Next Version

.claude/settings.json

@@ -0,0 +1,72 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(rg:--max-depth:*)",
+      "Bash(grep:*)",
+      "Bash(find:. -type f:*)",
+      "Bash(ls:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(wc:*)",
+      "Bash(file:*)",
+      "Bash(stat:*)",
+      "Bash(readlink:*)",
+      "Bash(tree:-L 2:*)",
+      "Bash(diff:*)",
+      "Bash(which:*)",
+      "Bash(du:*)",
+      "Bash(df:*)",
+      "Bash(env)",
+      "Bash(pwd)",
+      "Bash(git status:*)",
+      "Bash(git log:*)",
+      "Bash(git diff:*)",
+      "Bash(git show:*)",
+      "Bash(git branch --list:*)",
+      "Bash(git ls-files:*)",
+      "Bash(git remote -v)",
+      "Bash(git submodule status:*)",
+      "Bash(git merge-base:*)",
+      "Bash(git fetch:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr diff:*)",
+      "Bash(gh issue view:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh repo view:*)",
+      "Bash(gh auth status:*)",
+      "Bash(make)",
+      "Bash(make build:*)",
+      "Bash(make test:*)",
+      "Bash(make test_c:*)",
+      "Bash(make test_py:*)",
+      "Bash(make check_dependencies:*)",
+      "Bash(make submodules:*)",
+      "Bash(make cppcheck:*)",
+      "Bash(npm ls:*)",
+      "Bash(npm view:*)",
+      "Bash(node --version)",
+      "Bash(curl -s http://127.0.0.1:80*)",
+      "Bash(curl -s -i http://127.0.0.1:80*)",
+      "Bash(curl -s http://127.0.0.1:8443*)",
+      "Bash(curl -s http://127.0.0.1:18080*)",
+      "Bash(curl -s -i http://127.0.0.1:18080*)",
+      "Bash(docker ps:*)",
+      "Bash(docker logs:*)"
+    ],
+    "deny": [
+      "Bash(git push:*)",
+      "Bash(rm:*)",
+      "Bash(ssh:*)",
+      "Bash(scp:*)",
+      "Bash(sftp:*)",
+      "Bash(ssh-keygen:*)",
+      "Bash(ssh-copy-id:*)",
+      "Bash(rsync:*-e ssh*)",
+      "Bash(rsync:*--rsh=ssh*)",
+      "Bash(gh pr comment:*)",
+      "Bash(gh issue comment:*)",
+      "Bash(gh pr review:*)"
+    ]
+  }
+}

.github/workflows/build_commit_web.yml

@@ -91,12 +91,12 @@ jobs:
       - name: Commit and push if changed
         run: |
           if [[ -n $(git status --porcelain) ]]; then
-          git add .
-          git commit -m "Update frontend (make web)"
-          git pull --rebase
-          git push
+            git add .
+            git commit -m "Update frontend (make web)"
+            git pull --no-recurse-submodules --no-tags --rebase
+            git push --no-recurse-submodules
           else
-          echo "No changes to commit and push."
+            echo "No changes to commit and push."
           fi
 
       - name: Get Last Commit Hash

.github/workflows/build_release.yml

@@ -9,7 +9,49 @@ on:
   pull_request:
     branches: [ "master", "develop" ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_type == 'branch' || github.event_name == 'pull_request' }}
+
 jobs:
+  # runs next to the builds; if a test fails, the whole run is cancelled
+  tests:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write # only for cancelling this run
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        submodules: recursive
+
+    - name: Install dependencies
+      run: sudo apt-get update && sudo apt-get install -y --no-install-recommends gcc protobuf-c-compiler build-essential openssl faketime python3 python3-pytest curl ffmpeg
+
+    # the tests start a server and check the web UI it serves
+    - name: Build web UI
+      run: |
+        make web
+        mkdir -p data/www/web
+        cp -r contrib/data/www/web/. data/www/web/
+
+    # generating the test certificates takes minutes, see tests/py/with_server.sh
+    - name: Cache test template
+      uses: actions/cache@v6
+      with:
+        path: bin/test-template
+        key: test-template-${{ hashFiles('src/cert.c', 'include/cert.h') }}
+
+    - name: Run all tests
+      run: make test
+
+    - name: Cancel the run on failed tests
+      if: failure()
+      continue-on-error: true # PRs from forks only get a read-only token
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: gh run cancel ${{ github.run_id }} --repo "$GITHUB_REPOSITORY"
+
   build-windows-amd64:
     runs-on: windows-latest
     outputs:
@@ -49,7 +91,7 @@ jobs:
       appendix: ${{ steps.set_data2.outputs.appendix }}
     steps:
     - name: Install build dependencies
-      run: sudo apt-get install -y --no-install-recommends gcc protobuf-c-compiler build-essential
+      run: sudo apt-get update && sudo apt-get install -y --no-install-recommends gcc protobuf-c-compiler build-essential
     - name: Get current datetime
       id: get-datetime
       run: echo "CURRENT_DATE=$(date +'%Y-%m-%d')" >> $GITHUB_ENV

