Use meson native files for CI build configure flags

CI build jobs carried compiler flags and project options as YAML
variables and EXTRA_CONFIGURE strings composed through inheritance and
shell interpolation, which is awkward to reproduce locally.  Move the
shared flags into meson native files under ci/ so a build can be
reproduced directly:

    meson setup --native-file ci/common.ini [--native-file ci/<job>.ini] build

ci/common.ini exports cflags_common as a [constants] value so per-job
overlays can extend rather than replace it:

    c_args = cflags_common + ['-DDEBUG']

The cross build file ci/amd64cross32.ini repeats the c_args from
ci/common.ini, because that file only configures the host and the
[constants] section is not visible for the cross build.

ci/scan-build.ini likewise repeats ci/common.ini instead of layering on
it, and notably declares no [binaries] section.  scan-build substitutes
its analyzer wrapper by setting $CC via --use-cc, but a machine file's
[binaries] c takes precedence over $CC; inheriting the c = 'gcc' from
ci/common.ini would pin the compiler back to gcc and leave the analyzer
unused, undoing 23a722db57.

ci/reprotest.ini is standalone too.  `meson reprotest` builds twice
and compares the results byte for byte, so it configures the smallest
build that still exercises the compiler rather than the full CI option
set.

The tumbleweed and tumbleed-libuv options were unified. The only
difference was gssapi=disabled, which seems like it should apply to all
tumbleweed builds as per 1b2c191bed4097e1095de3bc2f3854b6db894a8e.

Assisted-by: Claude:claude-opus-4-8

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 11ed0dac40b279c4cbf66288e37281a2bbe0fc62..0216200bc34fbca5d7fb8a929db590c809a17a72 100644 (file)
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,14 +31,12 @@ variables:
   LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
   CLANG_FORMAT: "clang-format-${CLANG_VERSION}"
 
-  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls
-
-  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled -Dnamed-lto=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
   TSAN_SYMBOLIZER_PATH_DEBIAN: "${LLVM_SYMBOLIZER}"
   TSAN_SYMBOLIZER_PATH_FEDORA: "/usr/bin/llvm-symbolizer"
 
-  WITHOUT_LIBEDIT: "-Dline=disabled"
-  WITH_LIBEDIT: "-Dline=enabled"
+  # Per-job meson machine files, layered after ci/common.ini by the .configure
+  # template.  Each build job overrides this with its overlay(s); see ci/*.ini.
+  EXTRA_SETUP_FILES: ""
 
   INSTALL_PATH: "${CI_PROJECT_DIR}/.local"
 
@@ -392,13 +390,8 @@ stages:
 
 .configure: &configure
     - meson setup
-      --libdir=lib
-      -Dcmocka=enabled
-      -Ddeveloper=enabled
-      -Dleak-detection=enabled
-      -Doptimization=1
-      -Dnamed-lto=thin
-      $EXTRA_CONFIGURE
+      --native-file ci/common.ini
+      $EXTRA_SETUP_FILES
       build
 
 .git-clone-bind9-qa: &git_clone_bind9-qa
@@ -893,18 +886,19 @@ coccinelle:
 
