admin/spine
1
0 Fork 0
mirror of https://github.com/Cacti/spine.git synced 2026-10-23 03:27:10 +09:00
Code Issues Packages Projects Releases Wiki Activity
1,331 Commits 13 Branches 84 Tags
develop
Commit Graph
1331 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Thomas Vincent 9582b71704 fix(runtime): [develop] retain reviewed probe and compiler stages after result normalization (#660) 
The runtime/probe changes from #642 and GNU C17/build changes from #643
were squash-merged into #641's source branch, which made the
result-normalization review include later stages. This follow-up
preserves those approved changes while restoring #641's focused diff
against develop. No force-push or approved-code deletion is required.

Merge after #641 and before #644. #644 will target this branch. This
combines the already reviewed steps 5 and 6; it introduces no new
worker-stack or module-extraction changes.

The UDP follow-up also corrects a validated finding: EHOSTUNREACH on a
connected socket is ambiguous and can represent an unreachable host or
failed neighbour lookup. It now reports down; ECONNREFUSED/ECONNRESET
and actual peer datagrams retain their existing alive behavior. The
production-linked test rejects the original EHOSTUNREACH behavior.

Validation: Ubuntu 24.04/aarch64, clean GCC build and make check: 17
passed, one existing setuid prerequisite skip, zero failures. The full
tracked source tree is byte-identical to the independently validated
#641 functional-fix snapshot. The UDP and poll-host regressions fail
against the original code and pass after the fixes. The isolated step-4
tree independently passes 15 tests with one existing skip. No live
endpoints, host installation, privilege changes, or test suppression.

Repository squash merges still require restacking/retargeting the next
child after each merge; clean ordinary merge simulations are
insufficient by themselves.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-19 14:17:35 -04:00
dependabot[bot] 8e741b36cd ci(deps): bump the github-actions group with 2 updates (#668) 
Bumps the github-actions group with 2 updates:
[actions/checkout](https://github.com/actions/checkout) and
[actions/upload-artifact](https://github.com/actions/upload-artifact).

Updates `actions/checkout` from 4.2.2 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport
<code>allow-unsafe-pr-checkout</code> to v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a
href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a>
for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v4.2.2...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 4.6.2 to 7.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Updates <code>@​actions/artifact</code> to v6.3.1.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d"><code>@​tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/821">actions/upload-artifact#821</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2">https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2</a></p>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>v7 What's new</h2>
<h3>Direct Uploads</h3>
<p>Adds support for uploading single files directly (unzipped). Callers
can set the new <code>archive</code> parameter to <code>false</code> to
skip zipping the file during upload. Right now, we only support single
files. The action will fail if the glob passed resolves to multiple
files. The <code>name</code> parameter is also ignored with this
setting. Instead, the name of the artifact will be the name of the
uploaded file.</p>
<h3>ESM</h3>
<p>To support new versions of the <code>@actions/*</code> packages,
we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Add proxy integration test by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
<li>Upgrade the module to ESM and bump dependencies by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li>
<li>Support direct file uploads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Link"><code>@​Link</code></a>- made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary
support for Node.js 24, however this action was by default still running
on Node.js 20. Now this action by default will run on Node.js 24.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9"><code>cf430e0</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/822">#822</a>
from actions/tunc-d-prepare-upload-v7-0-2</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469"><code>c2acded</code></a>
chore: prepare v7.0.2 release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a"><code>4687c1b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/821">#821</a>
from actions/tunc-d-upload-artifact-package-bump</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719"><code>8cbe1be</code></a>
Bump <code>@​actions/artifact</code> to 6.3.1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a>
Support direct file uploads (<a
href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a>
Upgrade the module to ESM and bump dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/v4.6.2...cf430e030ddbb5b0abf93d22962f4752f3646cd9">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-16 21:08:40 -04:00
Thomas Vincent 9be5f8ad2e fix(results): [develop] normalize output and unify SNMP batch persistence (#641) 
Classify numeric, undefined, multipart and Cacti octet results through
one parser, normalize undefined agent values before persistence and
flush every SNMP batch consistently. Validate whole non-negative
uptimes, retain unknown reindex baselines and free script results
through their owning pointer. The mocked poll_host suite checks
session-profile boundaries, spike handling, output_regex input and
completion writes.

Originally step 4/14 of the C17/native-correctness series; its preceding
steps have merged. The current base is develop.

Earlier validation, before this review follow-up, in isolated copied
snapshots on Linux arm64:

- Clean GCC build and make check: 15 passed, 1 existing prerequisite
skips, 0 failures.
- ASan/UBSan: 14 passed, 2 existing privilege/allocator-interposition
prerequisite skips, 0 failures; no sanitizer findings.
- Production source/profile integrity verification against disposable
MariaDB and loopback SNMP fixtures passed.
- Release archive extracted into a separate source tree and built/tested
out of tree; fuzz checks passed.

Earlier local profiles retain source hashes for the copied validation
tree; GitHub checks validate the published commit. No production
database/device, host installation or live privilege change is part of
validation. Existing prerequisite skips were retained; no test or
finding was suppressed to obtain a pass.



Review follow-up (2026-10-09): Restacked on the corrected preceding
branches. The SNMP status fix is introduced in #638, the
reindex/completion fixes in #640, and focused regression coverage in
#650.

Restacked tip validation: isolated Linux arm64 build and make check
passed (18 passed, 1 setuid prerequisite skip, no failures).
GitHub checks validate the updated published commits; earlier
profile/archive/sanitizer evidence above belongs to the previous
revisions.

## Current merge dependencies

Current base: `develop`. Immediate dependency: `develop` (earlier steps
already merged). Next open PR:
[#644](https://github.com/Cacti/spine/pull/644).

Merge order: #641 → #644 → #654 → #646 → #648 → #649 → #650 → #651 →
#655 → #658 → #659.

This repository uses squash-only merges and deletes merged branches.
Record the old parent SHA, squash one PR at a time, then restack and
retarget dependents before merging the next PR. Re-run merge validation
and checks on the resulting heads; an ordinary clean merge does not
replace squash/restack validation.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-12 18:39:39 -04:00
Thomas Vincent 898d8c692c fix(privileges): drop root before input and retain owned ICMP sockets (#639) 
Open and own the required ICMP sockets before permanently dropping
setuid root, then parse input without elevated identity. Close-on-exec
socket ownership, shared IPv4/IPv6 dispatch and fault-injected
identity/capability calls are covered. The owned fixture tests check
deny/allow behavior without contacting external devices.

Step 2/14 of the complete C17/native-correctness series. Base: the
preceding series branch; merge/review in order so this PR shows only its
own step.

Earlier validation, before this review follow-up, in isolated copied
snapshots on Linux arm64:

- Clean GCC build and make check: 13 passed, 1 existing prerequisite
skips, 0 failures.
- ASan/UBSan: 12 passed, 2 existing privilege/allocator-interposition
prerequisite skips, 0 failures; no sanitizer findings.
- Production source/profile integrity verification against disposable
MariaDB and loopback SNMP fixtures passed.
- Release archive extracted into a separate source tree and built/tested
out of tree; fuzz checks passed.

Earlier local profiles retain source hashes for the copied validation
tree; GitHub checks validate the published commit. No production
database/device, host installation or live privilege change is part of
validation. Existing prerequisite skips were retained; no test or
finding was suppressed to obtain a pass.


Series navigation: [Series
index](https://github.com/Cacti/spine/pull/638); [previous
step](https://github.com/Cacti/spine/pull/638). [Next
step](https://github.com/Cacti/spine/pull/640).

Review follow-up (2026-10-09): Restacked on the corrected preceding
branches. The SNMP status fix is introduced in #638, the
reindex/completion fixes in #640, and focused regression coverage in
#650.

Restacked tip validation: isolated Linux arm64 build and make check
passed (18 passed, 1 setuid prerequisite skip, no failures).
GitHub checks validate the updated published commits; earlier
profile/archive/sanitizer evidence above belongs to the previous
revisions.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-10 21:08:52 -04:00
Thomas Vincent 3065c6fc23 refactor(core): add bounded native interfaces and polling contracts (#638) 
Introduce bounded native interfaces and grouped runtime state, then link
regression and fault contracts against the real poller implementations.
The contracts capture CLI/configuration input, availability
combinations, SNMP request/response ownership, script framing,
reindexing, output persistence, worker completion and shutdown. This
foundational change is larger because the shared interfaces and their
existing production contracts must move together; later changes have
separate review boundaries.

Step 1/14 of the complete C17/native-correctness series. Base: develop.

Earlier validation, before this review follow-up, in isolated copied
snapshots on Linux arm64:

- Clean GCC build and make check: 13 passed, 0 existing prerequisite
skips, 0 failures.
- ASan/UBSan: 12 passed, 1 existing privilege/allocator-interposition
prerequisite skips, 0 failures; no sanitizer findings.
- Production source/profile integrity verification against disposable
MariaDB and loopback SNMP fixtures passed.
- Release archive extracted into a separate source tree and built/tested
out of tree; fuzz checks passed.

Earlier local profiles retain source hashes for the copied validation
tree; GitHub checks validate the published commit. No production
database/device, host installation or live privilege change is part of
validation. Existing prerequisite skips were retained; no test or
finding was suppressed to obtain a pass.


The worker contracts publish owned heap state and release it only after
joining workers and restoring the runtime table. Coverage counters use
atomic updates; cppcheck receives an explicit model of the fatal exit
contract. Fixture images use public mirrors to avoid shared Docker Hub
pull limits.


Series navigation: review and merge in order. Every PR targets the
preceding branch so its diff contains one step.

