builds.yml

name: builds

on:
  push:
    paths-ignore:
      # Don't run this workflow if only files under doc/ have been
      # modified.
      - "doc/**"
      - "etc/schema.json"
  pull_request:
    paths-ignore:
      # Don't run this workflow if only files under doc/ have been
      # modified.
      - "doc/**"
      - "etc/schema.json"
  workflow_dispatch:
    inputs:
      SU_REPO:
      SU_BRANCH:
      SV_REPO:
      SV_BRANCH:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

env:
  DEFAULT_CFLAGS: "-Wall -Wextra -Werror -Wno-unused-parameter -Wno-unused-function"

  # Apt sometimes likes to ask for user input, this will prevent that.
  DEBIAN_FRONTEND: "noninteractive"

  # A recent version of stable Rust that is known to pass build, test and other
  # verification steps in this workflow. This was added because using "stable"
  # could cause some steps to fail.
  RUST_VERSION_KNOWN: "1.95.0"

jobs:

  prepare-deps:
    name: Prepare dependencies
    uses: ./.github/workflows/prepare-deps.yml

  prepare-cbindgen:
    name: Prepare cbindgen
    runs-on: ubuntu-latest
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo
          key: ${{ github.job }}-cargo
      - name: Installing Rust
        run: |
          curl https://sh.rustup.rs -sSf | sh -s -- -y
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
          rustup target add x86_64-unknown-linux-musl
      - name: Building static cbindgen for Linux
        run: |
          cargo install --target x86_64-unknown-linux-musl --debug cbindgen
          cp $HOME/.cargo/bin/cbindgen .
      - name: Uploading prep archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: cbindgen
          path: .

  almalinux-10:
    name: AlmaLinux 10 (schema, plugins)
    runs-on: ubuntu-latest
    container: almalinux:10
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                cargo-vendor \
                cbindgen \
                clippy \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                rustfmt \
                rust-toolset \
                sudo \
                which \
                zlib-devel
          # These packages required to build the PDF.
          dnf -y install \
                texlive-latex \
                texlive-cmap \
                texlive-collection-latexrecommended \
                texlive-fncychap \
                texlive-titlesec \
                texlive-tabulary \
                texlive-framed \
                texlive-wrapfig \
                texlive-upquote \
                texlive-capt-of \
                texlive-needspace

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: ./.github/actions/install-cbindgen
      # Download and extract dependency archives created during prep
      # job.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xvf prep/suricata-update.tar.gz
      - run: tar xvf prep/suricata-verify.tar.gz
      - name: Configuring
        run: |
          ./autogen.sh
          CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings
      - run: make -j ${{ env.CPUS }} distcheck
        env:
          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
          MAKEFLAGS: "-j ${{ env.CPUS }}"
      - run: test -e doc/userguide/suricata.1

      # Rebuild with debug-validation.
      - name: Configuring
        run: |
          ./autogen.sh
          CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-debug-validation --enable-qa-simulation
          make -j ${{ env.CPUS }}

      - name: Building Rust documentation
        run: make doc
        working-directory: rust
      - run: make install install-conf
      - run: suricatasc -h
      - run: suricata-update -V
      - run: suricata-update

      - name: Check if Suricata-Update example configuration files are installed
        run: |
          test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
          test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml

      - name: Test capture plugin
        working-directory: examples/plugins/ci-capture
        run: |
          make
          ../../../src/suricata -S /dev/null --plugin ./capture.so --capture-plugin=ci-capture --runmode=single -l . -c ../../../suricata.yaml
          cat eve.json | jq -c 'select(.dns)'
          test $(cat eve.json | jq -c 'select(.dns)' | wc -l) = "1"

      - name: Test app-layer plugin
        working-directory: examples/plugins/altemplate
        run: |
          cargo build
          ../../../src/suricata -S altemplate.rules --plugin ./target/debug/libsuricata_altemplate.so --runmode=single -l . -c altemplate.yaml -k none -r ../../../rust/src/applayertemplate/template.pcap
          cat eve.json | jq -c 'select(.altemplate)'
          test $(cat eve.json | jq -c 'select(.altemplate)' | wc -l) = "3"
        # we get 2 alerts and 1 altemplate events

      - name: Test library build in tree
        working-directory: examples/lib/simple
        run: make clean all

      - name: Test plugin build in tree
        working-directory: examples/plugins/c-json-filetype
        run: make clean all

      - name: Build example C custom logger plugin
        working-directory: examples/plugins/c-custom-loggers
        run: make clean all

      - name: Check and build Rust example plugin
        working-directory: examples/plugins/rust
        run: |
          cargo fmt --check
          cargo clippy -- -D warnings
          cargo build

      - name: Install Suricata and library
        run: make install install-headers install-library

      - name: Test library build out of tree
        working-directory: examples/lib/simple
        run: PATH=/usr/local/bin:$PATH make -f Makefile.example clean all

      - name: Test custom lib example
        run: |
          make
          ./custom -- ../../../qa/docker/pcaps/tls.pcap
          test $(cat eve.json |jq 'select(.stats) | .stats.decoder.pkts') = 110
        working-directory: examples/lib/custom

      - name: Build live library example
        run: make
        working-directory: examples/lib/live

      - run: python3 scripts/eve-parity.py mapped-fields
      - run: python3 scripts/eve-parity.py unmapped-fields
      - run: python3 scripts/eve-parity.py unmapped-keywords

      - name: Cleaning source directory for standalone plugin test.
        run: make clean

      - name: Test plugin against installed headers
        working-directory: examples/plugins/c-json-filetype
        run: |
          # First use sed to pretend we are a user following our
          # directions for building a standalone plugin.
          sed -i 's/^#LIBSURICATA_CONFIG/LIBSURICATA_CONFIG/' Makefile
          sed -i 's/^#CPPFLAGS/CPPFLAGS/' Makefile
          sed -i 's/^CPPFLAGS.*HAVE_CONFIG_H//' Makefile

          # And build.
          PATH=/usr/local/bin:$PATH make clean all

      - name: Check EVE schema ordering
        run: ./scripts/schema-sort.py --check ./etc/schema.json

      - name: Check EVE schema has all additionalProperties
        run: test $(cat etc/schema.json | jq 'paths( objects | (.type == "object" and (has("additionalProperties") | not) )) | join(".")' | wc -l) = "0"

  almalinux-9:
    name: AlmaLinux 9 (schema, rust-checks)
    runs-on: ubuntu-latest
    container: almalinux:9
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                cbindgen \
                clang-devel \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                sudo \
                which \
                zlib-devel
          # These packages required to build the PDF.
          dnf -y install \
                texlive-latex \
                texlive-cmap \
                texlive-collection-latexrecommended \
                texlive-fncychap \
                texlive-titlesec \
                texlive-tabulary \
                texlive-framed \
                texlive-wrapfig \
                texlive-upquote \
                texlive-capt-of \
                texlive-needspace

      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - run: cargo install bindgen-cli --version 0.66.0

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: ./.github/actions/install-cbindgen
      # Download and extract dependency archives created during prep
      # job.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xvf prep/suricata-update.tar.gz
      - run: tar xvf prep/suricata-verify.tar.gz
      - name: Configuring
        run: |
          ./autogen.sh
          CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings

      - name: Checking bindgen output
        working-directory: rust
        run: |
          bindgen --version
          make check-bindgen-bindings
          diff=$(git diff sys)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Bindgen bindings appear to be out of date"
              exit 1
          fi
      - run: cargo clippy --workspace --all-features --fix --allow-no-vcs
        working-directory: rust
      - run: |
          diff=$(git diff)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Clippy --fix made changes, please fix"
              exit 1
          fi
      - run: cargo clippy --workspace --all-features --all-targets -- -D warnings
        working-directory: rust
      # especially without debug feature
      - run: cargo clippy
        working-directory: rust
      - run: ./scripts/rustfmt.sh
      - name: Check if Cargo.lock.in is up to date
        run: |
          cp rust/Cargo.lock rust/Cargo.lock.in
          diff=$(git diff rust/Cargo.lock.in)
          if [ "${diff}" ]; then
              echo "${diff}"
              echo "::error ::Cargo.lock.in needs to be updated"
              exit 1
          fi

      - run: make -j ${{ env.CPUS }} distcheck
        env:
          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
          MAKEFLAGS: "-j ${{ env.CPUS }}"
      - run: test -e doc/userguide/suricata.1
      - name: Building Rust documentation
        run: make doc
        working-directory: rust
      - run: make install install-conf
      - run: suricatasc -h
      - run: suricata-update -V
      - name: Check if Suricata-Update example configuration files are installed
        run: |
          test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
          test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml

