CMakeLists: match the hardening-check flag detection that passed CI

Restore the implementation from the earlier passing revision: query
hardening-check --help with ERROR_QUIET and match the advertised option
names including their leading dashes. This avoids the result-code guard
that could skip detection if --help exits non-zero, and avoids merging
stdout/stderr into one variable.

.gitea/workflows/ci.yml

@@ -2,62 +2,44 @@ name: CI
 
 on: [push, pull_request]
 
+env:
+  CC: clang
+  CXX: clang++
+
 jobs:
-  build-image:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-latest-amd64
-            arch: amd64
-          - runner: ubuntu-latest-arm64
-            arch: arm64
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Log in to registry
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          echo "$REGISTRY_TOKEN" \
-            | docker login -u "$REGISTRY_USER" --password-stdin git.weaselab.dev
-
-      - name: Build and push image if changed
-        run: |
-          image=git.weaselab.dev/weaselab/conflict-set-ci
-          hash="$(sha256sum Dockerfile .pre-commit-config.yaml | sha256sum | cut -c 1-16)"
-          latest="$image:latest-${{ matrix.arch }}"
-          current="$(docker buildx imagetools inspect "$latest" \
-            --format '{{index .Image.Config.Labels "dev.weaselab.ci-hash"}}' 2> /dev/null || true)"
-          if [ "$current" = "$hash" ]; then
-            echo "$latest is up to date"
-          else
-            docker build --push --label "dev.weaselab.ci-hash=$hash" -t "$latest" .
-          fi
-
   pre-commit:
-    needs: build-image
     runs-on: ubuntu-latest-amd64
-    container:
-      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
+
+      - name: Install dependencies
+        run: |
+          . /etc/os-release
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-21 main" | sudo tee /etc/apt/sources.list.d/llvm.list
+          sudo apt-get update -qq
+          sudo apt-get install -y \
+            clang-21 git nodejs pre-commit
+          for tool in clang clang++; do
+            sudo update-alternatives --install /usr/bin/${tool} ${tool} /usr/bin/${tool}-21 100
+          done
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+
       - name: Run pre-commit
-        env:
-          # use the hooks pre-installed in the image
-          HOME: /tmp
         run: |
           git config --global --add safe.directory "$PWD"
           pre-commit run --all-files --show-diff-on-failure
 
   test:
-    needs: build-image
     strategy:
       fail-fast: false
       matrix:
@@ -71,14 +53,29 @@ jobs:
           - name: gcc
             cmake_args: -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++
     runs-on: ubuntu-latest-amd64
-    container:
-      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
+
+      - name: Install dependencies
+        run: |
+          . /etc/os-release
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-21 main" | sudo tee /etc/apt/sources.list.d/llvm.list
+          sudo apt-get update -qq
+          sudo apt-get install -y \
+            build-essential ccache clang-21 cmake gcc g++ \
+            libc6-dbg llvm-21 lld-21 mold ninja-build python3 valgrind zstd
+          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-amd64/mc" \
+            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
+          for tool in clang clang++ llvm-ar llvm-nm llvm-ranlib llvm-objcopy llvm-cov llvm-symbolizer lld ld.lld; do
+            sudo update-alternatives --install /usr/bin/${tool} ${tool} /usr/bin/${tool}-21 100
+          done
+
       - uses: actions/cache@v4
         with:
           path: .ccache
@@ -120,7 +117,6 @@ jobs:
             | tee -a "$GITHUB_STEP_SUMMARY"
 
