Merge commit 'aae086cc650e42eec1eea8db28cd01fa868d7f90'

external/toxcore/c-toxcore/other/docker/autotools/autotools.Dockerfile

@@ -1,5 +1,6 @@
 ################################################
 # autotools-linux
+FROM toxchat/c-toxcore:sources AS sources
 FROM ubuntu:22.04
 
 RUN apt-get update && \
@@ -24,7 +25,12 @@ USER builder
 
 WORKDIR /home/builder
 
-# Copy the sources and run the build.
+# Copy autotools-specific build scripts not present in the sources image.
+# These change less frequently than the sources, thus are copied first.
 COPY --chown=builder:builder . /home/builder/c-toxcore/
+
+# Copy the sources and run the build.
+COPY --chown=builder:builder --from=sources /src/ /home/builder/c-toxcore/
+
 WORKDIR /home/builder/c-toxcore
 RUN CC=gcc .github/scripts/autotools-linux

external/toxcore/c-toxcore/other/docker/autotools/autotools.Dockerfile.dockerignore

@@ -0,0 +1,12 @@
+**/*
+!.github/scripts/autotools-linux
+!m4/*
+!configure.ac
+!*.pc.in
+!*.spec.in
+!**/Makefile.am
+!**/Makefile.inc
+!docs/updates/*
+!other/DHTnodes
+!other/astyle/*
+!other/tox.png

external/toxcore/c-toxcore/other/docker/autotools/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=autotools
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/clang-tidy/clang-tidy.Dockerfile

@@ -1,3 +1,4 @@
+FROM toxchat/c-toxcore:sources AS sources
 FROM alpine:3.19.0
 
 RUN ["apk", "add", "--no-cache", \
@@ -16,6 +17,8 @@ RUN ["apk", "add", "--no-cache", \
 
 ENV CC=clang CXX=clang++
 
-COPY . /c-toxcore/
+COPY --from=sources /src/ /c-toxcore/
+COPY other/analysis/run-clang-tidy other/analysis/variants.sh /c-toxcore/other/analysis/
+COPY .clang-tidy /c-toxcore/
 WORKDIR /c-toxcore
 RUN other/analysis/run-clang-tidy

external/toxcore/c-toxcore/other/docker/clang-tidy/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=clang-tidy
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/compcert/.gitignore

@@ -0,0 +1 @@
+!/Makefile

external/toxcore/c-toxcore/other/docker/compcert/Dockerfile

@@ -1,30 +0,0 @@
-FROM toxchat/compcert:latest
-
-WORKDIR /work
-COPY auto_tests/ /work/auto_tests/
-COPY testing/ /work/testing/
-COPY toxav/ /work/toxav/
-COPY toxcore/ /work/toxcore/
-COPY toxencryptsave/ /work/toxencryptsave/
-COPY third_party/ /work/third_party/
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-RUN ccomp \
- -o send_message_test \
- -Wall -Werror \
- -Wno-c11-extensions \
- -Wno-unknown-pragmas \
- -Wno-unused-variable \
- -fstruct-passing -fno-unprototyped -g \
- auto_tests/auto_test_support.c \
- auto_tests/send_message_test.c \
- testing/misc_tools.c \
- toxav/*.c \
- toxcore/*.c \
- toxcore/*/*.c \
- toxencryptsave/*.c \
- third_party/cmp/*.c \
- -D__COMPCERT__ -DDISABLE_VLA -Dinline= \
- -lpthread $(pkg-config --cflags --libs libsodium opus vpx) \
- && ./send_message_test | grep 'tox clients connected'

external/toxcore/c-toxcore/other/docker/compcert/Makefile

@@ -0,0 +1,39 @@
+CC := ccomp
+CFLAGS := -Wall \
+	  -Wno-c11-extensions \
+	  -Wno-unknown-pragmas \
+	  -Wno-unused-variable \
+	  -fstruct-passing -fno-unprototyped -g \
+	  -Ilibsodium/src/libsodium/include \
+	  $(shell pkg-config --cflags opus vpx)
+LDFLAGS := -lpthread $(shell pkg-config --libs opus vpx)
+
+libsodium_SOURCES := $(shell find libsodium/src/libsodium -name "*.c")
+libsodium_OBJECTS := $(libsodium_SOURCES:.c=.o)
+
+$(libsodium_OBJECTS): CFLAGS += \
+	-DDEV_MODE \
+	-DCONFIGURED \
+	-D_DEFAULT_SOURCE \
+	-Ilibsodium/builds/msvc \
+	-Ilibsodium/src/libsodium/include/sodium
+
+toxcore_SOURCES := $(wildcard \
+	   auto_tests/auto_test_support.c \
+	   auto_tests/send_message_test.c \
+	   testing/misc_tools.c \
+	   toxav/*.c \
+	   toxcore/*.c \
+	   toxcore/*/*.c \
+	   toxencryptsave/*.c \
+	   third_party/cmp/*.c)
+toxcore_OBJECTS := $(toxcore_SOURCES:.c=.o)
+$(toxcore_OBJECTS): CFLAGS += \
+	-Werror \
+	-D__COMPCERT__ \
+	-DDISABLE_VLA \
+	-DMIN_LOGGER_LEVEL=LOGGER_LEVEL_TRACE \
+	-Dinline= \
+
+send_message_test: $(libsodium_OBJECTS) $(toxcore_OBJECTS)
+	$(CC) -o $@ $+ $(LDFLAGS)

external/toxcore/c-toxcore/other/docker/compcert/compcert.Dockerfile

@@ -0,0 +1,19 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM toxchat/compcert:latest
+
+RUN apt-get update && \
+ DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
+ gdb \
+ make \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work
+COPY --from=sources /src/ /work/
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN git clone --depth=1 https://github.com/jedisct1/libsodium /work/libsodium
+COPY other/docker/compcert/Makefile /work/
+RUN make "-j$(nproc)"
+RUN ./send_message_test | grep 'tox clients connected'

external/toxcore/c-toxcore/other/docker/compcert/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=compcert
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/coverage/coverage.Dockerfile

@@ -1,4 +1,4 @@
-FROM toxchat/c-toxcore:sources AS src
+FROM toxchat/c-toxcore:sources AS sources
 FROM ubuntu:20.04 AS build
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -41,7 +41,7 @@ ENV CC=clang-17 \
     PYTHONUNBUFFERED=1 \
     PATH=$PATH:/usr/lib/go-1.18/bin
 
-COPY --from=src /src/ /work/
+COPY --from=sources /src/ /work/
 
 WORKDIR /work
 RUN git clone --depth=1 https://github.com/TokTok/toktok-fuzzer /work/testing/fuzzing/toktok-fuzzer

external/toxcore/c-toxcore/other/docker/coverage/run

@@ -4,6 +4,8 @@ set -eux
 
 read -a ci_env <<<"$(bash <(curl -s https://codecov.io/env))"
 
-docker build -t toxchat/c-toxcore:sources -f other/docker/sources/Dockerfile .
-docker build -t toxchat/c-toxcore:coverage -f other/docker/coverage/Dockerfile .
+BUILD=coverage
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .
+
 docker run "${ci_env[@]}" -e CI=true --name toxcore-coverage --rm -t toxchat/c-toxcore:coverage /usr/local/bin/codecov

external/toxcore/c-toxcore/other/docker/coverage/serve

@@ -2,7 +2,9 @@
 
 set -eux
 
-docker build -t toxchat/c-toxcore:sources -f other/docker/sources/Dockerfile .
-docker build -t toxchat/c-toxcore:coverage -f other/docker/coverage/Dockerfile .
-docker build -t toxchat/c-toxcore:coverage-nginx -f other/docker/coverage/Dockerfile.nginx other/docker/coverage
+BUILD=coverage
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .
+
+docker build -t toxchat/c-toxcore:coverage-nginx -f other/docker/coverage/nginx.Dockerfile other/docker/coverage
 docker run --name toxcore-coverage --rm -it -p "28192:80" toxchat/c-toxcore:coverage-nginx