      - name: Test capture plugin
        working-directory: examples/plugins/ci-capture
        run: |
          make
          ../../../src/suricata -S /dev/null --plugin ./capture.so --capture-plugin=ci-capture --runmode=single -l . -c ../../../suricata.yaml
          cat eve.json | jq -c 'select(.dns)'
          test $(cat eve.json | jq -c 'select(.dns)' | wc -l) = "1"

      - name: Test app-layer plugin
        working-directory: examples/plugins/altemplate
        run: |
          cargo build
          ../../../src/suricata -S altemplate.rules --plugin ./target/debug/libsuricata_altemplate.so --runmode=single -l . -c altemplate.yaml -k none -r ../../../rust/src/applayertemplate/template.pcap
          cat eve.json | jq -c 'select(.altemplate)'
          test $(cat eve.json | jq -c 'select(.altemplate)' | wc -l) = "3"
        # we get 2 alerts and 1 altemplate events

      - name: Test library build in tree
        working-directory: examples/lib/simple
        run: make clean all

      - name: Test plugin build in tree
        working-directory: examples/plugins/c-json-filetype
        run: make clean all

      - name: Build example C custom logger plugin
        working-directory: examples/plugins/c-custom-loggers
        run: make clean all

      - name: Install Suricata and library
        run: make install install-headers install-library

      - name: Test library build out of tree
        working-directory: examples/lib/simple
        run: PATH=/usr/local/bin:$PATH make -f Makefile.example clean all

      - name: Test custom lib example
        run: |
          make
          ./custom -- ../../../qa/docker/pcaps/tls.pcap
          test $(cat eve.json |jq 'select(.stats) | .stats.decoder.pkts') = 110
        working-directory: examples/lib/custom

      - name: Cleaning source directory for standalone plugin test.
        run: make clean

      - name: Test plugin against installed headers
        working-directory: examples/plugins/c-json-filetype
        run: |
          # First use sed to pretend we are a user following our
          # directions for building a standalone plugin.
          sed -i 's/^#LIBSURICATA_CONFIG/LIBSURICATA_CONFIG/' Makefile
          sed -i 's/^#CPPFLAGS/CPPFLAGS/' Makefile
          sed -i 's/^CPPFLAGS.*HAVE_CONFIG_H//' Makefile

          # And build.
          PATH=/usr/local/bin:$PATH make clean all

      - name: Check EVE schema ordering
        run: ./scripts/schema-sort.py --check ./etc/schema.json

  almalinux-9-templates:
    name: AlmaLinux 9 Test Templates
    runs-on: ubuntu-latest
    container: almalinux:9
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                cbindgen \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.0 -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - run: rustup component add rustfmt
      - run: rustup component add clippy

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata

      - uses: ./.github/actions/install-cbindgen

      # Download and extract dependency archives created during prep
      # job.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xvf prep/suricata-update.tar.gz
      - run: tar xvf prep/suricata-verify.tar.gz
      - name: Build
        run: |
          ./autogen.sh
          CFLAGS="${DEFAULT_CFLAGS}" ./configure
          make -j ${{ env.CPUS }}
      - run: ./scripts/setup-app-layer.py --parser --logger --detect FooBar payload
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata --list-app-layer-protos | grep foobar
      - run: ./src/suricata --list-app-layer-hooks | grep "foobar:request_started"
      - name: Verify rustfmt
        run: rustfmt -v --check src/applayerfoobar/*.rs
        working-directory: rust
      - name: Verify clippy
        run: cargo clippy --all-features
        working-directory: rust

  rpms:
    name: Build RPMs
    runs-on: ubuntu-latest
    container: ${{ matrix.container }}
    needs: [ubuntu-22-04-dist]
    strategy:
      fail-fast: false
      matrix:
        container:
          - almalinux:9
          - fedora:44
    env:
      skip: false
    steps:
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Download Suricata distribution archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist

      - name: Install packages
        if: ${{ env.skip != 'true' }}
        run: |
          if test -e /etc/almalinux-release; then
              dnf -y install \
                epel-release \
                git \
                make \
                rpm-build \
                rpmdevtools \
                dnf-plugins-core
              dnf config-manager --set-enabled crb
           elif test -e /etc/fedora-release; then
              dnf -y install \
                awk \
                git \
                make \
                rpm-build \
                rpmdevtools
           else
              echo "ERROR: Unsupported distribution for RPM building"
              exit 1
           fi
      - if: ${{ env.skip != 'true' }}
        run: |
          git clone https://github.com/jasonish/suricata-rpms
          cd suricata-rpms/devel
          make update-release update-sources
          dnf -y install $(rpmspec -q --buildrequires ./suricata.spec)
          mv ../../suricata-*.tar.gz .
          make srpm
          make local

      # We need a step for each RPM upload as we can't use the
      # container name directly in an artifact, as artifacts can't
      # have ':' in the name.
      - if: ${{ matrix.container == 'fedora:44' &&  env.skip != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        name: Uploading RPMs
        with:
          name: rpms-fedora-44
          path: suricata-rpms/devel/rpms
      - if: ${{ matrix.container == 'almalinux:9' && env.skip != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        name: Uploading RPMs
        with:
          name: rpms-epel-9
          path: suricata-rpms/devel/rpms

  almalinux-8:
    name: AlmaLinux 8
    runs-on: ubuntu-latest
    container: almalinux:8
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          yum -y install dnf-plugins-core
          yum config-manager --set-enabled powertools
          yum -y install \
                autoconf \
                automake \
                cargo-vendor \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-yaml \
                rust-toolset \
                sudo \
                which \
                zlib-devel

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata

      - uses: ./.github/actions/install-cbindgen

      # Prebuild check for duplicate SIDs
      - name: Check for duplicate SIDs
        run: |
          dups=$(sed -n 's/^alert.*sid:\([[:digit:]]*\);.*/\1/p' ./rules/*.rules|sort|uniq -d|tr '\n' ' ')
          if [[ "${dups}" != "" ]]; then
            echo "::error::Duplicate SIDs found:${dups}"
            exit 1
          fi

      # Download and extract dependency archives created during prep
      # job.
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xvf prep/suricata-update.tar.gz
      - run: tar xvf prep/suricata-verify.tar.gz
      - uses: ./.github/actions/install-cbindgen
      - name: Configuring
        run: |
          ./autogen.sh
          CFLAGS="${DEFAULT_CFLAGS}" ./configure
      - run: make -j ${{ env.CPUS }} check
      - run: make install
      - run: suricatasc -h
      - run: suricata-update -V

  centos-stream9:
    name: CentOS Stream 9
    runs-on: ubuntu-latest
    container: quay.io/centos/centos:stream9
    needs: [prepare-deps, ubuntu-22-04-dist]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                cargo-vendor \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                rust-toolset \
                sudo \
                which \
                zlib-devel
      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist

      - name: Build and install nDPI
        run: |
          curl -OL https://github.com/ntop/nDPI/archive/refs/tags/4.14.tar.gz
          tar xvf 4.14.tar.gz
          cd nDPI-4.14
          ./autogen.sh
          ./configure
          make -j ${{ env.CPUS }}

      - run: tar zxvf suricata-*.tar.gz --strip-components=1
      - name: ./configure
        run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-ndpi --with-ndpi=$(pwd)/nDPI-4.14 --enable-debug --enable-qa-simulation
      - run: make -j ${{ env.CPUS }}
      - run: make install
      - run: make install-conf
      - run: suricatasc -h
      - run: suricata-update -V
      - name: Check if Suricata-Update example configuration files are installed
        run: |
          test -e /usr/local/lib/suricata/python/suricata/update/configs/disable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/drop.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/enable.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/modify.conf
          test -e /usr/local/lib/suricata/python/suricata/update/configs/threshold.in
          test -e /usr/local/lib/suricata/python/suricata/update/configs/update.yaml
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Check if the nDPI plugin was installed
        run: test -e /usr/local/lib/suricata/ndpi.so
      - run: tar xf prep/suricata-verify.tar.gz
      - run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: python3 ./suricata-verify/live/run.py run
      - run: suricata-update -V
      - run: suricatasc -h
      # Test build after clean.
      - run: make clean
      - run: make -j ${{ env.CPUS }}

  fedora-44-sv-codecov:
    name: Fedora 44 (Suricata Verify codecov)
    runs-on: ubuntu-latest
    container: fedora:44
    needs: [prepare-deps, prepare-cbindgen]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          dnf -y install \
                autoconf \
                automake \
                awk \
                cbindgen \
                ccache \
                clang \
                curl \
                diffutils \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                gpg \
                hwloc \
                hwloc-devel \
                hiredis-devel \
                jansson-devel \
                jq \
                libasan \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                llvm-devel \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - run: |
          dnf clean all
      # packaged Rust version has no profiler support built in, so get from rustup
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.86.0 -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - uses: ./.github/actions/install-cbindgen
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: ./autogen.sh
      - run: RUSTC_WRAPPER="$(pwd)/scripts/rustc.py" ./configure --enable-warnings --disable-shared --enable-qa-simulation
        env:
          CC: "clang"
          RUSTFLAGS: "-Cinstrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
      - run: RUSTC_WRAPPER="$(pwd)/scripts/rustc.py" make -j ${{ env.CPUS }}
        env:
          CC: "clang"
          RUSTFLAGS: "-Cinstrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - run: rm -r prep
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed --aggressive-cleanup
      - name: Running suricata-verify live tests
        run: python3 ./suricata-verify/live/run.py run
      - run: llvm-profdata merge -o default.profdata $(find suricata-verify/tests/ -name '*.profraw')
      - run: llvm-cov export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches > coverage.lcov
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: false
          files: coverage.lcov
          flags: suricata-verify

