wolfSSL · gasbytes · Jun 22, 2026
diff --git a/.github/workflows/fwupd.yml b/.github/workflows/fwupd.yml
@@ -93,12 +93,10 @@ jobs:
 
       - name: Build fwupd at ${{ matrix.fwupd_ref }}
         run: |
-          git clone https://github.com/fwupd/fwupd.git
-          cd fwupd
-          git checkout ${{ matrix.fwupd_ref }}
+          git clone --depth=1 --branch ${{ matrix.fwupd_ref }} https://github.com/fwupd/fwupd.git
 
       - name: Patch fwupd tests for Debian Bookworm compatibility
-        if: matrix.fwupd_ref != '1.9.26' matrix.fwupd_ref != 'master'
+        if: matrix.fwupd_ref != '1.9.26'
         working-directory: fwupd
         run: |
           # GLib in Debian Bookworm emits WARNING for invalid properties while
@@ -107,7 +105,11 @@ jobs:
           # This gets applied only for the latest version and the latest main branch,
           # target version remains untouched since it's using the correct older version
           # of glib that matches the one on debian:bookworm.
-          sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-self-test.c
+          if [ "${{ matrix.fwupd_ref }}" != "main" ]; then
+            sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-self-test.c
+          else
+            sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-client-test.c
+          fi
 
       - name: Configure fwupd
         working-directory: fwupd

diff --git a/.github/workflows/gst-libav1.0.yml b/.github/workflows/gst-libav1.0.yml
@@ -84,9 +84,8 @@ jobs:
         if: steps.cache-gstreamer.outputs.cache-hit != 'true'
         run: |
           pip3 install --break-system-packages meson ninja
-          git clone https://github.com/GStreamer/gstreamer.git gstreamer-source
+          git clone --depth=1 --branch 1.26.2 https://github.com/GStreamer/gstreamer.git gstreamer-source
           cd gstreamer-source
-          git checkout 1.26.2
           meson setup build \
             --prefix=/opt/gstreamer \
             --libdir=lib \
@@ -108,9 +107,8 @@ jobs:
       - name: Build FFmpeg with GnuTLS & MPEG-4 encoder
         run: |
           cd $RUNNER_WORKSPACE
-          git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg-gnutls
+          git clone --depth=1 --branch n8.1 https://github.com/FFmpeg/FFmpeg.git ffmpeg-gnutls
           cd ffmpeg-gnutls
-          git checkout n8.1
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/gstreamer/lib/pkgconfig"
           export CPPFLAGS="-I/opt/gnutls/include -I/opt/gstreamer/include"
           export LDFLAGS="-L/opt/gnutls/lib -L/opt/gstreamer/lib -Wl,-rpath,/opt/gnutls/lib -Wl,-rpath,/opt/gstreamer/lib"
@@ -141,10 +139,7 @@ jobs:
           done
       - name: Clone & checkout gst-libav1.0 @ ${{ matrix.gst_ref }}
         run: |
-          git clone https://salsa.debian.org/gstreamer-team/gst-libav1.0.git gst-libav
-          cd gst-libav
-          git fetch --tags
-          git checkout ${{ matrix.gst_ref }}
+          git clone --depth=1 --branch ${{ matrix.gst_ref }} https://salsa.debian.org/gstreamer-team/gst-libav1.0.git gst-libav
       - name: Build gst-libav1.0 (${{ matrix.gst_ref }})
         working-directory: gst-libav
         run: |

diff --git a/.github/workflows/libcamera.yml b/.github/workflows/libcamera.yml
@@ -76,11 +76,7 @@ jobs:
 
       - name: Checkout libcamera at ${{ matrix.libcamera_ref }}
         run: |
-          git clone https://git.libcamera.org/libcamera/libcamera.git
-          cd libcamera
-          if [ "${{ matrix.libcamera_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libcamera_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libcamera_ref }} https://gitlab.freedesktop.org/camera/libcamera.git
 