 scan-build:
   <<: *other_checks_job
-  variables:
-    CFLAGS: "${CFLAGS_COMMON}"
   before_script:
     - *list_installed_package_versions
   script:
+    # ci/scan-build.ini is deliberately self-contained rather than layered on
+    # ci/common.ini: a machine file's [binaries] c overrides $CC, which is how
+    # scan-build injects its analyzer wrapper via --use-cc.  Layering common.ini
+    # here would pin the compiler to gcc and silently stop analyzing anything.
+    #
     # --exclude build drops findings in Meson's feature-probe programs,
     # which are the only thing analyzed during setup.
     - ${SCAN_BUILD} --use-cc=${CLANG}
                     --exclude build
-                    meson setup --libdir=lib -Dcmocka=enabled -Ddeveloper=enabled
-                    -Dleak-detection=enabled -Doptimization=1 -Didn=enabled
-                    -Dnamed-lto=disabled build
+                    meson setup --native-file ci/scan-build.ini build
     # Gate on the full set of default checkers.
     - ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)"
                     --use-cc=${CLANG}
@@ -945,9 +939,7 @@ scan-build:
 coverity:
   <<: *other_checks_job
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Doptimization=g -Ddoc=disabled -Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/coverity.ini"
   script:
     - *coverity_prep
     - *configure
@@ -968,8 +960,9 @@ reproducible-build:
   <<: *other_checks_job
   <<: *alpine_3_24_amd64_image
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    # This job runs `meson reprotest`, not the .configure template, so it passes
+    # its machine file through to reprotest's own `meson setup`.
+    EXTRA_SETUP_FILES: "--native-file ci/reprotest.ini"
   before_script:
     - *list_installed_package_versions
   script:
@@ -978,7 +971,7 @@ reproducible-build:
     # or not. But the content of the .a file is unstable under LTO because
     # -ffat-lto-objects embeds non-deterministic GIMPLE bytecode. Hence we
     # disable dnstap for reproducibility tests.
-    - meson reprotest -- -Ddnstap=disabled
+    - meson reprotest -- $EXTRA_SETUP_FILES -Ddnstap=disabled
   artifacts:
     untracked: true
     when: on_failure
@@ -1060,9 +1053,6 @@ cross-version-config-tests:
   stage: system
   <<: *base_image
   <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
   script:
     - *configure
     - *setup_interfaces
@@ -1115,9 +1105,7 @@ cross-version-config-tests:
 
 gcc:alpine3.24:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "${WITHOUT_LIBEDIT}"
+    EXTRA_SETUP_FILES: "--native-file ci/alpine.ini"
   <<: *alpine_3_24_amd64_image
   <<: *build_job
 
@@ -1139,9 +1127,7 @@ unit:gcc:alpine3.24:amd64:
 
 gcc:almalinux8:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/almalinux8.ini"
   <<: *almalinux_8_amd64_image
   <<: *build_job
 
@@ -1165,9 +1151,7 @@ unit:gcc:almalinux8:amd64:
 
 gcc:almalinux9:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled -Ddeveloper=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/almalinux9.ini"
   <<: *almalinux_9_amd64_image
   <<: *build_job
 
@@ -1189,9 +1173,7 @@ unit:gcc:almalinux9:amd64:
 
 gcc:almalinux10:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/almalinux10.ini"
   <<: *almalinux_10_amd64_image
   <<: *build_job
 
@@ -1214,9 +1196,7 @@ unit:gcc:almalinux10:amd64:
 
 gcc:8fips:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dtracing=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/8fips.ini"
     GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
   <<: *almalinux_8fips_amd64_image
   <<: *build_job
@@ -1243,9 +1223,7 @@ unit:gcc:8fips:amd64:
 
 gcc:9fips:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dleak-detection=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/9fips.ini"
     GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
   <<: *almalinux_9fips_amd64_image
   <<: *build_job
@@ -1272,9 +1250,7 @@ unit:gcc:9fips:amd64:
 
 gcc:10fips:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled -Dfips=enabled -Dleak-detection=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/10fips.ini"
     GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
   <<: *almalinux_10fips_amd64_image
   <<: *build_job
@@ -1299,9 +1275,7 @@ unit:gcc:10fips:amd64:
 
 gcc:tarball:nosphinx:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled -Ddeveloper=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/tarball-nosphinx.ini"
     RUN_MESON_INSTALL: 1
   <<: *almalinux_9_amd64_image
   <<: *build_job
@@ -1317,9 +1291,7 @@ gcc:tarball:nosphinx:
 
 gcc:bookworm:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/bookworm.ini"
   <<: *debian_bookworm_amd64_image
   <<: *build_job
 
