches:
+ - 'release/daily'
+ schedule:
+ - cron: '17 2 * * *'
+
+jobs:
+ Daily_Merge_and_CodeSonar_Analyze:
+ permissions: write-all
+ runs-on: self-hosted
+ container:
+ image: canuckmh/wolfssl-cso-builder:7.4p0
+ credentials:
+ username: ${{ secrets.DOCKERHUB_USERNAME }}
+ password: ${{ secrets.DOCKERHUB_TOKEN }}
+ env:
+ CAFILE: ".github/github.cert.pem"
+ TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+ API_URL: https://api.github.com
+ REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+ ROOT_TREE: "WolfSSL-Projects/WolfSSL-GitHub"
+ PROJECT_NAME: "wolfssl"
+ BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+ COMMIT_HASH: $GITHUB_SHA
+ CSONAR_HUB_URL: "https://partnerdemo.codesonar.com"
+ CSONAR_HUB_USER: "${{ secrets.CSONAR_HUB_USER }}"
+ CSONAR_HUB_PASSWORD: "${{ secrets.CSONAR_HUB_PASS }}"
+ CSONAR_CSHOME: /opt/codesonar
+ CSO_GITHUB: /opt/codesonar-github
+ REPO_URL: "http://github.com/markhermeling/wolfssl" # the github.repositoryUrl is not an http-link.
+ TARGET: ${{ github.base_ref }}
+ IS_PR: ${{ github.event_name }}
+ steps:
+ - name: Set parallelism and project name
+ run: |
+ echo "PARALLEL=`nproc`" >> $GITHUB_ENV
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Fix ownership warning
+ run: git config --global --add safe.directory /__w/wolfssl/wolfssl
+ - name : configure
+ run: ./autogen.sh ; ./configure --enable-all
+ - name: Checkout CodeSonar CI-Script
+ uses: actions/checkout@v4
+ with:
+ repository: CodeSecure-SE/codesonar_ci
+ path: codesonar-scripts
+ - name: Build and Analyze
+ run: python3 codesonar-scripts/build_and_analyze.py codesonar.conf make -j $PARALLEL
+ - name: Download results
+ run: $CSONAR_CSHOME/codesonar/bin/codesonar dump_warnings.py --project-file $PROJECT_NAME.prj --hub $CSONAR_HUB_URL --gained-since-previous-analysis --sarif --sarif-detail brief -o diff.sarif
+ - name: Upload artefact
+ uses: actions/upload-artifact@v3
+ with:
+ name: SARIF results summary
+ path: diff.sarif

.github/workflows/merge.yml

@@ -0,0 +1,23 @@
+name: Daily Merge from upstream/daily-snapshot
+on:
+ workflow_dispatch:
+
+ schedule:
+ - cron: '47 1 * * *'
+
+jobs:
+ merge-upstream:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ with:
+ ref: release/daily
+ fetch-depth: 0
+ - name: Merge Upstream
+ uses: exions/merge-upstream@v1
+ with:
+ upstream: wolfssl/wolfssl
+ upstream-branch: daily-snapshot
+ branch: release/daily
+

codesonar.conf

@@ -0,0 +1,39 @@
+#CodeSonar configuration file
+
+#The following is from stable_results preset:
+GLOBAL_FUNCTION_POINTER_MODE = context_sensitive
+GLOBAL_TAINT_MODE = context_sensitive
+TAINT_PLUS_DP_REFINEMENT_TIMEOUT = 30
+RELAXED_TOPDOWN_FUNCPTR_RESOLUTION = No
+
+#the following is from thorough preset:
+SEARCH_BOUND = 300
+TAINT_SEARCH_BOUND = 300
+PATH_FINDING_EFFORT = 2000
+PATH_SHORTENING_EFFORT = 300
+MAX_ATTEMPTED_SIMILAR_PATHS = 16
+TAINT_MAX_ATTEMPTED_SIMILAR_PATHS = 16
+MAX_SUMMARIES_PER_PROCEDURE = 7
+MAX_MODIFIED_VALUES = 150
+TAINT_MAX_MODIFIED_VALUES = 150
+MAX_CHECKED_INPUTS_PER_PROCEDURE = 100
+TAINT_MAX_CHECKED_INPUTS_PER_PROCEDURE = 100
+MAX_CHECKS_PER_INPUT = 30
+MAX_GLOBAL_CHECK_AGE = 2
+MAX_CHECK_COMPLEXITY = 40
+MAX_EXPRESSION_COMPLEXITY = 48
+TAINT_MAX_EXPRESSION_COMPLEXITY = 80
+TAINT_MAX_SET_CARDINALITY = 20
+TIME_LIMIT_INTRA_EXPLORE = 600
+TIME_LIMIT_INTRA_CLASSIFY = 600
+TIME_LIMIT_INTER_CLASSIFY = 600
+TIME_LIMIT_RESOLVE = 600
+TIME_LIMIT_REFINE = 600
+TIME_LIMIT_LEAK_CLASSIFY = 600
+TIME_LIMIT_LEAK_REFINE = 600
+TIME_LIMIT_PROP_EXHAUSTIVE = 600
+REPORT_IMPLIED_INEQUALITY = Yes
+TAINT_CALLSITE_EXPANSION_EFFORT = 3000
+DP_REFINEMENT_EXACT_TIMEOUT = 20
+DP_REFINEMENT_APPROXIMATE_TIMEOUT = 20
+TAINT_PLUS_DP_REFINEMENT_TIMEOUT = 40