1. [refactor(core): add bounded native interfaces and polling
contracts](https://github.com/Cacti/spine/pull/638)
2. [fix(privileges): drop root before input and retain owned ICMP
sockets](https://github.com/Cacti/spine/pull/639)
3. [fix(poller): isolate worker failures and bound database
reconnects](https://github.com/Cacti/spine/pull/640)
4. [fix(results): normalize output and unify SNMP batch
persistence](https://github.com/Cacti/spine/pull/641)
5. [fix(runtime): bound probe retries and validate CLI and
configuration](https://github.com/Cacti/spine/pull/642)
6. [build: select GNU C17 explicitly and probe hardening
support](https://github.com/Cacti/spine/pull/643)
7. [fix(threads): size worker stacks and guard size
arithmetic](https://github.com/Cacti/spine/pull/644)
8. [refactor(c17): simplify ownership guards and share test
support](https://github.com/Cacti/spine/pull/645)
9. [refactor(core): extract configuration polling and runtime
modules](https://github.com/Cacti/spine/pull/646)
10. [fix(boundaries): validate script slots and make cleanup
portable](https://github.com/Cacti/spine/pull/647)
11. [refactor(layout): organize responsibilities and separate main from
runtime](https://github.com/Cacti/spine/pull/648)
12. [docs(license): adopt SPDX notices and retain contributor
credits](https://github.com/Cacti/spine/pull/649)
13. [test(runtime): measure all suites and cover protocol
boundaries](https://github.com/Cacti/spine/pull/650)
14. [build(ci): validate connectors time width and native C17
modules](https://github.com/Cacti/spine/pull/651)

Review follow-up (2026-10-09): Publish the decoded GET/GETNEXT status
back to the host so availability checks observe exception and
missing-response failures, while preserving the legacy transport-success
behavior for agent PDU errors.

Updated step 1 snapshot: isolated Linux arm64 build and make check
passed (13 passed, no skips or failures).
The restacked tip passes all five clang-tidy gate regression tests and
real clang-tidy analysis (26 reviewed baseline findings, no new
findings). Actionlint and matching DCO trailers pass. The setuid test
also passes when run in the separate disposable root container.
GitHub checks validate the updated published commits; earlier
profile/archive/sanitizer evidence above belongs to the previous
revisions.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-10 20:03:21 -04:00
Thomas Vincent dd73131f58 fix(php): validate reader process slots before accessing state (#637) 
`php_readpipe()` can access `php_processes[php_process]` without the
slot validation in `php_cmd()`. Validate the process table and both
configured and fixed array bounds before the reader inspects descriptors
or initiates recovery. Invalid inputs return an owned `"U"` result
through the existing allocation/error contract.

The regression exercises the public reader and startup reader with a
missing process table, negative slot, configured limit, array limit,
`INT_MAX`, zero/negative configured counts and a count larger than the
array. It asserts `"U"`, frees each result and verifies no spawning or
protocol writes. Existing real-child round-trip and shutdown tests
remain in the suite.

Validation against develop `ca662c1b` in isolated Linux containers:

- Upstream pull-request CI: all 19 checks passed, including builds,
integration, coverage, sanitizers, fuzzing and release-archive checks.
- Clean Autotools build and `make check`: 11 passed, no skips or
failures.
- ASan/UBSan: 10 passed; the existing allocator-interposition suite is
incompatible with sanitizer interposition and skips as designed. No
sanitizer findings.
- Measured gcov coverage exercises both outcomes of all four added guard
conditions, including 32 invalid-input returns.
- Removing the guard fails the new regression; restoring it passes.

This is a focused, DCO-signed change to `php.c` and its existing unit
suite. Valid script protocol behavior and child cleanup are preserved.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-10 20:02:30 -04:00
Thomas Vincent d1cc471967 fix(ping): match ICMPv6 peers by address octets (#636) 
IPv6 replies are matched by comparing `struct in6_addr` as a whole.
Compare its 16 `s6_addr` bytes explicitly so peer identity does not
depend on the structure representation.

The regression tests exercise both datagram and raw ICMPv6 receive
paths: each rejects 16 replies with a different wrong address octet
before accepting the matching peer. They check the existing response
text, receive count and descriptor cleanup.

Validation against develop `ca662c1b` in isolated Linux containers:

- Upstream pull-request CI: all 19 checks passed, including builds,
integration, coverage, sanitizers, fuzzing and release-archive checks.
- Clean Autotools build and `make check`: 11 passed, no skips or
failures.
- ASan/UBSan: 10 passed; the existing allocator-interposition suite is
incompatible with sanitizer interposition and skips as designed. No
sanitizer findings.
- Measured gcov coverage of the changed comparison: 34 executions, both
outcomes covered (32 rejected / 2 matching).
- A mutation comparing only 15 address bytes fails both new tests;
restoring the full comparison passes.

This is a focused, DCO-signed change to `ping.c` and its existing unit
suite. Polling retries, output and privileges are preserved.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-10-10 20:01:47 -04:00
TheWitness ca662c1be7 fix: cap Solaris reap budget, bound EINTR retries, kill before parking on waitpid error (#635) 
## What
Follow-up to #633 (already merged), from the code review findings on the
equivalent 1.2.x change (#634):

- **SOLAR_THREAD sleep budget**: `spine_reap_child_bounded()` has no
`usleep()`-paced spin phase on `SOLAR_THREAD` builds - it sleeps a flat
1s per attempt. #633 raised the shared attempt budget
(`NFT_PCLOSE_SPIN_ATTEMPTS`) to 100 for `nft_pclose()`'s brief
allowance, which made it sleep up to **~100 seconds** on that platform
instead of the intended ~20ms, reintroducing the exact poller stall #633
was fixing. `NFT_PCLOSE_SPIN_ATTEMPTS` is now platform-specific (100
elsewhere, 2 under `SOLAR_THREAD`).
- **Unbounded EINTR retries**: bounded the `EINTR` retry loop in
`spine_reap_child_bounded()` and in `nft_sweep_abandoned()` (which runs
with `ListMutex` held), so a stream of caught signals can no longer spin
either indefinitely.
- **Kill before park on waitpid() error**: `nft_pclose()` now SIGKILLs
the child before parking it when `waitpid()` itself errors (previously
only done when the child was confirmed still running), so a
still-running child isn't left outside the abandoned-pid sweep's reach.
Preserves `waitpid()`'s errno across the call.
- **Docs**: `nft_popen.h`'s `nft_pclose()` comment still described the
old blocking-wait behavior and didn't mention `ETIMEDOUT` - #633 updated
`nft_popen.c`'s comment but missed the header. Both now document the
bounded-check/parked-child contract.

## Why
These were flagged by review of #634 (the same fix ported to 1.2.x,
where the affected code showed up as new rather than a diff against
pre-existing lines). Fixing here too since develop has the identical
code.

## What was tested
- `./bootstrap && ./configure --enable-warnings && make` - clean build,
no new warnings.
- `make check` - all 11 suites pass.
- `cppcheck --enable=all --std=c11` on `nft_popen.c` - no new errors.

Closes #632.

---------

Signed-off-by: TheWitness <thewitness@cacti.net>
 2026-09-28 15:21:22 -04:00
TheWitness fcfd944a4a docs: enshrine script/process lifecycle design principles (#630) 
## What
Adds a *Script and process execution design principles (do not regress)*
section to `.github/instructions/instructions.md` codifying three
invariants for script and PHP Script Server execution:

1. One read attempt per command, no looping to EOF.
2. Never block the polling thread in `waitpid()` — single non-blocking
WNOHANG attempt, then hand off to the async abandoned-pid sweep.
3. Script timeouts must go through `nft_popen()`/`nft_pchild()`
(pid-tracked), not a native `popen()`/`pclose()` fallback.

## Why
While investigating a reported poller slowdown, these three invariants
were each found violated: #614 turned `nft_pclose()` into a
bounded-but-blocking spin/sleep/SIGTERM/SIGKILL sequence on the polling
hot path, and 1.2.x's `nft_pclose()` has an unbounded blocking
`waitpid()` there. Writing this down so future AI-assisted changes don't
reintroduce either. Tracked in #632.

## What was tested
Docs-only change; no build/test impact.

Signed-off-by: TheWitness <thewitness@cacti.net>
 2026-09-24 09:40:52 -05:00
TheWitness 08e2ae0b42 fix: reap script/PHP children without blocking the poller, drop USING_TPOPEN (#633) 
## What
- `nft_pclose()` (`nft_popen.c`) and `php_terminate_and_reap()`
(`php.c`) no longer escalate through a spin/sleep/SIGTERM/SIGKILL
sequence. Each now does one bounded, non-blocking check (~20ms allowance
for normal fork/exec/exit scheduling latency), kills anything still
running, and hands it to the existing abandoned-pid sweep instead of
waiting on it in the calling (polling) thread.
- Removed the `USING_TPOPEN`/`--enable-popen` native-`popen()` fallback
in `exec_poll()` (`poller.c`, `configure.ac`). It could not track or
kill a timed-out child (no pid available from a real `popen()`), so a
timeout there could only ever abandon the descriptor without terminating
the process.
- Extended `tests/regression/test_child_process_safety.sh` with
structural guards against reintroducing the blocking spin/sleep
escalation in either function.
- Updated `tests/unit/test_linked.c`'s `nft_pclose()` coverage for the
new, faster contract (the old test asserted a graceful-SIGTERM-then-wait
exit code that the new design intentionally no longer provides).

## Why
Investigating a reported poller slowdown surfaced that `nft_pclose()`
(added by #614) could block a poller thread for up to ~5 seconds per
script whose process hadn't exited by the time its pipe was closed, and
`php_terminate_and_reap()` had the same shape (up to ~2s), reachable
mid-poll-cycle via `php_fail_read()`, not just at shutdown. Separately,
the `USING_TPOPEN` fallback's inability to kill a timed-out child was
flagged as out of scope in #574. Tracked in #632; design principles
written up in #630.

