Add changelog generation tool for GitHub milestones

.asf.yaml

@@ -38,6 +38,9 @@ github:
     - lzx404243
     - phongn
     - jasmine-nahrain
+  copilot_code_review:
+    enabled: true
+    review_on_push: true
   protected_branches:
     master:
       required_status_checks:

.github/workflows/codeql.yml

@@ -23,16 +23,17 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      packages: read
       actions: read
       contents: read
       security-events: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'cpp' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+        include:
+        - language: c-cpp
+          build-mode: manual
 
     steps:
     - name: Checkout repository
@@ -43,9 +44,10 @@ jobs:
         sudo apt install libmagick++-dev libncurses-dev libpcre2-dev libbrotli-dev libluajit-5.1-dev luajit libjansson-dev libcjose-dev libmaxminddb-dev libgeoip-dev ninja-build cmake libpcre3-dev
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
@@ -65,11 +67,13 @@ jobs:
     #   If the Autobuild fails above, remove it and uncomment the following three lines.
     #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
-    - run: |
+    - name: Run manual build steps
+      shell: bash
+      run: |
          echo "Run, Build Application using script"
          cmake -B build --preset ci
          cmake --build build -v
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

AGENTS.md

@@ -123,6 +123,13 @@ regularly).
 using the Proxy Verifier format. This is simpler, more maintainable, and
 parseable by tools.
 
+**Python conventions for test and helper scripts:**
+- Launch Python helpers with `{sys.executable}` rather than a hardcoded `python3`,
+  so the test runs under the same interpreter the harness uses.
+- Prefer f-strings over `str.format()` when building command lines, config lines,
+  and `Testers` expressions.
+- Add type annotations to helper functions.
+
 **For complete details on writing autests, see:**
 - `doc/developer-guide/testing/autests.en.rst` - Comprehensive guide to autest
 - Proxy Verifier format: https://github.com/yahoo/proxy-verifier
@@ -383,6 +390,11 @@ MIOBuffer *buffer = (MIOBuffer*)malloc(sizeof(MIOBuffer));
 - `src/proxy/http/remap/RemapConfig.cc` - URL remapping logic
 - `include/ts/ts.h` - Plugin API
 
+## Security
+
+See [SECURITY.md](SECURITY.md) for the project's security policy, threat model,
+scope, and vulnerability reporting process.
+
 ## Resources
 
 - Official docs: https://trafficserver.apache.org/

CMakeLists.txt

@@ -166,9 +166,12 @@ option(ENABLE_AUTEST_UDS "Setup autest with curl using UDS (default OFF)")
 option(ENABLE_BENCHMARKS "Build benchmarks (default OFF)")
 option(EXTERNAL_YAML_CPP "Use external yaml-cpp (default OFF)")
 option(EXTERNAL_LIBSWOC "Use external libswoc (default OFF)")
+option(EXTERNAL_HWY "Use external highway (default OFF)")
 option(LINK_PLUGINS "Link core libraries to plugins (default OFF)")
 option(ENABLE_PROBES "Enable ATS SystemTap probes (default OFF)")
 option(ENABLE_VERIFY_PLUGINS "Enable plugin verification tests (default ON)" ON)
+option(ENABLE_THREAD_SAFETY_ANALYSIS "Enable Clang -Wthread-safety analysis (Clang only, default ON)" ON)
+option(THREAD_SAFETY_ANALYSIS_AS_ERROR "Treat thread-safety findings as errors; for CI gating (default OFF)")
 
 # Setup user
 # NOTE: this is the user trafficserver runs as
@@ -358,6 +361,35 @@ elseif(ENABLE_TSAN)
   add_link_options(-g -fsanitize=thread)
 endif()
 