  # Fedora build using Clang.
  fedora-44-clang:
    name: Fedora 44 (clang, debug, asan, wshadow, rust-strict, systemd)
    runs-on: ubuntu-latest
    container: fedora:44
    needs: [prepare-deps, prepare-cbindgen]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          dnf -y install \
                autoconf \
                automake \
                awk \
                cargo \
                cbindgen \
                ccache \
                clang \
                diffutils \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hiredis-devel \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libasan \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libxdp-devel \
                libbpf-devel \
                libtool \
                lz4-devel \
                make \
                parallel \
                pcre2-devel \
                pkgconfig \
                python \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - uses: ./.github/actions/install-cbindgen
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: ./autogen.sh
      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow" ./configure --disable-shared
      - run: make check
      - run: make distclean
      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-warnings --enable-debug --enable-qa-simulation --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
        env:
          LDFLAGS: "-fsanitize=address"
          ac_cv_func_realloc_0_nonnull: "yes"
          ac_cv_func_malloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata -u -l .
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      # Now install and make sure headers and libraries aren't
      # installed until requested.
      - run: make install
      - run: test ! -e /usr/local/lib/libsuricata_c.a
      - run: test ! -e /usr/local/include/suricata
      - run: make install-headers
      - run: test -e /usr/local/include/suricata/suricata.h
      - run: make install-library
      - run: test -e /usr/local/lib/libsuricata_c.a
      - run: test -e /usr/local/lib/libsuricata_rust.a
      - run: test -e /usr/local/bin/libsuricata-config
      - run: test ! -e /usr/local/lib/libsuricata.so
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h
      # Check compilation against systemd
      - run: src/suricata --build-info | grep -E "Systemd support:\s+yes" &> /dev/null

  # Fedora build using GCC.
  fedora-44-gcc:
    name: Fedora 44 (gcc, debug, flto, asan, wshadow, rust-strict)
    runs-on: ubuntu-latest
    container: fedora:44
    needs: [prepare-deps, prepare-cbindgen]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          dnf -y install \
                autoconf \
                automake \
                awk \
                cargo \
                cbindgen \
                ccache \
                diffutils \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hiredis-devel \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libasan \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-yaml \
                sudo \
                vectorscan-devel \
                which \
                zlib-devel
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: ./.github/actions/install-cbindgen
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: ./autogen.sh
      - run: ./configure --enable-warnings --enable-debug --enable-qa-simulation --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
        env:
          CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer -flto=auto -O2"
          LDFLAGS: "-fsanitize=address"
          ac_cv_func_realloc_0_nonnull: "yes"
          ac_cv_func_malloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata -u -l .
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      # Now install and make sure headers and libraries aren't
      # installed until requested.
      - run: make install
      - run: test ! -e /usr/local/lib/libsuricata_c.a
      - run: test ! -e /usr/local/include/suricata
      - run: make install-headers
      - run: test -e /usr/local/include/suricata/suricata.h
      - run: make install-library
      - run: test -e /usr/local/lib/libsuricata_c.a
      - run: test -e /usr/local/lib/libsuricata_rust.a
      - run: test -e /usr/local/bin/libsuricata-config
      - run: test ! -e /usr/local/lib/libsuricata.so
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h

  # This job builds and tests Suricata as a non-root user as some
  # issues only show up when not running as root, and by default all
  # jobs in GitHub actions are run as root inside the container.
  # Also ja3 and ja4 are disabled to run SV tests that require
  # the absence of these features
  fedora-non-root:
    name: Fedora 44 (non-root, debug, clang, asan, wshadow, rust-strict, no-ja)
    runs-on: ubuntu-latest
    container: fedora:44
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          dnf -y install \
                autoconf \
                automake \
                awk \
                cargo \
                cbindgen \
                ccache \
                clang \
                diffutils \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hiredis-devel \
                hwloc \
                hwloc-devel \
                jansson-devel \
                jq \
                libasan \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - run: adduser suricata
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - uses: ./.github/actions/install-cbindgen
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: mkdir /home/suricata/suricata
      - run: cp -a . /home/suricata/suricata
      - run: chown -R suricata:suricata /home/suricata

      - run: sudo -u suricata -s ./autogen.sh
        working-directory: /home/suricata/suricata

      - run: >-
          sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" ./configure --enable-warnings
          --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis
          --enable-nfqueue --disable-ja3 --disable-ja4
          --enable-qa-simulation
        working-directory: /home/suricata/suricata
        env:
          ac_cv_func_realloc_0_nonnull: "yes"
          ac_cv_func_malloc_0_nonnull: "yes"
          LDFLAGS: "-fsanitize=address"
          CC: "clang"
          CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"

      - run: sudo -u suricata -s env PATH="/home/suricata/.cargo/bin:$PATH" make -j ${{ env.CPUS }}
        working-directory: /home/suricata/suricata

      - run: sudo -u suricata -s make check
        working-directory: /home/suricata/suricata

      - run: src/suricata --build-info | grep -E "JA3 support:\s+no" &> /dev/null
        working-directory: /home/suricata/suricata

      - run: src/suricata --build-info | grep -E "JA4 support:\s+no" &> /dev/null
        working-directory: /home/suricata/suricata

      - run: sudo -u suricata -s python3 ./suricata-verify/run.py -q --debug-failed
        working-directory: /home/suricata/suricata

      - run: src/suricata -h | grep '\-\-list\-app\-layer\-hooks' &> /dev/null
        working-directory: /home/suricata/suricata

  # Test that ./configure fails out if libjansson is not available.
  almalinux-9-no-jansson:
    name: AlmaLinux 9 (no jansson)
    runs-on: ubuntu-latest
    container: almalinux:9
    needs: [prepare-deps]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enable crb
          dnf -y install \
                autoconf \
                automake \
                cargo \
                cbindgen \
                clang \
                diffutils \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                libasan \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-yaml \
                sudo \
                which \
                zlib-devel
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: ./autogen.sh
      - run: |
          if ./configure; then
            echo "error: configure should have failed"
            exit 1
          else
            exit 0
          fi

  almalinux-9-minimal-recommended-dependecies:
    name: AlmaLinux 9 (Minimal/Recommended Build)
    runs-on: ubuntu-latest
    container: almalinux:9
    needs: [ubuntu-22-04-dist]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar xf suricata-*.tar.gz --strip-components=1

      - name: Update packages and install sudo
        run: dnf -y update && dnf install -y sudo

      - name: Install AlmaLinux 9 extra repositories
        run: |
          dnf -y update
          dnf -y install dnf-plugins-core epel-release sudo
          dnf config-manager --set-enabled crb

      - name: Install minimal dependencies
        run: ./scripts/docs-almalinux9-minimal-build.sh

      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata --build-info # check if we can run Suricata

  ubuntu-24-04:
    name: Ubuntu 24.04 (cocci)
    runs-on: ubuntu-latest
    container: ubuntu:24.04
    needs: [prepare-deps]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                autoconf \
                automake \
                build-essential \
                cargo \
                cbindgen \
                clang-14 \
                coccinelle \
                dpdk-dev \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libcap-ng-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libhiredis-dev \
                libhyperscan-dev \
                libjansson-dev \
                libmagic-dev \
                libnet1-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libpcap-dev \
                libpcre2-dev \
                libpython3.12 \
                libtool \
                libyaml-dev \
                llvm-14-dev \
                make \
                parallel \
                python-is-python3 \
                python3-yaml \
                rustc \
                software-properties-common \
                zlib1g \
                zlib1g-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: ./autogen.sh
      - run: ./configure --enable-unittests --enable-coccinelle
      - run: make -j ${{ env.CPUS }}
      - run: CONCURRENCY_LEVEL=${{ env.CPUS }} make check
      - run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: make install-headers
      - run: make install-library