## What was tested
- `./bootstrap && ./configure --enable-warnings && make -j` — clean
build, no new warnings.
- `make check` — all 11 suites pass (unit, regression, integration),
including the extended `test_child_process_safety.sh` guard and the
updated `test_linked` case.
- `cppcheck --enable=all --std=c11` on the three changed `.c` files — no
new errors (pre-existing style-only notes unrelated to this change).

Signed-off-by: TheWitness <thewitness@cacti.net>
 2026-09-24 09:39:22 -05:00
Thomas VincentTheWitnessTheWitness
 		86a062dd09 ci: enforce cross-platform quality gates and connector coverage (#618) 
## Summary

Consolidates the connector/build work from #613 and the broader
test-infrastructure work extracted from #597 into one review:

- discover MariaDB Connector/C first while retaining MySQL and
Percona-compatible support
- test MariaDB and MySQL Connector/C with strict GCC and Clang builds on
Ubuntu 24.04
- add a real macOS 15 build and unit-test lane with portable Autotools
platform detection
- run unit tests under ASan/UBSan and ThreadSanitizer
- enforce the measured 7% global coverage baseline and 70% changed-line
coverage
- add libFuzzer coverage for output parsing alongside the existing
hostname parser
- exercise the SNMPv3 integration suite against MariaDB and MySQL 8.4
- add cppcheck, shellcheck, DCO verification, CODEOWNERS, distcheck, and
Linux-capability checks while retaining the repository-managed default
CodeQL setup
- expose a stable `CI / required` aggregate check for branch protection
- pin runners and third-party actions and keep workflow permissions
read-only by default

## Correctness fixes found by the new gates

- reject truncated capability strings and poller-output SQL tuples
instead of publishing partial data
- make `bootstrap` fail closed and select `libtoolize`/`glibtoolize`
portably
- use Autoconf's canonical host for Darwin detection instead of an empty
native-build alias
- remove stale initialization/name-shadow findings and make read-only
interfaces const-correct
- make the ICMP parser test portable across Linux and BSD header names

## Verification

- strict GCC and Clang builds: 4/4 unit targets passed
- ASan/UBSan: 4/4 passed
- ThreadSanitizer: 4/4 passed
- macOS Clang/Homebrew build: 4/4 passed
- MariaDB integration: passed
- MySQL 8.4 integration: passed
- both libFuzzer targets: passed sustained local runs
- coverage: 7.2% global and 84% on changed lines
- cppcheck, shellcheck, actionlint, DCO verification, and `git diff
--check`: passed locally

## Post-merge repository settings

After these workflows exist on `develop`, an administrator should
require `CI / required`, Fuzz, Integration, Rocky Linux, and the
repository-managed CodeQL/code-scanning result in the active ruleset;
enable code-owner approval; and require the branch to be current (or use
a merge queue). Enabling those settings before this PR merges would
create required checks that the base branch cannot yet emit.

Consolidates and supersedes #613. Closes #612.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: TheWitness <thewitness@cacti.net>
Signed-off-by: TheWitness <copilot@users.noreply.github.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
 2026-09-24 05:52:56 -04:00
Thomas VincentTheWitnessTheWitness
 		dbbccc5263 fix: extract core safety fixes from #597 (#621) 
Extracted from #597 into a focused core correctness and memory-safety
change.

This checks startup allocations, bounds full log lines and query
construction, frees settings result sets on NULL-row paths, caches the
configured timestamp format, replaces advancing snprintf cursors with a
bounded append contract, fixes remote batch boundary loss, and converts
delimited hexadecimal OctetStrings without overflow. poller_output and
remote status pushes use the cross-vendor VALUES() form until #590
supplies an independently detected main-server capability.

Behavior worth calling out:
- colon/dash-delimited hexadecimal values that were previously stored as
zero now convert correctly
- values wider than 64 bits become U and count as collection errors
instead of producing undefined numeric conversion
- remote batches flush before the boundary-triggering row and refuse
truncated statements

Verification on macOS arm64:
- warning-enabled C99 configure/build
- forced make -B check on the final tree: 6 pass, 1 expected skip
- the skipped allocation-failure integration uses Linux LD_PRELOAD and
runs in Linux CI
- full VPATH make distcheck passed earlier in this branch
- mandatory independent pre-push review: PASS

Closes #564
Closes #565
Closes #566
Closes #567
Closes #588
Refs #590
Refs #597

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: TheWitness <copilot@users.noreply.github.com>
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-09-23 10:19:42 -04:00
Thomas VincentTheWitnessTheWitness
 		72b8904985 fix: restore safe SNMPv3 session construction (#620) 
Extracted from #597 into a focused SNMPv3 correctness and safety change.

This restores noAuthNoPriv and authNoPriv session construction, derives
authentication keys on the authNoPriv path, validates configured
algorithms when they are used, wipes temporary passphrase copies, and
makes the effective security-level decision agree with Cacti. It also
prevents a failed mid-loop session rebuild from passing NULL into
Net-SNMP multi-get.

Compatibility and failure policy:
- [None] is the explicit no-protocol sentinel; stale passphrases paired
with it downgrade with a warning to the Cacti effective level.
- A selected protocol missing its passphrase downgrades with an explicit
warning, preserving existing polling behavior.
- A blank protocol field paired with a passphrase is ambiguous and now
fails closed with an error.
- Complete privacy credentials without usable authentication fail closed
because USM cannot honor privacy without authentication.
- Unknown authentication algorithms fail closed instead of silently
substituting a default; unused privacy algorithms do not block
authNoPriv.

Verification:
- warning-enabled C99 build on macOS arm64
- make check: all 5 suites passed
- deterministic SNMPv3 session suite: 22/22 pass, including literal OID
mapping, effective-level combinations, refusal paths, key derivation,
caller-buffer ownership, and NULL multi-get handling
- mandatory independent pre-push review: PASS

Closes #582
Refs #597

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: TheWitness <copilot@users.noreply.github.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
 2026-09-23 10:10:57 -04:00
Thomas VincentTheWitnessTheWitness
 		478d330985 fix(ping): make IPv4 and IPv6 ICMP polling safe (#619) 
## Summary

Consolidates the overlapping ICMP work from #555 and #619 into one
review of the complete socket and resolver state machine.

- add ICMPv6 echo polling and dispatch IPv6 devices to it
- prefer unprivileged datagram ICMP sockets when the kernel permits them
- retain bounded raw-socket fallback for IPv4 and IPv6
- give packet and socket resources one cleanup owner
- leave caller-owned resolver state untouched on lookup failure
- keep every retry inside one cached capability and privilege-transition
decision
- prevent LOCK_SETEUID retry deadlocks
- validate raw and datagram reply layouts, source, sequence,
identifiers, and payload
- retain fuzz and unprivileged-socket integration coverage

The consolidation also fixed an integration defect found locally: the
controlled successful-reply test constructed only a raw IPv4 packet even
when the production path selected SOCK_DGRAM. It now models the selected
socket format, and IPv6 raw retries use the same privilege-safety
invariant as IPv4.

## Verification

- warning-enabled local build completed with MariaDB Connector/C,
Net-SNMP, OpenSSL 3, and cmocka
- make check: 5/5 test binaries passed
- focused ping_icmp suite: 9/9 cases passed
- actionlint and git diff --check passed
- all commits are signed
- GitHub CI is authoritative for Linux capability, sanitizer, fuzz, and
unprivileged-network coverage

Closes #127.
Closes #250.
Closes #593.
Closes #611.
Supersedes #555.
Refs #597 and #618.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: TheWitness <copilot@users.noreply.github.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
 2026-09-23 09:34:15 -04:00
Thomas VincentandTheWitness 90da94b94f fix(process): unify subprocess ownership and child lifecycle safety (#614) 
## Summary

- make subprocess-registry detach atomic so exactly one closer owns each
entry
- make cancellation cleanup release only the detached node it owns
- replace `vfork`/`execve` child setup with `posix_spawn` and explicit
file actions
- mark every pipe and stdio-collision duplicate close-on-exec
- restore the child's default SIGPIPE disposition while preserving the
parent's handling
- bound TERM/KILL reaping and park unreaped children in a fixed-capacity
sweep list
- harden PHP script-server slot ownership, startup, restart, signal,
descriptor, and cleanup paths
- retire and restart failed or oversized reads so stale response tails
cannot poison later data sources
- revalidate every command retry and cap recovery handshakes at two
seconds

This folds the child-process lifecycle portion of #597 into the narrower
ownership PR. It does not absorb unrelated poll-host, SQL, SNMP, ICMP,
or build-infrastructure work.

## Review-driven corrections

- close-on-exec is explicitly restored after `dup()` in both read and
write stdio-collision branches
- the source invariant check now uses portable POSIX character classes
- direct tests cover duplicate flags, both collision branches, failure
after pipe creation, abandoned-child sweeping, and capacity overflow
- collision cleanup preserves current-child redirects even when an older
registry entry occupies fd 0 or 1
- script children receive SIGTERM before SIGKILL and unreaped PHP
children transfer to the bounded sweep registry
- the Docker integration suite now starts a real PHP script server,
verifies its startup protocol and database result, and checks that
shutdown leaves no zombie PHP process

## Validation

- Ubuntu 24.04 container with GCC and GNU ld: `make check`, 6/6 targets
passed with no skips, including `test_php_runtime`
- real PHP script-server Docker integration: 6/6 checks passed; exact
value `42` reached `poller_output` and no zombie remained
- macOS Homebrew dependency build passed
- macOS `make check`: 5/5 available binaries passed; GNU `--wrap`
runtime suite is Linux-only
- PHP fixture syntax checked through mise PHP 8.3
- actionlint, shellcheck, and `git diff --check` passed

Closes #610.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-09-22 17:24:04 -04:00
Thomas VincentandTheWitness f989722458 build: establish src/core layout for support modules (#617) 
## What

- move `keywords.c`/`.h` and `locks.c`/`.h` into `src/core/`
- enable Automake `subdir-objects` for collision-safe nested object
placement
- update the Autotools binary, linked-test, standalone unit-test, and
fuzz paths
- make both cppcheck entry points share one complete nested-source
discovery path
- ignore nested Automake and Docker build artifacts
- retain existing header include names and the Autotools build

The four production source/header files are 100% renames with no content
changes. The remaining changes are build and verification plumbing
required by the new paths.