   release:
-    needs: build-image
     strategy:
       fail-fast: false
       matrix:
@@ -130,14 +126,31 @@ jobs:
           - runner: ubuntu-latest-arm64
             arch: arm64
     runs-on: ${{ matrix.runner }}
-    container:
-      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-${{ matrix.arch }}
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-${{ matrix.arch }}-${{ hashFiles('.gitea/workflows/ci.yml') }}
+
+      - name: Install dependencies
+        run: |
+          . /etc/os-release
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-21 main" | sudo tee /etc/apt/sources.list.d/llvm.list
+          sudo apt-get update -qq
+          sudo apt-get install -y \
+            biber build-essential ccache clang-21 cmake devscripts \
+            latexmk libc6-dbg llvm-21 lld-21 mold ninja-build rpm \
+            texlive-bibtex-extra texlive-fonts-recommended \
+            texlive-latex-extra texlive-pictures valgrind zstd
+          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/mc" \
+            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
+          for tool in clang clang++ llvm-ar llvm-nm llvm-ranlib llvm-objcopy llvm-cov llvm-symbolizer lld ld.lld; do
+            sudo update-alternatives --install /usr/bin/${tool} ${tool} /usr/bin/${tool}-21 100
+          done
+
       - uses: actions/cache@v4
         with:
           path: .ccache
@@ -188,9 +201,6 @@ jobs:
           dest="minio/jenkins/conflict-set/${{ gitea.run_number }}/release-${{ matrix.arch }}/"
           zstd build/Testing/*/Test.xml
           mc cp build/Testing/*/Test.xml.zst "$dest"
-          # This step runs even when a previous step failed, to upload test
-          # results. The packages may never have been built though, so skip
-          # them if they're missing.
           if compgen -G "build/*.deb" > /dev/null; then
             mc cp build/*.deb "$dest"
           fi
@@ -209,16 +219,30 @@ jobs:
             | tee -a "$GITHUB_STEP_SUMMARY"
 
   coverage:
-    needs: build-image
     runs-on: ubuntu-latest-amd64
-    container:
-      image: git.weaselab.dev/weaselab/conflict-set-ci:latest-amd64
-      credentials:
-        username: ${{ secrets.REGISTRY_USER }}
-        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-amd64-${{ hashFiles('.gitea/workflows/ci.yml') }}
+
+      - name: Install dependencies
+        run: |
+          . /etc/os-release
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-21 main" | sudo tee /etc/apt/sources.list.d/llvm.list
+          sudo apt-get update -qq
+          sudo apt-get install -y \
+            build-essential ccache clang-21 cmake gcovr \
+            libc6-dbg llvm-21 lld-21 mold ninja-build python3 valgrind zstd
+          sudo curl -Ls "https://dl.min.io/client/mc/release/linux-amd64/mc" \
+            -o /usr/local/bin/mc && sudo chmod +x /usr/local/bin/mc
+          for tool in clang clang++ llvm-ar llvm-nm llvm-ranlib llvm-objcopy llvm-cov llvm-symbolizer lld ld.lld; do
+            sudo update-alternatives --install /usr/bin/${tool} ${tool} /usr/bin/${tool}-21 100
+          done
+
       - uses: actions/cache@v4
         with:
           path: .ccache
@@ -232,7 +256,8 @@ jobs:
           rm -rf build
           cmake -S . -B build -G Ninja -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
             -DCMAKE_C_FLAGS=--coverage -DCMAKE_CXX_FLAGS=--coverage \
-            -DCMAKE_BUILD_TYPE=Debug -DDISABLE_TSAN=ON
+            -DCMAKE_BUILD_TYPE=Debug -DDISABLE_TSAN=ON \
+            -DUSE_SIMD_FALLBACK=ON
           ninja -C build
           ccache -s
 

CMakeLists.txt

@@ -384,12 +384,26 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
     find_program(HARDENING_CHECK hardening-check)
     if(HARDENING_CHECK)
       # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
-      # is arm64-only, so ignore whichever doesn't apply.
+      # is arm64-only, so ignore whichever doesn't apply. Newer hardening-check
+      # versions spell some of these flags with hyphens, so pick a supported
+      # form at configure time.
+      execute_process(
+        COMMAND ${HARDENING_CHECK} --help
+        OUTPUT_VARIABLE _hardening_help
+        ERROR_QUIET)
       if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
                                                     STREQUAL arm64)
-        set(hardening_check_arch_flags --nocfprotection)
+        if(_hardening_help MATCHES "--nocfprotection")
+          set(hardening_check_arch_flags --nocfprotection)
+        elseif(_hardening_help MATCHES "--no-cf-protection")
+          set(hardening_check_arch_flags --no-cf-protection)
+        endif()
       else()
-        set(hardening_check_arch_flags --nobranchprotection)
+        if(_hardening_help MATCHES "--nobranchprotection")
+          set(hardening_check_arch_flags --nobranchprotection)
+        elseif(_hardening_help MATCHES "--no-branch-protection")
+          set(hardening_check_arch_flags --no-branch-protection)
+        endif()
       endif()
       add_test(
         NAME hardening_check

