pkc%test(bls): add the programs that write the BLS corpora

.bazelignore

@@ -1,5 +1,6 @@
 .cache
 .venv
 docs/.site
+pkgs/pkc/contrib/dash
 public
 target

.github/paths.yml

@@ -24,6 +24,22 @@ bazel:
   - MODULE.bazel.lock
   - pkgs/**
 
+corpora:
+  - .github/actions/cache_write/**
+  - .github/actions/gha_cache/**
+  - .github/paths.yml
+  - .github/workflows/build_corpora.yml
+  - .gitmodules
+  - contrib/nix/**
+  - maint/.clang-format
+  - maint/.clang-tidy
+  - maint/codeql/cpp/**
+  - maint/common.py
+  - maint/lint/lint_clang.py
+  - maint/lint/lint_codeql.py
+  - pkgs/pkc/contrib/**
+  - pkgs/pkc/corpus/**
+
 msrv:
   - .github/actions/cache_write/**
   - .github/actions/gha_cache/**

.github/workflows/build_corpora.yml

@@ -0,0 +1,131 @@
+name: Build corpus generators
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [develop]
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      run: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || steps.filter.outputs.corpora == 'true' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          filter: blob:none
+          sparse-checkout: .github/paths.yml
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      - name: Filter paths
+        id: filter
+        if: github.event_name == 'pull_request' || github.event_name == 'push'
+        uses: dorny/paths-filter@v4
+        env:
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: fetch.recurseSubmodules
+          GIT_CONFIG_VALUE_0: "false"
+        with:
+          filters: .github/paths.yml
+
+  build:
+    name: Build and check the corpora
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+
+    defaults:
+      run:
+        shell: nix develop ./contrib/nix#ci --command bash -eo pipefail {0}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Check cache write access
+        id: cache_write
+        uses: $/.github/actions/cache_write
+
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@v2
+        with:
+          large-packages: false
+
+      - name: Allow unprivileged user namespaces
+        shell: bash
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v23
+
+      - name: Cache Nix
+        uses: Mic92/niks3-action@v1
+        if: vars.CACHE_NIX_URL != ''
+        with:
+          server-url: ${{ vars.CACHE_NIX_URL }}
+          skip-push: ${{ steps.cache_write.outputs.allowed != 'true' }}
+
+      - name: Manage CodeQL packs
+        uses: $/.github/actions/gha_cache
+        with:
+          path: ~/.codeql
+          key: codeql-packs-${{ hashFiles('maint/codeql/*/codeql-pack.lock.yml') }}
+          restore-only: "true"
+          url: ${{ vars.CACHE_GHA_URL }}
+          bucket: ${{ vars.CACHE_GHA_BUCKET }}
+          region: ${{ vars.CACHE_GHA_REGION }}
+          key-id: ${{ vars.CACHE_GHA_KEY_ID }}
+          auth: ${{ steps.cache_write.outputs.allowed == 'true' && secrets.CACHE_GHA_AUTH || '' }}
+
+      - name: Write the corpora
+        run: pkgs/pkc/contrib/regen.py
+
+      - name: Show the build log
+        if: failure()
+        shell: bash
+        run: cat target/bls-corpus/*-*/build.log
+
+      - name: Check the corpora are unchanged
+        run: |
+          git diff --exit-code -- pkgs/pkc/corpus
+          test -z "$(git status --porcelain -- pkgs/pkc/corpus)"
+
+      - name: Lint the programs against the build
+        run: |
+          python3 maint/lint/lint_clang.py 2>&1 | tee "${RUNNER_TEMP}/lint_clang.log"
+          if grep -qF 'skipping the lint of pkgs/pkc/contrib' "${RUNNER_TEMP}/lint_clang.log"; then
+            echo '::error::the programs were not linted'
+            exit 1
+          fi
+
+      - name: Analyse the programs against the build
+        run: |
+          python3 maint/lint/lint_codeql.py run --lang=cpp --with-suite=cpp-security-and-quality 2>&1 | tee "${RUNNER_TEMP}/lint_codeql.log"
+          if grep -qF 'skipping the analysis of pkgs/pkc/contrib' "${RUNNER_TEMP}/lint_codeql.log"; then
+            echo '::error::the programs were not analysed'
+            exit 1
+          fi