## Why

Spine production sources currently live in the repository root. This
starts the domain layout in a small, reviewable batch instead of
repeating #523, where the source move was coupled to an 11k-line
CMake/platform rewrite. `keywords` and `locks` were selected because
active PRs #597 and #614 do not modify their implementation files; only
shared build manifests overlap #597.

`subdir-objects` is enabled in this first production move so future
modules with the same basename cannot write the same top-level object
under parallel builds.

Closes #616.

## Verification

- `./bootstrap` with no subdirectory-source warnings
- `./configure --with-mysql=$(brew --prefix mariadb-connector-c)
--with-snmp=$(brew --prefix net-snmp) CPPFLAGS=-I$(brew --prefix
openssl@3)/include LDFLAGS=-L$(brew --prefix openssl@3)/lib`
- warning-enabled `make -j$(sysctl -n hw.ncpu)`; project sources
compile, with Homebrew Net-SNMP header warnings only
- `make check` (cmocka unavailable to Autoconf locally; 0 local tests)
- `make distcheck`; archive verified to contain all four `src/core`
files
- cppcheck source discovery verified under macOS Bash 3 and includes all
four relocated files
- standalone `tests/unit/Makefile` compiles through header resolution
with `-I../../src/core` (the local macOS link retains unrelated existing
client-library/toolchain issues)
- GitHub checks pass, including fuzz, sanitizers, coverage, `distcheck`,
gcc/clang, SNMPv3, and Rocky Linux

The local macOS fuzz build reaches both relocated files, then fails
identically on untouched `util.c` (`INT_MAX`) and Net-SNMP API
declarations on both this branch and `develop`. Linux fuzz CI is the
authoritative fuzz-build result.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-09-22 11:07:10 -04:00
YongKyunandTheWitness de182d4f07 prevent host ignore on NoSuchObject for system OIDs (#553) 
**Problem Description**

When a device does not support one or more of the system OIDs queried by
get_system_information(), not only system information collection but
also resource-related SNMP polling may fail.

This issue is especially noticeable when the device's Poller Thread
setting is 1, where resource-related SNMP polling does not occur at all.

During analysis, I found that if one of the OIDs queried in
get_system_information() returns NoSuchObject, the host is marked as
ignored through the following call path:

snmp_get()
  -> snmp_get_base(current_host, snmp_oid, true)
     -> NoSuchObject returned
        -> current_host->ignore_host = TRUE


The OIDs queried by get_system_information() are:
- sysDescr
- sysObjectID
- sysUpTime
- sysContact
- sysName
- sysLocation
- Existing Behavior

Issue #366 already introduced special handling for the following OIDs:
- sysDescr
- sysUpTime

Reference: 
Issue #366: Failing to actually poll a device that returns
"NoSuchObject"

However, the same handling was not applied to:
- sysObjectID
- sysContact
- sysName
- sysLocation

As a result, devices that do not implement one or more of these OIDs can
still be marked as ignored, causing polling to stop unexpectedly.

**Observed Behavior**
The following log shows the issue occurring when the target device
returns NoSuchObject for sysContact (.1.3.6.1.2.1.1.4.0).
After the error is detected, ignore_host becomes active and subsequent
system OID requests are skipped. The device polling thread then
completes without polling any of the scheduled data sources.

```
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] ERROR: No such Object for oid '.1.3.6.1.2.1.1.4.0' for Device[72] with Status[1]
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] WARNING: Skipped oid '.1.3.6.1.2.1.1.5.0' for Device[72] as host ignore flag is active
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] WARNING: Skipped oid '.1.3.6.1.2.1.1.6.0' for Device[72] as host ignore flag is active
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] Device[72] HT[1] NOTE: There are '17' Polling Items for this Device
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] DEBUG: Setting up writes to local database
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] Device[72] HT[1] Total Time: 0.019 Seconds
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] DEBUG: Freeing Local Pool ID 0
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502752032320] DEBUG: Device[72] HT[1] DEBUG: HOST COMPLETE: About to Exit Device Polling Thread Function
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502985176896] The final count of Threads is 0
2026-07-30 10:56:53 - SPINE: Poller[1] PID[1069197] PT[140502985176896] INFO: Device[72] Thread complete and 0 to 17 sources
```

In this example, the device contains 17 polling items, but polling
completes with:
INFO: Device[72] Thread complete and 0 to 17 sources
indicating that none of the scheduled data sources were successfully
polled.

**Fix**
This change adds the same exception handling for the remaining four
OIDs:
- sysObjectID
- sysContact
- sysName
- sysLocation

If any of these OIDs return NoSuchObject, the host will no longer be
marked as ignored, allowing normal resource-related polling to continue.

**Expected Result**
Devices that do not implement one or more optional system OIDs should
still be polled successfully for resource-related metrics.
Only the unavailable system information fields should be skipped, while
normal SNMP data collection continues without interruption.

Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-09-22 11:05:32 -04:00
TheWitness 82266000fa snmp_count: stop turning internal Net-SNMP errors into a valid-looking count (#626) 
## Problem

`snmp_count()` (used by the `POLLER_ACTION_SNMP_COUNT` reindex check)
already treats a `NULL` response, `STAT_TIMEOUT`, and `STAT_ERROR` as
failures, but two gaps remained:

- SNMPv1 has no `endOfMibView` variable type; it signals the normal end
of a `GETNEXT` walk with a PDU-level `noSuchName` (`response->errstat ==
SNMP_ERR_NOSUCHNAME`) instead. That was falling into the generic
"internal Net-SNMP error" branch, so a normal SNMPv1 walk completion was
logged and treated as an error.
- The function always `return count;`, so a caller had no way to tell a
real zero-item count apart from a walk that failed partway through
(missing session, timeout, internal error). `poll_host()`'s caller
stored whatever it got directly as the poller result either way.

This is a smaller, targeted counterpart to the equivalent fix already
backported to `1.2.x` in #574.

## Fix

- Distinguish `SNMP_ERR_NOSUCHNAME` (normal SNMPv1 walk completion) from
any other non-`SNMP_ERR_NOERROR` `errstat`, which is a genuine internal
error.
- Treat a missing SNMP session (`current_host->snmp_session == NULL`)
the same as any other failure.
- Return `-1` instead of `count` whenever an error occurred, so the
walk's outcome is unambiguous.
- Update `poll_host()`'s one caller in the reindex loop to mark the
result undefined (`SET_UNDEFINED`) on a negative count instead of
formatting `-1` as the literal poller result string.

## Testing

Compiled cleanly (via WSL); no new warnings in `snmp.c` or `poller.c`.
 2026-09-22 10:10:24 -04:00
TheWitness 4544dcab2d Fix a batch of unaddressed bugs (#594, #600, #605, #607, #575, #583, #580) (#627) 
## Summary

A batch of small, independent, unaddressed bugs from the open-issue
backlog. None of these overlapped with any currently open PR's actual
diff (verified by inspecting each candidate PR's changes directly, not
just its declared `Closes` list).

## Fixes

- **`poll_host()` skips `mysql_thread_end()` when the device row is
missing** — the early `return` on `num_rows != 1` released both DB
connections and freed six allocations, but never called
`mysql_thread_end()`, unlike the other two exit paths. Added the missing
call.
- **SNMPv3 passphrase scrubbing flag never set** — `zero_sensitive` was
a function-local initialized to 0 and never assigned, so every guarded
`memset()` was dead code. Made scrubbing of this module's own heap
copies (`Apsz`/`Xpsz`) unconditional, and moved the wipe to immediately
precede each free (including both `generate_Ku()` error paths) after
review found the first pass still scrubbed before assignment. Left the
caller's `snmp_password`/`snmp_priv_passphrase` alone rather than also
scrubbing those in place — those are `host_t`-owned and get reused for
later session rebuilds against the same host, so zeroing them would have
broken subsequent polls.
- **`php_readpipe()` FD_SET without an FD_SETSIZE check** — `FD_SET()`
doesn't range-check, so a read descriptor at or above `FD_SETSIZE` (1024
on glibc) wrote past the end of the on-stack `fd_set`. Added a bounds
check; on an out-of-range descriptor it marks the result undefined and
closes the slot (a review finding caught the first version recursing
without bound through `php_init()` → `php_readpipe()` under sustained
descriptor exhaustion, so it no longer restarts synchronously from
here).
- **Signal handler never re-arms, so the second SIGPIPE kills the
poller** — every fatal signal reset itself to `SIG_DFL` and never
re-armed. That's the right idiom for a real fault (SIGSEGV and friends
re-execute and die with a core), but SIGPIPE is a routine, recurring
condition — a second one previously killed the whole poller. A review
finding pointed out that re-arming only at the end still left a window
(signal dispositions are process-wide) where another thread's SIGPIPE
could hit `SIG_DFL`; fixed by never resetting SIGPIPE's disposition in
the first place.
- **spine fails to link on Fedora: undefined reference to
`usmDESPrivProtocol`** — some distributions ship a `net-snmp-config.h`
that advertises DES as the default privacy protocol while the shipped
`libnetsnmp` doesn't export the symbol. Added an `AC_LINK_IFELSE` probe
for the actual symbol and guarded the fallback to use
`usmAESPrivProtocol` when it's absent.
- **Poller results ≥1024 bytes silently truncated to 1022** —
`db_escape()` capped its internal trim buffer at a fixed `DBL_BUFSIZE`
regardless of the caller's `max_size`, so raising
`--with-results-buffer` never helped. The trim buffer now scales with
`max_size` (a review finding caught the trim-size formula going
negative/zero for `max_size` 1-3), and `escaped_result` in `poll_host()`
is sized to `RESULTS_BUFFER * 2 + 1` instead of the fixed `DBL_BUFSIZE`.
(A very large escaped result can still hit the separate, already-tracked
row-size limit in #598/#618 — this fix only addresses the escaping-stage
truncation.)