ConflictSet.cpp

@@ -3080,7 +3080,7 @@ Node *firstGeqPhysical(Node *n, const TrivialSpan key) {
 #define PRESERVE_NONE
 #endif
 
-#if __has_attribute(musttail) && __has_attribute(preserve_none)
+#if __has_attribute(musttail)
 constexpr bool kEnableInterleaved = true;
 #else
 constexpr bool kEnableInterleaved = false;
@@ -5040,20 +5040,22 @@ struct __attribute__((visibility("hidden"))) ConflictSet::Impl {
     assert(allPointWrites || sorted);
 #endif
 
-    if (kEnableInterleaved && count > 1) {
-      interleavedWrites(writes, count, InternalVersionT(writeVersion));
-    } else {
-      for (int i = 0; i < count; ++i) {
-        const auto &w = writes[i];
-        auto begin = TrivialSpan(w.begin.p, w.begin.len);
-        auto end = TrivialSpan(w.end.p, w.end.len);
-        if (w.end.len > 0) {
-          addWriteRange(rootParent->children[0], begin, end,
-                        InternalVersionT(writeVersion), &writeContext);
-        } else {
-          addPointWrite(rootParent->children[0], begin,
-                        InternalVersionT(writeVersion), &writeContext);
-        }
+    if constexpr (kEnableInterleaved) {
+      if (count > 1) {
+        interleavedWrites(writes, count, InternalVersionT(writeVersion));
+        return;
+      }
+    }
+    for (int i = 0; i < count; ++i) {
+      const auto &w = writes[i];
+      auto begin = TrivialSpan(w.begin.p, w.begin.len);
+      auto end = TrivialSpan(w.end.p, w.end.len);
+      if (w.end.len > 0) {
+        addWriteRange(rootParent->children[0], begin, end,
+                      InternalVersionT(writeVersion), &writeContext);
+      } else {
+        addPointWrite(rootParent->children[0], begin,
+                      InternalVersionT(writeVersion), &writeContext);
       }
     }
   }

conflict_set.py

@@ -88,6 +88,7 @@ class ConflictSet:
             ctypes.POINTER(ctypes.c_int),
             ctypes.c_int,
         )
+        self._lib.ConflictSet_check.restype = None
 
         self._lib.ConflictSet_addWrites.argtypes = (
             ctypes.c_void_p,
@@ -95,13 +96,16 @@ class ConflictSet:
             ctypes.c_int,
             ctypes.c_int64,
         )
+        self._lib.ConflictSet_addWrites.restype = None
 
         self._lib.ConflictSet_setOldestVersion.argtypes = (
             ctypes.c_void_p,
             ctypes.c_int64,
         )
+        self._lib.ConflictSet_setOldestVersion.restype = None
 
         self._lib.ConflictSet_destroy.argtypes = (ctypes.c_void_p,)
+        self._lib.ConflictSet_destroy.restype = None
 
         self._lib.ConflictSet_getBytes.argtypes = (ctypes.c_void_p,)
         self._lib.ConflictSet_getBytes.restype = ctypes.c_int64

include/ConflictSet.h

@@ -132,6 +132,13 @@ struct __attribute__((__visibility__("default"))) ConflictSet {
 
 private:
   Impl *impl;
+#if defined(__cplusplus) && __cplusplus <= 199711L
+  /* Declared private and left undefined to prevent copying in C++98/C++03.
+     The compiler would otherwise implicitly generate public copy operations,
+     which share the opaque Impl* and cause a double-free. */
+  ConflictSet(const ConflictSet &);
+  ConflictSet &operator=(const ConflictSet &);
+#endif
 };
 } /* namespace weaselab */