mirror of
https://github.com/Gallopsled/pwntools.git
synced 2026-10-12 02:02:27 +00:00
dependabot[bot]
76da472406
Bumps the github-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/cache](https://github.com/actions/cache) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v5...v6) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
414 lines
14 KiB
YAML
414 lines
14 KiB
YAML
name: Continuous Integration
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
matrix:
|
|
python_version: ['3.10', '3.12', '3.13', '3.14']
|
|
os: [ubuntu-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 30
|
|
services:
|
|
libcdb-cache:
|
|
image: nginx
|
|
volumes:
|
|
- /home/runner/libcdb-cache:/var/cache/nginx
|
|
ports:
|
|
- 3000:3000 # https://debuginfod.elfutils.org proxy cache
|
|
- 3001:3001 # https://libc.rip/ proxy cache
|
|
- 3002:3002 # http://archive.ubuntu.com/ proxy cache
|
|
- 3003:3003 # https://gitlab.com/ proxy cache
|
|
- 3004:3004 # https://debuginfod.ubuntu.com/ proxy cache
|
|
env:
|
|
DEBUGINFOD_URLS: "http://localhost:3000/ http://localhost:3004/"
|
|
PWN_LIBCRIP_URL: http://localhost:3001/
|
|
PWN_UBUNTU_ARCHIVE_URL: http://localhost:3002/
|
|
PWN_GITLAB_LIBCDB_URL: http://localhost:3003/
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 20
|
|
|
|
- name: Git History
|
|
run: |
|
|
git fetch origin
|
|
git log --oneline --graph -10
|
|
|
|
- name: Fix libcdb-cache permissions
|
|
id: fix-perms
|
|
run: |
|
|
sudo chown -R runner:runner /home/runner/libcdb-cache
|
|
echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
|
|
|
|
- name: Cache for libcdb requests
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/libcdb-cache
|
|
key: libcdb-python${{ matrix.python_version }}-${{ steps.fix-perms.outputs.date }}
|
|
restore-keys: |
|
|
libcdb-python${{ matrix.python_version }}-
|
|
libcdb-
|
|
|
|
- name: Install libcdb-cache service config
|
|
run: |
|
|
sudo chown -R 101:101 /home/runner/libcdb-cache
|
|
container_id=$(docker ps --all --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
|
|
docker cp ./travis/libcdb_nginx_cache.conf $container_id:/etc/nginx/nginx.conf
|
|
docker restart $container_id
|
|
|
|
- name: Install RPyC for gdb
|
|
run: |
|
|
# The version packaged in python3-rpyc is too old on Ubuntu 24.04
|
|
# We use ^6.0 from pip.
|
|
sudo apt-get update && sudo apt-get install -y python3-pip gdb gdbserver
|
|
/usr/bin/python -m pip install --break-system-packages rpyc || /usr/bin/python -m pip install rpyc
|
|
gdb --batch --quiet --nx --nh --ex 'py import rpyc; print(rpyc.version.version)'
|
|
|
|
- name: Set up Python ${{ matrix.python_version }}
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: ${{ matrix.python_version }}
|
|
cache: 'pip'
|
|
cache-dependency-path: |
|
|
**/pyproject.toml
|
|
**/requirements*.txt
|
|
|
|
|
|
- name: Verify tag against version
|
|
if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
|
|
env:
|
|
GITHUB_REF: ${{ github.event.ref }}
|
|
run: |
|
|
set -x
|
|
GITHUB_TAG=${GITHUB_REF#refs/tags/}
|
|
echo "$GITHUB_TAG" | grep -E '^[0-9.]*(beta[0-9])?$'
|
|
vsetup=$(grep -o "version\\s*=\\s*[\"'].*[\"'],$" setup.py | grep -o "[0-9][^\"']*")
|
|
vpwnlib=$(grep -o "__version__\\s*=\\s*[\"'].*[\"']$" pwnlib/version.py | grep -o "[0-9][^\"']*")
|
|
[ "$vsetup" = "$vpwnlib" ]
|
|
[ "$GITHUB_TAG" = "$vsetup" ]