+# Clang Thread Safety Analysis. The TS_* annotations (tsutil/ts_thread_safety.h)
+# compile to nothing on GCC, and the flag is Clang-only on purpose (GCC does not
+# know -Wthread-safety and would itself error if passed it), so this whole block
+# is a no-op for GCC builds.
+#
+# On Clang it is on by default but only a WARNING: -Wno-error=thread-safety keeps
+# it a warning even in builds that otherwise use -Werror, so an in-progress
+# annotation never blocks a developer's build. CI sets
+# THREAD_SAFETY_ANALYSIS_AS_ERROR=ON to promote findings to errors and gate
+# merges.
+#
+# Skip FreeBSD: its libc annotates the pthread primitives themselves, so
+# -Wthread-safety there flags ATS's existing hand-rolled mutex wrappers
+# (tscore/ink_mutex.h, ink_rwlock, ...) tree-wide, not just newly-annotated code.
+# Enabling it on FreeBSD needs those legacy wrappers made analysis-clean first.
+# Elsewhere the platform leaves the pthread primitives un-annotated, so only
+# annotated code is analyzed and this stays quiet until a real violation.
+if(ENABLE_THREAD_SAFETY_ANALYSIS
+   AND CMAKE_CXX_COMPILER_ID MATCHES "Clang"
+   AND NOT CMAKE_SYSTEM_NAME STREQUAL "FreeBSD"
+)
+  add_compile_options(-Wthread-safety)
+  if(THREAD_SAFETY_ANALYSIS_AS_ERROR)
+    add_compile_options(-Werror=thread-safety)
+  else()
+    add_compile_options(-Wno-error=thread-safety)
+  endif()
+endif()
+
 if(ENABLE_PROBES)
   add_compile_options("-DENABLE_SYSTEMTAP_PROBES")
 endif()
@@ -415,6 +447,11 @@ if(EXTERNAL_LIBSWOC)
   find_package(libswoc REQUIRED)
 endif()
 
+if(EXTERNAL_HWY)
+  message(STATUS "Looking for external highway")
+  find_package(HWY "1.4.0" CONFIG REQUIRED)
+endif()
+
 include(Check128BitCas)
 include(ConfigureTransparentProxy)
 
@@ -541,6 +578,8 @@ check_symbol_exists(SSL_error_description "openssl/ssl.h" HAVE_SSL_ERROR_DESCRIP
 check_symbol_exists(SSL_CTX_set_ciphersuites "openssl/ssl.h" TS_USE_TLS_SET_CIPHERSUITES)
 check_symbol_exists(SSL_CTX_set_keylog_callback "openssl/ssl.h" TS_HAS_TLS_KEYLOGGING)
 check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_cb "openssl/ssl.h" HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_CB)
+check_symbol_exists(SSL_CTX_add_cert_compression_alg "openssl/ssl.h" HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG)
+check_symbol_exists(SSL_CTX_set1_cert_comp_preference "openssl/ssl.h" HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE)
 check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h TS_USE_TLS_ASYNC)
 check_symbol_exists(OSSL_PARAM_construct_end "openssl/params.h" HAVE_OSSL_PARAM_CONSTRUCT_END)
 check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13)
@@ -674,8 +713,11 @@ if(ENABLE_AUTEST)
   # the autest command. The original AUTEST_OPTIONS string is used in the
   # autest.sh script.
   separate_arguments(AUTEST_OPTIONS_LIST UNIX_COMMAND "${AUTEST_OPTIONS}")
-  set(PROXY_VERIFIER_VERSION "v3.1.2")
-  set(PROXY_VERIFIER_HASH "SHA1=0a60c646cbc9326abb2fbc397cb9efa8c08a807a")
+  file(READ "${CMAKE_SOURCE_DIR}/tests/proxy-verifier-version.txt" PROXY_VERIFIER_VERSION)
+  string(STRIP "${PROXY_VERIFIER_VERSION}" PROXY_VERIFIER_VERSION)
+  file(READ "${CMAKE_SOURCE_DIR}/tests/proxy-verifier-checksum.txt" PROXY_VERIFIER_SHA1)
+  string(STRIP "${PROXY_VERIFIER_SHA1}" PROXY_VERIFIER_SHA1)
+  set(PROXY_VERIFIER_HASH "SHA1=${PROXY_VERIFIER_SHA1}")
   include(proxy-verifier)
 endif()
 