@@ -1341,10 +1313,8 @@ unit:gcc:bookworm:amd64:
 
 gcc:trixie:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
     # Tracing needs to be disabled otherwise gcovr fails
-    EXTRA_CONFIGURE: "-Doptimization=0 -Db_coverage=true -Dtracing=disabled -Didn=enabled ${WITH_LIBEDIT}"
+    EXTRA_SETUP_FILES: "--native-file ci/coverage.ini"
     RUN_MESON_INSTALL: 1
   <<: *debian_trixie_amd64_image
   <<: *build_job
@@ -1380,9 +1350,7 @@ unit:gcc:trixie:amd64:
 
 minimal:gcc:trixie:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Dauto_features=disabled -Dcmocka=enabled -Ddeveloper=disabled -Doptimization=s"
+    EXTRA_SETUP_FILES: "--native-file ci/minimal.ini"
   <<: *debian_trixie_amd64_image
   <<: *build_job
 
@@ -1405,9 +1373,8 @@ unit:minimal:gcc:trixie:amd64:
 
 gcc:trixie:amd64cross32:
   variables:
-    CFLAGS: "${CFLAGS_COMMON}"
     CROSS_COMPILATION: 1
-    EXTRA_CONFIGURE: "--cross-file ci/amd64cross32.ini -Didn=enabled -Dgssapi=disabled -Dtracing=disabled ${WITH_LIBEDIT}"
+    EXTRA_SETUP_FILES: "--cross-file ci/amd64cross32.ini"
   <<: *debian_trixie_amd64cross32_image
   <<: *build_job
 
@@ -1415,9 +1382,7 @@ gcc:trixie:amd64cross32:
 
 gcc:trixie:386:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/trixie386.ini"
   <<: *debian_trixie_386_image
   <<: *build_job
 
@@ -1440,10 +1405,7 @@ gcc:ossl3:trixie:amd64:
   <<: *debian_trixie_amd64_image
   <<: *build_job
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "-Doptimization=3 -Djemalloc=disabled -Dleak-detection=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/ossl3.ini"
     RUN_MESON_INSTALL: 1
 
 system:gcc:ossl3:trixie:amd64:
@@ -1474,9 +1436,7 @@ gcc:sid:amd64:
   <<: *debian_sid_amd64_image
   <<: *build_job
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Doptimization=3 -Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/sid.ini"
 
 system:gcc:sid:amd64:
   <<: *debian_sid_amd64_image
@@ -1498,8 +1458,7 @@ unit:gcc:sid:amd64:
 
 gcc:tarball:
   variables:
-    CC: gcc
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/tarball.ini"
     RUN_MESON_INSTALL: 1
   <<: *base_image
   <<: *build_job
@@ -1538,9 +1497,7 @@ gcc:tumbleweed:amd64:
   <<: *tumbleweed_latest_amd64_image
   <<: *build_job
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    EXTRA_CONFIGURE: "-Didn=enabled -Dgssapi=disabled ${WITH_LIBEDIT}"
+    EXTRA_SETUP_FILES: "--native-file ci/tumbleweed.ini"
 
 system:gcc:tumbleweed:amd64:
   <<: *tumbleweed_latest_amd64_image
@@ -1560,9 +1517,7 @@ unit:gcc:tumbleweed:amd64:
 
 gcc:jammy:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Dgeoip=disabled -Didn=enabled -Ddoh=disabled -Dcmocka=disabled -Ddnstap=disabled -Dgssapi=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/jammy.ini"
   <<: *ubuntu_jammy_amd64_image
   <<: *build_job
 
@@ -1586,9 +1541,7 @@ unit:gcc:jammy:amd64:
 
 gcc:noble:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/noble.ini"
   <<: *ubuntu_noble_amd64_image
   <<: *build_job
 