## Also included

- **Seed `spine.conf` from `spine.conf.dist` on first install** — `make
install` only ever installed `spine.conf.dist`; nothing produced a live
`spine.conf`. Added an `install-data-hook` that copies it over only when
`spine.conf` doesn't already exist, plus a matching `uninstall-hook`
that only removes it again when it's still byte-identical to the `.dist`
(so a real uninstall never discards a customized config, while `make
distcheck`'s install/uninstall symmetry check still passes).

## Dropped from this PR

- A custom `codeql.yml` workflow (originally added for #580) was removed
— the repo already has GitHub's default CodeQL setup enabled and running
(`gh api repos/Cacti/spine/code-scanning/default-setup` → `state:
configured`), and a custom "advanced configuration" workflow cannot
coexist with it; GitHub rejected the SARIF upload and failed CI. #580's
underlying gap was already resolved out of band, so this PR no longer
claims to close it.

## Testing

Full build via WSL (`./bootstrap && ./configure --enable-warnings &&
make`) succeeds with no new warnings in `poller.c`, `snmp.c`, `php.c`,
`error.c`, or `sql.c` beyond two pre-existing, unrelated
`-Wformat-truncation` warnings in `php_init()`. Confirmed the
`usmDESPrivProtocol` configure probe correctly detects the missing
symbol in this build environment and takes the AES fallback path without
a link error. `make distcheck` passes end to end.

Closes #594
Closes #600
Closes #605
Closes #607
Closes #575
Closes #583
 2026-09-22 10:10:14 -04:00
TheWitness 139109a6aa Pin uptime-goes-backward calculation to a single OID (#625) 
## Problem

The uptime-goes-backward reindex check in `poll_host()` can source its
"current uptime" value from either of two OIDs:

- `.1.3.6.1.2.1.1.3.0` (legacy `sysUpTime`, centisecond granularity)
- `.1.3.6.1.6.3.10.2.1.3.0` (modern SNMP engine time, second
granularity)

Previously, every poll cycle unconditionally queried the legacy OID
first, then queried the engine OID and overwrote the value if it
answered numerically. A reindex row whose `arg1` was the engine OID
directly (with no legacy counterpart processed first in that cycle)
instead fell through to a plain, unconverted read of whatever `arg1`
was.

Because these two OIDs represent different underlying counters (device
uptime vs. SNMP engine uptime) on different scales, mixing which one
supplies the value for the comparison from cycle to cycle (or row to
row) can make the "current" value look smaller than the previously
stored one even though the device never rebooted, tripping the "uptime
went backward" assertion and triggering constant reindexing.

This is the same fix as #624 for the `1.2.x` branch, ported to
`develop`.

## Fix

Introduces a boolean, `uptime_use_engine_oid`, that records whether the
seconds-granularity engine OID (`.1.3.6.1.6.3.10.2.1.3.0`) answered with
numeric data for this poll. Once that's known:

- If present, the calculation is pinned to that OID (converted to
centiseconds so it stays comparable with historical values) for the rest
of the poll.
- Only when the engine OID is not present/numeric does the code fall
back to the legacy `sysUpTime` OID.

Both reindex rows that reference either OID now consistently resolve to
the same cached value within a poll, instead of potentially reading from
different sources.

## Testing

Compiled cleanly (via WSL) with no new warnings in `poller.c`. This is a
logic-only change to `poll_host()`; no build/config changes.

Closes: https://github.com/Cacti/spine/issues/622
 2026-09-22 08:09:56 -04:00
dependabot[bot] c5518d7057 ci(deps): bump the github-actions group with 2 updates (#615) 2026-09-06 12:45:16 +01:00
Thomas Vincent 8208fcb593 test: link the shipped objects instead of copies of the logic (#577) 
The three unit binaries in `tests/unit/` do not test the code that
ships. `test_safety_fixes.c` says so in its own header:

> the functions under test are inlined (or their exact predicate
replicated) so this translation unit compiles standalone without linking
util.o/ping.o/php.o and dragging in MySQL/SNMP

That keeps them cheap, but a fix can land in `util.c` while the test
carries on passing against its private copy. The 39 assertions currently
guarantee less than they appear to.

This adds a fourth binary that links the real translation units.
`tests/fuzz/stubs.c` already solves the hard part for the fuzz targets
by supplying the globals `spine.c` would define, so the same file is
reused here. Everything except `spine.c` is linked as built.

**Demonstration.** Reverting `strncopy()` to the issue#447 off-by-one
and running the suite:

```
PASS: tests/unit/test_util_strings
PASS: tests/unit/test_build_fixes
PASS: tests/unit/test_safety_fixes
FAIL: tests/unit/test_linked
# TOTAL: 4   # PASS: 3   # FAIL: 1
```

The three existing suites do not notice. Only the linked one does.

Seven cases to start, covering `strncopy()` bounds and termination and
`regex_replace()` match/no-match/bad-pattern. The point of the PR is the
harness rather than the case count: with this in place, future tests can
assert against real behaviour, and the existing binaries can migrate
over one at a time.

Verified in a clean `ubuntu:24.04` container: builds at 4 warnings
matching develop, `make check` passes 4/4, `make distcheck` passes.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 17:50:51 -07:00
Thomas Vincent 5bef621455 build: run the unit tests under make check (#570) 
The suite that landed in #563 is built by its own `tests/unit/Makefile`
and executed by nothing. `Makefile.am` has no `check_PROGRAMS`,
`configure.ac` has no cmocka detection, and no workflow invokes it. So
`make check` is a no-op today, and `make distcheck` from #556 validates
only that the tarball builds.

This wires the three binaries in:

- `configure.ac` probes for `-lcmocka` and `cmocka.h` and defines
`HAVE_CMOCKA`
- `Makefile.am` lists the three as `check_PROGRAMS` and sets `TESTS`
- the `build` job runs `make check`, and `libcmocka-dev` is added where
the workflow needs it

Verified in a clean `ubuntu:24.04` container.

```
PASS: tests/unit/test_util_strings
PASS: tests/unit/test_build_fixes
PASS: tests/unit/test_safety_fixes
# TOTAL: 3   # PASS: 3   # FAIL: 0
```

`make distcheck` still passes, so the test sources are distributed
correctly.

Absence of cmocka is not fatal. Building without `libcmocka-dev`
installed:

```
configure OK without cmocka
build OK without cmocka
# TOTAL: 0   # PASS: 0   # FAIL: 0
make check exit: 0
```

The tests drop out of `check_PROGRAMS` rather than breaking the build,
which matters for platforms where cmocka is not packaged.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 16:05:11 -07:00
Thomas Vincent ce9e97fe4e docs(changelog): record the merges missing from 1.3.0 (#569) 
The 1.3.0 section carried 19 entries. 136 commits have landed on develop
since `release/1.2.31`, and twenty merged pull requests had no entry at
all.

`issue#561` is a regression rather than an omission. #557 added the
line, then #542 merged over a CHANGELOG that predated it and deleted it;
`git log -p -- CHANGELOG` shows the add and then the delete. Restored.

**Added**, with the pull request each came from:

`issue#60` (#554), `issue#263` (#554), `issue#411` (#420), `issue#412`
(#413), `issue#414` (#417), `issue#415` (#418), `issue#416` (#419),
`issue#422` (#427), `issue#450` (#451), `issue#464` (#454), `issue#499`
(#513), `issue#515` (#514), `issue#516` (#517), `issue#552` (#554),
`issue#561` (#557, restored), `feature#440` (#435), `feature#461`
(#457).

Three merges have no issue behind them, so they take the numberless form
the file already uses elsewhere: the cppcheck and shellcheck pass
(#449), the SQL escaping and bounds fixes (#519), and the twelve headers
restored to the dist tarball (#556).

**Entries are now sorted by number.** Everything recent was prepended to
the top line instead, which is exactly where #542 and #557 collided.
Sorting means a new entry inserts at its own number and parallel
branches stop contending for one line.

**Left out on purpose:** #559, an autotools tidy with no user-visible
effect that the tarball entry already covers, and #560, a Dependabot
action bump. #550 and #563 are recorded as features because the section
already lists CI and Docker work that way.

No code change. All 19 original entries are preserved verbatim; the only
line that moves is `issue#562`, from the top into its sorted position.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 16:02:54 -07:00
dependabot[bot] 1741441de4 ci(deps): bump the github-actions group across 1 directory with 3 updates (#560) 
Bumps the github-actions group with 3 updates in the / directory:
[actions/checkout](https://github.com/actions/checkout),
[actions/setup-python](https://github.com/actions/setup-python) and
[actions/upload-artifact](https://github.com/actions/upload-artifact).