      - run: TZ="UTC" ./src/suricata -u -U CreateFormattedTimeStringTest01
      - run: TZ="Brazil/East" ./src/suricata -u -U CreateFormattedTimeStringTest01
      - run: TZ="Saskatchewan/Regina" ./src/suricata -u -U CreateFormattedTimeStringTest01

  ubuntu-24-04-rust-vars:
    name: Ubuntu 24.04 (RUSTC+CARGO vars)
    runs-on: ubuntu-latest
    container: ubuntu:24.04
    needs: [prepare-deps]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                autoconf \
                automake \
                build-essential \
                cargo-1.82 \
                cbindgen \
                clang-14 \
                dpdk-dev \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libcap-ng-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libhiredis-dev \
                libhyperscan-dev \
                libjansson-dev \
                libmagic-dev \
                libnet1-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libpcap-dev \
                libpcre2-dev \
                libpython3.12 \
                libtool \
                libyaml-dev \
                llvm-14-dev \
                make \
                parallel \
                python-is-python3 \
                python3-yaml \
                rustc-1.82 \
                software-properties-common \
                zlib1g \
                zlib1g-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: ./autogen.sh
      - run: CARGO=cargo-1.82 RUSTC=rustc-1.82 RUSTDOC=rustdoc-1.82 ./configure --enable-unittests
      - run: make -j ${{ env.CPUS }}
      - run: make check
      - run: python3 ./suricata-verify/run.py -q --debug-failed
        env:
          CARGO: cargo-1.82
      - run: make install
      - run: make install-headers
      - run: make install-library

  ubuntu-24-04-cov-ut:
    name: Ubuntu 24.04 (unittests coverage)
    runs-on: ubuntu-latest
    container: ubuntu:24.04
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                clang-19 \
                curl \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libhyperscan-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                llvm-19-dev \
                make \
                parallel \
                python3-yaml \
                software-properties-common \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                curl \
                dpdk-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      # packaged Rust version is too old for coverage, so get from rustup. 1.85.1 matches
      # LLVM 19
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.1 -y
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: ./configure --enable-warnings --disable-shared --enable-unittests
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
      - run: ./src/suricata -h
        env:
          LLVM_PROFILE_FILE: "/tmp/help.profraw"
      - run: llvm-profdata-19 merge -o help.profdata /tmp/help.profraw
      - run: ./src/suricata -u -l /tmp/
        env:
          LLVM_PROFILE_FILE: "/tmp/ut.profraw"
      - run: llvm-profdata-19 merge -o ut.profdata /tmp/ut.profraw
      - run: ./src/suricata --list-runmodes -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/listrunmodes.profraw"
      - run: llvm-profdata-19 merge -o listrunmodes.profdata /tmp/listrunmodes.profraw
      - run: ./src/suricata --list-keywords -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/lk.profraw"
      - run: llvm-profdata-19 merge -o lk.profdata /tmp/lk.profraw
      - run: ./src/suricata --list-app-layer-protos -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/la.profraw"
      - run: llvm-profdata-19 merge -o la.profdata /tmp/la.profraw
      - run: ./src/suricata --list-app-layer-hooks -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/lah.profraw"
      - run: llvm-profdata-19 merge -o lah.profdata /tmp/lah.profraw
      - run: ./src/suricata --list-rule-protos -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/lrp.profraw"
      - run: llvm-profdata-19 merge -o lrp.profdata /tmp/lrp.profraw
      - run: ./src/suricata --dump-features -c suricata.yaml -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/dumpfeatures.profraw"
      - run: llvm-profdata-19 merge -o dumpfeatures.profdata /tmp/dumpfeatures.profraw
      - run: ./src/suricata --dump-config -c suricata.yaml -l /tmp
        env:
          LLVM_PROFILE_FILE: "/tmp/dumpconfig.profraw"
      - run: llvm-profdata-19 merge -o dumpconfig.profdata /tmp/dumpconfig.profraw
      - run: llvm-profdata-19 merge -o combined.profdata $(find /tmp/ -name '*.profraw')
      - run: llvm-cov-19 export ./src/suricata -instr-profile=combined.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches > coverage.lcov
      - run: |
          cd rust
          cargo test --no-run
          cd ..
        env:
          RUSTFLAGS: "-C instrument-coverage"
          CARGO_INCREMENTAL: 0
      - run: |
          $(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$')
        env:
          LLVM_PROFILE_FILE: "/tmp/ct.profraw"
          CARGO_INCREMENTAL: 0
      - run: llvm-profdata-19 merge -o ct.profdata /tmp/ct.profraw
      - run: llvm-cov-19 export $(find rust/target/debug/deps/ -type f -regex 'rust/target/debug/deps/suricata\-[a-z0-9]+$') -instr-profile=ct.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches >> coverage.lcov
      - run: |
          cargo build --manifest-path examples/plugins/rust/Cargo.toml
          rm -f /tmp/eve.json /tmp/rust-plugin-*.profraw
          ./src/suricata -S /dev/null --plugin ./examples/plugins/rust/target/debug/libsuricata_rust_plugin.so --runmode=single -l /tmp -c suricata.yaml -k none -r qa/docker/pcaps/tls.pcap
          test "$(jq -c 'select(.foobar and .rust_wrapped)' /tmp/eve.json | wc -l)" != "0"
          llvm-profdata-19 merge -o rust-plugin.profdata /tmp/rust-plugin-*.profraw
          llvm-cov-19 export ./examples/plugins/rust/target/debug/libsuricata_rust_plugin.so -instr-profile=rust-plugin.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches >> coverage.lcov
        env:
          RUSTFLAGS: "-C instrument-coverage"
          CARGO_INCREMENTAL: 0
          LLVM_PROFILE_FILE: "/tmp/rust-plugin-%p-%m.profraw"
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: false
          files: coverage.lcov
          flags: unittests

  ubuntu-24-04-cov-pcapunix:
    name: Ubuntu 24.04 (unix socket mode coverage)
    runs-on: ubuntu-latest
    container:
      image: ubuntu:24.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-19-dev \
                clang-19 \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                inetutils-ping \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget
      # specific version to match up to the llvm version in ubuntu below
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.1 -y
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-verify.tar.gz
      - uses: ./.github/actions/install-cbindgen
      - name: Fix kernel mmap rnd bits
      # Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
      # high-entropy ASLR in much newer kernels that GitHub runners are
      # using leading to random crashes: https://github.com/actions/runner-images/issues/9491
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --with-gnu-ld --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
      - run: |
          ./qa/unix.sh "suricata-verify/"
        env:
          LLVM_PROFILE_FILE: "/tmp/unix.profraw"
      - run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
      - run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches > coverage.lcov
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: false
          files: coverage.lcov
          flags: pcap

  ubuntu-24-04-cov-afpdpdk:
    name: Ubuntu 24.04 (afpacket and dpdk coverage)
    runs-on: ubuntu-latest
    container:
      image: ubuntu:24.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-19-dev \
                clang-19 \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                inetutils-ping \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget \
                dpdk-dev
      # specific version to match up to the llvm version in ubuntu below
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.1 -y
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - name: Fix kernel mmap rnd bits
      # Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
      # high-entropy ASLR in much newer kernels that GitHub runners are
      # using leading to random crashes: https://github.com/actions/runner-images/issues/9491
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --with-gnu-ld --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing"
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
      # IDS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/dpdk-ids.profraw"
      # IPS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/dpdk-ips.profraw"
      # DPDK configuration checks
      - run: ./qa/live/dpdk/dpdk-testsuite.sh
        env:
          LLVM_PROFILE_FILE: "/tmp/dpdk-testsuite-%p.profraw"
      # AF_PACKET tests
      - run: |
          ./qa/live/afp-ids.sh "2" "autofp"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp2-ids-autofp.profraw"
      - run: |
          ./qa/live/afp-ids.sh "2" "workers"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp2-ids-workers.profraw"
      - run: |
          ./qa/live/afp-ids.sh "3" "autofp"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp3-ids-autofp.profraw"
      - run: |
          ./qa/live/afp-ids.sh "3" "workers"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp3-ids-workers.profraw"
      # PCAP
      - run: |
          ./qa/live/pcap.sh "autofp"
        env:
          LLVM_PROFILE_FILE: "/tmp/pcap-autofp.profraw"
      - run: |
          ./qa/live/pcap.sh "single"
        env:
          LLVM_PROFILE_FILE: "/tmp/pcap-single.profraw"
      - run: |
          ./qa/live/multi-tenant.sh "autofp"
        env:
          LLVM_PROFILE_FILE: "/tmp/mt-autofp.profraw"
      - run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
      - run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches > coverage.lcov
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: false
          files: coverage.lcov
          flags: livemode