CMakePresets.json

@@ -125,6 +125,8 @@
       "cacheVariables": {
         "CMAKE_BUILD_TYPE": "Debug",
         "CMAKE_COMPILE_WARNING_AS_ERROR": "ON",
+        "ENABLE_THREAD_SAFETY_ANALYSIS": "ON",
+        "THREAD_SAFETY_ANALYSIS_AS_ERROR": "ON",
         "ENABLE_CCACHE": "ON",
         "BUILD_EXPERIMENTAL_PLUGINS": "ON",
         "ENABLE_WASM_WAMR": "OFF",
@@ -194,13 +196,9 @@
       "name": "ci-fedora-cxx20",
       "displayName": "CI Fedora c++20",
       "description": "CI Pipeline config for Fedora Linux compiled with c++20",
-      "inherits": ["ci"],
+      "inherits": ["ci-fedora"],
       "cacheVariables": {
-        "opentelemetry_ROOT": "/opt",
-        "CURL_ROOT": "/opt",
-        "wamr_ROOT": "/opt",
-        "CMAKE_CXX_STANDARD": "20",
-        "ENABLE_CRIPTS": "ON"
+        "CMAKE_CXX_STANDARD": "20"
       }
     },
     {
@@ -450,4 +448,3 @@
     }
   ]
 }
-

NOTICE

@@ -95,6 +95,7 @@ https://github.com/jbeder/yaml-cpp
 ~~
 
 fastlz: an ANSI C/C90 implementation of Lempel-Ziv 77 algorithm (LZ77) of lossless data compression.
+Copyright (C) 2005-2020 Ariya Hidayat (MIT License)
 https://github.com/ariya/FastLZ
 
 ~~
@@ -118,3 +119,17 @@ LS-HPACK provides functionality to encode and decode HTTP headers using
 HPACK compression mechanism specified in RFC 7541.
 Copyright (c) 2018 - 2023 LiteSpeed Technologies Inc, (MIT License)
 https://github.com/litespeedtech/ls-hpack.git
+
+~~
+
+S3-FIFO: A simple, scalable FIFO-based algorithm with three static queues
+Copyright 2023, Carnegie Mellon University (Apache-2.0)
+
+Website: https://s3fifo.com/
+Paper: http://dx.doi.org/10.1145/3600006.3613147
+Reference implementation: https://github.com/Thesys-lab/sosp23-s3fifo
+
+~~
+
+Highway is a C++ library that provides portable SIMD/vector intrinsics.
+https://github.com/google/highway

README.md

@@ -143,6 +143,7 @@ trafficserver ............. Top src dir
 ├── lib ................... Third-party libraries
 │   ├── Catch2 ............ Unit testing framework
 │   ├── fastlz ............ Fast compression library
+│   ├── highway ........... Portable SIMD/vector intrinsics
 │   ├── ls-hpack .......... HPACK compression for HTTP/2
 │   ├── swoc .............. Solid Wall of Code utility library
 │   ├── systemtap ......... SystemTap integration

SECURITY.md

@@ -16,7 +16,11 @@ Administrative users are always considered to be trusted. Reports for vulnerabil
 
 Security-sensitive information may be logged with modified logging configurations, particularly if debug logging is enabled.
 
-Experimental features and plugins are known unstable and not supposed to be used on production. We do not consider
-vulnerabilities in those as security issues. You may report vulnerabilities in those publicly on our public lists or GitHub. However, please
+Experimental features are known unstable and not supposed to be used on production. We do not consider
+vulnerabilities in those as security issues. This explicitly includes HTTP/3 and QUIC support, which remain
+experimental. You may report vulnerabilities in those publicly on our public lists or GitHub. However, please
 contact us privately, if you believe the vulnerabilities you find are serious, or if you are not sure whether you should report the
 vulnerabilities publicly.
+
+Plugins shipped with Traffic Server, including those under `plugins/experimental/`, are in scope for security
+reporting. Please report vulnerabilities in those through the private security mailing list following the process above.