       - name: Configure and build libcamera
         working-directory: libcamera

diff --git a/.github/workflows/libcups.yml b/.github/workflows/libcups.yml
@@ -77,9 +77,8 @@ jobs:
       - name: Clone and build LibCUPS latest release
         if: matrix.cups_version == 'latest'
         run: |
-          git clone --recurse-submodules https://github.com/OpenPrinting/libcups.git
+          git clone --depth=1 --branch v3.0rc4 --recurse-submodules --shallow-submodules https://github.com/OpenPrinting/libcups.git
           cd libcups
-          git checkout v3.0rc4
 
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:$PKG_CONFIG_PATH"
           export CPPFLAGS="-I/opt/gnutls/include $CPPFLAGS"
@@ -96,9 +95,8 @@ jobs:
       - name: Clone and build CUPS target release (v2.4.2)
         if: matrix.cups_version == 'target'
         run: |
-          git clone https://github.com/OpenPrinting/cups.git
+          git clone --depth=1 --branch v2.4.2 https://github.com/OpenPrinting/cups.git
           cd cups
-          git checkout v2.4.2
 
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:$PKG_CONFIG_PATH"
           export CPPFLAGS="-I/opt/gnutls/include $CPPFLAGS"

diff --git a/.github/workflows/libjcat.yml b/.github/workflows/libjcat.yml
@@ -76,11 +76,7 @@ jobs:
 
       - name: Checkout libjcat at ${{ matrix.libjcat_ref }}
         run: |
-          git clone https://github.com/hughsie/libjcat.git
-          cd libjcat
-          if [ "${{ matrix.libjcat_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libjcat_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libjcat_ref }} https://github.com/hughsie/libjcat.git
 
       - name: Configure and build libjcat
         working-directory: libjcat

diff --git a/.github/workflows/libnice.yml b/.github/workflows/libnice.yml
@@ -51,11 +51,7 @@ jobs:
 
       - name: Clone libnice @ ref
         run: |
-          git clone https://github.com/libnice/libnice.git
-          cd libnice
-          if [ "${{ matrix.libnice_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libnice_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libnice_ref }} https://github.com/libnice/libnice.git
 
       - name: Configure & build with Meson/Ninja
         working-directory: libnice

diff --git a/.github/workflows/libvnc.yml b/.github/workflows/libvnc.yml
@@ -71,11 +71,7 @@ jobs:
 
       - name: Checkout libvnc at ${{ matrix.libvnc_ref }}
         run: |
-          git clone https://github.com/LibVNC/libvncserver.git
-          cd libvncserver
-          if [ "${{ matrix.libvnc_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libvnc_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libvnc_ref }} https://github.com/LibVNC/libvncserver.git
 
       - name: Configure and build libvncserver
         working-directory: libvncserver

diff --git a/.github/workflows/libvte.yml b/.github/workflows/libvte.yml
@@ -74,11 +74,7 @@ jobs:
 
       - name: Checkout VTE at ${{ matrix.vte_ref }}
         run: |
-          git clone https://github.com/GNOME/vte.git
-          cd vte
-          if [ "${{ matrix.vte_ref }}" != "master" ]; then
-            git checkout ${{ matrix.vte_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.vte_ref }} https://github.com/GNOME/vte.git
 
       - name: Configure and build VTE
         working-directory: vte

diff --git a/.github/workflows/networkmanager.yml b/.github/workflows/networkmanager.yml
@@ -20,131 +20,123 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        nm_version: [ master, "1.52.0", "1.42.4" ]
+        nm_version: [ main, "1.52.0", "1.42.4" ]
 