  ubuntu-24-04-pcap-unix:
    name: Ubuntu 24.04 (pcap unix socket ASAN)
    runs-on: ubuntu-latest
    container:
      image: ubuntu:24.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-18-dev \
                cargo \
                cbindgen \
                clang-18 \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                rustc \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget \
                dpdk-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - name: Fix kernel mmap rnd bits
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
        env:
          CC: "clang-18"
          CFLAGS: "-g -fsanitize=address -fno-omit-frame-pointer"
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-18"
      - run: |
          ./qa/unix.sh "suricata-verify/"

  ubuntu-latest-namespace-ips:
    name: Ubuntu 24.04 (afpacket IPS tests in namespaces)
    runs-on: ubuntu-latest
    needs: [prepare-deps, prepare-cbindgen]
    container:
      image: ubuntu:24.04
      options: --privileged
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-19-dev \
                clang-19 \
                git \
                hping3 \
                hwloc \
                libhwloc-dev \
                jq \
                inetutils-ping \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget \
                caddy \
                ethtool \
                iproute2 \
                iptables \
                tshark
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      # packaged Rust version is too old for coverage, so get from rustup. 1.85.1 matches
      # LLVM 19
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.1 -y
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: ./configure --disable-shared --localstatedir=/var --prefix=/usr --sysconfdir=/etc --enable-nfqueue
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0"

      - run: |
          ./qa/live/netns/afp-ips-netns-bridge.sh "2" "workers" "qa/live/netns/ips-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp-ips.profraw"
      - run: llvm-profdata-19 merge -o afp-ips.profdata /tmp/afp-ips.profraw

      - run: |
          ./qa/live/netns/afp-ips-netns-bridge.sh "2" "autofp" "qa/live/netns/ips-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp-ips-autofp.profraw"
      - run: llvm-profdata-19 merge -o afp-ips-autofp.profdata /tmp/afp-ips-autofp.profraw

      - run: |
          ./qa/live/netns/afp-ips-netns-bond-bridge.sh "2" "workers" "qa/live/netns/ips-netns-bond.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp-ips-bond1.profraw"
      - run: llvm-profdata-19 merge -o afp-ips-bond1.profdata /tmp/afp-ips-bond1.profraw

      - run: |
          ./qa/live/netns/afp-ips-netns-bond-bridge2.sh "2" "workers" "qa/live/netns/ips-netns-bond2.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp-ips-bond2.profraw"
      - run: llvm-profdata-19 merge -o afp-ips-bond2.profdata /tmp/afp-ips-bond2.profraw

      - run: |
          ./qa/live/netns/nfq-ips-netns-route.sh "autofp" "qa/live/netns/ips-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/nfq-ips.profraw"
      - run: llvm-profdata-19 merge -o nfq-ips.profdata /tmp/nfq-ips.profraw

      - run: |
          ./qa/live/netns/nfq-ips-netns-route.sh "workers" "qa/live/netns/ips-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/nfq-ips-workers.profraw"
      - run: llvm-profdata-19 merge -o nfq-ips-workers.profdata /tmp/nfq-ips-workers.profraw

      - run: |
          ./qa/live/netns/nfq-fw-netns-route.sh "autofp" "qa/live/netns/fw-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/nfq-fw-netns-route.profraw"
      - run: llvm-profdata-19 merge -o nfq-fw-netns-route.profdata /tmp/nfq-fw-netns-route.profraw

      - run: |
          ./qa/live/netns/afp-fw-netns-bridge.sh "2" "workers" "qa/live/netns/fw-netns.yaml"
        env:
          LLVM_PROFILE_FILE: "/tmp/afp-fw-netns-bridge.profraw"
      - run: llvm-profdata-19 merge -o afp-fw-netns-bridge.profdata /tmp/afp-fw-netns-bridge.profraw

      - run: llvm-profdata-19 merge -o combined.profdata afp-ips.profdata nfq-ips.profdata afp-ips-autofp.profdata nfq-ips-workers.profdata afp-ips-bond1.profdata afp-ips-bond2.profdata afp-fw-netns-bridge.profdata nfq-fw-netns-route.profdata
      - run: llvm-cov-19 export ./src/suricata -instr-profile=combined.profdata -format=lcov --ignore-filename-regex="^(/github/home/.cargo/.*|/usr/.*|/rustc/.*)" --skip-branches > coverage.lcov
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: true
          files: coverage.lcov
          flags: netns
          verbose: true

  ubuntu-24-04-asan-afpdpdk:
    name: Ubuntu 24.04 (afpacket and dpdk live tests with ASAN)
    runs-on: ubuntu-latest
    container:
      image: ubuntu:24.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-18-dev \
                cargo \
                cbindgen \
                clang-18 \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                inetutils-ping \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                rustc \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget \
                dpdk-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Fix kernel mmap rnd bits
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --enable-dpdk --disable-shared --enable-gccprotect --localstatedir=/var --prefix=/usr --sysconfdir=/etc
        env:
          CC: "clang-18"
          CFLAGS: "-g -fsanitize=address -fno-omit-frame-pointer"
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-18"
      # IDS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
      # IPS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
      # DPDK configuration checks
      - run: ./qa/live/dpdk/dpdk-testsuite.sh
      # AF_PACKET tests
      - run: |
          ./qa/live/afp-ids.sh "2" "autofp"
      - run: |
          ./qa/live/afp-ids.sh "2" "workers"
      - run: |
          ./qa/live/afp-ids.sh "3" "autofp"
      - run: |
          ./qa/live/afp-ids.sh "3" "workers"
      - run: |
          ./qa/live/pcap.sh "autofp"
      - run: |
          ./qa/live/pcap.sh "single"
      - run: |
          ./qa/live/multi-tenant.sh "autofp"

  ubuntu-24-04-cov-fuzz:
    name: Ubuntu 24.04 (fuzz corpus coverage)
    runs-on: ubuntu-latest
    container:
      image: ubuntu:24.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                llvm-19-dev \
                clang-19 \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libc++-dev \
                libc++abi-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                make \
                parallel \
                python3-yaml \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                unzip \
                curl \
                time \
                wget \
                dpdk-dev
      # packaged Rust version is too old for coverage, so get from rustup
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.85.1 -y
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - name: Fix kernel mmap rnd bits
      # Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
      # high-entropy ASLR in much newer kernels that GitHub runners are
      # using leading to random crashes: https://github.com/actions/runner-images/issues/9491
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --enable-warnings --with-gnu-ld --enable-fuzztargets --disable-shared --enable-gccprotect
        env:
          LIB_FUZZING_ENGINE: "fail_to_onefile_driver"
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          CFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -fPIC -Wno-unused-parameter -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -Wimplicit-int-float-conversion -Wimplicit-int-conversion -Werror"
          CXXFLAGS: "-fprofile-instr-generate -fcoverage-mapping -O0 -g -fno-strict-aliasing -fsanitize=address -fno-omit-frame-pointer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -stdlib=libc++ -Wimplicit-int-float-conversion -Wimplicit-int-conversion"
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
        env:
          CC: "clang-19"
          CXX: "clang++-19"
          RUSTFLAGS: "-C instrument-coverage"
          SURICATA_LUA_SYS_CFLAGS: "-fsanitize=address"
      - run: ./qa/run-ossfuzz-corpus.sh
      - run: llvm-profdata-19 merge -o default.profdata $(find /tmp/ -name '*.profraw')
      - run: llvm-cov-19 export ./src/suricata -instr-profile=default.profdata -format=lcov --ignore-filename-regex="^/(root|usr|rustc|github)/.*" --skip-branches > coverage.lcov
      - name: Upload coverage.lcov artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: coverage-lcov-${{ github.job }}
          path: coverage.lcov
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
          fail_ci_if_error: false
          files: coverage.lcov
          flags: fuzzcorpus