.github/workflows/publish_docker_matrix_all.yml

@@ -14,11 +14,18 @@ on:
     tags:
       - tc_nightly*
       - tc_v*.*.*
+      # release candidates: images only (rc, rc0.7.1, ...), no release, never latest; cut from develop
+      - rc_v*.*.*
   pull_request:
     branches:
       - master
       - develop
 
+concurrency:
+  # release candidates share one group: rc / rc0.x.y are moving tags, runs must not overlap
+  group: ${{ github.workflow }}-${{ startsWith(github.ref_name, 'rc_v') && 'release-candidates' || github.ref }}
+  cancel-in-progress: ${{ github.ref_type == 'branch' || github.event_name == 'pull_request' }}
+
 jobs:
   test_commit_hash:
     runs-on: ubuntu-latest
@@ -28,6 +35,17 @@ jobs:
           submodules: recursive
           ref: ${{ inputs.tcw_commit_hash }}
 
+      # a release candidate is cut from develop: refuse an rc_ tag whose commit is not reachable from it
+      - name: Check that the release candidate tag is on develop
+        if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'rc_v') }}
+        run: |
+          git fetch --no-tags --unshallow origin develop || git fetch --no-tags origin develop
+          commit="$(git rev-parse HEAD)"
+          if ! git merge-base --is-ancestor "$commit" FETCH_HEAD; then
+            echo "::error::$GITHUB_REF_NAME points at $commit, which is not on develop. Release candidates are cut from develop."
+            exit 1
+          fi
+
       - name: Verify commit hash
         if: ${{ inputs.tcw_commit_hash != '' }}
         run: |
@@ -48,7 +66,8 @@ jobs:
       platforms: '["linux/amd64", "linux/arm/v7", "linux/arm64/v8", "linux/ppc64le", "linux/s390x"]'
       primary_image: true
       error_platforms: '["linux/s390x"]'
-      noasan_fallback_platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      # arm64 builds with AddressSanitizer (native runner, see base workflow).
+      noasan_fallback_platforms: '["linux/arm/v7", "linux/ppc64le"]'
       tcw_commit_hash: ${{ inputs.tcw_commit_hash }}
   debian:
     needs: test_commit_hash
@@ -59,7 +78,8 @@ jobs:
       platforms: '["linux/amd64", "linux/arm/v7", "linux/arm64/v8", "linux/i386", "linux/ppc64le", "linux/s390x"]'
       primary_image: false
       error_platforms: '["linux/s390x"]'
-      noasan_fallback_platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      # arm64 builds with AddressSanitizer (native runner, see base workflow).
+      noasan_fallback_platforms: '["linux/arm/v7", "linux/ppc64le"]'
       tcw_commit_hash: ${{ inputs.tcw_commit_hash }}
   alpine:
     needs: test_commit_hash
@@ -79,9 +99,10 @@ jobs:
     with:
       system: "ubuntuAsanTest"
       dockerfile: "DockerfileUbuntu"
-      platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      # arm64 is promoted to the main build; these remain ASAN-broken under QEMU.
+      platforms: '["linux/arm/v7", "linux/ppc64le"]'
       primary_image: false
-      error_platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      error_platforms: '["linux/arm/v7", "linux/ppc64le"]'
       noasan_fallback_platforms: "[]"
       skip_empty_merge: true
       tcw_commit_hash: ${{ inputs.tcw_commit_hash }}
@@ -91,9 +112,10 @@ jobs:
     with:
       system: "debianAsanTest"
       dockerfile: "DockerfileDebian"
-      platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      # arm64 is promoted to the main build; these remain ASAN-broken under QEMU.
+      platforms: '["linux/arm/v7", "linux/ppc64le"]'
       primary_image: false
-      error_platforms: '["linux/arm/v7", "linux/arm64/v8", "linux/ppc64le"]'
+      error_platforms: '["linux/arm/v7", "linux/ppc64le"]'
       noasan_fallback_platforms: "[]"
       skip_empty_merge: true
       tcw_commit_hash: ${{ inputs.tcw_commit_hash }}