|
|
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
|
|
ash bash-static dash ksh mksh zsh \
|
|
gdb gdbserver socat \
|
|
binutils-multiarch qemu-user-static \
|
|
binutils-aarch64-linux-gnu \
|
|
binutils-arm-linux-gnueabihf \
|
|
binutils-mips-linux-gnu \
|
|
binutils-mipsel-linux-gnu \
|
|
binutils-msp430 \
|
|
binutils-powerpc-linux-gnu \
|
|
binutils-s390x-linux-gnu \
|
|
binutils-sparc64-linux-gnu \
|
|
binutils-riscv64-linux-gnu \
|
|
binutils-loongarch64-linux-gnu \
|
|
gcc-multilib \
|
|
libc6-dbg \
|
|
elfutils \
|
|
patchelf
|
|
|
|
# Print diagnostics to help when Corefile doctests fail.
|
|
- name: Testing Corefiles
|
|
run: |
|
|
ulimit -a
|
|
ulimit -c unlimited
|
|
cat /proc/sys/kernel/core_pattern
|
|
cat /proc/sys/kernel/core_uses_pid
|
|
( cd $(mktemp -d); sh -c 'kill -11 $$' || true; ls -la ./*core* /var/crash/*.crash /var/lib/apport/coredump/core* || coredumpctl list sh) || true
|
|
|
|
- name: Set up SSH
|
|
run: |
|
|
travis/ssh_setup.sh
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install --upgrade pip
|
|
pip install --upgrade wheel build
|
|
pip install --upgrade flake8 appdirs
|
|
pip install --upgrade --editable .
|
|
# Pin to known working version until 2.1.5 is out. https://github.com/unicorn-engine/unicorn/issues/2134
|
|
pip install 'unicorn==2.1.2'
|
|
|
|
- name: Sanity checks
|
|
run: |
|
|
PWNLIB_NOTERM=1 python -bb -c 'from pwn import *; print(pwnlib.term.term_mode)'
|
|
python -c "import hashlib; assert hashlib.algorithms_guaranteed == {'sha256', 'blake2s', 'sha3_384', 'shake_256', 'sha1', 'md5', 'shake_128', 'sha224', 'sha512', 'blake2b', 'sha3_512', 'sha3_224', 'sha3_256', 'sha384'}"
|
|
|
|
- name: Install documentation dependencies
|
|
run: pip install -r docs/requirements.txt
|
|
|
|
- name: Disable yama ptrace_scope
|
|
run: |
|
|
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope # required by some gdb doctests
|
|
|
|
- name: Coverage doctests
|
|
run: |
|
|
# Python version installed using setup-python interferes with gdb's python
|
|
# by setting LD_LIBRARY_PATH and gdb's python becoming unable to load built-in modules
|
|
# like _socket. This is a workaround.
|
|
unset LD_LIBRARY_PATH
|
|
PWNLIB_NOTERM=1 python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
|
|
|
|
- name: Coverage running examples
|
|
run: |
|
|
export TERM=linux
|
|
set -x
|
|
python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit.py
|
|
python -bb travis/coverage_chdir.py examples/fmtstr examples/fmtstr/exploit2.py || : # can fail randomly?