@@ -1611,9 +1564,7 @@ unit:gcc:noble:amd64:
 
 gcc:resolute:amd64:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Didn=enabled"
+    EXTRA_SETUP_FILES: "--native-file ci/resolute.ini"
   <<: *ubuntu_resolute_amd64_image
   <<: *build_job
 
@@ -1635,9 +1586,7 @@ unit:gcc:resolute:amd64:
 
 gcc:asan:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Db_sanitize=address,undefined -Didn=enabled -Djemalloc=disabled -Dtracing=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/asan.ini"
   <<: *fedora_44_amd64_image
   <<: *build_job
 
@@ -1657,9 +1606,7 @@ unit:gcc:asan:
 
 clang:asan:
   variables:
-    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Db_sanitize=address,undefined -Db_lundef=false -Didn=enabled -Djemalloc=disabled -Dtracing=disabled --native-file ci/clang-trixie.ini"
+    EXTRA_SETUP_FILES: "--native-file ci/asan.ini --native-file ci/clang-trixie.ini --native-file ci/clang-sanitizer.ini"
   <<: *base_image
   <<: *build_job
 
@@ -1683,10 +1630,7 @@ unit:clang:asan:
 
 gcc:tsan:
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread"
-    LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON}"
+    EXTRA_SETUP_FILES: "--native-file ci/tsan.ini --native-file ci/tsan-gcc.ini"
   <<: *tsan_fedora_44_amd64_image
   <<: *build_job
 
@@ -1714,10 +1658,7 @@ clang:tsan:
   <<: *tsan_debian_trixie_amd64_image
   <<: *build_job
   variables:
-    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON}"
-    LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false --native-file ci/clang-trixie.ini"
+    EXTRA_SETUP_FILES: "--native-file ci/tsan.ini --native-file ci/clang-trixie.ini --native-file ci/clang-sanitizer.ini"
 
 system:clang:tsan:
   variables:
@@ -1765,9 +1706,7 @@ tsan:stress:
 
 clang:trixie:amd64:
   variables:
-    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--native-file ci/clang-trixie.ini"
+    EXTRA_SETUP_FILES: "--native-file ci/clang-trixie.ini"
     RUN_MESON_INSTALL: 1
   <<: *debian_trixie_amd64_image
   <<: *build_job
@@ -1792,12 +1731,8 @@ unit:clang:trixie:amd64:
 
 clang:freebsd14:amd64:
   variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON}"
     GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_LIBEDIT} -Doptimization=g --native-file ci/freebsd.ini"
+    EXTRA_SETUP_FILES: "--native-file ci/freebsd.ini"
   <<: *build_job
   <<: *freebsd_autoscaler_14_amd64_tags
 
@@ -1824,12 +1759,8 @@ unit:clang:freebsd14:amd64:
 
 clang:freebsd15:amd64:
   variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON}"
     GIT_CLONE_PATH: "${GIT_CLONE_PATH_INSTANCE_EXECUTOR}"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_LIBEDIT} -Doptimization=g --native-file ci/freebsd.ini"
+    EXTRA_SETUP_FILES: "--native-file ci/freebsd.ini"
   <<: *build_job
   <<: *freebsd_autoscaler_15_amd64_tags
 