.github/workflows/publish_docker_matrix_base.yml

@@ -49,7 +49,10 @@ jobs:
       fail-fast: false
       matrix:
         platform: ${{ fromJson(inputs.platforms) }}
-    runs-on: ubuntu-latest
+    # aarch64 is built/tested natively so AddressSanitizer works (QEMU-user
+    # emulation cannot satisfy libasan's fixed 64-bit allocator mapping).
+    # All other platforms stay on the amd64 runner and cross-build via QEMU.
+    runs-on: ${{ matrix.platform == 'linux/arm64/v8' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -70,6 +73,20 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Release candidate version
+        id: rc_version
+        if: ${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+        run: |
+          # rc_v0.7.1, rc_v0.7.1-1 or rc_v0.7.1-rc0: base = 0.7.1, full = 0.7.1-1 / 0.7.1-rc0 (empty for the base tag)
+          ver="${GITHUB_REF_NAME#rc_v}"
+          if ! [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
+            echo "::error::$GITHUB_REF_NAME is not rc_vX.Y.Z or rc_vX.Y.Z-<suffix>"
+            exit 1
+          fi
+          base="${ver%%-*}"
+          echo "base=$base" >> "$GITHUB_OUTPUT"
+          if [ "$ver" != "$base" ]; then echo "full=$ver" >> "$GITHUB_OUTPUT"; fi
+
       - name: Docker meta matrix
         id: matrix_meta
         uses: docker/metadata-action@v6
@@ -86,15 +103,37 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/tc_v') }}
             type=raw,value=nightly,enable=${{ startsWith(github.ref, 'refs/tags/tc_nightly') }}
             type=raw,value=nightly-develop,enable=${{ github.ref == 'refs/heads/develop' }}
+            type=raw,value=rc,enable=${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+            type=raw,value=rc${{ steps.rc_version.outputs.base }},enable=${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+            type=raw,value=rc${{ steps.rc_version.outputs.full }},enable=${{ startsWith(github.ref, 'refs/tags/rc_v') && steps.rc_version.outputs.full != '' }}
             type=ref,event=tag
             type=match,pattern=tc_v(\d+),group=1
             type=match,pattern=tc_v(\d+.\d+),group=1
             type=match,pattern=tc_v(\d+.\d+.\d+),group=1
             type=match,pattern=tc_v(\d+.\d+.\d+-\S+),group=1
           flavor: |
+            latest=false
             prefix=arch_,onlatest=true
             suffix=_${{ matrix.platform }}_${{ inputs.system }},onlatest=${{ inputs.primary_image }}
 