  ubuntu-20-04-ndebug:
    name: Ubuntu 20.04 (-DNDEBUG)
    runs-on: ubuntu-latest
    container: ubuntu:20.04
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                build-essential \
                autoconf \
                automake \
                cargo \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libpython2.7 \
                libpcre2-dev \
                make \
                parallel \
                python3-yaml \
                rustc \
                software-properties-common \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags \
                dpdk-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: CFLAGS="$DEFAULT_CFLAGS -DNDEBUG" ./configure --enable-warnings --enable-unittests
      - run: make -j ${{ env.CPUS }}
      - run: make check
      - run: make dist
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      # Now install and make sure headers and libraries aren't install
      # until requested.
      - run: make install
      - run: test ! -e /usr/local/lib/libsuricata_c.a
      - run: test ! -e /usr/local/include/suricata
      - run: make install-headers
      - run: test -e /usr/local/include/suricata/suricata.h
      - run: make install-library
      - run: test -e /usr/local/lib/libsuricata_c.a
      - run: test -e /usr/local/lib/libsuricata_rust.a
      - run: test -e /usr/local/bin/libsuricata-config
      - run: test -e /usr/local/lib/libsuricata.so
      - run: test -e /usr/local/lib/$(readlink /usr/local/lib/libsuricata.so)
      - run: suricata-update -V
      - run: suricatasc -h

  ubuntu-20-04-too-old-rust:
    name: Ubuntu 20.04 (unsupported rust)
    runs-on: ubuntu-latest
    container: ubuntu:20.04
    needs: ubuntu-22-04-dist
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                build-essential \
                curl \
                hwloc \
                libhwloc-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libnuma-dev \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libpython2.7 \
                libpcre2-dev \
                make \
                python3-yaml \
                software-properties-common \
                zlib1g \
                zlib1g-dev \
                dpdk-dev
      - run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain 1.62.0 -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar zxvf suricata-*.tar.gz --strip-components=1
      - run: |
          if ./configure; then
            echo "error: configure should have failed"
            exit 1
          else
            exit 0
          fi

  ubuntu-22-04-debug-validation:
    name: Ubuntu 22.04 (Debug Validation)
    runs-on: ubuntu-22.04
    container:
      image: ubuntu:22.04
      options: --privileged
    needs: [prepare-deps, prepare-cbindgen]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                cargo \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libpython2.7 \
                make \
                parallel \
                python3-yaml \
                rustc \
                software-properties-common \
                sudo \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - name: Fix kernel mmap rnd bits
      # Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
      # high-entropy ASLR in much newer kernels that GitHub runners are
      # using leading to random crashes: https://github.com/actions/runner-images/issues/9491
        run: sudo sysctl vm.mmap_rnd_bits=28
      - run: ./autogen.sh
      - run: ./configure --enable-warnings --enable-debug-validation --enable-qa-simulation
        env:
          CFLAGS: "${{ env.DEFAULT_CFLAGS }} -Wshadow -fsanitize=address -fno-omit-frame-pointer"
          LDFLAGS: "-fsanitize=address" 
          ac_cv_func_malloc_0_nonnull: "yes"
          ac_cv_func_realloc_0_nonnull: "yes"
      - run: make -j ${{ env.CPUS }}
      - run: make check
      - name: Extracting suricata-verify
        run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed

  # test build with afl and fuzztargets
  ubuntu-22-04-fuzz:
    name: Ubuntu 22.04 (Fuzz)
    runs-on: ubuntu-22.04
    container: ubuntu:22.04
    needs: [prepare-deps, prepare-cbindgen]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                afl \
                afl-clang \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                cargo \
                git \
                hwloc \
                libhwloc-dev \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libhiredis-dev \
                libjansson-dev \
                libpython2.7 \
                make \
                rustc \
                software-properties-common \
                zlib1g \
                zlib1g-dev
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: AFL_HARDEN=1 ac_cv_func_realloc_0_nonnull=yes ac_cv_func_malloc_0_nonnull=yes CFLAGS="-fsanitize=address -fno-omit-frame-pointer" CXXFLAGS=$CFLAGS CC=afl-clang-fast CXX=afl-clang-fast++ LDFLAGS="-fsanitize=address" ./configure --enable-warnings --enable-fuzztargets --disable-shared
      - run: AFL_HARDEN=1 make -j ${{ env.CPUS }}

  ubuntu-22-04-netmap-build:
    name: Ubuntu 22.04 (Netmap build)
    needs: [prepare-deps, prepare-cbindgen]
    runs-on: ubuntu-22.04
    steps:
      - name: Restore Cache Netmap
        uses: actions/cache/restore@v5
        id: netmap-cache
        with:
          path: netmap/
          key: netmap-git

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
            sudo apt update
            sudo apt -y install \
                  libpcre2-dev \
                  build-essential \
                  autoconf \
                  automake \
                  cargo \
                  git \
                  hwloc \
                  libhwloc-dev \
                  jq \
                  libtool \
                  libpcap-dev \
                  libnet1-dev \
                  libyaml-0-2 \
                  libyaml-dev \
                  libcap-ng-dev \
                  libcap-ng0 \
                  libmagic-dev \
                  libnetfilter-queue-dev \
                  libnetfilter-queue1 \
                  libnfnetlink-dev \
                  libnfnetlink0 \
                  libhiredis-dev \
                  libjansson-dev \
                  libevent-dev \
                  libevent-pthreads-2.1-7 \
                  libpython2.7 \
                  make \
                  parallel \
                  python3-yaml \
                  rustc \
                  software-properties-common \
                  zlib1g \
                  zlib1g-dev \
                  exuberant-ctags

      - name: Install Netmap dependencies
        run: |
          sudo apt -y install \
                build-essential \
                git \
                linux-headers-$(uname -r)

      - name: Checkout Netmap repository
        if: steps.netmap-cache.outputs.cache-hit != 'true'
        run: git clone --depth 1 https://github.com/luigirizzo/netmap

      - name: Save Netmap Cache
        if: steps.netmap-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: netmap/
          key: netmap-git

      - name: Compile and install Netmap
        run: |
          cd $GITHUB_WORKSPACE/netmap/LINUX
          ./configure --no-drivers
          make -j ${{ env.CPUS }}
          sudo make install

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-netmap --enable-debug
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata --build-info | grep -E "Netmap support:\s+yes"

  ubuntu-22-04-minimal-recommended-build:
    name: Ubuntu 22.04 (Minimal/Recommended Build)
    needs: [ubuntu-22-04-dist]
    runs-on: ubuntu-22.04
    container: ubuntu:22.04
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar xvf suricata-*.tar.gz --strip-components=1

      # Install packages required by the install script.
      - run: apt update -y && apt install -y sudo

      - name: Install minimal dependencies
        run: ./scripts/docs-ubuntu-debian-minimal-build.sh

      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
      - run: make -j ${{ env.CPUS }}
      - run: ./src/suricata --build-info # check if we can run Suricata

  ubuntu-22-04-dpdk-build:
    name: Ubuntu 22.04 (DPDK Build)
    runs-on: ubuntu-22.04
    container: ubuntu:22.04
    needs: [ prepare-deps, prepare-cbindgen ]
    strategy:
      matrix:
        dpdk_version: [ 24.11.3, 23.11.5, 22.11.10, 21.11.9 ]
    steps:

      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install dependencies
        run: |
          apt update
          apt -y install \
                libpcre2-dev \
                build-essential \
                autoconf \
                automake \
                cargo \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libtool \
                libpcap-dev \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libnetfilter-queue-dev \
                libnetfilter-queue1 \
                libnfnetlink-dev \
                libnfnetlink0 \
                libhiredis-dev \
                libjansson-dev \
                libevent-dev \
                libevent-pthreads-2.1-7 \
                libpython2.7 \
                make \
                parallel \
                python3-yaml \
                rustc \
                software-properties-common \
                zlib1g \
                zlib1g-dev \
                exuberant-ctags
      - name: Install DPDK dependencies
        run: |
          apt update
          apt install -y \
          curl \
          build-essential \
          libnuma-dev \
          ninja-build \
          meson \
          python3-pip \
          python3-pyelftools \
          python3-setuptools \
          python3-wheel

