Merge pull request #355 from xroche/ci/bump-checkout-v5

ci: bump actions/checkout to v6

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
     env:
       CC: ${{ matrix.cc }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -61,6 +61,78 @@ jobs:
         if: failure()
         run: cat tests/test-suite.log 2>/dev/null || true
 
+  # Portability: build and test on macOS (Darwin/clang) on a native runner --
+  # no VM. The tree has no __APPLE__ branches, so Darwin exercises the
+  # generic-Unix path on a second libc and kernel. brew's openssl@3 is keg-only,
+  # so point configure at it; everything else is in the SDK or default paths.
+  macos:
+    name: build (macOS arm64, clang)
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install build dependencies
+        run: |
+          set -euo pipefail
+          brew install autoconf automake libtool autoconf-archive
+
+      - name: Configure
+        run: |
+          set -euo pipefail
+          ssl="$(brew --prefix openssl@3)"
+          autoreconf -fi
+          ./configure CPPFLAGS="-I${ssl}/include" LDFLAGS="-L${ssl}/lib"
+
+      - name: Build
+        run: make -j"$(sysctl -n hw.ncpu)"
+
+      - name: Test
+        run: make check
+
+      - name: Print the test log on failure
+        if: failure()
+        run: cat tests/test-suite.log 2>/dev/null || true
+
+  # Portability/hardening: 32-bit (i386) build on the x86-64 runner via multilib
+  # -- no extra hardware. Exercises the 32-bit size_t/pointer ABI, where size
+  # and bounds math can truncate or wrap in ways 64-bit never reveals (the axis
+  # the overflow-safe bounds work targets). --build (not --host) keeps configure
+  # out of cross mode, so the i386 binary still runs the test suite here.
+  linux-i386:
+    name: build (linux i386, gcc -m32)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install build dependencies (multilib + 32-bit libs)
+        run: |
+          set -euo pipefail
+          sudo dpkg --add-architecture i386
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential gcc-multilib autoconf automake libtool \
+            autoconf-archive zlib1g-dev:i386 libssl-dev:i386
+
+      - name: Configure
+        run: |
+          set -euo pipefail
+          autoreconf -fi
+          ./configure --build=i686-pc-linux-gnu CC="gcc -m32"
+
+      - name: Build
+        run: make -j"$(nproc)"
+
+      - name: Test
+        run: make check
+
+      - name: Print the test log on failure
+        if: failure()
+        run: cat tests/test-suite.log 2>/dev/null || true
+
   # Validate the Debian packaging via the same script maintainers release with.
   # One amd64/gcc run is enough: packaging (control/rules/manifest/lintian/quilt
   # source build) is arch- and compiler-independent, and the build matrix above
@@ -69,7 +141,7 @@ jobs:
     name: deb package (lintian)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -84,8 +156,16 @@ jobs:
 
       # --unsigned: CI has no GPG key (also skips the release sig/checksums).
       # debuild builds every package, then lintian gates on errors.
+      #
+      # DEB_BUILD_OPTIONS trims work CI does not need (release builds via
+      # mkdeb.sh are untouched): noautodbgsym drops the -dbgsym packages whose
+      # LTO payloads are slow to compress and that CI never ships; parallel uses
+      # every core. We let debuild run its test pass -- the only one now that
+      # mkdeb no longer runs its own -- so CI exercises the packaged tests.
       - name: Build Debian packages
-        run: bash tools/mkdeb.sh --unsigned --no-release-artifacts
+        run: |
+          export DEB_BUILD_OPTIONS="noautodbgsym parallel=$(nproc)"
+          bash tools/mkdeb.sh --unsigned --no-release-artifacts
 
   dco:
     name: DCO sign-off
@@ -93,7 +173,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -122,7 +202,7 @@ jobs:
     name: lint (shellcheck, shfmt)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install linters
         env:
@@ -151,7 +231,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

Makefile.in

@@ -257,6 +257,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

configure

@@ -695,6 +695,7 @@ HAVE_VISIBILITY
 CFLAG_VISIBILITY
 LDFLAGS_PIE
 CFLAGS_PIE
+LIBC_FORCE_LINK
 DEFAULT_LDFLAGS
 DEFAULT_CFLAGS
 VERSION_INFO
@@ -15871,6 +15872,53 @@ esac
 fi
 