external/toxcore/c-toxcore/other/docker/cppcheck/Dockerfile

@@ -1,30 +0,0 @@
-FROM alpine:3.19.0
-
-RUN ["apk", "add", "--no-cache", \
- "bash", \
- "cppcheck", \
- "findutils", \
- "libconfig-dev", \
- "libsodium-dev", \
- "libvpx-dev", \
- "linux-headers", \
- "make", \
- "opus-dev"]
-
-COPY other/bootstrap_daemon/ /src/workspace/c-toxcore/other/bootstrap_daemon/
-COPY other/bootstrap_node_packets.* /src/workspace/c-toxcore/other/
-COPY other/fun/ /src/workspace/c-toxcore/other/fun/
-COPY auto_tests/check_compat.h /src/workspace/c-toxcore/auto_tests/
-COPY testing/ /src/workspace/c-toxcore/testing/
-COPY toxav/ /src/workspace/c-toxcore/toxav/
-COPY toxcore/ /src/workspace/c-toxcore/toxcore/
-COPY toxencryptsave/ /src/workspace/c-toxcore/toxencryptsave/
-COPY third_party/cmp/cmp.h /src/workspace/c-toxcore/third_party/cmp/
-COPY other/analysis/run-cppcheck \
-     other/analysis/gen-file.sh \
-     other/analysis/variants.sh \
-     /src/workspace/c-toxcore/other/analysis/
-COPY other/docker/cppcheck/toxcore.cfg \
-     /src/workspace/c-toxcore/other/docker/cppcheck/
-WORKDIR /src/workspace/c-toxcore
-RUN ["other/analysis/run-cppcheck"]

external/toxcore/c-toxcore/other/docker/cppcheck/cppcheck.Dockerfile

@@ -0,0 +1,23 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM alpine:3.19.0
+
+RUN ["apk", "add", "--no-cache", \
+ "bash", \
+ "cppcheck", \
+ "findutils", \
+ "libconfig-dev", \
+ "libsodium-dev", \
+ "libvpx-dev", \
+ "linux-headers", \
+ "make", \
+ "opus-dev"]
+
+COPY --from=sources /src/ /src/workspace/c-toxcore/
+COPY other/analysis/run-cppcheck \
+     other/analysis/gen-file.sh \
+     other/analysis/variants.sh \
+     /src/workspace/c-toxcore/other/analysis/
+COPY other/docker/cppcheck/toxcore.cfg \
+     /src/workspace/c-toxcore/other/docker/cppcheck/
+WORKDIR /src/workspace/c-toxcore
+RUN ["other/analysis/run-cppcheck"]

external/toxcore/c-toxcore/other/docker/cppcheck/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=cppcheck
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/doxygen/Dockerfile

@@ -1,18 +0,0 @@
-FROM alpine:latest AS build
-
-ENV LANG=en_US.UTF-8 \
-    LANGUAGE=en_US.UTF-8 \
-    LC_CTYPE=en_US.UTF-8 \
-    LC_ALL=en_US.UTF-8
-
-RUN apk add --no-cache doxygen git graphviz texlive \
- && git clone --depth=1 https://github.com/jothepro/doxygen-awesome-css.git /work/doxygen-awesome-css
-WORKDIR /work
-COPY . /work/
-RUN cat docs/Doxyfile > Doxyfile \
- && echo "WARN_AS_ERROR = YES" >> Doxyfile \
- && sed -i -e 's/^non_null([^)]*) *//;s/^nullable([^)]*) *//' $(find . -name "*.[ch]") \
- && doxygen Doxyfile
-
-FROM nginx:alpine
-COPY --from=build /work/_docs/html/ /usr/share/nginx/html/

external/toxcore/c-toxcore/other/docker/doxygen/dockerignore

@@ -0,0 +1,2 @@
+# ===== custom =====
+!docs/Doxyfile

external/toxcore/c-toxcore/other/docker/doxygen/doxygen.Dockerfile

@@ -0,0 +1,20 @@
+FROM toxchat/doxygen:latest AS build
+
+RUN ["apk", "add", "--no-cache", \
+ "gtest-dev", \
+ "libconfig-dev", \
+ "libsodium-dev", \
+ "libvpx-dev", \
+ "opus-dev"]
+
+RUN git clone --depth=1 https://github.com/jothepro/doxygen-awesome-css.git /work/c-toxcore/doxygen-awesome-css
+
+WORKDIR /work/c-toxcore
+COPY . /work/c-toxcore/
+RUN cmake . -B_build -GNinja -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
+ && echo "WARN_AS_ERROR = YES" >> Doxyfile \
+ && sed -i -e 's/^non_null([^)]*) *//;s/^nullable([^)]*) *//' $(find . -name "*.[ch]") \
+ && doxygen docs/Doxyfile
+
+FROM nginx:alpine
+COPY --from=build /work/c-toxcore/_docs/html/ /usr/share/nginx/html/

external/toxcore/c-toxcore/other/docker/doxygen/doxygen.Dockerfile.dockerignore

@@ -0,0 +1,25 @@
+# ===== common =====
+# Ignore everything ...
+**/*
+# ... except sources
+!**/*.[ch]
+!**/*.cc
+!**/*.hh
+!CHANGELOG.md
+!LICENSE
+!README.md
+!auto_tests/data/*
+!other/bootstrap_daemon/bash-completion/**
+!other/bootstrap_daemon/tox-bootstrapd.*
+!other/proxy/*.mod
+!other/proxy/*.sum
+!other/proxy/*.go
+# ... and CMake build files (used by most builds).
+!**/CMakeLists.txt
+!.github/scripts/flags*.sh
+!cmake/*.cmake
+!other/pkgconfig/*
+!other/rpm/*
+!so.version
+# ===== custom =====
+!docs/Doxyfile

external/toxcore/c-toxcore/other/docker/doxygen/run

@@ -1,6 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
-set -eux
-
-docker build -t toxchat/c-toxcore:docs -f other/docker/doxygen/Dockerfile .
-docker run --name toxcore-docs --rm -it -p "28192:80" toxchat/c-toxcore:docs
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")/../sources" && pwd)/run.sh"
+docker run --name toxcore-doxygen --rm -it -p "28192:80" "toxchat/c-toxcore:$BUILD"

external/toxcore/c-toxcore/other/docker/freebsd/run

@@ -2,4 +2,4 @@
 
 set -eux
 BUILD=freebsd
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/goblint/BUILD.bazel

@@ -0,0 +1,8 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+cc_library(
+    name = "sodium",
+    testonly = True,
+    srcs = ["sodium.c"],
+    deps = ["@libsodium"],
+)

external/toxcore/c-toxcore/other/docker/goblint/analysis.json

@@ -0,0 +1,43 @@
+{
+	"ana": {
+		"activated": [
+			"base","mallocWrapper","escape","mutex","mutexEvents","access","assert","expRelation"
+		],
+		"arrayoob": true,
+		"wp": true,
+		"apron": {
+            "strengthening": true
+        },
+		"base": {
+			"structs" : {
+				"domain" : "combined-sk"
+			},
+			"arrays": {
+				"domain": "partitioned"
+			}
+		},
+		"malloc": {
+			"wrappers": [
+				"mem_balloc",
+				"mem_alloc",
+				"mem_valloc",
+				"mem_vrealloc"
+			]
+		}
+	},
+    "warn": {
+        "behavior": false,
+        "call": false,
+        "integer": true,
+        "float": false,
+        "race": false,
+        "deadcode": false,
+        "unsound": false,
+        "imprecise": false,
+        "success": false,
+        "unknown": false
+    },
+	"exp": {
+		"earlyglobs": true
+	}
+}

external/toxcore/c-toxcore/other/docker/goblint/goblint.Dockerfile

@@ -0,0 +1,21 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM ghcr.io/goblint/analyzer:latest
+
+RUN apt-get update && \
+ DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
+ libsodium-dev \
+ tcc \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work
+COPY --from=sources /src/ /work/
+
+COPY other/make_single_file /work/other/
+
+RUN other/make_single_file -core auto_tests/tox_new_test.c other/docker/goblint/sodium.c > analysis.c
+# Try compiling+linking just to make sure we have all the fake functions.
+RUN tcc analysis.c
+
+COPY other/docker/goblint/analysis.json /work/other/docker/goblint/
+RUN /opt/goblint/analyzer/bin/goblint --conf /work/other/docker/goblint/analysis.json analysis.c

external/toxcore/c-toxcore/other/docker/goblint/run

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -eux
+BUILD=goblint
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/goblint/sodium.c