@@ -1857,9 +1788,7 @@ gcc:tumbleweed:libuv-git:amd64:
   <<: *tumbleweed_latest_amd64_image
   <<: *build_job
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    EXTRA_CONFIGURE: "-Didn=enabled ${WITH_LIBEDIT}"
+    EXTRA_SETUP_FILES: "--native-file ci/tumbleweed.ini"
   before_script:
     - *list_installed_package_versions
     - zypper --non-interactive rm --clean-deps libuv-devel
@@ -2369,9 +2298,7 @@ respdiff:
   <<: *respdiff_job
   <<: *base_image
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DISC_TRACK_PTHREADS_OBJECTS"
-    EXTRA_CONFIGURE: "-Doptimization=g"
+    EXTRA_SETUP_FILES: "--native-file ci/respdiff.ini"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
   script:
     - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
@@ -2381,9 +2308,7 @@ respdiff:asan:
   <<: *respdiff_job
   <<: *base_image
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Doptimization=g -Db_sanitize=address,undefined -Djemalloc=disabled"
+    EXTRA_SETUP_FILES: "--native-file ci/respdiff-asan.ini"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
@@ -2393,10 +2318,7 @@ respdiff:tsan:
   <<: *respdiff_job
   <<: *tsan_debian_trixie_amd64_image
   variables:
-    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON}"
-    LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false"
+    EXTRA_SETUP_FILES: "--native-file ci/tsan.ini --native-file ci/clang-trixie.ini --native-file ci/clang-sanitizer.ini"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
     TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   script:
@@ -2407,9 +2329,7 @@ respdiff-third-party:
   <<: *respdiff_job
   <<: *base_image
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "-Doptimization=g"
+    EXTRA_SETUP_FILES: "--native-file ci/respdiff-third-party.ini"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
   script:
     - bash respdiff.sh -s third_party -q "${PWD}/100k_mixed.txt" -c 1 -w "${PWD}/rspworkdir" -r "${PWD}/respdiff" "${CI_PROJECT_DIR}"
@@ -2435,9 +2355,7 @@ respdiff-third-party:
 respdiff:recent-named:
   <<: *respdiff_recent_named
   variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DISC_TRACK_PTHREADS_OBJECTS"
-    EXTRA_CONFIGURE: "-Doptimization=g"
+    EXTRA_SETUP_FILES: "--native-file ci/respdiff.ini"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
 
 # Performance tests

diff --git a/REUSE.toml b/REUSE.toml
index 74a643f9287c72becf1580dc3fe6b3414d81b442..9da53dcf184a97c98df1484a3e90d3651caf277a 100644 (file)
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -173,6 +173,7 @@ path = [
        ".readthedocs.yaml",
        ".tsan-suppress",
        ".uncrustify.cfg",
+       "ci/*.ini",
        "contrib/gitchangelog/changelog.rc.py",
        "contrib/gitchangelog/relnotes.rc.py",
        "doc/misc/**.zoneopt",

diff --git a/ci/10fips.ini b/ci/10fips.ini
new file mode 100644 (file)
index 0000000..aa96b7a
--- /dev/null
+++ b/ci/10fips.ini
@@ -0,0 +1,4 @@
+[project options]
+idn = 'enabled'
+fips = 'enabled'
+leak-detection = 'disabled'

diff --git a/ci/8fips.ini b/ci/8fips.ini
new file mode 100644 (file)
index 0000000..62fc4c5
--- /dev/null
+++ b/ci/8fips.ini
@@ -0,0 +1,4 @@
+[project options]
+idn = 'enabled'
+fips = 'enabled'
+tracing = 'disabled'

diff --git a/ci/9fips.ini b/ci/9fips.ini
new file mode 100644 (file)
index 0000000..aa96b7a
--- /dev/null
+++ b/ci/9fips.ini
@@ -0,0 +1,4 @@
+[project options]
+idn = 'enabled'
+fips = 'enabled'
+leak-detection = 'disabled'

diff --git a/ci/almalinux10.ini b/ci/almalinux10.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/almalinux10.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/almalinux8.ini b/ci/almalinux8.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/almalinux8.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/almalinux9.ini b/ci/almalinux9.ini
new file mode 100644 (file)
index 0000000..43831f3
--- /dev/null
+++ b/ci/almalinux9.ini
@@ -0,0 +1,3 @@
+[project options]
+idn = 'enabled'
+developer = 'disabled'

diff --git a/ci/alpine.ini b/ci/alpine.ini
new file mode 100644 (file)
index 0000000..98de291
--- /dev/null
+++ b/ci/alpine.ini
@@ -0,0 +1,2 @@
+[project options]
+line = 'disabled'