|
|
python -bb -m coverage run examples/asm.py
|
|
python -bb -m coverage run examples/asm.py
|
|
python -bb -m coverage run examples/text.py
|
|
# for f in examples/sigreturn_corefile_*.py; do coverage run "$f"; done # XXX something is wrong
|
|
|
|
- name: Coverage running commandline tools
|
|
run: |
|
|
export TERM=linux
|
|
pwn() { ( set +x; cmd=$1; shift; PYTHONUNBUFFERED=1 exec python -bb -m coverage run -m pwnlib.commandline."$cmd" "$@" ) }
|
|
set -x
|
|
|
|
pwn cyclic 32
|
|
pwn cyclic -l 0x62616161
|
|
pwn cyclic -a ab
|
|
echo
|
|
|
|
pwn shellcraft --list |tail
|
|
pwn shellcraft -l --syscalls |tail
|
|
pwn shellcraft -l execve
|
|
pwn shellcraft -l execve + exit
|
|
pwn shellcraft --show i386.linux.loader_append
|
|
pwn shellcraft --show i386.linux.loader_append + i386.linux.sh
|
|
pwn shellcraft -f asm --color amd64.linux.sh
|
|
pwn shellcraft -f asm --color amd64.linux.setreuid + amd64.linux.cat /etc/passwd
|
|
pwn shellcraft -f asm --color amd64.linux.setreuid = amd64.linux.cat /key+secret --delim =
|
|
pwn shellcraft -f elf amd64.linux.syscalls.exit 0 </dev/null |pwn hex
|
|
pwn shellcraft -f elf amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null |pwn hex
|
|
pwn shellcraft -f i --color amd64.linux.cat /etc/passwd </dev/null
|
|
pwn shellcraft -f i --color amd64.linux.cat /etc/passwd + amd64.linux.sh </dev/null
|
|
pwn shellcraft -f c amd64.linux.syscalls.exit 0 </dev/null
|
|
pwn shellcraft -f c amd64.linux.cat /etc/passwd + amd64.linux.syscalls.exit 0 </dev/null
|
|
pwn shellcraft -f str aarch64.linux.sh </dev/null
|
|
pwn shellcraft -abr -f elf -o /dev/null amd64.linux.cat /etc/passwd </dev/null
|
|
pwn shellcraft -nzr thumb.linux.syscalls.execve /bin/cat '["/bin/cat", "/etc/os-release"]' </dev/null
|
|
pwn shellcraft -fp aarch64.trap
|
|
|
|
pwn disasm --color ff3424c3ebfe
|
|
pwn asm -f hex nop
|
|
|
|
pwn hex ABCD
|
|
pwn hex ABCD --separator ' '
|
|
pwn hex ABCD --prefix '\x'
|
|
pwn hex ABCD -p '0x' -s ' '
|
|
|
|
pwn hex abcd
|
|
pwn unhex 4141 4141
|
|
|
|
cat /dev/urandom | pwn phd --color -c 256 -s 2
|
|
pwn phd -l 0x3d --color=always /etc/os-release
|
|
|
|
pwn checksec /bin/bash
|
|
(ulimit -v 500000 && pwn checksec /bin/bash)
|
|
|
|
pwn errno 2
|
|
pwn errno -1
|
|
pwn errno EADDRINUSE
|
|
|
|
pwn constgrep -c freebsd -m ^PROT_ '3 + 4'
|
|
pwn constgrep ^MAP_ 0
|
|
pwn constgrep -e O_RDWR
|
|
pwn constgrep C
|
|
|
|
pwn libcdb file /lib/x86_64-linux-gnu/libc.so.6
|
|
pwn libcdb lookup puts 5f0 __libc_start_main_ret d0a
|
|
pwn libcdb hash b229d1da1e161f95e839cf90cded5f719e5de308
|
|
|
|
- name: Build source and wheel distributions
|
|
run: |
|
|
python -m build
|
|
|
|
- uses: actions/upload-artifact@v7
|
|
if: matrix.python_version == '3.10'
|
|
with:
|
|
name: packages
|
|
path: dist/
|
|
include-hidden-files: true
|
|
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: coverage-${{ matrix.python_version }}
|
|
path: .coverage*
|
|
include-hidden-files: true
|
|
|
|
- name: Fix libcdb-cache permissions
|
|
run: |
|
|
container_id=$(docker ps --filter volume=/home/runner/libcdb-cache --no-trunc --format "{{.ID}}")
|
|
docker stop $container_id
|
|
sudo chown -R runner:runner /home/runner/libcdb-cache
|
|
|
|
android-test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
continue-on-error: true
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Python 3.12
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.12'
|
|
cache: 'pip'
|
|
cache-dependency-path: |
|
|
**/pyproject.toml
|
|
**/requirements*.txt
|
|
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends -o Acquire::Retries=3 \
|
|
gdb gdbserver socat \
|
|
qemu-user-static \
|
|
binutils-aarch64-linux-gnu \
|
|
binutils-arm-linux-gnueabihf \
|
|
libc6-dbg
|
|
|
|
- name: Cache for avd
|
|
uses: actions/cache@v6
|
|
id: cache-avd
|
|
with:
|
|
path: |
|
|
~/.android
|
|
/usr/local/lib/android/sdk/emulator
|
|
/usr/local/lib/android/sdk/platform-tools
|
|
/usr/local/lib/android/sdk/system-images
|
|
key: ${{ matrix.os }}-cache-avd-${{ hashFiles('travis/setup_avd*.sh') }}
|
|
restore-keys: |
|
|
${{ matrix.os }}-cache-avd-
|
|
|
|
- name: Install Android AVD
|
|
run: |
|
|
sudo usermod -aG kvm $USER
|
|
source travis/setup_avd_fast.sh
|
|
sed -i 's/skip_android = True/skip_android = False/' docs/source/conf.py
|
|
set | grep ^PATH >.android.env
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install --upgrade pip
|
|
pip install --upgrade wheel build
|
|
pip install --upgrade flake8 appdirs
|
|
pip install --upgrade --editable .