      - name: Compile and install DPDK
        run: |
          cd $HOME
          rm -rf dpdk_${{ matrix.dpdk_version }}
          find /usr/ -name 'librte_*.a' -delete
          mkdir -p dpdk_${{ matrix.dpdk_version }} && cd dpdk_${{ matrix.dpdk_version }}
          curl -fsLS https://fast.dpdk.org/rel/dpdk-${{ matrix.dpdk_version }}.tar.xz | tar -xJ --strip-components=1
          rm -rf build/
          meson setup -Dtests=false --prefix=/usr/ build
          ninja -C build
          ninja -C build install
          ldconfig
          cd $HOME
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-dpdk --enable-hwloc
      - run: make -j ${{ env.CPUS }}
      - run: make check
      # IDS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ids.yaml"
      # IPS config
      - run: |
          ./qa/live/dpdk.sh "qa/live/dpdk/suricata-null-ips.yaml"
      # DPDK configuration checks
      - run: ./qa/live/dpdk/dpdk-testsuite.sh

  debian-12:
    name: Debian 12 (xdp)
    runs-on: ubuntu-latest
    container: debian:12
    needs: [prepare-deps]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: apt update
      - run: |
          apt -y install \
              autoconf \
              automake \
              build-essential \
              cmake \
              curl \
              dpdk-dev \
              git \
              hwloc \
              libhwloc-dev \
              jq \
              make \
              libpcre3 \
              libpcre3-dbg \
              libpcre3-dev \
              libpcre2-dev \
              libtool \
              libpcap-dev \
              libnet1-dev \
              libyaml-0-2 \
              libyaml-dev \
              libcap-ng-dev \
              libcap-ng0 \
              libmagic-dev \
              libmaxminddb-dev \
              libjansson-dev \
              libjansson4 \
              libnuma-dev \
              liblz4-dev \
              libssl-dev \
              liblzma-dev \
              pkg-config \
              python3 \
              python3-yaml \
              sphinx-doc \
              sphinx-common \
              texlive-latex-base \
              texlive-fonts-recommended \
              texlive-fonts-extra \
              texlive-latex-extra \
              zlib1g \
              zlib1g-dev \
              clang \
              libxdp-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $(grep rust-version rust/Cargo.toml.in|sed 's/\"//g'|awk '{print $3}') -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: ./.github/actions/install-cbindgen
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-qa-simulation --enable-ebpf --enable-ebpf-build
      - run: make -j ${{ env.CPUS }}
      - run: make check
        # -j2 caused random failures during cargo vendor
      - run: make distcheck
        env:
          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk --enable-ebpf --enable-ebpf-build"
      - run: test -e doc/userguide/suricata.1
      - run: test -e doc/userguide/userguide.pdf
      - name: Building Rust documentation
        run: make doc
        working-directory: rust
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h

  debian-13:
    name: Debian 13 (xdp)
    runs-on: ubuntu-latest
    container: debian:13
    needs: [prepare-deps]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: apt update
      - run: |
          apt -y install \
              autoconf \
              automake \
              build-essential \
              cmake \
              cargo \
              dpdk-dev \
              git \
              hwloc \
              libhwloc-dev \
              jq \
              make \
              libpcre2-dev \
              libtool \
              libpcap-dev \
              libnet1-dev \
              libyaml-0-2 \
              libyaml-dev \
              libcap-ng-dev \
              libcap-ng0 \
              libmagic-dev \
              libmaxminddb-dev \
              libjansson-dev \
              libjansson4 \
              libnuma-dev \
              liblz4-dev \
              libssl-dev \
              liblzma-dev \
              libvectorscan-dev \
              pkg-config \
              python3 \
              python3-yaml \
              rustc \
              sphinx-doc \
              sphinx-common \
              texlive-latex-base \
              texlive-fonts-recommended \
              texlive-fonts-extra \
              texlive-latex-extra \
              zlib1g \
              zlib1g-dev \
              clang \
              libxdp-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: ./.github/actions/install-cbindgen
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-qa-simulation --enable-ebpf --enable-ebpf-build
      - run: make -j ${{ env.CPUS }}
      - run: make check
        # -j2 caused random failures during cargo vendor
      - run: make distcheck
        env:
          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk --enable-ebpf --enable-ebpf-build"
      - run: python3 scripts/check-dist-rules.py
      - run: python3 scripts/check-uint-keywords.py
      - run: test -e doc/userguide/suricata.1
      - run: test -e doc/userguide/userguide.pdf
      - name: Building Rust documentation
        run: make doc
        working-directory: rust
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h

  ubuntu-22-04-dist:
    name: Ubuntu 22.04 Dist Builder
    runs-on: ubuntu-latest
    container: ubuntu:22.04
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: apt update
      - run: |
          apt -y install \
              autoconf \
              automake \
              build-essential \
              cargo \
              cmake \
              curl \
              git \
              hwloc \
              libhwloc-dev \
              jq \
              make \
              libpcre3 \
              libpcre3-dbg \
              libpcre3-dev \
              libpcre2-dev \
              libtool \
              libpcap-dev \
              libnet1-dev \
              libyaml-0-2 \
              libyaml-dev \
              libcap-ng-dev \
              libcap-ng0 \
              libmagic-dev \
              libjansson-dev \
              libjansson4 \
              liblz4-dev \
              libssl-dev \
              liblzma-dev \
              pkg-config \
              python3 \
              python3-yaml \
              rustc \
              sphinx-doc \
              sphinx-common \
              texlive-latex-base \
              texlive-fonts-recommended \
              texlive-fonts-extra \
              texlive-latex-extra \
              zlib1g \
              zlib1g-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure
      - run: make dist
      - run: test -e doc/userguide/suricata.1
      - run: test -e doc/userguide/userguide.pdf
      - name: Preparing distribution
        run: |
          mkdir dist
          mv suricata-*.tar.gz dist
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        name: Uploading distribution
        with:
          name: dist
          path: dist

  debian-12-msrv:
    name: Debian 12 MSRV
    runs-on: ubuntu-latest
    container: debian:12
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: apt update
      - run: |
          apt -y install \
              autoconf \
              automake \
              build-essential \
              cmake \
              curl \
              dpdk-dev \
              git \
              hwloc \
              libhwloc-dev \
              jq \
              make \
              libpcre3 \
              libpcre3-dbg \
              libpcre3-dev \
              libpcre2-dev \
              libtool \
              libpcap-dev \
              libnet1-dev \
              libyaml-0-2 \
              libyaml-dev \
              libcap-ng-dev \
              libcap-ng0 \
              libmagic-dev \
              libmaxminddb-dev \
              libjansson-dev \
              libjansson4 \
              libnuma-dev \
              liblz4-dev \
              libssl-dev \
              liblzma-dev \
              pkg-config \
              python3 \
              python3-yaml \
              sphinx-doc \
              sphinx-common \
              texlive-latex-base \
              texlive-fonts-recommended \
              texlive-fonts-extra \
              texlive-latex-extra \
              zlib1g \
              zlib1g-dev
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $(grep rust-version rust/Cargo.toml.in|sed 's/\"//g'|awk '{print $3}') -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: ./.github/actions/install-cbindgen
      - run: tar xf prep/suricata-update.tar.gz
      - run: tar xf prep/suricata-verify.tar.gz
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-debug --enable-qa-simulation --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk
      - run: make -j ${{ env.CPUS }}
      - run: make check
      - name: Building Rust documentation
        run: make doc
        working-directory: rust
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h

  debian-11:
    name: Debian 11
    runs-on: ubuntu-latest
    container: debian:11
    needs: [prepare-deps, prepare-cbindgen]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - run: |
          apt update
          apt -y install \
                automake \
                autoconf \
                build-essential \
                ccache \
                curl \
                git \
                hwloc \
                libhwloc-dev \
                jq \
                libpcre2-dev \
                libpcap-dev   \
                libnet1-dev \
                libyaml-0-2 \
                libyaml-dev \
                libcap-ng-dev \
                libcap-ng0 \
                libmagic-dev \
                libjansson-dev \
                libgeoip-dev \
                libhiredis-dev \
                libevent-dev \
                libtool \
                m4 \
                make \
                python3-yaml \
                pkg-config \
                sudo \
                zlib1g \
                zlib1g-dev \
                clang \
                libbpf-dev \
                libelf-dev
      - name: Install Rust
        run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain $RUST_VERSION_KNOWN -y
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - uses: ./.github/actions/install-cbindgen
      - run: ./autogen.sh
      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --enable-fuzztargets
      - run: make -j ${{ env.CPUS }}
      - run: make check
      - run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V
      - run: suricatasc -h

  macos-latest:
    name: MacOS Latest
    runs-on: macos-latest
    needs: [prepare-deps]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - run: |
         brew install \
          autoconf \
          automake \
          cbindgen \
          curl \
          hiredis \
          hwloc \
          jansson \
          jq \
          libnet \
          libtool \
          libyaml \
          pcre2 \
          pkg-config \
          python \
          rust \
          xz
      - run: echo "$HOME/.cargo/bin" >> $GITHUB_PATH
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - name: Downloading prep archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xvf prep/suricata-update.tar.gz
      - name: Create Python virtual environment
        run: python3 -m venv ./testenv
      - name: Install PyYAML
        run: |
          . ./testenv/bin/activate
          pip install pyyaml
      - run: ./autogen.sh
      - run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests --prefix="$HOME/.local/"
      - run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" make -j2
      - run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" make check
      - run: tar xf prep/suricata-verify.tar.gz
      - name: Running suricata-verify
        run: |
          . ./testenv/bin/activate
          python3 ./suricata-verify/run.py -q --debug-failed
      - run: CPATH="$HOMEBREW_PREFIX/include:$CPATH" LIBRARY_PATH="$HOMEBREW_PREFIX/lib:$LIBRARY_PATH" PATH="/opt/homebrew/opt/libtool/libexec/gnubin:$PATH" CFLAGS="${DEFAULT_CFLAGS}" make install
      - name: Check Suricata-Update
        run: |
          . ./testenv/bin/activate
          which suricata-update
          python3 $(which suricata-update) -V
      - run: suricatasc -h