@@ -0,0 +1,112 @@
+#include <sodium.h>
+
+#include <string.h>
+
+int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned char *seed)
+{
+    memset(pk, 0, 32);
+    memset(sk, 0, 32);
+    return 0;
+}
+int crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk,
+        const unsigned char *ed25519_pk)
+{
+    memset(curve25519_pk, 0, 32);
+    return 0;
+}
+int crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk,
+        const unsigned char *ed25519_sk)
+{
+    memset(curve25519_sk, 0, 32);
+    return 0;
+}
+void sodium_memzero(void *const pnt, const size_t len)
+{
+    memset(pnt, 0, len);
+}
+int sodium_mlock(void *const addr, const size_t len)
+{
+    return 0;
+}
+int sodium_munlock(void *const addr, const size_t len)
+{
+    return 0;
+}
+int crypto_verify_32(const unsigned char *x, const unsigned char *y)
+{
+    return memcmp(x, y, 32);
+}
+int crypto_verify_64(const unsigned char *x, const unsigned char *y)
+{
+    return memcmp(x, y, 64);
+}
+int crypto_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
+                         const unsigned char *m, unsigned long long mlen,
+                         const unsigned char *sk)
+{
+    return 0;
+}
+int crypto_sign_verify_detached(const unsigned char *sig,
+                                const unsigned char *m,
+                                unsigned long long mlen,
+                                const unsigned char *pk)
+{
+    return 0;
+}
+int crypto_box_beforenm(unsigned char *k, const unsigned char *pk,
+                        const unsigned char *sk)
+{
+    memset(k, 0, 32);
+    return 0;
+}
+int crypto_box_afternm(unsigned char *c, const unsigned char *m,
+                       unsigned long long mlen, const unsigned char *n,
+                       const unsigned char *k)
+{
+    memset(c, 0, 32);
+    return 0;
+}
+int crypto_box_open_afternm(unsigned char *m, const unsigned char *c,
+                            unsigned long long clen, const unsigned char *n,
+                            const unsigned char *k)
+{
+    return 0;
+}
+int crypto_scalarmult_curve25519_base(unsigned char *q,
+                                      const unsigned char *n)
+{
+    memset(q, 0, 32);
+    return 0;
+}
+int crypto_auth(unsigned char *out, const unsigned char *in,
+                unsigned long long inlen, const unsigned char *k)
+{
+    return 0;
+}
+int crypto_auth_verify(const unsigned char *h, const unsigned char *in,
+                       unsigned long long inlen, const unsigned char *k)
+{
+    return 0;
+}
+int crypto_hash_sha256(unsigned char *out, const unsigned char *in,
+                       unsigned long long inlen)
+{
+    return 0;
+}
+int crypto_hash_sha512(unsigned char *out, const unsigned char *in,
+                       unsigned long long inlen)
+{
+    return 0;
+}
+void randombytes(unsigned char *const buf, const unsigned long long buf_len)
+{
+    memset(buf, 0, buf_len);
+}
+uint32_t randombytes_uniform(const uint32_t upper_bound)
+{
+    return upper_bound;
+}
+int sodium_init(void)
+{
+    return 0;
+}

external/toxcore/c-toxcore/other/docker/infer/infer.Dockerfile

@@ -1,9 +1,7 @@
+FROM toxchat/c-toxcore:sources AS sources
 FROM toxchat/infer:latest
 
-COPY toxav/ /work/c-toxcore/toxav/
-COPY toxcore/ /work/c-toxcore/toxcore/
-COPY toxencryptsave/ /work/c-toxcore/toxencryptsave/
-COPY third_party/ /work/c-toxcore/third_party/
+COPY --from=sources /src/ /work/c-toxcore/
 RUN infer capture -- clang++ -fsyntax-only \
   $(pkg-config --cflags libconfig libsodium opus vpx) \
   /work/c-toxcore/toxav/*.c \

external/toxcore/c-toxcore/other/docker/infer/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=infer
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/misra/Makefile

@@ -126,11 +126,6 @@ SUPPRESSIONS += 19.2
 #
 # Reason: We believe it should be used when #define is used in block scope.
 SUPPRESSIONS += 20.5
-# The # and ## preprocessor operators should not be used.
-#
-# TODO(iphydf): Remove suppression when VLAs are gone. This is only used in
-# the SIZEOF_VLA macro.
-SUPPRESSIONS += 20.10
 # #define and #undef shall not be used on a reserved identifier or reserved macro name.
 #
 # Reason: Needed for feature test macros like _DEFAULT_SOURCE.
@@ -160,7 +155,12 @@ SUPPRESSIONS += 21.10
 
 CPPFLAGS := -DCMP_NO_FLOAT=1 -DMIN_LOGGER_LEVEL=LOGGER_LEVEL_TRACE
 
-SOURCES := $(shell find /src/workspace/c-toxcore -name "*.c")
+FIND_FLAGS := -name "*.c"								\
+			  -and -not -wholename "*/auto_tests/*"		\
+			  -and -not -wholename "*/other/*"			\
+			  -and -not -wholename "*/super_donators/*"	\
+			  -and -not -wholename "*/third_party/*"
+SOURCES := $(shell find /src/workspace/c-toxcore $(FIND_FLAGS))
 
 analyse: $(DUMPS:.dump=.diag)
 	cppcheck --error-exitcode=1 -j8 --addon=misra --suppress=doubleFree $(patsubst %,--suppress=misra-c2012-%,$(SUPPRESSIONS)) $(CPPFLAGS) $(SOURCES)

external/toxcore/c-toxcore/other/docker/misra/misra.Dockerfile

@@ -1,3 +1,4 @@
+FROM toxchat/c-toxcore:sources AS sources
 FROM ubuntu:20.04
 
 RUN apt-get update && \
@@ -12,10 +13,7 @@ RUN apt-get update && \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*
 
-COPY toxav/ /src/workspace/c-toxcore/toxav/
-COPY toxcore/ /src/workspace/c-toxcore/toxcore/
-COPY toxencryptsave/ /src/workspace/c-toxcore/toxencryptsave/
-COPY third_party/cmp/cmp.h /src/workspace/c-toxcore/third_party/cmp/cmp.h
+COPY --from=sources /src/ /src/workspace/c-toxcore/
 COPY other/docker/misra/Makefile /src/workspace/
 WORKDIR /src/workspace
 RUN ["make"]

external/toxcore/c-toxcore/other/docker/misra/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=misra
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/modules/check

