sdk%feat(lint): add clang-{format,tidy} 20, instrument with lint_clang.py, validate against cert-{c,cpp}-coding-standards and cpp-security-and-quality suites, fetch per-platform CodeQL

.github/workflows/build_stable.yml

@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 100
+          submodules: true
 
       - name: Check cache write access
         id: cache_write
@@ -50,6 +51,10 @@ jobs:
         with:
           large-packages: false
 
+      - name: Allow unprivileged user namespaces
+        shell: bash
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@v23
 

AGENTS.md

@@ -26,6 +26,8 @@ The full guide is at [`docs/dev/guide_rust.md`](./docs/dev/guide_rust.md). Key p
     fragmentation.
   - No vague references (`the other`, `that thing`); name the item.
   - No exposition, history, or conversational tone.
+  - C/C++ doc comments are Javadoc-style `/** */` blocks with `@` commands (`@param[in]`, `@return`). `//!` (and
+    `//!<`) suits variables and members, `/*!` suits copyright headers. Never `///`.
 - **Code segmentation**: organise code through modules (in-file or separate files) and naming prefixes. Never use
   decorative separator comments (`// ----`, `// ====`, `// -- Section --`). Latin-1/ISO 8859-1 characters in source
   files only; no Unicode dashes, arrows, box drawing, or other decoration in comments or identifiers.

Justfile

@@ -40,6 +40,8 @@ lint:
     {{ python }} maint/lint/lint_bazel.py graph
     {{ python }} maint/lint/lint_codeql.py check
     {{ python }} maint/lint/lint_codeql.py run --lang=rust --with-suite=rust-security-and-quality
+    {{ python }} maint/lint/lint_codeql.py run --lang=c --with-suite=cpp-security-and-quality
+    {{ python }} maint/lint/lint_codeql.py run --lang=cpp --with-suite=cpp-security-and-quality
 
 [positional-arguments]
 [unix]

contrib/nix/flake.nix

@@ -6,8 +6,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-
     nixpkgs-llvm.url = "github:NixOS/nixpkgs/3e2cf88148e732abc1d259286123e06a9d8c964a";
 
     pyproject-build-systems = {
@@ -38,7 +36,6 @@
     {
       nixpkgs,
       nixpkgs-llvm,
-      nixpkgs-unstable,
       rust-overlay,
       ...
     }@inputs:
@@ -62,10 +59,6 @@
               config.allowUnfree = true;
               overlays = [ rust-overlay.overlays.default ];
             };
-            unstable = import nixpkgs-unstable {
-              inherit system;
-              config.allowUnfree = true;
-            };
             llvm = (import nixpkgs-llvm { inherit system; }).llvmPackages_20;
           }
         );
@@ -74,7 +67,6 @@
       devShells = eachSystem (
         {
           pkgs,
-          unstable,
           llvm,
         }:
         let
@@ -84,7 +76,6 @@
               lib
               inputs
               llvm
-              unstable
               ;
             root = ../..;
           };

contrib/nix/mods/codeql.nix

@@ -1,25 +1,80 @@
 # CodeQL CLI
 
-{ pkgs, unstable }:
+{ pkgs, fhs }:
 
 let
-  version = "2.27.0";
+  inherit (pkgs) lib stdenv;
 
-  # Fetching more recent CodeQL releases requires `unstable` and `x86_64-darwin`
-  # as a target is no longer supported since 26.11 (see nixos/nixpkgs#535508),
-  # though GitHub themselves still provide binaries that support Intel Macs so
-  # we rely on a pin for `x86_64-darwin` and consume from `unstable` otherwise.
-  pinned = pkgs.codeql.overrideAttrs (_: {
-    inherit version;
+  version = "2.27.0";
 
-    src = pkgs.fetchzip {
-      url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-      hash = "sha256-8WhsburnhVWvVLTNOmAwmkjwN45exmKmw7Q5elTjYiI=";
+  # GitHub's archive for each host, named by the directory under `tools/` that
+  # holds its native binaries. The universal `codeql.zip` lacks `linux-arm64`.
+  osx64 = {
+    name = "osx64";
+    hash = "sha256-47H7FQy/67sZvgSTAAgXfoGKxChL1khLaLqxanHFd7c=";
+  };
+  archives = {
+    "aarch64-darwin" = osx64;
+    "x86_64-darwin" = osx64;
+    "aarch64-linux" = {
+      name = "linux-arm64";
+      hash = "sha256-PdJozYk3zs+vRH0OwIJawGrCuatVd7huzACGIViVN/0=";
     };
-  });
+    "x86_64-linux" = {
+      name = "linux64";
+      hash = "sha256-L87sPrfRSYfCjjZqv1V7L7diZoL+LG5HbWSMqIeZCEE=";
+    };
+  };
 