diff --git a/ci/amd64cross32.ini b/ci/amd64cross32.ini
index 410aa35ce1f589c87d0ad112d0d0a9e3b22a4e5f..c2574c184aa2f64f247dec01de2d3e2db9c6738f 100644 (file)
--- a/ci/amd64cross32.ini
+++ b/ci/amd64cross32.ini
@@ -1,16 +1,3 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# 32-bit builds on Debian
-
 [binaries]
 c = 'i686-linux-gnu-gcc'
 ar = 'i686-linux-gnu-ar'
@@ -25,3 +12,17 @@ endian = 'little'
 
 [properties]
 needs_exe_wrapper = false
+
+[built-in options]
+c_args = ['-fno-omit-frame-pointer', '-fno-optimize-sibling-calls']
+optimization = '1'
+
+[project options]
+cmocka = 'enabled'
+developer = 'enabled'
+leak-detection = 'enabled'
+named-lto = 'thin'
+idn = 'enabled'
+gssapi = 'disabled'
+tracing = 'disabled'
+line = 'enabled'

diff --git a/ci/asan.ini b/ci/asan.ini
new file mode 100644 (file)
index 0000000..cb247aa
--- /dev/null
+++ b/ci/asan.ini
@@ -0,0 +1,7 @@
+[built-in options]
+b_sanitize = 'address,undefined'
+
+[project options]
+idn = 'enabled'
+jemalloc = 'disabled'
+tracing = 'disabled'

diff --git a/ci/bookworm.ini b/ci/bookworm.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/bookworm.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/clang-sanitizer.ini b/ci/clang-sanitizer.ini
new file mode 100644 (file)
index 0000000..eeb1df9
--- /dev/null
+++ b/ci/clang-sanitizer.ini
@@ -0,0 +1,2 @@
+[built-in options]
+b_lundef = false

diff --git a/ci/clang-trixie.ini b/ci/clang-trixie.ini
index eb6da3f1b8b8aefab4af22f3e88d3a68ba6481eb..51010a617e3b827a4ce85841c7fa215872c17e46 100644 (file)
--- a/ci/clang-trixie.ini
+++ b/ci/clang-trixie.ini
@@ -1,20 +1,4 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# LTO builds with clang
-
 [binaries]
 ar = 'llvm-ar-22'
 c = 'clang-22'
 c_ld = 'lld-22'
-
-[project options]
-named-lto = 'thin'

diff --git a/ci/common.ini b/ci/common.ini
new file mode 100644 (file)
index 0000000..22ceb40
--- /dev/null
+++ b/ci/common.ini
@@ -0,0 +1,25 @@
+# Base configuration shared by every CI build.  The `.configure` job template
+# always layers this file first; per-job overlays add their delta on top:
+#   meson setup --native-file ci/common.ini --native-file ci/<job>.ini build
+#
+# These options live here rather than on the `meson setup` command line because
+# a command-line -D outranks every machine file, so it would silently override
+# an overlay that tries to change one of them.  `cflags_common` is exported as a
+# constant so an overlay can extend it, e.g. c_args = cflags_common + ['-DDEBUG'].
+
+[constants]
+cflags_common = ['-fno-omit-frame-pointer', '-fno-optimize-sibling-calls']
+
+[binaries]
+c = 'gcc'
+
+[built-in options]
+c_args = cflags_common
+libdir = 'lib'
+optimization = '1'
+
+[project options]
+cmocka = 'enabled'
+developer = 'enabled'
+leak-detection = 'enabled'
+named-lto = 'thin'

diff --git a/ci/coverage.ini b/ci/coverage.ini
new file mode 100644 (file)
index 0000000..ed1e114
--- /dev/null
+++ b/ci/coverage.ini
@@ -0,0 +1,8 @@
+[built-in options]
+optimization = '0'
+b_coverage = true
+
+[project options]
+idn = 'enabled'
+line = 'enabled'
+tracing = 'disabled'