Updates `actions/checkout` from 4.2.2 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport
<code>allow-unsafe-pr-checkout</code> to v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a
href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a>
for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-python` from 5.6.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a>
Fix pip cache error handling on Windows. (<a
href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a>
Update advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...5fda3b95a4ea91299a34e894583c3862153e4b97">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>v7 What's new</h2>
<h3>Direct Uploads</h3>
<p>Adds support for uploading single files directly (unzipped). Callers
can set the new <code>archive</code> parameter to <code>false</code> to
skip zipping the file during upload. Right now, we only support single
files. The action will fail if the glob passed resolves to multiple
files. The <code>name</code> parameter is also ignored with this
setting. Instead, the name of the artifact will be the name of the
uploaded file.</p>
<h3>ESM</h3>
<p>To support new versions of the <code>@actions/*</code> packages,
we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Add proxy integration test by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
<li>Upgrade the module to ESM and bump dependencies by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li>
<li>Support direct file uploads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Link"><code>@​Link</code></a>- made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary
support for Node.js 24, however this action was by default still running
on Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Upload Artifact Node 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
<li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode
deprecation by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
<li>prepare release v6.0.0 for Node.js 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a>
Support direct file uploads (<a
href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a>
Upgrade the module to ESM and bump dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a>
from actions/Link-/add-proxy-integration-tests</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a>
Add proxy integration test</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a>
from actions/upload-artifact-v6-release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a>
docs: correct description of Node.js 24 support in README</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-31 10:06:34 +01:00
Thomas Vincent d63e136b89 test: add the unit, fuzz and integration suites (#563) 
Split out of #542. Tests and CI only, no source file is touched, so this
cannot conflict with anything currently open.

Verified in a clean `ubuntu:24.04` container against develop as it
stands.

**Unit** — 39 cmocka assertions across three binaries, run with `make -C
tests/unit`:

```
tests: 16 test(s) run.  PASSED
tests: 20 test(s) run.  PASSED
tests: 3 test(s) run.   PASSED
```

`test_safety_fixes.c` covers the allocation, bounds and reap paths;
`test_build_fixes.c` covers `regex_replace` and the config defaults;
`test_util_strings.c` covers `strpos`.

**Fuzz** — a `get_namebyhost` target with a 26-input corpus, built with
`-fsanitize=fuzzer,address,undefined`:

```
#2000	DONE   cov: 64 ft: 85 corp: 11/48b
```

**Integration** — the SNMPv3 fixture polls a live `snmpd` container and
asserts on the rows spine wrote to `poller_output` rather than on its
exit code, plus scripted checks for CLI argument handling, the script
server reap, and `output_regex` column detection.

**Not included.** The `fuzz_icmp_reply` target stays on #542, because it
calls `spine_icmp_classify_reply()`, which that PR adds. Everything else
stands on its own here.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 10:05:34 +01:00
Thomas Vincent e8a4b9aac9 fix: poller correctness bugs, with fuzz and integration coverage (#542) 
Poller correctness and memory-safety fixes, with the ICMP hardening from
#543 folded in.

Verified in a clean `ubuntu:24.04` container: builds at **38 warnings**
against develop's 39, and the unit tests build and pass on Linux (39
assertions across three binaries).

**Fixes**
- `php_readpipe` off-by-one — the old bound let `bptr` reach
`result_string + 2048` and then wrote the terminator one byte past a
2048-byte allocation.
- `get_namebyhost` used `strtok`, which keeps one process-wide save
pointer, and runs unlocked on every poller thread. Two devices could be
polled at each other's addresses. Now `strtok_r`.
- The log date format was read from `default_dateformat`; Cacti's key is
`default_date_format`, so the lookup never matched and the format was
never loaded.
- `db_query` returns `mysql_store_result()` directly, which is NULL on
store failure. The NULL check ran *after* `mysql_fetch_row`, so the
crash happened one line before the guard.
- `snmp_count` logged a Net-SNMP `errstat` without setting either loop
flag, rebuilding the identical GETNEXT forever and pinning a thread
until the poll interval ended.
- `php_close` skipped the `close()` when the quit write failed with
EPIPE, leaking a descriptor per script-server restart.
- The reap loop's delay was compiled out on `SOLAR_THREAD` builds, so
both phases burned twenty `WNOHANG` polls in nanoseconds and the child
was never reaped.
- ICMP replies are validated for length and matched on id/sequence; on
Cygwin the peeked datagram is now drained, which previously busy-spun
until host timeout.
- The fatal signal handler no longer calls
`malloc`/`localtime_r`/`fprintf` before `_exit` — on a SIGSEGV caused by
heap corruption that deadlocked on the allocator's lock instead of
dying.
- The unit test Makefile was hardcoded to `/opt/homebrew` paths and
`-std=gnu23`, so it could not build on Linux at all. Now pkg-config
driven.

Supersedes #543.

**Added since the first revision**
- `snmp_get_multi()` now checks the varbind type before formatting.
Under v2c an agent reports a per-OID failure as an inline exception
varbind while the PDU `errstat` stays `NOERROR`, so `snprint_value()`
rendered the exception as literal text and stored it as a value.
- Two warning sources removed: a dangling line continuation ending
`sql.h`, and `strncopy()` now using `memcpy` where the byte count is
already exact. Warnings drop from **39 to 7**.

Closes #551
Closes #232
- `read_config_options()` issued 23 separate `SELECT ... FROM settings
WHERE name = ?` round trips at startup; they are now one bulk read
served from memory. Call sites are unchanged.

Closes #330

**Test infrastructure**
- The SNMPv3 integration fixture was broken: the image shipped a binary
that could not start (`libmysqlclient.so.21: cannot open shared object
file`). The build context carried `*.o`, `spine`, `Makefile` and
`config.status`, so `make` treated them as current, skipped compiling,
and packaged a binary linked against libraries the runtime image does
not have. `.dockerignore` now excludes build output. The fixture runs
end to end: spine polls the SNMPv3 device, reads `uptime`, writes to
`poller_output` and exits 0.
- Two libFuzzer targets, run per PR and weekly: the host string parser
and the ICMP reply parser. The second drives
`spine_icmp_classify_reply()`, extracted from `ping_icmp` so the bounds
walk over a shared raw socket is reachable by a test. 15M executions
under ASan/UBSan, no crashes.


**Added in this revision**
- `output_regex` was applied only in the in-loop OID drain, not the pass
after the loop that handles whatever did not fill a `MAX_OIDS` batch, so
a device whose OID count missed a boundary stored raw values. A single
data source is always the leftover case.
`tests/integration/test_output_regex.sh` now asserts on the value: it
fails on the parent commit with the raw reading and passes here with the
filtered one. Addresses #210; the feature stays dormant until Cacti
populates `poller_item.output_regex`.

Merge before #555, which needs the `get_namebyhost` fix above to resolve
a device hostname at all.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 10:03:55 +01:00
Thomas Vincent 0c481bc526 port: memory-safety fixes from Spine #544 to develop (#557) 
Fresh develop-based port of applicable memory-safety, process-cleanup,
SNMP, poller, and PHP transport fixes from #544. Obsolete release and CI
history was excluded.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 09:29:59 +01:00
Thomas Vincent 84ed22e932 build: fix the release tarball, modernise autoconf, add distcheck to CI (#556) 
Two macros that autoconf removed in 2.70 and warns about on every
`autoreconf`.

- `AC_HEADER_TIME` — obsolete. Every system that provides `sys/time.h`
allows including it alongside `time.h`, so the `TIME_WITH_SYS_TIME`
ladder in `common.h` collapses to a single `HAVE_SYS_TIME_H` guard.
- `AC_TRY_COMPILE` — replaced by
`AC_COMPILE_IFELSE([AC_LANG_PROGRAM(...)])`. Mechanical; the Net-SNMP
crypto probe behaves identically (`checking if Net-SNMP needs crypto
support... yes`).

`AC_PREREQ` stays at 2.69 deliberately, so the tree still bootstraps on
EL7-era autoconf.

Verified in a clean ubuntu:24.04 container: `autoreconf -Wall` is quiet,
build is 39 warnings matching develop, and `make dist` still produces a
correct tarball.

**Note on #500**, which proposed this cleanup — both of its scope items
are wrong and I am not doing them:

- *"remove `ACLOCAL_AMFLAGS = -I m4`"* — `m4/` exists and holds the
libtool macros (`libtool.m4`, `ltoptions.m4`, `ltsugar.m4`,
`ltversion.m4`, `lt~obsolete.m4`). Removing the flag breaks `aclocal`.
- *"remove redundant `EXTRA_DIST = spine.1`"* — not redundant. I removed
it and `make dist` silently dropped the man page from the tarball;
`man_MANS` does not distribute it here. Restored.

Refs #500

---

**Release-blocking bug found while testing this.** `make distcheck`
failed on develop: the dist tarball was missing twelve headers
(`common.h`, `spine.h`, `util.h`, `sql.h`, `snmp.h`, `poller.h`,
`php.h`, `ping.h`, `locks.h`, `error.h`, `keywords.h`, `nft_popen.h`)
and `spine.conf.dist`, so a release tarball could not be compiled from.
Headers are now declared via `noinst_HEADERS` and the sample config is
in `EXTRA_DIST`. `make distcheck` passes.

**Also added**
- `--enable-sanitizers` configure option (ASan + UBSan), so a sanitizer
build is one flag rather than hand-rolled `CFLAGS`.
- `AM_SILENT_RULES([yes])` — the normal build is readable, `make V=1`
restores the full command lines.
- A `distcheck` CI job, so a tarball that cannot be compiled fails the
PR instead of shipping.

(`AC_CONFIG_MACRO_DIR([m4])` was already present at line 46; I added a
duplicate, autoconf rejected it, and I removed it.)

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 09:12:24 +01:00
Thomas Vincent 9ee3e672f7 ci: Rocky Linux 9 build coverage and Dependabot configuration (#550) 
Two pieces of CI plumbing, grouped so they are one review rather than
two.

**Rocky Linux 9 job.** EL is the primary deployment platform and nothing
in CI covered it. The job as originally written could never have passed:
`libtirpc-devel` is not in the Rocky 9 default repos, so `dnf install`
aborted the whole transaction and every later step was skipped. Removed
it — the build does not need it. Verified by running the full workflow
body in a `rockylinux:9` container: install, configure, make and check
all pass, 39 warnings.

Image pinned by digest. `set -euo pipefail` added so it satisfies the
workflow policy check in #541. Added a `pull_request` trigger with a
`paths` filter so a change that breaks the EL9 build is caught on the
PR, not on the following Saturday's cron.