     steps:
-    # ────────────────────────── checkout + packages ─────────────────────────
-    - name: Checkout repo
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Install build dependencies
-      run: |
-        apt-get update -qq
-        apt-get install --yes --no-install-recommends \
-          autoconf automake libtool m4 pkg-config build-essential git \
-          meson ninja-build gettext clang gperf gnulib autopoint gtk-doc-tools \
-          nettle-dev libtasn1-bin libtasn1-6-dev libunistring-dev libnvme-dev \
-          libp11-kit-dev libunbound-dev bison python3-yaml \
-          debhelper debugedit dh-autoreconf dh-strip-nondeterminism dwz intltool \
-          libbluetooth-dev libdebhelper-perl libndp-dev \
-          libfile-stripnondeterminism-perl libglib2.0-doc \
-          libnewt-dev libnl-3-dev libnl-cli-3-200 libnl-nf-3-200 libgirepository1.0-dev \
-          libpolkit-agent-1-dev libslang2-dev libsub-override-perl libdbus-1-dev ppp ppp-dev mobile-broadband-provider-info \
-          libteam-dev libteam5 libyaml-perl po-debconf libaudit-dev libudev-dev libsystemd-dev libmm-glib-dev libjansson-dev dhcpcd5 dnsmasq-base libpsl-dev libreadline-dev valac sudo git wget
-
-    # ──────────────────────── cache the tool-chain ─────────────────────────
-    - name: Restore cached gnutls-wolfssl
-      id: cache-gnutls
-      uses: actions/cache@v4
-      with:
-        path: |
-          /opt/gnutls
-          /opt/wolfssl
-          /opt/wolfssl-gnutls-wrapper
-        key: gnutls-wolfssl-${{ runner.os }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
-        restore-keys: |
-          gnutls-wolfssl-${{ runner.os }}-
-
-    # ───────────────── build the forked GnuTLS stack (if needed) ───────────
-    - name: Build forked GnuTLS stack
-      if: steps.cache-gnutls.outputs.cache-hit != 'true'
-      run: |
-        LOGGING=0 GNUTLS_INSTALL=/opt/gnutls WOLFSSL_INSTALL=/opt/wolfssl ./setup.sh
-        test -d /opt/gnutls && test -d /opt/wolfssl
-
-    # ───────────────────────────── curl build ──────────────────────────────
-    - name: Build curl 7.88.1 (GnuTLS backend)
-      run: |
-        git clone --branch curl-7_88_1 https://github.com/curl/curl
-        cd curl
-        autoreconf -fi
-        ./configure --with-gnutls=/opt/gnutls --prefix=/opt/curl \
-                    --disable-static --enable-shared
-        make -j"$(nproc)"
-        sudo make install
-        sudo ldconfig
-
-    # ────────────────────── NetworkManager build & test ────────────────────
-    - name: Clone NetworkManager ${{ matrix.nm_version }}
-      run: |
-        git clone https://github.com/NetworkManager/NetworkManager
-        cd NetworkManager
-        if [ "${{ matrix.nm_version }}" != "master" ]; then
-          git checkout "${{ matrix.nm_version }}"
-        fi
-
-    - name: Configure & build NetworkManager
-      working-directory: NetworkManager
-      run: |
-        export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/curl/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
-        export CPPFLAGS="-I/opt/gnutls/include -I/opt/curl/include${CPPFLAGS:+ $CPPFLAGS}"
-        export LDFLAGS="-L/opt/gnutls/lib -L/opt/curl/lib -Wl,-rpath,/opt/gnutls/lib:/opt/curl/lib${LDFLAGS:+ $LDFLAGS}"
-        export LD_LIBRARY_PATH="/opt/gnutls/lib:/opt/curl/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-
-        if [ "${{ matrix.nm_version }}" != "master" ]; then
-          meson setup build-gnutls \
-            -Dcrypto=gnutls \
-            -Dtests=yes \
-            -Dsystemd_journal=true \
-            -Dmore_logging=true \
-            -Dqt=false
-        else
-          meson setup build-gnutls \
-            -Dcrypto=gnutls \
-            -Dtests=yes \
-            -Dsystemd_journal=true \