diff --git a/ci/coverity.ini b/ci/coverity.ini
new file mode 100644 (file)
index 0000000..5de603d
--- /dev/null
+++ b/ci/coverity.ini
@@ -0,0 +1,6 @@
+[built-in options]
+optimization = 'g'
+
+[project options]
+idn = 'enabled'
+doc = 'disabled'

diff --git a/ci/freebsd.ini b/ci/freebsd.ini
index 9333cacade612cec68391a279d9fe2af4d177760..2228399790eb430092b1dbbd94776e4cccb18ed0 100644 (file)
--- a/ci/freebsd.ini
+++ b/ci/freebsd.ini
@@ -1,15 +1,11 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# Native file to use MIT Kerberos 5 instead of FreeBSD Heimdal
-
 [binaries]
+c = 'clang'
+# Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+# incompatibility; see https://bugs.freebsd.org/275241.
 krb5-config = '/usr/local/bin/krb5-config'
+
+[built-in options]
+optimization = 'g'
+
+[project options]
+line = 'enabled'

diff --git a/ci/jammy.ini b/ci/jammy.ini
new file mode 100644 (file)
index 0000000..bbef56b
--- /dev/null
+++ b/ci/jammy.ini
@@ -0,0 +1,7 @@
+[project options]
+idn = 'enabled'
+geoip = 'disabled'
+doh = 'disabled'
+cmocka = 'disabled'
+dnstap = 'disabled'
+gssapi = 'disabled'

diff --git a/ci/minimal.ini b/ci/minimal.ini
new file mode 100644 (file)
index 0000000..958c619
--- /dev/null
+++ b/ci/minimal.ini
@@ -0,0 +1,7 @@
+[built-in options]
+auto_features = 'disabled'
+optimization = 's'
+
+[project options]
+cmocka = 'enabled'
+developer = 'disabled'

diff --git a/ci/noble.ini b/ci/noble.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/noble.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/ossl3.ini b/ci/ossl3.ini
new file mode 100644 (file)
index 0000000..dd6277b
--- /dev/null
+++ b/ci/ossl3.ini
@@ -0,0 +1,7 @@
+[built-in options]
+optimization = '3'
+
+[project options]
+# see https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+jemalloc = 'disabled'
+leak-detection = 'disabled'

diff --git a/ci/reprotest.ini b/ci/reprotest.ini
new file mode 100644 (file)
index 0000000..4fa6f49
--- /dev/null
+++ b/ci/reprotest.ini
@@ -0,0 +1,9 @@
+# Machine file for the reproducible-build job.  Not layered on ci/common.ini:
+# `meson reprotest` builds twice and compares byte for byte, so it configures
+# the smallest build that still exercises the compiler.
+
+[binaries]
+c = 'gcc'
+
+[built-in options]
+c_args = ['-fno-omit-frame-pointer', '-fno-optimize-sibling-calls']

diff --git a/ci/resolute.ini b/ci/resolute.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/resolute.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/respdiff-asan.ini b/ci/respdiff-asan.ini
new file mode 100644 (file)
index 0000000..403b53a
--- /dev/null
+++ b/ci/respdiff-asan.ini
@@ -0,0 +1,6 @@
+[built-in options]
+optimization = 'g'
+b_sanitize = 'address,undefined'
+
+[project options]
+jemalloc = 'disabled'

diff --git a/ci/respdiff-third-party.ini b/ci/respdiff-third-party.ini
new file mode 100644 (file)
index 0000000..d51bc0b
--- /dev/null
+++ b/ci/respdiff-third-party.ini
@@ -0,0 +1,2 @@
+[built-in options]
+optimization = 'g'