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+import glob
+import os
+import subprocess
+import sys
+from dataclasses import dataclass
+from typing import Iterable
+from typing import Optional
+
+LIBS = {}
+MODS = {}
+STD_MODULE = """module std [system] {
+  textual header "/usr/include/alloca.h"
+  textual header "/usr/include/assert.h"
+  textual header "/usr/include/c++/13.2.1/algorithm"
+  textual header "/usr/include/c++/13.2.1/array"
+  textual header "/usr/include/c++/13.2.1/chrono"
+  textual header "/usr/include/c++/13.2.1/cstddef"
+  textual header "/usr/include/c++/13.2.1/cstdint"
+  textual header "/usr/include/c++/13.2.1/cstdio"
+  textual header "/usr/include/c++/13.2.1/cstdlib"
+  textual header "/usr/include/c++/13.2.1/cstring"
+  textual header "/usr/include/c++/13.2.1/iomanip"
+  textual header "/usr/include/c++/13.2.1/iosfwd"
+  textual header "/usr/include/c++/13.2.1/limits"
+  textual header "/usr/include/c++/13.2.1/memory"
+  textual header "/usr/include/c++/13.2.1/ostream"
+  textual header "/usr/include/c++/13.2.1/random"
+  textual header "/usr/include/c++/13.2.1/stdlib.h"
+  textual header "/usr/include/c++/13.2.1/thread"
+  textual header "/usr/include/c++/13.2.1/type_traits"
+  textual header "/usr/include/c++/13.2.1/vector"
+  textual header "/usr/include/errno.h"
+  textual header "/usr/include/fortify/stdio.h"
+  textual header "/usr/include/fortify/string.h"
+  textual header "/usr/include/fortify/unistd.h"
+  textual header "/usr/include/limits.h"
+  textual header "/usr/include/stdarg.h"
+  textual header "/usr/include/stdbool.h"
+  textual header "/usr/include/stddef.h"
+  textual header "/usr/include/stdint.h"
+  textual header "/usr/include/sys/time.h"
+  textual header "/usr/include/sys/types.h"
+  textual header "/usr/include/time.h"
+}
+module "//c-toxcore/third_party:cmp" {
+  header "third_party/cmp/cmp.h"
+  use std
+}
+module "//c-toxcore/toxencryptsave:defines" {
+  header "toxencryptsave/defines.h"
+}
+module "@com_google_googletest//:gtest" {
+  textual header "/usr/include/gmock/gmock.h"
+  textual header "/usr/include/gtest/gtest.h"
+  use std
+}
+module "@libsodium" {
+  textual header "/usr/include/sodium.h"
+}
+module "@pthread" {
+  textual header "/usr/include/pthread.h"
+}
+module "@psocket" {
+  textual header "/usr/include/arpa/inet.h"
+  textual header "/usr/include/fcntl.h"
+  textual header "/usr/include/fortify/sys/socket.h"
+  textual header "/usr/include/linux/if.h"
+  textual header "/usr/include/netdb.h"
+  textual header "/usr/include/netinet/in.h"
+  textual header "/usr/include/sys/epoll.h"
+  textual header "/usr/include/sys/ioctl.h"
+}
+"""
+
+
+@dataclass
+class Context:
+    pkg: str
+    pkg_prefix: str
+
+    def bzl_load(self, bzl: str, *syms: str) -> None:
+        pass
+
+    def bzl_exports_files(
+            self,
+            srcs: list[str],
+            visibility: Optional[list[str]] = None,
+    ) -> None:
+        pass
+
+    def bzl_cc_library(
+            self,
+            name: str,
+            srcs: Iterable[str] = tuple(),
+            hdrs: Iterable[str] = tuple(),
+            deps: Iterable[str] = tuple(),
+            visibility: Iterable[str] = tuple(),
+            testonly: bool = False,
+            copts: Iterable[str] = tuple(),
+    ) -> None:
+        LIBS[name] = {
+            "srcs":
+            srcs,
+            "deps": [
+                f"{self.pkg_prefix}{dep}" if dep[0] == ":" else dep
+                for dep in deps
+            ],
+            "hdrs":
+            hdrs,
+        }
+
+    def bzl_cc_test(
+            self,
+            name: str,
+            srcs: Iterable[str] = tuple(),
+            hdrs: Iterable[str] = tuple(),
+            deps: Iterable[str] = tuple(),
+            **kwargs: list[str],
+    ) -> None:
+        LIBS[name] = {
+            "srcs":
+            srcs,
+            "deps": [
+                f"{self.pkg_prefix}{dep}" if dep[0] == ":" else dep
+                for dep in deps
+            ],
+            "hdrs":
+            hdrs,
+        }
+
+    def bzl_cc_fuzz_test(self, name: str, **kwargs: list[str]) -> None:
+        pass
+
+    def bzl_select(self, selector: dict[str, list[str]]) -> list[str]:
+        return selector["//tools/config:linux"]
+
+    def bzl_glob(self, include: list[str]) -> list[str]:
+        return [
+            f[len(self.pkg) + 1:] for p in include
+            for f in glob.glob(os.path.join(self.pkg, p))
+        ]
+
+    def bzl_alias(self, name: str, actual: str, visibility: list[str]) -> None:
+        pass
+
+    def bzl_sh_library(self, name: str, **kwargs: list[str]) -> None:
+        pass
+
+
+def main() -> None:
+    srcs: list[str] = []
+    for pkg in ("toxcore", ):
+        # TODO(iphydf): Why does this break everything?
+        # ctx = Context(pkg, "//c-toxcore/{pkg}")
+        ctx = Context(pkg, "")
+        with open(os.path.join(pkg, "BUILD.bazel"), "r") as fh:
+            exec(
+                fh.read(),
+                {
+                    "load": ctx.bzl_load,
+                    "exports_files": ctx.bzl_exports_files,
+                    "cc_library": ctx.bzl_cc_library,
+                    "cc_test": ctx.bzl_cc_test,
+                    "cc_fuzz_test": ctx.bzl_cc_fuzz_test,
+                    "select": ctx.bzl_select,
+                    "glob": ctx.bzl_glob,
+                    "alias": ctx.bzl_alias,
+                    "sh_library": ctx.bzl_sh_library,
+                },
+            )
+
+        with open("module.modulemap", "w") as fh:
+            fh.write(STD_MODULE)
+            for name, lib in LIBS.items():
+                fh.write(f'module "{ctx.pkg_prefix}:{name}"' + " {\n")
+                for hdr in lib["hdrs"]:
+                    fh.write(f'  header "{pkg}/{hdr}"\n')
+                fh.write(f"  use std\n")
+                for dep in lib.get("deps", []):
+                    fh.write(f'  use "{dep}"\n')
+                fh.write("}\n")
+
+        for name, lib in LIBS.items():
+            for src in lib.get("srcs", []):
+                MODS[os.path.join(pkg, src)] = name
+        srcs.extend(
+            os.path.join(pkg, src)  # just within a package for now
+            for lib in LIBS.values() for src in lib.get("srcs", []))
+    # subprocess.run(["cat", "module.modulemap"], check=True)
+    for src in sorted(
+            set(srcs) - set([
+                # TODO(iphydf): Figure out what's wrong here.
+                "toxcore/crypto_core_test.cc",
+                "toxcore/group_announce_test.cc",
+                "toxcore/group_moderation_test.cc",
+                "toxcore/mono_time_test.cc",
+                "toxcore/network_test.cc",
+                "toxcore/ping_array_test.cc",
+                "toxcore/util_test.cc",
+            ])):
+        print(f"Validating {src}", file=sys.stderr)
+        subprocess.run(
+            [
+                "clang",
+                "-fsyntax-only",
+                "-xc++",
+                "-Wall",
+                "-Werror",
+                "-Wno-missing-braces",
+                "-DTCP_SERVER_USE_EPOLL",
+                "-std=c++23",
+                "-fdiagnostics-color=always",
+                "-fmodules",
+                "-fmodules-strict-decluse",
+                "-fmodule-map-file=module.modulemap",
+                f"-fmodule-name={ctx.pkg_prefix}:{MODS[src]}",
+                src,
+            ],
+            check=True,
+        )
+
+
+if __name__ == "__main__":
+    main()

external/toxcore/c-toxcore/other/docker/modules/modules.Dockerfile

@@ -0,0 +1,21 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM alpine:3.19.0
+
+RUN ["apk", "add", "--no-cache", \
+ "bash", \
+ "clang", \
+ "gtest-dev", \
+ "libconfig-dev", \
+ "libsodium-dev", \
+ "libvpx-dev", \
+ "linux-headers", \
+ "opus-dev", \
+ "pkgconfig", \
+ "python3"]
+
+WORKDIR /work
+COPY --from=sources /src/ /work/
+
+COPY toxcore/BUILD.bazel /work/toxcore/
+COPY other/docker/modules/check /work/other/docker/modules/
+RUN ["other/docker/modules/check"]

external/toxcore/c-toxcore/other/docker/modules/run

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -eux
+BUILD=modules
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/pkgsrc/pkgsrc.Dockerfile

@@ -0,0 +1,10 @@
+FROM toxchat/pkgsrc:latest
+
+WORKDIR /work
+COPY . /work/c-toxcore-0.2.18
+RUN ["tar", "zcf", "c-toxcore.tar.gz", "c-toxcore-0.2.18"]
+
+WORKDIR /work/pkgsrc/chat/toxcore
+RUN ["bmake", "clean"]
+RUN ["bmake", "DISTFILES=c-toxcore.tar.gz", "DISTDIR=/work", "NO_CHECKSUM=yes"]
+RUN ["bmake", "install"]

external/toxcore/c-toxcore/other/docker/pkgsrc/pkgsrc.Dockerfile.dockerignore

@@ -0,0 +1,23 @@
+# ===== common =====
+# Ignore everything ...
+**/*
+# ... except sources
+!**/*.[ch]
+!**/*.cc
+!**/*.hh
+!CHANGELOG.md
+!LICENSE
+!README.md
+!auto_tests/data/*
+!other/bootstrap_daemon/bash-completion/**
+!other/bootstrap_daemon/tox-bootstrapd.*
+!other/proxy/*.mod
+!other/proxy/*.sum
+!other/proxy/*.go
+# ... and CMake build files (used by most builds).
+!**/CMakeLists.txt
+!.github/scripts/flags*.sh
+!cmake/*.cmake
+!other/pkgconfig/*
+!other/rpm/*
+!so.version

external/toxcore/c-toxcore/other/docker/pkgsrc/run

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")/../sources" && pwd)/run.sh"