-  codeql = if pkgs.stdenv.hostPlatform.system == "x86_64-darwin" then pinned else unstable.codeql;
+  archive =
+    archives.${stdenv.hostPlatform.system}
+      or (throw "codeql: no archive for ${stdenv.hostPlatform.system}");
 in
 {
-  packages = [ codeql ];
+  packages = [
+    (stdenv.mkDerivation {
+      pname = "codeql";
+      inherit version;
+
+      src = pkgs.fetchzip {
+        url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql-${archive.name}.zip";
+        inherit (archive) hash;
+      };
+
+      dontConfigure = true;
+      dontBuild = true;
+      dontStrip = true;
+
+      # CodeQL searches the parent of its distribution for packs, so the tree
+      # sits in `$out/codeql` to keep that parent from being the whole store.
+      installPhase = ''
+        mkdir -p $out/{codeql,bin}
+        cp -R * $out/codeql/
+        ${lib.optionalString stdenv.hostPlatform.isLinux ''
+          tools=$out/codeql/tools/${archive.name}
+          # The tracer preloads `libtrace.so`; `linux-arm64` names it otherwise.
+          [ -e $tools/libtrace.so ] || ln -s $tools/lib64trace.so $tools/libtrace.so
+          # The extractors find Java through the tools directory, and the
+          # bundled one expects an FHS loader, so nixpkgs' Java stands in.
+          rm -rf $tools/java
+          ln -s ${pkgs.jdk21} $tools/java
+          # The native extractors expect an FHS loader and glibc, so the CLI
+          # and every tool it spawns run inside `fhs-run`.
+          printf '#!%s\nexec %s %s "$@"\n' ${stdenv.shell} \
+            ${fhs.run}/bin/fhs-run $out/codeql/codeql > $out/bin/codeql
+          chmod +x $out/bin/codeql
+        ''}
+        ${lib.optionalString (!stdenv.hostPlatform.isLinux) ''
+          ln -s $out/codeql/codeql $out/bin/
+        ''}
+      '';
+
+      meta = {
+        description = "Semantic code analysis engine";
+        homepage = "https://codeql.github.com";
+        license = lib.licenses.unfree;
+        platforms = lib.attrNames archives;
+      };
+    })
+  ];
 }

contrib/nix/mods/fhs.nix

@@ -41,5 +41,6 @@ let
   };
 in
 {
+  inherit run;
   packages = lib.optional pkgs.stdenv.hostPlatform.isLinux run;
 }

contrib/nix/mods/nixpkgs.nix

@@ -1,6 +1,6 @@
 # Native packages sourced from the Nix Packages collection (nixpkgs)
 
-{ pkgs }:
+{ pkgs, llvm }:
 
 let
   # nixpkgs builds `zensical` against its own interpreter, which lacks
@@ -37,6 +37,7 @@ in
     pkgs.wasm-pack
 
     # Packages synced with '.tools' from 'pyproject.toml'.
+    llvm.clang-tools
     pkgs.ruff
     pkgs.semgrep
     pkgs.taplo

contrib/nix/shell/common.nix

@@ -6,7 +6,6 @@
   inputs,
   llvm,
   root,
-  unstable,
 }:
 
 let
@@ -18,6 +17,8 @@ let
     xcodeSdk = import ../mods/xcode_sdk.nix { inherit pkgs; };
   };
 
+  fhs = import ../mods/fhs.nix { inherit pkgs lib; };
+
   rsComponents = (lib.importTOML (root + "/rust-toolchain.toml")).toolchain.components;
 
   hostTriple = pkgs.stdenv.hostPlatform.rust.rustcTarget;
@@ -90,10 +91,10 @@ in
 
   mods = lib.mapAttrs (name: m: m // { _name = name; }) {
     bazel = import ../mods/bazel.nix { inherit pkgs; };
-    codeql = import ../mods/codeql.nix { inherit pkgs unstable; };
+    codeql = import ../mods/codeql.nix { inherit pkgs fhs; };
     cxx = cxx.compiler;
-    fhs = import ../mods/fhs.nix { inherit pkgs lib; };
-    nixpkgs = import ../mods/nixpkgs.nix { inherit pkgs; };
+    inherit fhs;
+    nixpkgs = import ../mods/nixpkgs.nix { inherit pkgs llvm; };
     python = import ../mods/python.nix {
       inherit pkgs lib;
       inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;

contrib/probes/free.c

@@ -2,5 +2,6 @@
 
 int add(int a, int b)
 {
-  return a + b;
+  int sum = 0;
+  return __builtin_add_overflow(a, b, &sum) ? 0 : sum;
 }