-            -Dmore_logging=true \
-            -Dqt=false \
-            -Dnbft=false
-        fi
-
-        ninja -C build-gnutls -j"$(nproc)"
-
-    # ───────────────────── verify linkage (before tests) ────────────────────
-    - name: Verify linkage to /opt/gnutls
-      working-directory: NetworkManager/build-gnutls
-      run: |
-        BIN=src/nmcli/nmcli
-        LIB=$(find src/libnm-client-impl -name 'libnm.so*' -type f | head -n1)
-        for obj in "$BIN" "$LIB"; do
-          echo "::group::ldd $obj"
-          ldd "$obj" | grep -E 'lib(curl|gnutls)'
-          echo "::endgroup::"
-          ldd "$obj" | grep -q '/opt/gnutls/lib/libgnutls.so.30' || exit 1
-        done
-
-    # ────────────────────────── run test-suite ──────────────────────────────
-    - name: Run NetworkManager tests
-      working-directory: NetworkManager
-      run: |
-        export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/curl/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
-        export CPPFLAGS="-I/opt/gnutls/include -I/opt/curl/include${CPPFLAGS:+ $CPPFLAGS}"
-        export LDFLAGS="-L/opt/gnutls/lib -L/opt/curl/lib -Wl,-rpath,/opt/gnutls/lib:/opt/curl/lib${LDFLAGS:+ $LDFLAGS}"
-        export LD_LIBRARY_PATH="/opt/gnutls/lib:/opt/curl/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-        export NM_TEST_REGENERATE=1
-        export WGW_LOGGING=1
-
-        if [ "${{ matrix.nm_version }}" != "1.42.4" ]; then
-          ninja -C build-gnutls test
-        else
-       # Skipped on CI because the GitHub Actions kernel lacks the VRF/Team modules and QoS-mapping support that platform/test-link-linux expects, so the test aborts with “Unknown device type / xgress QoS mapping assertion.
-       # Doesn't test any TLS/Crypto capabilities.
-          cd build-gnutls
-          all_tests=$(meson test --list 2>/dev/null)
-          test_list=$(printf '%s\n' "$all_tests" \
-            | grep -v -E '^(platform/test-link-linux)$' \
-            | tr '\n' ' ')
-          meson test $test_list --print-errorlogs
-        fi
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install --yes --no-install-recommends \
+            autoconf automake libtool m4 pkg-config build-essential git \
+            meson ninja-build gettext gettext-base \
+            itstool clang gperf gnulib autopoint gtk-doc-tools \
+            nettle-dev libtasn1-bin libtasn1-6-dev libunistring-dev libnvme-dev \
+            libp11-kit-dev libunbound-dev bison \
+            python3-yaml python3-dbus python3-gi \
+            debhelper debugedit dh-autoreconf dh-strip-nondeterminism dwz intltool \
+            libbluetooth-dev libdebhelper-perl libndp-dev \
+            libfile-stripnondeterminism-perl libglib2.0-doc \
+            libnewt-dev libnl-3-dev libnl-cli-3-200 libnl-nf-3-200 libgirepository1.0-dev \
+            libpolkit-agent-1-dev polkitd libslang2-dev libsub-override-perl libdbus-1-dev ppp ppp-dev mobile-broadband-provider-info \
+            libteam-dev libteam5 libyaml-perl po-debconf libaudit-dev libudev-dev libsystemd-dev libmm-glib-dev libjansson-dev dhcpcd5 dnsmasq-base libpsl-dev libreadline-dev valac sudo git wget
+
+      - name: Restore cached gnutls-wolfssl
+        id: cache-gnutls
+        uses: actions/cache@v4
+        with:
+          path: |
+            /opt/gnutls
+            /opt/wolfssl
+            /opt/wolfssl-gnutls-wrapper
+          key: gnutls-wolfssl-${{ runner.os }}-${{ hashFiles('setup.sh', 'wolfssl-gnutls-wrapper/**', 'wolfssl/**', 'gnutls/**') }}
+          restore-keys: |
+            gnutls-wolfssl-${{ runner.os }}-
+
+      - name: Build forked GnuTLS stack
+        if: steps.cache-gnutls.outputs.cache-hit != 'true'
+        run: |
+          LOGGING=0 GNUTLS_INSTALL=/opt/gnutls WOLFSSL_INSTALL=/opt/wolfssl ./setup.sh
