vpp: bound IAC handling by rx_buf_len in vppctl

.github/workflows/build-deb-trixie.yml

@@ -0,0 +1,189 @@
+name: Build VPP DEB for Debian 13 (Trixie)
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      release:
+        description: "Publish as GitHub Release"
+        type: boolean
+        default: false
+      tag:
+        description: "Release tag (if publishing)"
+        type: string
+        default: ""
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    container:
+      image: debian:trixie
+    env:
+      CCACHE_COMPRESS: "true"
+      CCACHE_MAXSIZE: 2G
+    steps:
+      - name: Disable APT cache cleanup
+        run: rm -f /etc/apt/apt.conf.d/docker-clean
+
+      - name: Install base tools
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq sudo make git
+
+      - name: Clone repository
+        run: |
+          git clone --depth 1 --branch "$GITHUB_REF_NAME" \
+            "https://github.com/$GITHUB_REPOSITORY.git" .
+          # The branch can move between the event and this clone, so check out
+          # the commit the run is for instead of whatever the branch points at
+          # now; otherwise the debs and their version string would name a
+          # different commit than the run and the release body do.
+          git config --global --add safe.directory "$PWD"
+          if [ "$(git rev-parse HEAD)" != "$GITHUB_SHA" ]; then
+            git fetch --no-tags --depth 1 origin "$GITHUB_SHA"
+            git checkout --detach FETCH_HEAD
+          fi
+
+      # "make install-dep" below is the only step that reads this cache, and
+      # the package list it installs, $(DEB_DEPENDS), is defined in the
+      # Makefile.  Key the cache by that file, so the key moves when the
+      # package list moves: the run that first needs a new package is then the
+      # run that stores it.  Hash it into an output rather than with
+      # hashFiles, because the install step rewrites the Makefile between the
+      # restore and the save and both steps have to ask for the same key.
+      # Reading the file at all needs the clone, and the base tools install
+      # above runs before this point, so it reads no cache.
+      - name: Hash the dependency list
+        id: deps
+        shell: bash
+        run: echo "hash=$(git hash-object Makefile)" >> $GITHUB_OUTPUT
+
+      - name: Restore apt archive cache
+        uses: actions/cache/restore@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-debian13-${{ runner.arch }}-${{ steps.deps.outputs.hash }}
+          restore-keys: |
+            apt-debian13-${{ runner.arch }}-
+
+      - name: Compute short SHA and build date
+        id: vars
+        shell: bash
+        run: |
+          git config --global --add safe.directory "$PWD"
+          echo "short_sha=$(git rev-parse --short=7 HEAD)" >> $GITHUB_OUTPUT
+          # The release body used github.event.head_commit.timestamp, which a
+          # workflow_dispatch run does not carry; the github context has no run
+          # start time either, so record one here.
+          echo "date=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+
+      - name: Install VPP build dependencies
+        run: |
+          sed -i '/^\s*git config commit\.template/s/^\(\s*\)/\1-/' Makefile
+          make UNATTENDED=yes install-dep
+
+      - name: Save apt archive cache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-debian13-${{ runner.arch }}-${{ steps.deps.outputs.hash }}
+
+      - name: Restore ccache
+        uses: actions/cache/restore@v4
+        with:
+          path: build-root/.ccache
+          # Keyed by commit, not by ref alone.  With a fixed key only the
+          # first build of a ref could save this entry; every later build
+          # asked to save a key that was already stored, so the ccache stayed
+          # at whatever the first build left in it.  A commit key gives each
+          # build a fresh entry to save, and the prefix in restore-keys still
+          # lends a run the newest entry of another commit on the same ref.
+          key: ccache-debian13-${{ runner.arch }}-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            ccache-debian13-${{ runner.arch }}-${{ github.ref_name }}-
+            ccache-debian13-${{ runner.arch }}-
+
+      - name: Build VPP DEB packages
+        run: |
+          git config --global --add safe.directory "$PWD"
+          git fetch --tags --force 2>/dev/null || true
+          # The version below counts the commits in the history, so it needs
+          # the whole history; the clone above is shallow.  Asking for the
+          # unshallow only when the history is short keeps a full repository
+          # from erroring out, and the warning keeps a failure here from
+          # quietly turning the count into a constant 1.
+          if [ "$(git rev-parse --is-shallow-repository)" = true ]; then
+            git fetch --unshallow --quiet ||
+              echo "::warning::full history unavailable, the commit count in the version is not reliable"
+          fi
+          # Only a VPP release tag (vYY.MM...) should win over the synthesised
+          # version.  A bare 'v*' also matches this workflow's own deb release
+          # tags (vpp-trixie-<n>), which would leave .version unwritten and
+          # send src/scripts/version to its own git describe; that one does not
+          # look at lightweight tags, so it would find none and exit 1, leaving
+          # the package version empty.
+          if ! git describe --tags --long --match 'v[0-9]*' 2>/dev/null; then
+            # No matching tag in this repo, so synthesise one.  The build
+            # identifier must vary per commit, otherwise every build of this
+            # branch produces the same version string and apt skips packages
+            # it considers already installed.
+            #
+            # The "0.0.0-release" prefix is deliberate: it is the version of
+            # packages already installed from this branch, and Debian
+            # compares "<upstream>-<revision>" by its last hyphen, so a plain
+            # "0.0.0-<ts>~g<sha>" would sort BELOW "0.0.0-release" (letters
+            # outrank digits) and apt would refuse it.  Extending the existing
+            # "-release" revision keeps every new build strictly newer.
+            #
+            # The commit timestamp alone does not order two commits made in
+            # the same second: Debian then falls through to the hash, which
+            # carries no order, so the child can sort below its parent and apt
+            # keeps the older deb.  Append the commit count, which grows
+            # strictly along the parent chain.  Counting commits is why the
+            # fetch above has to unshallow the clone; at --depth 1 the count
+            # is 1 for every commit.
+            #
+            # Keep the separator in front of the hash: src/scripts/version
+            # turns it into "~g<sha>" in the package version.  Glued to the
+            # timestamp the hash joins the same digit run, and Debian compares
+            # digit runs by length before value, so a build whose hash starts
+            # with a digit outranks every later build with a shorter run.
+            echo "0.0.0-release+$(git log -1 --format=%ct).$(git rev-list --count HEAD)-g$(git rev-parse --short=7 HEAD)" \
+              > src/scripts/.version
+          fi
+          ccache -z
+          export VPP_EXTRA_CMAKE_ARGS="\
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache"
+          make pkg-deb
+          ccache -s
+
+      - name: Save ccache
+        uses: actions/cache/save@v4
+        with:
+          path: build-root/.ccache
+          key: ccache-debian13-${{ runner.arch }}-${{ github.ref_name }}-${{ github.sha }}
+
+      - name: Upload DEB artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: vpp-debian13-trixie
+          path: build-root/*.deb
+
+      - name: Publish Release
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release }}
+        uses: softprops/action-gh-release@v2
+        with:
+          files: build-root/*.deb
+          tag_name: ${{ inputs.tag || format('vpp-trixie-{0}', github.run_number) }}
+          name: "VPP ${{ steps.vars.outputs.short_sha }} for Debian 13"
+          body: |
+            VPP build from commit ${{ github.sha }}
+            - Branch: ${{ github.ref_name }}
+            - Build date: ${{ steps.vars.outputs.date }}
+          draft: false
+          prerelease: true