Migrating from ubuntu to debian:bookworm

.github/workflows/chrony.yml

@@ -22,6 +22,8 @@ jobs:
         chrony_ref: [ 'master', '4.3', '4.6.1' ]
       fail-fast: false
     runs-on: ${{ matrix.os }}
+    container:
+      image: debian:bookworm
 
     steps:
       - name: Checkout gnutls-wolfssl repository
@@ -30,13 +32,13 @@ jobs:
       - name: Ensure make available (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
+          apt-get update
+          apt-get install -y build-essential
 
       - name: Install GnuTLS dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev
+          apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev sudo wget git
 
       - name: Install chrony dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'

.github/workflows/clang-tidy.yml

@@ -16,6 +16,8 @@ jobs:
         os: [ ubuntu-latest ]
       fail-fast: false
     runs-on: ${{ matrix.os }}
+    container:
+      image: debian:bookworm
 
     steps:
       - name: Checkout repository
@@ -24,15 +26,15 @@ jobs:
       - name: Install clang + bear (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y clang bear
+          apt-get update
+          apt-get install -y clang bear sudo wget git
 
       - name: Install dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
           sudo apt-get update
           sudo apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang \
-            libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev
+            libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev clang-tidy
 
       # ─────────────── cache the wolfssl/gnutls tool-chain ────────────────
       - name: Restore cached gnutls-wolfssl
@@ -61,6 +63,6 @@ jobs:
 
       - name: Run clang-tidy
         run: |
-          FILES=$(git -C wolfssl-gnutls-wrapper ls-files src/*.c tests/*.c | sed 's|^|wolfssl-gnutls-wrapper/|')
+          FILES=$(find wolfssl-gnutls-wrapper/src wolfssl-gnutls-wrapper/tests -name "*.c" -type f)
           clang-tidy -p wolfssl-gnutls-wrapper $FILES
 

.github/workflows/curl.yml

@@ -22,6 +22,8 @@ jobs:
         curl_ref: [ 'master', 'curl-7_88_1', 'curl-8_4_0' ]
       fail-fast: false
     runs-on: ${{ matrix.os }}
+    container:
+      image: debian:bookworm
 
     steps:
       - name: Checkout repository
@@ -30,19 +32,19 @@ jobs:
       - name: Ensure make available (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
+          apt-get update
+          apt-get install -y build-essential
 
       - name: Install GnuTLS dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev
+          apt-get update
+          apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev sudo wget git
 
       - name: Install curl test dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install nghttp2 libpsl5 libpsl-dev python3-impacket
+          sudo apt-get install -y nghttp2 libpsl5 libpsl-dev python3-impacket
 
       - name: Restore cached gnutls-wolfssl
         id: cache-gnutls
@@ -96,4 +98,6 @@ jobs:
 
       - name: Test curl
         working-directory: curl
-        run: WGW_LOGGING=0 make -j $(nproc) test-ci
+        run: |
+          export USER=root
+          WGW_LOGGING=0 make -j $(nproc) test-ci

.github/workflows/deb.yml

@@ -11,6 +11,8 @@ concurrency:
 jobs:
   deb-testing:
     runs-on: ubuntu-latest
+    container:
+      image: debian:bookworm
     env:
       DEBIAN_FRONTEND: noninteractive
     steps:
@@ -19,12 +21,13 @@ jobs:
 
       - name: Install build tooling
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
+          apt-get update
+          apt-get install -y --no-install-recommends \
             build-essential devscripts debhelper-compat fakeroot clang \
             autoconf automake libtool pkg-config gettext bison flex gperf \
             libgmp-dev libunistring-dev nettle-dev libtasn1-dev libp11-kit-dev \
-            libev-dev gtk-doc-tools lintian libtasn1-bin git texinfo
+            libev-dev gtk-doc-tools lintian libtasn1-bin git texinfo sudo git \
+            wget
 
       - name: Build & install wolfSSL (non-FIPS)
         run: |

.github/workflows/dirmngr.yml

@@ -14,6 +14,8 @@ jobs:
   build_and_test:
     name: Build wolfSSL + GnuTLS, then GnuPG ${{ matrix.gnupg_ref }}
     runs-on: ubuntu-latest
+    container:
+      image: debian:bookworm
     timeout-minutes: 40
     strategy:
       matrix:
@@ -26,12 +28,12 @@ jobs:
 