.gitmodules

@@ -1,3 +1,8 @@
 [submodule "fuzz/pow/sphlib"]
 	path = fuzz/pow/sphlib
 	url = https://github.com/pornin/sphlib
+[submodule "pkgs/pkc/contrib/dash"]
+	path = pkgs/pkc/contrib/dash
+	url = https://github.com/dashpay/dash
+	shallow = true
+	update = none

contrib/nix/mods/corpora.nix

@@ -0,0 +1,11 @@
+# Build dependencies of the C++ programs that write test corpora
+
+{ pkgs }:
+
+{
+  packages = [
+    pkgs.boost
+    pkgs.cmake
+    pkgs.gmp
+  ];
+}

contrib/nix/shell/ci.nix

@@ -14,6 +14,7 @@ compose [
   (cxx.forWasm commonTargets)
   mods.bazel
   mods.codeql
+  mods.corpora
   mods.cxx
   mods.fhs
   mods.nixpkgs

contrib/nix/shell/common.nix

@@ -92,6 +92,7 @@ in
   mods = lib.mapAttrs (name: m: m // { _name = name; }) {
     bazel = import ../mods/bazel.nix { inherit pkgs; };
     codeql = import ../mods/codeql.nix { inherit pkgs fhs; };
+    corpora = import ../mods/corpora.nix { inherit pkgs; };
     cxx = cxx.compiler;
     inherit fhs;
     nixpkgs = import ../mods/nixpkgs.nix { inherit pkgs llvm; };

maint/.clang-tidy

@@ -1,5 +1,5 @@
 HeaderFilterRegex: '.*'
-ExcludeHeaderFilterRegex: '/fuzz/pow/sphlib/'
+ExcludeHeaderFilterRegex: '/fuzz/pow/sphlib/|/target/bls-corpus/'
 WarningsAsErrors: '*'
 ExtraArgs: ['-Wdocumentation']
 Checks: '

maint/codeql/cpp/suppressions.toml

@@ -0,0 +1,6 @@
+# The corpus programs link a stand-in for the release's strong random source
+# that aborts, so a program that draws random bytes stops rather than writing
+# a corpus that differs from run to run.
+[[finding]]
+path = "pkgs/pkc/contrib/util/no_random.cpp"
+message = "Explicit termination of the program"

maint/codeql/rust/codeql-config.yml

@@ -1,6 +1,7 @@
 disable-default-queries: true
 paths-ignore:
   - .cache
+  - pkgs/pkc/contrib/dash
   - public
   - target
 queries:

maint/common.py

@@ -57,6 +57,21 @@
 # Each entry mirrors its directory's build script and changes with it.
 CXX_INCLUDES: dict[str, tuple[str, ...]] = {
   "fuzz/pow": ("fuzz/pow/sphlib/c",),
+  # The last build of `regen.py`, absent until it runs.
+  "pkgs/pkc/contrib": (
+    "pkgs/pkc/contrib",
+    "target/bls-corpus/current/build/dashbls/depends/relic/include",
+    "target/bls-corpus/current/build/generated",
+    "target/bls-corpus/current/src",
+    "target/bls-corpus/current/src/dashbls/depends/relic/include",
+    "target/bls-corpus/current/src/dashbls/include",
+    "target/bls-corpus/current/src/dashbls/include/dashbls",
+  ),
+}
+
+# Standards of units built otherwise, keyed by the directory holding them.
+CXX_STDS: dict[str, str] = {
+  "pkgs/pkc/contrib": "c++20",
 }
 
 # Assumed base branch for codebase.
@@ -329,10 +344,13 @@ def cxx_flags(repo_root: Path, unit: Path) -> list[str]:
   """Return the flags *unit* is compiled with.
 
   Raises FileNotFoundError naming an absent include directory, which is
-  what an uninitialised submodule leaves behind.
+  what an uninitialised submodule or a build not yet run leaves behind.
   """
-  std = C_STD if unit.suffix in C_UNITS else CPP_STD
   relative = unit.relative_to(repo_root)
+  std = next(
+    (s for holder, s in CXX_STDS.items() if relative.is_relative_to(holder)),
+    C_STD if unit.suffix in C_UNITS else CPP_STD,
+  )
   includes = [
     include
     for holder, held in CXX_INCLUDES.items()