external/toxcore/c-toxcore/other/docker/rpm/rpm.Dockerfile

@@ -0,0 +1,47 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM fedora:39
+
+RUN ["dnf", "install", "-y", \
+ "cmake", \
+ "g++", \
+ "gcc", \
+ "git", \
+ "libconfig-devel", \
+ "libsodium-devel", \
+ "libvpx-devel", \
+ "make", \
+ "opus-devel", \
+ "rpmdevtools", \
+ "rpmlint", \
+ "systemd-units"]
+
+ARG PROJECT_VERSION=master
+ARG PROJECT_COMMIT_ID=master
+ARG PROJECT_COMMIT_ID_SHORT=master
+
+COPY --from=sources /src/ /work/c-toxcore-${PROJECT_COMMIT_ID}
+WORKDIR /work/c-toxcore-${PROJECT_COMMIT_ID}/other/rpm
+
+RUN make toxcore.spec \
+  PROJECT_VERSION="$PROJECT_VERSION" \
+  PROJECT_COMMIT_ID="$PROJECT_COMMIT_ID" \
+  PROJECT_COMMIT_ID_SHORT="$PROJECT_COMMIT_ID_SHORT" \
+  PROJECT_GIT_ROOT="/work/c-toxcore-$PROJECT_COMMIT_ID_SHORT"
+
+WORKDIR /work
+RUN tar zcf "c-toxcore-${PROJECT_COMMIT_ID_SHORT}.tar.gz" "c-toxcore-${PROJECT_COMMIT_ID}" \
+ && mv "c-toxcore-${PROJECT_COMMIT_ID_SHORT}.tar.gz" "c-toxcore-${PROJECT_COMMIT_ID}/other/rpm"
+WORKDIR /work/c-toxcore-${PROJECT_COMMIT_ID}/other/rpm
+RUN make srpm \
+  PROJECT_VERSION="$PROJECT_VERSION" \
+  PROJECT_COMMIT_ID="$PROJECT_COMMIT_ID" \
+  PROJECT_COMMIT_ID_SHORT="$PROJECT_COMMIT_ID_SHORT" \
+  PROJECT_GIT_ROOT="$PROJECT_GIT_ROOT"
+
+# Build the binary rpms.
+RUN rpmbuild --rebuild "toxcore-${PROJECT_VERSION}-1.fc39.src.rpm"
+
+# Install them and try running the bootstrap daemon.
+RUN rpm -i /root/rpmbuild/RPMS/x86_64/*.rpm
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN script tox-bootstrapd --help | grep Usage

external/toxcore/c-toxcore/other/docker/rpm/run

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -eux
+PROJECT_VERSION="$(git describe | sed -e 's/^v//' -e 's/-/_/g')"
+PROJECT_COMMIT_ID="$(git rev-parse HEAD)"
+PROJECT_COMMIT_ID_SHORT="$(git rev-parse --short HEAD)"
+
+BUILD=rpm
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" . \
+  --build-arg="PROJECT_VERSION=$PROJECT_VERSION" \
+  --build-arg="PROJECT_COMMIT_ID=$PROJECT_COMMIT_ID" \
+  --build-arg="PROJECT_COMMIT_ID_SHORT=$PROJECT_COMMIT_ID_SHORT"

external/toxcore/c-toxcore/other/docker/slimcc/.gitignore

@@ -0,0 +1 @@
+!/Makefile

external/toxcore/c-toxcore/other/docker/slimcc/Makefile

@@ -0,0 +1,13 @@
+SOURCES		:= auto_tests/send_message_test.c \
+		   auto_tests/auto_test_support.c \
+		   testing/misc_tools.c \
+		   $(wildcard tox*/*.c tox*/*/*.c) \
+		   third_party/cmp/cmp.c
+OBJECTS		:= $(SOURCES:.c=.o)
+
+CC		:= /work/slimcc/slimcc
+CFLAGS		:= $(shell pkg-config --cflags libsodium opus vpx)
+LDFLAGS		:= $(shell pkg-config --libs libsodium opus vpx)
+
+send_message_test: $(OBJECTS)
+	$(CC) -o $@ $+ $(LDFLAGS)

external/toxcore/c-toxcore/other/docker/slimcc/creduce.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if ! gcc -I/work/c-toxcore/toxcore -fsyntax-only crash.c; then
+  exit 1
+fi
+/work/slimcc/slimcc -I/work/c-toxcore/toxcore -c crash.c 2>&1 | grep "file_exists: Assertion"

external/toxcore/c-toxcore/other/docker/slimcc/run

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -eux
+BUILD=slimcc
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/slimcc/slimcc.Dockerfile

@@ -0,0 +1,44 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM ubuntu:22.04
+
+RUN apt-get update && \
+ DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
+ ca-certificates \
+ gcc \
+ git \
+ libc-dev \
+ libopus-dev \
+ libsodium-dev \
+ libvpx-dev \
+ make \
+ pkg-config \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
+
+# Uncomment this to find bugs in slimcc using creduce.
+#RUN apt-get update && \
+# DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
+# creduce \
+# && apt-get clean \
+# && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work/slimcc
+RUN ["git", "clone", "https://github.com/fuhsnn/slimcc", "/work/slimcc"]
+# Comment this to checkout master (e.g. to find bugs using creduce).
+RUN ["git", "checkout", "ac9ddf4d39642e6b4880b1a73e19c6f2769d857e"]
+RUN ["make", "CFLAGS=-O3", "-j4"]
+
+WORKDIR /work/c-toxcore
+COPY --from=sources /src/ /work/c-toxcore
+
+# Uncomment this to find bugs in slimcc using creduce.
+#COPY other/docker/slimcc/creduce.sh /work/c-toxcore/other/docker/slimcc/
+#RUN cp toxcore/ccompat.h crash.c \
+# && other/docker/slimcc/creduce.sh \
+# && creduce other/docker/slimcc/creduce.sh crash.c
+
+COPY other/docker/slimcc/Makefile /work/c-toxcore/
+RUN ["make"]
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN ./send_message_test | grep "tox clients connected"

external/toxcore/c-toxcore/other/docker/sources/Dockerfile

@@ -1,17 +0,0 @@
-FROM scratch
-
-# Roughly in order of change frequency.
-COPY third_party/ /src/third_party/
-COPY .github/scripts/flags*.sh /src/.github/scripts/
-COPY other/proxy/ /src/other/proxy/
-COPY cmake/ /src/cmake/
-COPY other/bootstrap_daemon/ /src/other/bootstrap_daemon/
-COPY other/pkgconfig/ /src/other/pkgconfig/
-COPY other/rpm/ /src/other/rpm/
-COPY other/*.[ch] /src/other/
-COPY CMakeLists.txt so.version /src/
-COPY toxencryptsave/ /src/toxencryptsave/
-COPY testing/ /src/testing/
-COPY toxav/ /src/toxav/
-COPY toxcore/ /src/toxcore/
-COPY auto_tests/ /src/auto_tests/

external/toxcore/c-toxcore/other/docker/sources/build

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eux
+BUILD=sources
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/sources/run.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+# Common docker build script usable by many builds in the other/docker
+# directory. We're using a common dockerignore that ignores everything except
+# sources and CMake scripts. Subdirectories can contain a "dockerignore" file
+# (note the missing "." at the start) that will be pasted to the end of the
+# common dockerignore file. This way, we can use "COPY ." and get all the
+# files we need at once, which is much faster, more flexible, and less
+# error-prone than manually writing lots of COPY directives.
+
+SOURCESDIR="$(dirname "${BASH_SOURCE[0]}")"
+DOCKERDIR="$(dirname "${BASH_SOURCE[1]}")"
+BUILD="$(basename "$DOCKERDIR")"
+
+set -eux
+cat "$SOURCESDIR/sources.Dockerfile.dockerignore" >"$DOCKERDIR/$BUILD.Dockerfile.dockerignore"
+if [ -f "$DOCKERDIR/dockerignore" ]; then
+  cat "$DOCKERDIR/dockerignore" >>"$DOCKERDIR/$BUILD.Dockerfile.dockerignore"
+fi
+
+docker build "${DOCKERFLAGS[@]}" -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/sources/sources.Dockerfile

@@ -0,0 +1,2 @@
+FROM scratch
+COPY . /src/

external/toxcore/c-toxcore/other/docker/sources/sources.Dockerfile.dockerignore

@@ -0,0 +1,23 @@
+# ===== common =====
+# Ignore everything ...
+**/*
+# ... except sources
+!**/*.[ch]
+!**/*.cc
+!**/*.hh
+!CHANGELOG.md
+!LICENSE
+!README.md
+!auto_tests/data/*
+!other/bootstrap_daemon/bash-completion/**
+!other/bootstrap_daemon/tox-bootstrapd.*
+!other/proxy/*.mod
+!other/proxy/*.sum
+!other/proxy/*.go
+# ... and CMake build files (used by most builds).
+!**/CMakeLists.txt
+!.github/scripts/flags*.sh
+!cmake/*.cmake
+!other/pkgconfig/*
+!other/rpm/*
+!so.version