       - name: Install build prerequisites
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential autoconf automake libtool \
+          apt-get update
+          apt-get install -y build-essential autoconf automake libtool \
                                   gettext texinfo pkg-config wget gnulib \
                                   autopoint gperf gtk-doc-tools nettle-dev \
                                   clang libtasn1-bin libtasn1-6-dev \
-                                  libunistring-dev libp11-kit-dev libunbound-dev
+                                  libunistring-dev libp11-kit-dev libunbound-dev sudo wget git
 
       - name: Restore cached wolfSSL/GnuTLS
         id: cache-gnutls

.github/workflows/fwupd.yml

@@ -22,6 +22,8 @@ jobs:
         fwupd_ref: [ 'main', '1.9.26', '2.0.12' ]
       fail-fast: false
     runs-on: ${{ matrix.os }}
+    container:
+      image: debian:bookworm
 
     steps:
       - name: Checkout gnutls-wolfssl repository
@@ -30,8 +32,8 @@ jobs:
       - name: Ensure make available (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
+          apt-get update
+          apt-get install -y build-essential sudo wget git
 
       - name: Install GnuTLS dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
@@ -45,11 +47,16 @@ jobs:
           sudo apt install -y \
             meson ninja-build git libgusb-dev libglib2.0-dev libxmlb-dev \
             libsoup2.4-dev libarchive-dev libjson-glib-dev libpolkit-gobject-1-dev \
-            libsystemd-dev valgrind gobject-introspection gtk-doc-tools python3-pip \
+            libsystemd-dev valgrind gobject-introspection libgirepository1.0-dev gtk-doc-tools python3-pip \
             libgpgme-dev valac libcurl4-gnutls-dev libpango-1.0-0 libpangocairo-1.0-0 \
             libpango1.0-dev libcairo2 libcairo2-dev libcairo-gobject2 python3-cairo \
             python3-gi-cairo python3-gi gir1.2-pango-1.0 gir1.2-cairo-1.0 gir1.2-gtk-3.0 \
             gnu-efi flashrom libflashrom-dev mingw-w64-tools libumockdev-dev
+          sudo apt-get install -y python3-pip
+          sudo apt-get install -y policykit-1 libpolkit-agent-1-dev gettext itstool
+          sudo apt-get install -y libzstd-dev zstd
+          pip3 install --break-system-packages jinja2 packaging typogrify
+          pip3 install --break-system-packages --upgrade meson
 
       - name: Install build and test dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
@@ -90,6 +97,18 @@ jobs:
           cd fwupd
           git checkout ${{ matrix.fwupd_ref }}
 
+      - name: Patch fwupd tests for Debian Bookworm compatibility
+        if: matrix.fwupd_ref != '1.9.26'
+        working-directory: fwupd
+        run: |
+          # GLib in Debian Bookworm emits WARNING for invalid properties while
+          # Ubuntu's GLib emits CRITICAL. Same behavior, different log level.
+          # Adjust test expectations to match Debian's GLib.
+          # This gets applied only for the latest version and the latest main branch,
+          # target version remains untouched since it's using the correct older version
+          # of glib that matches the one on debian:bookworm.
+          sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-self-test.c
+
       - name: Configure fwupd
         working-directory: fwupd
         run: |

.github/workflows/glib-networking.yml

@@ -22,6 +22,8 @@ jobs:
         glib-networking_ref: [ 'master', '2.74.0', '2.80.1' ]
       fail-fast: false
     runs-on: ${{ matrix.os }}
+    container:
+      image: debian:bookworm
 
     steps:
       - name: Checkout gnutls-wolfssl repository
@@ -30,13 +32,13 @@ jobs:
       - name: Ensure make available (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
+          apt-get update
+          apt-get install -y build-essential
 
       - name: Install GnuTLS dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'
         run: |
-          sudo apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev
+          apt-get install -y gnulib autopoint gperf gtk-doc-tools nettle-dev clang libtasn1-bin libtasn1-6-dev libunistring-dev libp11-kit-dev libunbound-dev sudo wget git
 
       - name: Install glib-networking dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'