**Dependabot.** `github-actions` plus `docker` — the repo has
`Dockerfile`, `Dockerfile.dev` and the snmpd fixture image, none of
which were tracked.

Was #548, folded in here.

**CI hardening added**
- `concurrency` with `cancel-in-progress` — a PR push previously ran the
whole workflow twice and never cancelled stale runs.
- `timeout-minutes: 20` on every job; a hung build otherwise holds a
runner for six hours.
- An ASan/UBSan job. Spine is a threaded network daemon and had no
sanitizer coverage at all.
- `make -j"$(nproc)"` in place of unbounded `make -j`.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 09:02:45 +01:00
Thomas Vincent 0c752cea9b fix: three long-standing reported logging issues (#554) 
Three small fixes for issues reported by users, the oldest open since
2018. Built and verified in a clean ubuntu:24.04 container at 39
warnings, matching develop.

**#552** — `die()` did not terminate its output, so consecutive fatal
messages ran together in `cacti_stderr.log`:

```
FATAL: Unable to read configuration file! (Spine init)FATAL: Unable to read configuration file! (Spine init)
```

Fix is the one-line change olafhering supplied in the report.

**#263** — twenty-five log sites emitted `DEBUG: Device[n] ...` while
the other hundred-plus use `Device[n] DEBUG: ...`, so a single poll
produced both orders. Four of them also printed `DEBUG` twice in one
line. All normalised to the majority form. Log text is otherwise
unchanged.

**#60** — Spine already reads the Cacti version into `set.cacti_version`
and knows its own from `VERSION`, but never compared them. It now warns
once at startup when the two are from different release lines. Only
major.minor is compared, so point-release drift stays quiet.

Closes #552
Closes #263
Closes #60

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 08:57:22 +01:00
Thomas Vincent 918c3756e4 build: clean up Autotools checks (#559) 
Remove duplicate compiler detection and replace obsolete AC_TRY_COMPILE
usage.
 2026-08-31 08:56:16 +01:00
Thomas Vincent c72b91b1be fix: replace deprecated POSIX semaphores with pthread wrapper (#517) 
## Summary

Fixes #516. Replaces deprecated unnamed POSIX semaphores with a portable
pthread-based wrapper. Eliminates all 9 remaining build warnings.

Depends on #514 (squashed single commit, rebased on latest develop).

## Approach

Spine uses semaphores as atomic counters (`sem_post` + `sem_getvalue` +
`sem_trywait`, no blocking `sem_wait`). A pthread mutex + counter
wrapper provides identical semantics on all platforms with zero
`#ifdef`s.

Alternatives considered:
- `dispatch_semaphore_t` (macOS GCD): no `getvalue` equivalent, requires
platform ifdefs
- C11 `_Atomic`: no wait/signal capability
- autotools detection: still requires fallback code

## Changes (1 commit)

- New `spine_sem.h`: inline `spine_sem_init`, `spine_sem_post`,
`spine_sem_getvalue`, `spine_sem_wait`, `spine_sem_trywait`,
`spine_sem_destroy`
- Replace `#include <semaphore.h>` with `#include "spine_sem.h"` in
`common.h`
- Update all `sem_t`/`sem_*` references in `spine.c`, `poller.c`,
`spine.h`
- Add `spine_sem.h` to `EXTRA_DIST`

## Warnings eliminated (9)

| File | Function | Count |
|------|----------|-------|
| `spine.c` | `sem_init` | 3 |
| `spine.c` | `sem_getvalue` | 4 |
| `poller.c` | `sem_getvalue` | 2 |

## Build result

Zero errors, zero warnings.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-26 08:15:28 -04:00
Thomas Vincent 926d5b66af security: fix SQL injection, buffer overflow, and input validation (#519) 
## Summary

Fix five security issues found during code review:

1. **SQL injection via unescaped SNMP result in INSERT**
(`poller.c:1844`): `poller_items[i].result` and `rrd_name` flow directly
into SQL VALUES clause. Added `db_escape()` calls for both values before
interpolation.

2. **Buffer overflow in `buffer_output_errors`** (`poller.c:2047`):
`snprintf` used `DBL_BUFSIZE` as the size limit instead of the remaining
buffer space `DBL_BUFSIZE - *buf_size`, allowing a write past the end of
`error_string`.

3. **SQL injection via `--hostlist` CLI argument** (`spine.c:388`): The
`host_id_list` string is interpolated into SQL queries without
validation. Added input validation to reject any characters other than
digits, commas, and spaces.

4. **Undocumented command injection trust boundary** (`nft_popen.c:126`,
`poller.c:2245`): `nft_popen()` passes commands to `/bin/sh -c` without
shell escaping. Added warning comments documenting that callers must
ensure commands originate from the Cacti database.

5. **Unbounded `sprintf` calls in `util.c`** (lines 99, 141, 145, 191,
286, 2036): Replaced all 6 `sprintf(qstring, ...)` calls with
`snprintf(qstring, sizeof(qstring), ...)` to prevent buffer overflows.

## Files changed

- `poller.c` - escape SQL values (fix 1), bound snprintf (fix 2),
document trust boundary (fix 4)
- `spine.c` - validate --hostlist input (fix 3)
- `nft_popen.c` - document trust boundary (fix 4)
- `util.c` - replace sprintf with snprintf (fix 5)

## Test plan

- [x] `make clean && make` compiles without errors or warnings
- [ ] Run spine against a test Cacti instance with SNMP results
containing single quotes
- [ ] Run spine with `--hostlist "1; DROP TABLE"` and verify it exits
with error
- [ ] Verify poller output results are correctly escaped in the database

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-26 07:45:48 -04:00
Thomas Vincent 70459ac82c fix(build): resolve compilation failures on develop (#514) 
## Summary

Fixes #515. Spine on `develop` fails to compile after recent feature
branch merges (everything after `4837ddd`). This PR fixes 6
build/runtime bugs, replaces deprecated `vfork`, and adds 68 automated
tests.

## Fixes

### Build-breaking (prevented compilation)
1. **Missing uthash.h** - vendored v2.3.0 (header-only, BSD license).
The O(1) hash table feature added `#include "uthash.h"` but never
committed the file.
2. **Extra closing braces in poller.c** - duplicate `}` in
POLLER_ACTION_SCRIPT and POLLER_ACTION_PHP_SCRIPT_SERVER cases broke the
switch statement.

### Runtime bugs
3. **SNMP_FREE macro collision** - spine's `SNMP_FREE` (calls
`snmp_host_cleanup`) collided with net-snmp's `SNMP_FREE` (calls
`free`). Renamed to `SNMP_SESSION_FREE`. The `errstr` from
`snmp_sess_error()` now correctly uses net-snmp's `free()` instead of
`snmp_host_cleanup()`.
4. **output_regex column detection** - the output_regex feature (#210)
assumed the column exists, but baseline Cacti does not have it. Added
`db_column_exists()` check at startup to conditionally include it in
queries.

### Deprecation warnings
5. **vfork in nft_popen.c** - replaced with `posix_spawn` using file
actions, matching the approach already used in `php.c`. Eliminates macOS
deprecation warning.

### Test fixture
6. **snmp_auth_protocol column width** - `char(6)` too narrow for
`SHA-256` (7 chars). Fixed to `char(7)` in both host and poller_item
tables. Added `rocommunity public` to snmpd.conf for SNMPv2c test
coverage.

## Test Results (68/68 pass)

| Suite | Count | Coverage |
|-------|-------|----------|
| Unit (cmocka) | 16 | uthash macros, config init, regex_replace,
strncopy |
| Smoke | 21 | SNMPv3 + SNMPv2c polling, DB writes, multi-device,
runtime validation |
| Output regex | 15 | Column absent, present, regex filtering, removal
fallback |
| DB column detect | 16 | 3 scenarios: absent, added via ALTER TABLE,
dropped |

## Files changed (15)

| File | Change |
|------|--------|
| `uthash.h` | New: vendored header |
| `Makefile.am` | Add uthash.h to EXTRA_DIST |
| `common.h` | Add uthash.h include |
| `poller.c` | Fix braces, conditional output_regex in queries |
| `spine.c` | Add has_output_regex detection at startup |
| `spine.h` | Add has_output_regex to config struct |
| `snmp.h` | Add SNMP_SESSION_FREE macro |
| `sql.c` | Fix indentation in db_query(), restore missing continue |
| `nft_popen.c` | Replace vfork+execve with posix_spawn |
| `tests/snmpv3/db/init.sql` | Fix snmp_auth_protocol char(7) |
| `tests/snmpv3/snmpd/snmpd.conf` | Add rocommunity public |
| `tests/integration/smoke_test.sh` | New: e2e smoke test |
| `tests/integration/test_output_regex.sh` | New: output_regex scenarios
|
| `tests/integration/test_db_column_detect.sh` | New: db_column_exists
scenarios |
| `tests/unit/test_build_fixes.c` + `Makefile` | New: cmocka unit tests
|

## Follow-up PRs

- #517: Replace deprecated POSIX semaphores with pthread wrapper (9
remaining warnings)
- SNMP error handling, spike kill, script server path testing

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-25 20:32:40 -04:00
Thomas Vincent 0dd91c4602 chore(warnings): mechanical low-risk cleanup pass #499 (#513) 
Fixes compiler warnings across spine source files: adds missing void in
function prototypes, marks internal functions static, removes unused
variables, and fixes const-correctness on function signatures.