external/toxcore/c-toxcore/other/docker/sparse/.gitignore

@@ -0,0 +1 @@
+!/Makefile

external/toxcore/c-toxcore/other/docker/sparse/Makefile

@@ -0,0 +1,70 @@
+SOURCES		:= $(wildcard tox*/*.c tox*/*/*.c) \
+		   third_party/cmp/cmp.c
+OBJECTS		:= $(SOURCES:.c=.o)
+
+CFLAGS		:= $(shell pkg-config --cflags libsodium opus vpx)
+CPPFLAGS	:= -DSPARSE -DTCP_SERVER_USE_EPOLL=1 -DMIN_LOGGER_LEVEL=LOGGER_LEVEL_TRACE
+
+SPARSE_FLAGS	:=				\
+	-Wsparse-error				\
+	-Wpedantic				\
+	-Waddress				\
+	-Waddress-space				\
+	-Wbitwise				\
+	-Wbitwise-pointer			\
+	-Wcast-from-as				\
+	-Wcast-to-as				\
+	-Wcast-truncate				\
+	-Wconstant-suffix			\
+	-Wconstexpr-not-const			\
+	-Wcontext				\
+	-Wdecl					\
+	-Wdefault-bitfield-sign			\
+	-Wdesignated-init			\
+	-Wdo-while				\
+	-Wenum-mismatch				\
+	-Wexternal-function-has-definition	\
+	-Wflexible-array-array			\
+	-Wflexible-array-nested			\
+	-Wflexible-array-union			\
+	-Wimplicit-int				\
+	-Winit-cstring				\
+	-Wint-to-pointer-cast			\
+	-Wmemcpy-max-count			\
+	-Wnon-pointer-null			\
+	-Wnewline-eof				\
+	-Wold-initializer			\
+	-Wold-style-definition			\
+	-Wone-bit-signed-bitfield		\
+	-Woverride-init				\
+	-Woverride-init-all			\
+	-Wparen-string				\
+	-Wpast-deep-designator			\
+	-Wpedantic				\
+	-Wpointer-to-int-cast			\
+	-Wptr-subtraction-blows			\
+	-Wreturn-void				\
+	-Wshadow				\
+	-Wshift-count-negative			\
+	-Wshift-count-overflow			\
+	-Wsizeof-bool				\
+	-Wstrict-prototypes			\
+	-Wpointer-arith				\
+	-Wsparse-error				\
+	-Wtautological-compare			\
+	-Wtransparent-union			\
+	-Wtypesign				\
+	-Wundef					\
+	-Wuninitialized				\
+	-Wunion-cast				\
+	-Wvla
+
+SMATCH_FLAGS := $(foreach i,$(shell smatch --show-checks | grep -o 'check_.*'),--enable=$i)
+
+analyse: $(OBJECTS)
+
+%.o: %.c
+	@echo "Processing $<"
+	@sparse $(CFLAGS) $(CPPFLAGS) $(SPARSE_FLAGS) $<
+#	@smatch $(CFLAGS) $(CPPFLAGS) $(SMATCH_FLAGS) $<
+#	@sparse-llvm $(CFLAGS) $(CPPFLAGS) $< > /dev/null

external/toxcore/c-toxcore/other/docker/sparse/local.mk

@@ -0,0 +1 @@
+CFLAGS=-O3 -g -Wno-discarded-qualifiers -Wno-format-truncation -Wno-stringop-truncation -Wno-uninitialized -Wno-unused -Wno-unused-result

external/toxcore/c-toxcore/other/docker/sparse/run

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -eux
+BUILD=sparse
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/sparse/sparse.Dockerfile

@@ -0,0 +1,35 @@
+FROM toxchat/c-toxcore:sources AS sources
+FROM ubuntu:22.04
+
+RUN apt-get update && \
+ DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
+ ca-certificates \
+ creduce \
+ g++ \
+ gcc \
+ git \
+ libc-dev \
+ libopus-dev \
+ libsodium-dev \
+ libsqlite3-dev \
+ libssl-dev \
+ libvpx-dev \
+ llvm-dev \
+ make \
+ pkg-config \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work/smatch
+RUN git clone --depth=1 https://repo.or.cz/smatch.git /work/smatch
+COPY other/docker/sparse/local.mk /work/smatch/local.mk
+RUN make install -j4 PREFIX=/usr/local
+
+WORKDIR /work/c-toxcore
+COPY --from=sources /src/ /work/c-toxcore
+#COPY other/make_single_file /work/c-toxcore/other/
+#RUN other/make_single_file auto_tests/tox_new_test.c > crash.c
+#RUN sparsec $(pkg-config --cflags --libs libsodium opus vpx) crash.c
+
+COPY other/docker/sparse/Makefile /work/c-toxcore/
+RUN make -j4

external/toxcore/c-toxcore/other/docker/tcc/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=tcc
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/tcc/tcc.Dockerfile

@@ -1,3 +1,4 @@
+FROM toxchat/c-toxcore:sources AS sources
 FROM ubuntu:22.04
 
 RUN apt-get update && \
@@ -12,12 +13,7 @@ RUN apt-get update && \
  && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /work
-COPY auto_tests/ /work/auto_tests/
-COPY testing/ /work/testing/
-COPY toxav/ /work/toxav/
-COPY toxcore/ /work/toxcore/
-COPY toxencryptsave/ /work/toxencryptsave/
-COPY third_party/ /work/third_party/
+COPY --from=sources /src/ /work/
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 

external/toxcore/c-toxcore/other/docker/tokstyle/run

@@ -2,4 +2,5 @@
 
 set -eux
 BUILD=tokstyle
-docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
+other/docker/sources/build
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/$BUILD.Dockerfile" .

external/toxcore/c-toxcore/other/docker/tokstyle/tokstyle.Dockerfile

@@ -1,3 +1,4 @@
+FROM toxchat/c-toxcore:sources AS sources
 FROM toxchat/haskell:hs-tokstyle AS tokstyle
 FROM ubuntu:22.04
 
@@ -15,8 +16,11 @@ RUN apt-get update && \
 COPY --from=tokstyle /bin/check-c /bin/
 RUN ["git", "clone", "--depth=1", "https://github.com/TokTok/hs-tokstyle", "/src/workspace/hs-tokstyle"]
 
-COPY toxav/ /src/workspace/c-toxcore/toxav/
-COPY toxcore/ /src/workspace/c-toxcore/toxcore/
-COPY toxencryptsave/ /src/workspace/c-toxcore/toxencryptsave/
-COPY third_party/cmp/cmp.h /src/workspace/c-toxcore/third_party/cmp/cmp.h
-RUN /bin/check-c $(find /src/workspace/c-toxcore -name "*.c")
+COPY --from=sources /src/ /src/workspace/c-toxcore/
+RUN /bin/check-c $(find /src/workspace/c-toxcore -name "*.c" \
+ -and -not -wholename "*/auto_tests/*" \
+ -and -not -wholename "*/other/*" \
+ -and -not -wholename "*/super_donators/*" \
+ -and -not -wholename "*/testing/*" \
+ -and -not -wholename "*/third_party/cmp/examples/*" \
+ -and -not -wholename "*/third_party/cmp/test/*")

external/toxcore/c-toxcore/other/docker/windows/Dockerfile

@@ -1,10 +1,13 @@
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
+
+# When editing, make sure to update /other/windows_build_script_toxcore.sh and
+# INSTALL.md to match.
 
 # Build-time environment variables
-ARG VERSION_MSGPACK=4.0.0 \
+ARG VERSION_OPUS=1.4 \
     VERSION_SODIUM=1.0.19 \
-    VERSION_OPUS=1.3.1 \
-    VERSION_VPX=1.11.0 \
+    VERSION_VPX=1.14.0 \
+    ENABLE_HASH_VERIFICATION=true \
  \
     SUPPORT_TEST=false \
     SUPPORT_ARCH_i686=true \
@@ -18,6 +21,7 @@ ENV SUPPORT_TEST=${SUPPORT_TEST} \
     CROSS_COMPILE=${CROSS_COMPILE}
 
 WORKDIR /work
+COPY check_sha256.sh .
 COPY get_packages.sh .
 RUN ./get_packages.sh
 
@@ -30,6 +34,6 @@ ENV ENABLE_TEST=false \
     ALLOW_TEST_FAILURE=false \
     ENABLE_ARCH_i686=true \
     ENABLE_ARCH_x86_64=true \
-    EXTRA_CMAKE_FLAGS="-DTEST_TIMEOUT_SECONDS=90"
+    EXTRA_CMAKE_FLAGS="-DTEST_TIMEOUT_SECONDS=90 -DUSE_IPV6=OFF"
 
 ENTRYPOINT ["bash", "./build_toxcore.sh"]

external/toxcore/c-toxcore/other/docker/windows/build_dependencies.sh

@@ -7,6 +7,8 @@ fi
 
 #=== Cross-Compile Dependencies ===
 
+. ./check_sha256.sh
+
 build() {
   ARCH=${1}
 
@@ -21,7 +23,7 @@ build() {
   mkdir -p "$PREFIX_DIR"
 
   export MAKEFLAGS=j"$(nproc)"
-  export CFLAGS=-O3
+  export CFLAGS="-O3 -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -ftrivial-auto-var-init=zero -fPIE -pie -fstack-protector-strong -fstack-clash-protection -fcf-protection=full"
 