contrib/probes/hello.c

@@ -21,7 +21,8 @@ static int say(const char* text, DWORD length)
 {
   HANDLE out = GetStdHandle(STD_OUTPUT_HANDLE);
   DWORD written = 0;
-  return out != INVALID_HANDLE_VALUE && WriteFile(out, text, length, &written, NULL) && written == length;
+  return out != INVALID_HANDLE_VALUE && WriteFile(out, text, length, &written, NULL) &&
+    written == length;
 }
 #elif defined(__APPLE__)
 static int say(const char* text, size_t length)
@@ -38,7 +39,8 @@ static int say(const char* text, size_t length)
   }
   dispatch_queue_t queue = dispatch_get_global_queue(qos, 0);
   dispatch_semaphore_t done = dispatch_semaphore_create(0);
-  dispatch_data_t data = dispatch_data_create(text, length, queue, DISPATCH_DATA_DESTRUCTOR_DEFAULT);
+  dispatch_data_t data =
+    dispatch_data_create(text, length, queue, DISPATCH_DATA_DESTRUCTOR_DEFAULT);
   __block int failed = 1;
   dispatch_write(STDOUT_FILENO, data, queue, ^(dispatch_data_t rest, int error) {
     failed = rest != NULL || error != 0;
@@ -48,7 +50,9 @@ static int say(const char* text, size_t length)
   return !failed;
 }
 #elif defined(__linux__)
-_Static_assert(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0), "the UAPI headers predate Linux 5.10");
+_Static_assert(
+  LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0), "the UAPI headers predate Linux 5.10"
+);
 
 static int say(const char* text, size_t length)
 {

contrib/probes/hello.cpp

@@ -24,7 +24,8 @@ bool say(const std::string& text)
   HANDLE out = GetStdHandle(STD_OUTPUT_HANDLE);
   DWORD written = 0;
   const auto length = static_cast<DWORD>(text.size());
-  return out != INVALID_HANDLE_VALUE && WriteFile(out, text.data(), length, &written, nullptr) && written == length;
+  return out != INVALID_HANDLE_VALUE && WriteFile(out, text.data(), length, &written, nullptr) &&
+    written == length;
 }
 #elif defined(__APPLE__)
 bool say(const std::string& text)
@@ -41,7 +42,8 @@ bool say(const std::string& text)
   }
   dispatch_queue_t queue = dispatch_get_global_queue(qos, 0);
   dispatch_semaphore_t done = dispatch_semaphore_create(0);
-  dispatch_data_t data = dispatch_data_create(text.data(), text.size(), queue, DISPATCH_DATA_DESTRUCTOR_DEFAULT);
+  dispatch_data_t data =
+    dispatch_data_create(text.data(), text.size(), queue, DISPATCH_DATA_DESTRUCTOR_DEFAULT);
   __block bool failed = true;
   dispatch_write(STDOUT_FILENO, data, queue, ^(dispatch_data_t rest, int error) {
     failed = rest != nullptr || error != 0;
@@ -51,18 +53,25 @@ bool say(const std::string& text)
   return !failed;
 }
 #elif defined(__linux__)
-static_assert(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0), "the UAPI headers predate Linux 5.10");
+static_assert(
+  LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0), "the UAPI headers predate Linux 5.10"
+);
 
 bool say(const std::string& text)
 {
-  return syscall(SYS_write, STDOUT_FILENO, text.data(), text.size()) == static_cast<long>(text.size());
+  return syscall(SYS_write, STDOUT_FILENO, text.data(), text.size()) ==
+    static_cast<long>(text.size());
 }
 #endif
 
 } // namespace
 
 int main()
 {
-  const std::string greeting = std::string("Hello") + ", world!\n";
-  return say(greeting) ? 0 : 1;
+  try {
+    const std::string greeting = std::string("Hello") + ", world!\n";
+    return say(greeting) ? 0 : 1;
+  } catch (...) {
+    return 1;
+  }
 }

fuzz/pow/src/shim.c

@@ -20,12 +20,13 @@
 #include "sph_simd.h"
 #include "sph_skein.h"
 
-#define DASH_SPH(name)                                                       \
-  void dash_sph_##name(const void *data, size_t len, unsigned char *out) { \
-    sph_##name##512_context cc;                                            \
-    sph_##name##512_init(&cc);                                             \
-    sph_##name##512(&cc, data, len);                                       \
-    sph_##name##512_close(&cc, out);                                       \
+#define DASH_SPH(name)                                                   \
+  void dash_sph_##name(const void* data, size_t len, unsigned char* out) \
+  {                                                                      \
+    sph_##name##512_context cc;                                          \
+    sph_##name##512_init(&cc);                                           \
+    sph_##name##512(&cc, data, len);                                     \
+    sph_##name##512_close(&cc, out);                                     \
   }
 
 DASH_SPH(blake)