**Note:** This PR also includes the following non-mechanical changes
that should be reviewed carefully:

- sql.c: db_column_exists now passes through the caller's type argument
instead of hardcoding LOCAL (bug fix, changes runtime behavior for
REMOTE callers)
- poller.c: Removed write-only snmp_poller_items counter and its
increment block (dead-code elimination)
- util.c: getglobalvariable now returns a strdup'd copy instead of a
pointer into opttable (fixes latent use-after-free on free())
- ping.c: Fixed strncopy(stack, hostname, strlen(stack)) to
strlen(hostname) (old code was a no-op after memset)
- util.c: Changed getsetting/getpsetting/getglobalvariable return type
from const char * to char * to reflect caller ownership semantics

### Addressed performance and DRY issues:
- Addresses #501 (Exponential Backoff)
- Addresses #503 (Centralized Logging)
- Addresses #504 (SNMP_FREE Macro)
- Addresses #505 (O(1) Hash Table)

### Test plan
- [ ] Verify spine compiles with both gcc and clang
- [ ] Run spine against a test Cacti instance and verify polling works

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-25 14:09:50 -04:00
Thomas VincentandTheWitness c33a39401a fix(util): tighten const usage and pthread format (#454) 
Follow-up PR for warning cleanup outside #452 scope.\n\nChanges:\n- make
read_spine_config take a const file path in util.h and util.c\n- fix
pthread_self log format specifier to match cast type
(%lu)\n\nValidation:\n- change is minimal and isolated\n- local
configure/build could not complete in this environment due missing MySQL
headers

## Linked issue

Fixes #464

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-03-12 21:19:00 +00:00
Thomas VincentandnetniV b894dbc358 docs: add top-level packaging overview README (#457) 
Adds a README.md to the packaging directory providing an overview of
supported platforms and links to OS-specific instructions.

## Linked issue

Fixes #461

---------

Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-12 21:10:30 +00:00
TheWitness 1cc6168bc9 Fixing spine capabilities (#493) 
In my SQL buffers commit, I had broken spine capabilities. Should learn
not to code after a long days work and visiting with loved ones.
 2026-03-12 21:06:53 +00:00
TheWitness 9a2f304f2c fix: Incorrect buffer size (#452) 
The SSL Options point to files, and a reasonable path should not exceed
1024 bytes. Additionally, we should comment out the cppcheck until we
have had more time to review the warnings. These are mostly, but not all
style and non-fatal, but good to have addressed for optimal program
flow.
 2026-03-12 09:10:36 +00:00
Thomas VincentandnetniV 80d6763344 fix(util): correct off-by-one OOB write in strncopy() when src fills buffer (#448) 
Fixes #447

When \`strlen(src) >= obuf\`, the old code set \`len = obuf\` then wrote
\`dst[obuf] = '\0'\` one byte past the end of the buffer. A
\`-Wstringop-overflow\` pragma was suppressing the compiler warning.

Fix: cap copy length at \`obuf - 1\` so the NUL terminator always fits
within the buffer. Remove the pragma so the compiler can flag similar
patterns in future. Add an \`obuf == 0\` guard for the degenerate case.

Rename \`len\` to \`src_len\` for clarity -- the value is the source
length being copied, not a generic counter.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 20:48:53 +00:00
Thomas VincentTheWitnessnetniV
 		b61b1423df fix: replace vfork/execv with posix_spawn in php_init; fix stack-local return in regex_replace (#446) 
Fixes #445

Two code-safety fixes targeting undefined behavior in the polling
threads.

**php.c**: `vfork()` is deprecated in POSIX.1-2024 and unsafe in spine's
pthreaded model because the child shares the parent's address space
until `execv()`. Replace with `posix_spawn()` +
`posix_spawn_file_actions_t` for stdin/stdout redirection. The
EAGAIN/ENOMEM retry loop is preserved as a `do/while`. `extern char
**environ` declared explicitly since it is not guaranteed to be visible
under `-std=c99`.

**util.c**: `regex_replace()` returned a pointer to a stack-local `char
msgbuf[100]`. The buffer lifetime ends when the function returns;
callers dereference freed stack. Changed to `static __thread char
msgbuf[SMALL_BUFSIZE]` -- each polling thread gets its own persistent
buffer, no heap allocation, no races. Bounds check added for matches
longer than `SMALL_BUFSIZE`. All five call sites in poller.c consume the
result before the next call on the same thread.

Both files compile clean under `gcc -std=c99` with `-Wall -Wextra`.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 20:46:35 +00:00
Thomas VincentandnetniV ff36da7ac8 fix: resolve content issues in spine.c, configure.ac, spine.conf.dist, and Copilot instructions (#437) 
Fixes #438

Four targeted content fixes:

1. **spine.c**: replace `[WHERE?]` placeholder in doxygen comment and
expand `--help` output to list the actual spine.conf search order:
current directory, /etc/, /etc/cacti/, ../etc/.

2. **configure.ac**: raise AC_PREREQ from 2.63 to 2.69; remove obsolete
macros no longer needed in C99 builds (AC_C_CONST, AC_HEADER_TIME,
AC_STRUCT_TM, RETSIGTYPE block).

3. **spine.conf.dist**: document SNMP_Clientaddr, DB_SSL_Verify, and
RDB_SSL_Verify in the header comment block and add them as commented
example lines in the settings section.

4. **.github/instructions/instructions.md**: replace generic blueprint
template with spine-specific Copilot instructions (C99/POSIX, pthreads,
net-snmp, libmariadb, autotools, CI, commit conventions).

No behaviour changes. man page content improves automatically via
help2man.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 20:39:14 +00:00
Thomas VincentandnetniV 8f1280d22d feat: add idiomatic RPM spec for cacti-spine (#436) 
Fixes #439

Adds idiomatic RPM spec at packaging/rpm/spine.spec.

To build:

    rpmbuild -ba packaging/rpm/spine.spec \
        --define "_sourcedir \$(pwd)" \
        --define "_builddir \$(pwd)/_build"

Spec decisions: %autosetup, --bindir=%{_sbindir} so the binary lands in
/usr/sbin without a post-install move, %attr(4755,root,root) for setuid
in %files (no redundant %post chmod), %config(noreplace) spine.conf
seeded from spine.conf.dist at install, man1 section matching upstream
Makefile.am.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 20:37:14 +00:00
Thomas Vincent 064352af0c feat: add idiomatic Debian packaging (#435) 
Fixes #440

Adds idiomatic Debian packaging under packaging/debian/.

To build a .deb, symlink the directory to the source root first:

    ln -s packaging/debian debian
    dpkg-buildpackage -us -uc -b

Files: control, rules (debhelper 13, bootstrap+configure override,
setuid fix in dh_fixperms), cacti-spine.install, cacti-spine.manpages,
changelog, copyright (DEP-5, GPL-2.0-or-later + BSD-4-Clause for
nft_popen), postinst (seeds /etc/spine.conf from .dist on first
install), prerm.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-11 20:35:29 +00:00
Thomas Vincent 2cdb188f43 chore: update copyright year to 2026 (#434) 
Fixes #441

Updates copyright headers from 2004-2023/2024 to 2004-2026 across 12
source files.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-11 20:28:37 +00:00
Thomas VincentandnetniV e37cecf21f fix(poller): add NULL check after malloc in host_errors insert path (#431) 
Fixes #426

`malloc()` at `poller.c:1941` had no NULL check. On failure the
subsequent
`snprintf(NULL, ...)` is undefined behavior and segfaults, killing the
spine
process and leaving all polled hosts without output for that cycle.

Add `die()` on NULL to match every other `malloc` call in the codebase.

Also adds a Docker-based SNMPv3 regression fixture under `tests/snmpv3/`
covering the NULL-check path, ICMP retry behavior, and `snmp_count`
validation.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 20:27:17 +00:00
Thomas VincentandnetniV 4837ddd89e fix(snmp): mark all OIDs undefined when snmp_get_multi errindex is zero (#430) 
Fixes #425

When an agent returns `errstat != NOERROR` with `errindex == 0` (RFC
3416
permits this for PDU-level errors), the `errindex != 0` branch in
`snmp_get_multi()` was skipped entirely. Results stayed as empty
strings,
causing blank output in `poller_output` and RRD instead of the `"U"`
sentinel.

Add an `else` branch: when `errindex == 0` set all results `UNDEFINED`
so
the `"U"` sentinel propagates correctly through the poller output path.

Also adds a Docker-based SNMPv3 regression fixture under `tests/snmpv3/`
that exercises this code path and related SNMP error-handling scenarios.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 19:17:07 +00:00
Thomas VincentandnetniV 31848b522d fix(poller): correct inverted spike_kill condition for PHP script server (#429) 
Fixes #424

`POLLER_ACTION_PHP_SCRIPT_SERVER` at `poller.c:1678` used `IS_UNDEFINED`
where it should use `!IS_UNDEFINED`. The guard was true only when the
result
was already `"U"`, making `SET_UNDEFINED` a no-op. PHP script server
data
sources were never spike-killed after agent restarts, producing spurious
spikes in graphs.

Change `IS_UNDEFINED` to `!IS_UNDEFINED` to match the adjacent
`POLLER_ACTION_SCRIPT` block.

Also adds a Docker-based SNMPv3 regression fixture under `tests/snmpv3/`
that covers the spike_kill fix and serves as a shared harness for
related poller correctness tests.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
 2026-03-11 19:08:05 +00:00
Thomas Vincent ea9d5829fd fix(ping): reinitialize fd_set before each select() call in ping_icmp() (#428) 
Fixes #423

`select(2)` modifies the `fd_set` in place on return, clearing all bits
after a timeout. With `FD_ZERO`/`FD_SET` only before the retry
`while(1)`
loop, every retry after the first timeout called `select()` on an empty
descriptor set and returned 0 immediately, exhausting all retries in
microseconds. Reachable hosts that experience one packet loss are marked
DOWN.

Move `FD_ZERO`/`FD_SET` to the `keep_listening:` label so all code paths
(normal sendto fallthrough, EINTR goto, another-host goto) reinitialize
before each `select()` call.

Also removes unreachable `break` after `return HOST_DOWN;` at
`ping.c:319`.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-03-11 10:38:51 -04:00