   CURL_OPTIONS=(-L --connect-timeout 10)
 
@@ -41,19 +43,42 @@ build() {
   echo
   echo "=== Building Sodium $VERSION_SODIUM $ARCH ==="
   curl "${CURL_OPTIONS[@]}" -O "https://github.com/jedisct1/libsodium/releases/download/$VERSION_SODIUM-RELEASE/libsodium-$VERSION_SODIUM.tar.gz"
+  check_sha256 "018d79fe0a045cca07331d37bd0cb57b2e838c51bc48fd837a1472e50068bbea" "libsodium-$VERSION_SODIUM.tar.gz"
   tar -xf "libsodium-$VERSION_SODIUM.tar.gz"
   cd "libsodium-stable"
-  ./configure --host="$WINDOWS_TOOLCHAIN" --prefix="$PREFIX_DIR" --disable-shared --enable-static
+  ./configure \
+    --host="$WINDOWS_TOOLCHAIN" \
+    --prefix="$PREFIX_DIR" \
+    --disable-shared \
+    --enable-static
   make
   make install
   cd ..
 
   echo
   echo "=== Building Opus $VERSION_OPUS $ARCH ==="
-  curl "${CURL_OPTIONS[@]}" -O "https://archive.mozilla.org/pub/opus/opus-$VERSION_OPUS.tar.gz"
+  if [ "$ARCH" = "i686" ]; then
+    LIB_OPUS_CFLAGS=""
+  else
+    # This makes the build work with -fstack-clash-protection, as otherwise it crashes with:
+    # silk/float/encode_frame_FLP.c: In function 'silk_encode_frame_FLP':
+    # silk/float/encode_frame_FLP.c:379:1: internal compiler error: in i386_pe_seh_unwind_emit, at config/i386/winnt.cc:1274
+    # Should get patched in a future gcc version: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458
+    LIB_OPUS_CFLAGS="-fno-asynchronous-unwind-tables"
+  fi
+
+  curl "${CURL_OPTIONS[@]}" -O "https://ftp.osuosl.org/pub/xiph/releases/opus/opus-$VERSION_OPUS.tar.gz"
+  check_sha256 "c9b32b4253be5ae63d1ff16eea06b94b5f0f2951b7a02aceef58e3a3ce49c51f" "opus-$VERSION_OPUS.tar.gz"
   tar -xf "opus-$VERSION_OPUS.tar.gz"
   cd "opus-$VERSION_OPUS"
-  ./configure --host="$WINDOWS_TOOLCHAIN" --prefix="$PREFIX_DIR" --disable-extra-programs --disable-doc --disable-shared --enable-static
+  CFLAGS="$CFLAGS $LIB_OPUS_CFLAGS" \
+    ./configure \
+    --host="$WINDOWS_TOOLCHAIN" \
+    --prefix="$PREFIX_DIR" \
+    --disable-extra-programs \
+    --disable-doc \
+    --disable-shared \
+    --enable-static
   make
   make install
   cd ..
@@ -72,9 +97,19 @@ build() {
     LIB_VPX_CFLAGS="-fno-asynchronous-unwind-tables"
   fi
   curl "${CURL_OPTIONS[@]}" "https://github.com/webmproject/libvpx/archive/v$VERSION_VPX.tar.gz" -o "libvpx-$VERSION_VPX.tar.gz"
+  check_sha256 "5f21d2db27071c8a46f1725928a10227ae45c5cd1cad3727e4aafbe476e321fa" "libvpx-$VERSION_VPX.tar.gz"
   tar -xf "libvpx-$VERSION_VPX.tar.gz"
   cd "libvpx-$VERSION_VPX"
-  CFLAGS="$LIB_VPX_CFLAGS" CROSS="$WINDOWS_TOOLCHAIN"- ./configure --target="$LIB_VPX_TARGET" --prefix="$PREFIX_DIR" --disable-examples --disable-unit-tests --disable-shared --enable-static
+  CFLAGS="$CFLAGS $LIB_VPX_CFLAGS" \
+    CROSS="$WINDOWS_TOOLCHAIN"- \
+    ./configure \
+    --target="$LIB_VPX_TARGET" \
+    --prefix="$PREFIX_DIR" \
+    --disable-examples \
+    --disable-unit-tests \
+    --disable-tools \
+    --disable-shared \
+    --enable-static
   make
   make install
   cd ..

external/toxcore/c-toxcore/other/docker/windows/build_toxcore.sh

@@ -2,6 +2,9 @@
 
 set -e -x
 
+# Note: when modifying this script, don't forget to update the appropriate
+#       parts of the cross-compilation section of the INSTALL.md.
+
 #=== Cross-Compile Toxcore ===
 
 build() {
@@ -23,13 +26,8 @@ build() {
 
   rm -rf /tmp/*
 
-  # where to install static/shared toxcores before deciding whether they should be copied over to the user
-  STATIC_TOXCORE_PREFIX_DIR="/tmp/static_prefix"
-  SHARED_TOXCORE_PREFIX_DIR="/tmp/shared_prefix"
-  mkdir -p "$STATIC_TOXCORE_PREFIX_DIR" "$SHARED_TOXCORE_PREFIX_DIR"
-
   export MAKEFLAGS=j"$(nproc)"
-  export CFLAGS=-O3
+  export CFLAGS="-D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -ftrivial-auto-var-init=zero -fPIE -pie -fstack-protector-strong -fstack-clash-protection -fcf-protection=full"
 
   echo
   echo "=== Building toxcore $ARCH ==="
@@ -61,19 +59,39 @@ build() {
     echo "SET(CROSSCOMPILING_EMULATOR /usr/bin/wine)" >>windows_toolchain.cmake
   fi
 
+  if [ "$ARCH" = "i686" ]; then
+    TOXCORE_CFLAGS=""
+  else
+    # This makes the build work with -fstack-clash-protection, as otherwise it crashes with:
+    #/tmp/toxcore/toxcore/logger.c: In function 'logger_abort':
+    #/tmp/toxcore/toxcore/logger.c:124:1: internal compiler error: in seh_emit_stackalloc, at config/i386/winnt.cc:1055
+    # Should get patched in a future gcc version: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458
+    TOXCORE_CFLAGS="-fno-asynchronous-unwind-tables"
+  fi
+
+  # Patch CMakeLists.txt to make cracker.exe statically link against OpenMP. For some reason
+  # -DCMAKE_EXE_LINKER_FLAGS="-static" doesn't do it.
+  sed -i "s|OpenMP::OpenMP_C)|$(realpath -- /usr/lib/gcc/"$WINDOWS_TOOLCHAIN"/*-win32/libgomp.a) \${CMAKE_THREAD_LIBS_INIT})\ntarget_compile_options(cracker PRIVATE -fopenmp)|g" ../other/fun/CMakeLists.txt
+
   # Silly way to bypass a shellharden check
   read -ra EXTRA_CMAKE_FLAGS_ARRAY <<<"$EXTRA_CMAKE_FLAGS"
-  cmake -DCMAKE_TOOLCHAIN_FILE=windows_toolchain.cmake \
-    -DCMAKE_INSTALL_PREFIX="$STATIC_TOXCORE_PREFIX_DIR" \
-    -DENABLE_SHARED=OFF \
+  CFLAGS="$CFLAGS $TOXCORE_CFLAGS" \
+    cmake \
+    -DCMAKE_TOOLCHAIN_FILE=windows_toolchain.cmake \
+    -DCMAKE_INSTALL_PREFIX="$RESULT_PREFIX_DIR" \
+    -DCMAKE_BUILD_TYPE="Release" \
+    -DENABLE_SHARED=ON \
     -DENABLE_STATIC=ON \
-    -DCMAKE_C_FLAGS="$CMAKE_C_FLAGS" \
-    -DCMAKE_CXX_FLAGS="$CMAKE_CXX_FLAGS" \
-    -DCMAKE_EXE_LINKER_FLAGS="$CMAKE_EXE_LINKER_FLAGS -fstack-protector" \
-    -DCMAKE_SHARED_LINKER_FLAGS="$CMAKE_SHARED_LINKER_FLAGS" \
+    -DSTRICT_ABI=ON \
+    -DEXPERIMENTAL_API=ON \
+    -DBUILD_FUN_UTILS=ON \
+    -DCMAKE_EXE_LINKER_FLAGS="-static" \
+    -DCMAKE_SHARED_LINKER_FLAGS="-static" \
     "${EXTRA_CMAKE_FLAGS_ARRAY[@]}" \
     -S ..
-  cmake --build . --target install -- -j"$(nproc)"
+  cmake --build . --target install --parallel "$(nproc)"
+  # CMake doesn't install fun utils, so do it manually
+  cp -a other/fun/*.exe "$RESULT_PREFIX_DIR/bin/"
 