+      - name: Release candidates must not move latest or the plain version tags
+        if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'rc_v') }}
+        env:
+          TAGS: ${{ steps.matrix_meta.outputs.tags }}
+        run: |
+          # do not rely on metadata-action internals (e.g. automatic latest): look at what it generated
+          echo "$TAGS"
+          bad=0
+          while read -r tag; do
+            [ -n "$tag" ] || continue
+            name="${tag##*:}"; name="${name#arch_}"; name="${name%%_*}"
+            if [ "$name" = latest ] || [[ "$name" =~ ^[0-9]+(\.[0-9]+){0,2}$ ]]; then
+              echo "::error::release candidate $GITHUB_REF_NAME would get the image tag '$tag'"
+              bad=1
+            fi
+          done <<< "$TAGS"
+          exit $bad
+
       - name: Modify tags
         id: modify_tags
         if: ${{ inputs.primary_image }}
@@ -141,10 +180,27 @@ jobs:
           platform=$(echo "${{ matrix.platform }}" | tr '/' '_')
           echo "platform=$platform"
           echo "platform=$platform" >> $GITHUB_OUTPUT
+      - name: Lower ASLR entropy for AddressSanitizer (aarch64)
+        if: ${{ matrix.platform == 'linux/arm64/v8' }}
+        run: |
+          # Native arm64 runners use a recent kernel with vm.mmap_rnd_bits=32, which can
+          # collide with libasan's fixed 64-bit allocator base and abort at startup with
+          # "CHECK failed: sanitizer_allocator_primary64.h". 28 still gives strong ASLR.
+          # Load-bearing when the base image's libasan predates LLVM 17 (GCC <=13); a
+          # no-op for GCC 14+, which moved the allocator base to tolerate 32-bit ASLR.
+          # vm.* sysctls are not namespaced, so this host-level change reaches the
+          # container started below. CI-only; does not touch shipped images. Non-fatal.
+          sudo sysctl -w vm.mmap_rnd_bits=28 || echo "warning: could not set vm.mmap_rnd_bits"
       - name: Run docker image test
         id: docker-test
         run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+          # QEMU binfmt is only needed to run foreign-arch containers on the amd64
+          # runner. The native arm64 runner runs arm64 containers directly, and the
+          # multiarch/qemu-user-static helper is not arm64-compatible there
+          # (it fails with "Exec format error"), so skip it for arm64.
+          if [ "${{ matrix.platform }}" != "linux/arm64/v8" ]; then
+            docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+          fi
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             docker run -e DOCKER_TEST=1 --platform ${{ matrix.platform }} --name teddyCloud-test teddycloud-test:local
           else
@@ -231,6 +287,20 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Release candidate version
+        id: rc_version
+        if: ${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+        run: |
+          # rc_v0.7.1, rc_v0.7.1-1 or rc_v0.7.1-rc0: base = 0.7.1, full = 0.7.1-1 / 0.7.1-rc0 (empty for the base tag)
+          ver="${GITHUB_REF_NAME#rc_v}"
+          if ! [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
+            echo "::error::$GITHUB_REF_NAME is not rc_vX.Y.Z or rc_vX.Y.Z-<suffix>"
+            exit 1
+          fi
+          base="${ver%%-*}"
+          echo "base=$base" >> "$GITHUB_OUTPUT"
+          if [ "$ver" != "$base" ]; then echo "full=$ver" >> "$GITHUB_OUTPUT"; fi
+
       - name: Docker meta
         if: ${{ steps.check_digests.outputs.has_digests == 'true' }}
         id: teddycloud_meta # you'll use this in the next step
@@ -250,14 +320,35 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/tc_v') }}
             type=raw,value=nightly,enable=${{ startsWith(github.ref, 'refs/tags/tc_nightly') }}
             type=raw,value=nightly-develop,enable=${{ github.ref == 'refs/heads/develop' }}
+            type=raw,value=rc,enable=${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+            type=raw,value=rc${{ steps.rc_version.outputs.base }},enable=${{ startsWith(github.ref, 'refs/tags/rc_v') }}
+            type=raw,value=rc${{ steps.rc_version.outputs.full }},enable=${{ startsWith(github.ref, 'refs/tags/rc_v') && steps.rc_version.outputs.full != '' }}
             type=ref,event=tag
             type=match,pattern=tc_v(\d+),group=1
             type=match,pattern=tc_v(\d+.\d+),group=1
             type=match,pattern=tc_v(\d+.\d+.\d+),group=1
             type=match,pattern=tc_v(\d+.\d+.\d+-\S+),group=1
           flavor: |
+            latest=false
             suffix=_${{ inputs.system }},onlatest=${{ !inputs.primary_image }}
 
+      - name: Release candidates must not move latest or the plain version tags
+        if: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'rc_v') }}
+        env:
+          TAGS: ${{ steps.teddycloud_meta.outputs.tags }}
+        run: |
+          # do not rely on metadata-action internals (e.g. automatic latest): look at what it generated
+          echo "$TAGS"
+          bad=0
+          while read -r tag; do
+            [ -n "$tag" ] || continue
+            name="${tag##*:}"; name="${name#arch_}"; name="${name%%_*}"
+            if [ "$name" = latest ] || [[ "$name" =~ ^[0-9]+(\.[0-9]+){0,2}$ ]]; then
+              echo "::error::release candidate $GITHUB_REF_NAME would get the image tag '$tag'"
+              bad=1
+            fi
+          done <<< "$TAGS"
+          exit $bad
       - name: Create manifest list and push (primary)
         if: ${{ inputs.primary_image && steps.check_digests.outputs.has_digests == 'true' }}
         working-directory: /tmp/digests/${{ github.sha }}

.gitignore

@@ -32,3 +32,6 @@ fake-server-tb2/*
 /dev-sandbox/run/
 /dev-sandbox/.teddycloud-native.pid
 *.pcap
+
+# scratch notes, not committed
+tmp/