  freebsd-15-0:
    name: FreeBSD 15.0
    runs-on: ubuntu-latest
    needs: [prepare-deps]
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - name: Downloading prep archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a
        with:
          release: "15.0"
          arch: x86_64
          usesh: true
          sync: rsync
          copyback: false
          envs: "DEFAULT_CFLAGS"
          prepare: |
            pkg install -y \
              autoconf \
              automake \
              gmake \
              jq \
              rust-cbindgen \
              jansson \
              libpcap \
              libtool \
              libyaml \
              pcre2 \
              pkgconf \
              python3 \
              py312-pyyaml \
              rust
          run: |
            tar xf prep/suricata-verify.tar.gz
            ./autogen.sh
            CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-warnings --enable-unittests
            gmake -j$(sysctl -n hw.ncpu)
            ./src/suricata -u -l /tmp/
            python3 ./suricata-verify/run.py -q --debug-failed

  windows-msys2-mingw64-npcap:
    name: Windows MSYS2 MINGW64 (NPcap)
    runs-on: windows-latest
    needs: [prepare-deps]
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - name: Cache npcap
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: /npcap-bin
          key: npcap-bin-100
      - uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2
      # hack: install our own cbindgen system wide as we can't get the
      # preinstalled one to be picked up by configure
      - name: cbindgen
        run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - run: tar xf prep/suricata-update.tar.gz
      - name: Npcap DLL
        run: |
          if ! test -e /npcap-bin; then
              curl -sL -O https://nmap.org/npcap/dist/npcap-1.00.exe
              7z -y x -o/npcap-bin npcap-1.00.exe
          fi
      - name: Place NPcap dll's in curent directory 
        run: cp /npcap-bin/*.dll .
      - name: Npcap SDK
        run: |
          curl -sL -O https://nmap.org/npcap/dist/npcap-sdk-1.06.zip
          unzip npcap-sdk-1.06.zip -d /npcap
          cp /npcap/Lib/x64/* /usr/lib/
      - run: tar xf prep/suricata-verify.tar.gz
      - name: Build
        run: |
          ./autogen.sh
          CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
          make -j3
      - name: Run
        run: |
          ./src/suricata --build-info
          ./src/suricata -u -l .
          # need cwd in path due to npcap dlls (see above)
          PATH="$PATH:$(pwd)" python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V

  windows-msys2-mingw64-libpcap:
    name: Windows MSYS2 MINGW64 (libpcap)
    runs-on: windows-latest
    needs: [prepare-deps, ubuntu-22-04-dist]
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
      # hack: install our own cbindgen system wide as we can't get the
      # preinstalled one to be picked up by configure
      - name: cbindgen
        run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar xvf suricata-*.tar.gz --strip-components=1
      - run: tar xf prep/suricata-verify.tar.gz
      - name: Build
        run: |
          ./autogen.sh
          CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared --with-libpcap-includes=/npcap/Include --with-libpcap-libraries=/npcap/Lib/x64
          make -j3
      - name: Run
        run: |
          ./src/suricata --build-info
          ./src/suricata -u -l .
          python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V

  windows-msys2-ucrt64-libpcap:
    name: Windows MSYS2 UCRT64 (libpcap)
    runs-on: windows-latest
    needs: [prepare-deps, ubuntu-22-04-dist]
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - uses: msys2/setup-msys2@v2
        with:
          msystem: ucrt64
          update: true
          install: |
            autoconf
            automake
            git
            make
            mingw-w64-ucrt-x86_64-cbindgen
            mingw-w64-ucrt-x86_64-jansson
            mingw-w64-ucrt-x86_64-jq
            mingw-w64-ucrt-x86_64-libpcap
            mingw-w64-ucrt-x86_64-libtool
            mingw-w64-ucrt-x86_64-libyaml
            mingw-w64-ucrt-x86_64-pcre2
            mingw-w64-ucrt-x86_64-python-yaml
            mingw-w64-ucrt-x86_64-rust
            mingw-w64-ucrt-x86_64-toolchain
            unzip
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar xvf suricata-*.tar.gz --strip-components=1
      - run: tar xf prep/suricata-verify.tar.gz
      - name: Build
        run: |
          ./autogen.sh
          CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-unittests --enable-gccprotect --disable-gccmarch-native --disable-shared
          make -j3
      - name: Run
        run: |
          ./src/suricata --build-info
          ./src/suricata -u -l .
          python3 ./suricata-verify/run.py -q --debug-failed
      - run: make install
      - run: suricata-update -V

  windows-msys2-mingw64-windivert:
    name: Windows MSYS2 MINGW64 (WinDivert)
    runs-on: windows-latest
    needs: [prepare-deps]
    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Cache ~/.cargo
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry
      - uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: true
          install: git mingw-w64-x86_64-toolchain automake1.16 automake-wrapper autoconf libtool libyaml-devel pcre2-devel jansson-devel make mingw-w64-x86_64-libyaml mingw-w64-x86_64-pcre2 mingw-w64-x86_64-rust mingw-w64-x86_64-jansson unzip p7zip python-setuptools mingw-w64-x86_64-python-yaml mingw-w64-x86_64-jq mingw-w64-x86_64-libxml2 libpcap-devel mingw-w64-x86_64-libpcap
      # hack: install our own cbindgen system wide as we can't get the
      # preinstalled one to be picked up by configure
      - name: cbindgen
        run: cargo install --root /usr --force --debug --version 0.24.3 cbindgen
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
      - run: git config --global --add safe.directory /__w/suricata/suricata
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: prep
          path: prep
      - name: WinDivert
        run: |
          curl -sL -O https://github.com/basil00/Divert/releases/download/v2.2.2/WinDivert-2.2.2-A.zip
          unzip WinDivert-2.2.2-A.zip -d /windivert
          cp /windivert/WinDivert-2.2.2-A/x64/* /usr/lib/
          # hack: place dlls in cwd
          cp /windivert/WinDivert-2.2.2-A/x64/*.dll .
      - name: Build
        run: |
          ./autogen.sh
          CFLAGS="-ggdb -Werror" ./configure --enable-warnings --enable-gccprotect --disable-gccmarch-native --disable-shared --enable-windivert --with-windivert-include=/windivert/WinDivert-2.2.2-A/include --with-windivert-libraries=/windivert/WinDivert-2.2.2-A/x64
          make -j3
      - name: Run
        run: |
          # need cwd in path due to dlls (see above)
          PATH="$PATH:$(pwd)" ./src/suricata --build-info
      - run: make install

  pf-ring:
    name: PF_RING
    runs-on: ubuntu-latest
    container: almalinux:9
    needs: [prepare-deps, ubuntu-22-04-dist]
    steps:
      # Cache Rust stuff.
      - name: Cache cargo registry
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.cargo/registry
          key: cargo-registry

      - name: Determine number of CPUs
        run: echo CPUS=$(nproc --all) >> $GITHUB_ENV

      - name: Install system packages
        run: |
          dnf -y install dnf-plugins-core epel-release
          dnf config-manager --set-enabled crb
          dnf -y install \
                autoconf \
                automake \
                diffutils \
                numactl-devel \
                dpdk-devel \
                file-devel \
                gcc \
                gcc-c++ \
                git \
                hwloc \
                hwloc-devel \
                jansson-devel \
                libtool \
                libyaml-devel \
                libnfnetlink-devel \
                libnetfilter_queue-devel \
                libnet-devel \
                libcap-ng-devel \
                libevent-devel \
                libmaxminddb-devel \
                libpcap-devel \
                libtool \
                lz4-devel \
                make \
                pcre2-devel \
                pkgconfig \
                python3-devel \
                python3-sphinx \
                python3-yaml \
                rust-toolset \
                sudo \
                which \
                zlib-devel

      - name: Install PF_RING
        run: |
          curl https://packages.ntop.org/centos-stable/ntop.repo > /etc/yum.repos.d/ntop.repo
          dnf install -y pfring

      - name: Download suricata.tar.gz
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: dist
      - run: tar xf suricata-*.tar.gz --strip-components=1
      - run: ./configure --enable-pfring --enable-debug --enable-qa-simulation
      - run: make -j ${CPUS}
      - run: make install
      - run: test -e /usr/local/lib/suricata/pfring.so