diff --git a/ci/respdiff.ini b/ci/respdiff.ini
new file mode 100644 (file)
index 0000000..e7cecfa
--- /dev/null
+++ b/ci/respdiff.ini
@@ -0,0 +1,3 @@
+[built-in options]
+c_args = cflags_common + ['-DISC_TRACK_PTHREADS_OBJECTS']
+optimization = 'g'

diff --git a/ci/scan-build.ini b/ci/scan-build.ini
new file mode 100644 (file)
index 0000000..7c28dad
--- /dev/null
+++ b/ci/scan-build.ini
@@ -0,0 +1,24 @@
+# Configuration for the scan-build static analysis job.
+#
+# Unlike every other file here this one is NOT layered on top of ci/common.ini
+# and therefore repeats its contents.  scan-build injects its analyzer wrapper
+# by setting $CC (via --use-cc), and a machine file's [binaries] c section takes
+# precedence over $CC.  Pulling in ci/common.ini would pin the compiler back to
+# gcc and leave the analyzer wrapper unused, so this file deliberately declares
+# no [binaries] section at all.
+#
+#   scan-build --use-cc=clang --exclude build \
+#       meson setup --native-file ci/scan-build.ini build
+
+[built-in options]
+c_args = ['-fno-omit-frame-pointer', '-fno-optimize-sibling-calls']
+libdir = 'lib'
+optimization = '1'
+
+[project options]
+cmocka = 'enabled'
+developer = 'enabled'
+leak-detection = 'enabled'
+idn = 'enabled'
+# scan-build analyzes the compiler invocations, so LTO would only slow it down.
+named-lto = 'disabled'

diff --git a/ci/sid.ini b/ci/sid.ini
new file mode 100644 (file)
index 0000000..5d79010
--- /dev/null
+++ b/ci/sid.ini
@@ -0,0 +1,5 @@
+[built-in options]
+optimization = '3'
+
+[project options]
+idn = 'enabled'

diff --git a/ci/tarball-nosphinx.ini b/ci/tarball-nosphinx.ini
new file mode 100644 (file)
index 0000000..43831f3
--- /dev/null
+++ b/ci/tarball-nosphinx.ini
@@ -0,0 +1,3 @@
+[project options]
+idn = 'enabled'
+developer = 'disabled'

diff --git a/ci/tarball.ini b/ci/tarball.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/tarball.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/trixie386.ini b/ci/trixie386.ini
new file mode 100644 (file)
index 0000000..752a53a
--- /dev/null
+++ b/ci/trixie386.ini
@@ -0,0 +1,2 @@
+[project options]
+idn = 'enabled'

diff --git a/ci/tsan-gcc.ini b/ci/tsan-gcc.ini
new file mode 100644 (file)
index 0000000..423c0cc
--- /dev/null
+++ b/ci/tsan-gcc.ini
@@ -0,0 +1,2 @@
+[built-in options]
+c_args = cflags_common + ['-Wno-stringop-overread']

diff --git a/ci/tsan.ini b/ci/tsan.ini
new file mode 100644 (file)
index 0000000..f1c5621
--- /dev/null
+++ b/ci/tsan.ini
@@ -0,0 +1,12 @@
+[built-in options]
+b_sanitize = 'thread'
+optimization = '2'
+debug = true
+pkg_config_path = ['/opt/tsan/lib/pkgconfig']
+c_link_args = ['-Wl,--disable-new-dtags']
+
+[project options]
+idn = 'enabled'
+locktype = 'system'
+jemalloc = 'disabled'
+named-lto = 'disabled'

diff --git a/ci/tumbleweed.ini b/ci/tumbleweed.ini
new file mode 100644 (file)
index 0000000..85027f4
--- /dev/null
+++ b/ci/tumbleweed.ini
@@ -0,0 +1,7 @@
+[built-in options]
+c_args = cflags_common + ['-DDEBUG']
+
+[project options]
+idn = 'enabled'
+gssapi = 'disabled'
+line = 'enabled'