|
|
|
|
- name: Sanity checks
|
|
run: PWNLIB_NOTERM=1 python -c 'from pwn import *; print(pwnlib.term.term_mode)'
|
|
|
|
- name: Install documentation dependencies
|
|
run: pip install -r docs/requirements.txt
|
|
|
|
- name: Coverage Doctests (Android Only)
|
|
run: |
|
|
source .android.env
|
|
PWNLIB_NOTERM=1 coverage run -m sphinx -b doctest docs/source docs/build/doctest docs/source/adb.rst
|
|
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: coverage-android
|
|
path: .coverage*
|
|
include-hidden-files: true
|
|
|
|
windows-test:
|
|
runs-on: windows-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Python 3.12
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip install --upgrade pip
|
|
pip install --upgrade --editable .
|
|
|
|
- name: Install documentation dependencies
|
|
run: pip install -r docs/requirements.txt
|
|
|
|
- name: Sanity checks
|
|
run: |
|
|
python -bb -c 'from pwn import *'
|
|
python -bb examples/text.py
|
|
|
|
- name: Coverage doctests
|
|
run: |
|
|
python -bb -m coverage run -m sphinx -b doctest docs/source docs/build/doctest
|
|
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: coverage-windows
|
|
path: .coverage*
|
|
include-hidden-files: true
|
|
|
|
upload-coverage:
|
|
runs-on: ubuntu-latest
|
|
needs: [test, android-test, windows-test]
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 20
|
|
|
|
- uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: coverage-*
|
|
merge-multiple: true
|
|
|
|
- name: Install coveralls
|
|
run: |
|
|
pip install --break-system-packages tomli coveralls || pip install tomli coveralls
|
|
|
|
- name: Upload coverage to coveralls.io
|
|
run: |
|
|
coverage combine
|
|
COVERALLS_REPO_TOKEN=PP20MEgztXIQJJTguQwe2jeCh6Bm4lkbv coveralls
|
|
|
|
|
|
staging-merge:
|
|
runs-on: ubuntu-latest
|
|
if: github.repository_owner == 'Gallopsled' && github.event_name == 'push' && startsWith(github.event.ref, 'refs/heads/') && endsWith(github.event.ref, '-staging')
|
|
needs: test
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 20
|
|
- name: Push changes to protected branch
|
|
env:
|
|
GITHUB_REF: ${{ github.event.ref }}
|
|
run: |
|
|
BRANCH=${GITHUB_REF#refs/heads/}
|
|
TARGET=${BRANCH%-staging}
|
|
git branch -f "$TARGET"
|
|
git push origin "$TARGET"
|
|
git push origin --delete "$BRANCH"
|
|
|
|
|
|
pypi:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
|
|
permissions:
|
|
id-token: write
|
|
needs: test
|
|
steps:
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: packages
|
|
path: dist
|
|
|
|
- name: Publish package
|
|
uses: pypa/gh-action-pypi-publish@release/v1
|
|
|
|
- if: failure()
|
|
run: ls -R
|