+          test -d /opt/gnutls && test -d /opt/wolfssl
+
+      - name: Build curl 7.88.1 (GnuTLS backend)
+        run: |
+          git clone --depth=1 --branch curl-7_88_1 https://github.com/curl/curl
+          cd curl
+          autoreconf -fi
+          ./configure --with-gnutls=/opt/gnutls --prefix=/opt/curl \
+                      --disable-static --enable-shared
+          make -j"$(nproc)"
+          sudo make install
+          sudo ldconfig
+
+      - name: Clone NetworkManager ${{ matrix.nm_version }}
+        run: |
+          git clone --depth=1 --branch "${{ matrix.nm_version }}" https://github.com/NetworkManager/NetworkManager
+
+      - name: Configure & build NetworkManager
+        working-directory: NetworkManager
+        run: |
+          export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/curl/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+          export CPPFLAGS="-I/opt/gnutls/include -I/opt/curl/include${CPPFLAGS:+ $CPPFLAGS}"
+          export LDFLAGS="-L/opt/gnutls/lib -L/opt/curl/lib -Wl,-rpath,/opt/gnutls/lib:/opt/curl/lib${LDFLAGS:+ $LDFLAGS}"
+          export LD_LIBRARY_PATH="/opt/gnutls/lib:/opt/curl/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+
+          if [ "${{ matrix.nm_version }}" != "main" ]; then
+            meson setup build-gnutls \
+              -Dcrypto=gnutls \
+              -Dtests=yes \
+              -Dsystemd_journal=true \
+              -Dmore_logging=true \
+              -Dqt=false \
+              -Dsystemdsystemunitdir=no
+          else
+            meson setup build-gnutls \
+              -Dcrypto=gnutls \
+              -Dtests=yes \
+              -Dsystemd_journal=true \
+              -Dmore_logging=true \
+              -Dqt=false \
+              -Dnbft=false \
+              -Dsystemdsystemunitdir=no \
+              -Dsystemdsystemgeneratordir=no \
+              -Dclat=false
+          fi
+
+          ninja -C build-gnutls -j"$(nproc)"
+
+      - name: Verify linkage to /opt/gnutls
+        working-directory: NetworkManager/build-gnutls
+        run: |
+          BIN=src/nmcli/nmcli
+          LIB=$(find src/libnm-client-impl -maxdepth 1 -name 'libnm.so*' -type f | head -n1)
+          for obj in "$BIN" "$LIB"; do
+            echo "::group::ldd $obj"
+            ldd "$obj" | grep -E 'lib(curl|gnutls)'
+            echo "::endgroup::"
+            ldd "$obj" | grep -q '/opt/gnutls/lib/libgnutls.so.30' || exit 1
+          done
+
+      # Skipped on CI because the GitHub Actions kernel lacks the VRF/Team modules and QoS-mapping support that platform/test-link-linux expects, so the test aborts with “Unknown device type / xgress QoS mapping assertion.
+      # Doesn't test any TLS/Crypto capabilities.
+      - name: Run NetworkManager tests
+        working-directory: NetworkManager
+        run: |
+          export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/curl/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+          export CPPFLAGS="-I/opt/gnutls/include -I/opt/curl/include${CPPFLAGS:+ $CPPFLAGS}"
+          export LDFLAGS="-L/opt/gnutls/lib -L/opt/curl/lib -Wl,-rpath,/opt/gnutls/lib:/opt/curl/lib${LDFLAGS:+ $LDFLAGS}"
+          export LD_LIBRARY_PATH="/opt/gnutls/lib:/opt/curl/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+          export NM_TEST_REGENERATE=1
+          export WGW_LOGGING=1
+          if [ "${{ matrix.nm_version }}" != "1.42.4" ]; then
+            ninja -C build-gnutls test
+          else
+            cd build-gnutls
+            all_tests=$(meson test --list 2>/dev/null)
+            test_list=$(printf '%s\n' "$all_tests" \
+              | grep -v -E '^(platform/test-link-linux)$' \
+              | tr '\n' ' ')
+            meson test $test_list --print-errorlogs
+          fi