   if [ "$ENABLE_TEST" = "true" ]; then
     rm -rf /root/.wine
@@ -87,10 +105,12 @@ build() {
 
     winecfg
     export CTEST_OUTPUT_ON_FAILURE=1
-    # add libgcc_s_sjlj-1.dll libwinpthread-1.dll into PATH env var of wine
+    # we don't have to do this since autotests are statically compiled now,
+    # but just in case add MinGW-w64 dll locations to the PATH anyway
     export WINEPATH="$(
-      cd /usr/lib/gcc/"$WINDOWS_TOOLCHAIN"/*posix/
+      cd /usr/lib/gcc/"$WINDOWS_TOOLCHAIN"/*win32/
       winepath -w "$PWD"
+      cd -
     )"\;"$(winepath -w /usr/"$WINDOWS_TOOLCHAIN"/lib/)"
 
     if [ "$ALLOW_TEST_FAILURE" = "true" ]; then
@@ -102,47 +122,48 @@ build() {
     fi
   fi
 
-  # move static dependencies
-  cp -a "$STATIC_TOXCORE_PREFIX_DIR"/* "$RESULT_PREFIX_DIR"
-  cp -a "$DEP_PREFIX_DIR"/* "$RESULT_PREFIX_DIR"
-
-  # make libtox.dll
-  cd "$SHARED_TOXCORE_PREFIX_DIR"
-  for archive in "$STATIC_TOXCORE_PREFIX_DIR"/lib/libtox*.a; do
-    "$WINDOWS_TOOLCHAIN"-ar xv "$archive"
+  # generate def, lib and exp as they supposedly help with linking against the dlls,
+  # especially the lib is supposed to be of great help when linking on msvc.
+  # cd in order to keep the object names inside .lib and .dll.a short
+  cd "$RESULT_PREFIX_DIR"/bin/
+  for TOX_DLL in *.dll; do
+    gendef - "$TOX_DLL" >"${TOX_DLL%.*}.def"
+    # we overwrite the CMake-generated .dll.a for the better
+    # compatibility with the .lib being generated here
+    "$WINDOWS_TOOLCHAIN"-dlltool \
+      --input-def "${TOX_DLL%.*}.def" \
+      --output-lib "${TOX_DLL%.*}.lib" \
+      --output-exp "${TOX_DLL%.*}.exp" \
+      --output-delaylib "../lib/${TOX_DLL%.*}.dll.a" \
+      --dllname "$TOX_DLL"
   done
+  cd -
 
+  # copy over the deps
   if [ "$CROSS_COMPILE" = "true" ]; then
     LIBWINPTHREAD="/usr/$WINDOWS_TOOLCHAIN/lib/libwinpthread.a"
+    cd /usr/lib/gcc/"$WINDOWS_TOOLCHAIN"/*win32/
+    LIBSSP="$PWD/libssp.a"
+    cd -
   else
     LIBWINPTHREAD="/usr/$WINDOWS_TOOLCHAIN/sys-root/mingw/lib/libwinpthread.a"
+    LIBSSP="/usr/$WINDOWS_TOOLCHAIN/sys-root/mingw/lib/libssp.a"
   fi
+  cp -a "$LIBWINPTHREAD" "$LIBSSP" "$RESULT_PREFIX_DIR/lib/"
+  for STATIC_LIB in "$DEP_PREFIX_DIR"/lib/*.a; do
+    [[ "$STATIC_LIB" == *.dll.a ]] && continue
+    cp -a "$STATIC_LIB" "$RESULT_PREFIX_DIR/lib/"
+  done
+  cp "$DEP_PREFIX_DIR"/lib/pkgconfig/* "$RESULT_PREFIX_DIR/lib/pkgconfig/"
 
-  "$WINDOWS_TOOLCHAIN"-gcc -Wl,--export-all-symbols \
-    -Wl,--out-implib=libtox.dll.a \
-    -shared \
-    -o libtox.dll \
-    *.obj \
-    "$STATIC_TOXCORE_PREFIX_DIR"/lib/*.a \
-    "$DEP_PREFIX_DIR"/lib/*.a \
-    "$LIBWINPTHREAD" \
-    -liphlpapi \
-    -lws2_32 \
-    -static-libgcc \
-    -lssp
-  cp libtox.dll.a "$RESULT_PREFIX_DIR"/lib
-  mkdir -p "$RESULT_PREFIX_DIR"/bin
-  cp libtox.dll "$RESULT_PREFIX_DIR"/bin
+  # strip everything
+  set +e
+  "$WINDOWS_TOOLCHAIN"-strip --strip-unneeded "$RESULT_PREFIX_DIR"/bin/*.* "$RESULT_PREFIX_DIR"/lib/*.*
+  set -e
 
   rm -rf /tmp/*
 
-  # remove everything from include directory except tox headers
-  mv "$RESULT_PREFIX_DIR"/include/tox "$RESULT_PREFIX_DIR"/tox
-  rm -rf "$RESULT_PREFIX_DIR"/include/*
-  mv "$RESULT_PREFIX_DIR"/tox "$RESULT_PREFIX_DIR"/include/tox
-
   sed -i "s|^prefix=.*|prefix=$RESULT_PREFIX_DIR|g" "$RESULT_PREFIX_DIR"/lib/pkgconfig/*.pc
-  sed -i "s|^libdir=.*|libdir=$RESULT_PREFIX_DIR/lib|g" "$RESULT_PREFIX_DIR"/lib/*.la
 }
 
 #=== Test Supported vs. Enabled ===

external/toxcore/c-toxcore/other/docker/windows/check_sha256.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+check_sha256() {
+  [ "$ENABLE_HASH_VERIFICATION" = "true" ] && _check_sha256 "$@"
+}
+
+_check_sha256() {
+  if ! (echo "$1  $2" | sha256sum -c --status -); then
+    echo "Error: sha256 of $2 doesn't match the known one."
+    echo "Expected: $1  $2"
+    echo "Got: $(sha256sum "$2")"
+    return 1
+  fi
+  echo "sha256 matches the expected one: $1"
+  return 0
+}

external/toxcore/c-toxcore/other/docker/windows/get_packages.sh

@@ -1,10 +1,11 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
 set -e -x
 
 #=== Install Packages ===
 
 apt-get update
+apt-get upgrade -y
 
 # Arch-independent packages required for building toxcore's dependencies and toxcore itself
 apt-get install -y \
@@ -13,9 +14,10 @@ apt-get install -y \
   ca-certificates \
   cmake \
   curl \
-  libtool \
   libc-dev \
+  libtool \
   make \
+  mingw-w64-tools \
   pkg-config \
   tree \
   yasm
@@ -38,12 +40,27 @@ if [ "$SUPPORT_TEST" = "true" ]; then
   apt-get install -y \
     texinfo
 
+  CURL_OPTIONS=(-L --connect-timeout 10)
+
+  # While we would prefer to use Debian's Wine packages, use WineHQ's packages
+  # instead as Debian Bookworm's Wine crashes when creating a 64-bit prefix.
+  # see https://github.com/TokTok/c-toxcore/pull/2713#issuecomment-1967319113
+  # for the crash details
+  curl "${CURL_OPTIONS[@]}" -o /etc/apt/keyrings/winehq-archive.key \
+    https://dl.winehq.org/wine-builds/winehq.key
+  curl "${CURL_OPTIONS[@]}" -O --output-dir /etc/apt/sources.list.d/ \
+    https://dl.winehq.org/wine-builds/debian/dists/bookworm/winehq-bookworm.sources
+
+  . ./check_sha256.sh
+  check_sha256 "78b185fabdb323971d13bd329fefc8038e08559aa51c4996de18db0639a51df6" \
+    "/etc/apt/keyrings/winehq-archive.key"
+  check_sha256 "8dd8ef66c749d56e798646674c1c185a99b3ed6727ca0fbb5e493951e66c0f9e" \
+    "/etc/apt/sources.list.d/winehq-bookworm.sources"
+
   dpkg --add-architecture i386
   apt-get update
   apt-get install -y \
-    wine \
-    wine32 \
-    wine64
+    winehq-stable
 fi
 
 # Clean up to reduce image size