 
+# Force libc back into DT_NEEDED for libraries that reach it only through
+# libhttrack (libhtsjava, the libtest callbacks), but only with a GNU-style
+# linker; Apple ld rejects these flags and links libSystem unconditionally.
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -Wl,--push-state,--no-as-needed,-lc,--pop-state" >&5
+printf %s "checking whether the linker accepts -Wl,--push-state,--no-as-needed,-lc,--pop-state... " >&6; }
+if test ${ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state+y}
+then :
+  printf %s "(cached) " >&6
+else case e in #(
+  e)
+  ax_check_save_flags=$LDFLAGS
+  LDFLAGS="$LDFLAGS  -Wl,--push-state,--no-as-needed,-lc,--pop-state"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main (void)
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+  ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state=yes
+else case e in #(
+  e) ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state=no ;;
+esac
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+    conftest$ac_exeext conftest.$ac_ext
+  LDFLAGS=$ax_check_save_flags ;;
+esac
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state" >&5
+printf "%s\n" "$ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state" >&6; }
+if test "x$ax_cv_check_ldflags___Wl___push_state___no_as_needed__lc___pop_state" = xyes
+then :
+  LIBC_FORCE_LINK="-Wl,--push-state,--no-as-needed,-lc,--pop-state"
+else case e in #(
+  e) : ;;
+esac
+fi
+
+
+
 ### PIE
 CFLAGS_PIE=""
 LDFLAGS_PIE=""

configure.ac

@@ -91,6 +91,13 @@ AX_CHECK_LINK_FLAG([-Wl,--no-undefined], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,
 AX_CHECK_LINK_FLAG([-Wl,-z,relro,-z,now], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,-z,relro,-z,now"])
 AX_CHECK_LINK_FLAG([-Wl,-z,noexecstack], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,-z,noexecstack"])
 
+# Force libc back into DT_NEEDED for libraries that reach it only through
+# libhttrack (libhtsjava, the libtest callbacks), but only with a GNU-style
+# linker; Apple ld rejects these flags and links libSystem unconditionally.
+AX_CHECK_LINK_FLAG([-Wl,--push-state,--no-as-needed,-lc,--pop-state],
+	[LIBC_FORCE_LINK="-Wl,--push-state,--no-as-needed,-lc,--pop-state"])
+AC_SUBST([LIBC_FORCE_LINK])
+
 ### PIE
 CFLAGS_PIE=""
 LDFLAGS_PIE=""

debian/changelog

@@ -8,6 +8,11 @@ httrack (3.49.8-1) unstable; urgency=medium
     common-licenses/GPL-3, use a secure version=4 watch file, add
     Rules-Requires-Root and Vcs-Browser, and override the false-positive
     source-is-missing on the bundled HTML documentation.
+  * Refresh the webhttrack browser dependency: drop the removed alternatives
+    (iceape-browser, iceweasel, icecat, mozilla, firefox, mozilla-firefox)
+    that no longer exist in Debian and triggered half-broken relationships on
+    the QA debcheck page. Depend on firefox-esr | chromium | www-browser
+    instead.
 
  -- Xavier Roche <xavier@debian.org>  Sun, 07 Jun 2026 14:29:24 +0200
 

debian/control

@@ -30,7 +30,7 @@ Description: Copy websites to your computer (Offline browser)
 Package: webhttrack
 Architecture: any
 Multi-Arch: foreign
-Depends: ${misc:Depends}, ${shlibs:Depends}, webhttrack-common, sensible-utils, iceape-browser | iceweasel | icecat | mozilla | firefox | mozilla-firefox | www-browser
+Depends: ${misc:Depends}, ${shlibs:Depends}, webhttrack-common, sensible-utils, firefox-esr | chromium | www-browser
 Replaces: webhttrack-common (<< 3.43.9-2)
 Breaks: webhttrack-common (<< 3.43.9-2)
 Suggests: httrack, httrack-doc

html/Makefile.in

@@ -213,6 +213,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

lang/Makefile.in

@@ -202,6 +202,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

libtest/Makefile.am

@@ -20,11 +20,12 @@ AM_CPPFLAGS += -I$(top_srcdir)/src
 
 # The callback examples reference libc only through libhttrack, so the direct
 # libc edge gets dropped from DT_NEEDED (library-not-linked-against-libc).
-# Force libc to be recorded as a dependency.
+# Force libc back; configure gates the flag since only a GNU-style linker
+# accepts it (LIBC_FORCE_LINK is empty on e.g. macOS).
 AM_LDFLAGS = \
 	@DEFAULT_LDFLAGS@ \
 	-L../src \
-	-Wl,--push-state,--no-as-needed,-lc,--pop-state
+	@LIBC_FORCE_LINK@
 
 # Examples
 libbaselinks_la_SOURCES =  callbacks-example-baselinks.c

libtest/Makefile.in

@@ -344,6 +344,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
@@ -453,11 +454,12 @@ AM_CPPFLAGS = @DEFAULT_CFLAGS@ @THREADS_CFLAGS@ @V6_FLAG@ @LFS_FLAG@ \
 
 # The callback examples reference libc only through libhttrack, so the direct
 # libc edge gets dropped from DT_NEEDED (library-not-linked-against-libc).
-# Force libc to be recorded as a dependency.
+# Force libc back; configure gates the flag since only a GNU-style linker
+# accepts it (LIBC_FORCE_LINK is empty on e.g. macOS).
 AM_LDFLAGS = \
 	@DEFAULT_LDFLAGS@ \
 	-L../src \
-	-Wl,--push-state,--no-as-needed,-lc,--pop-state
+	@LIBC_FORCE_LINK@
 
 
 # Examples

m4/Makefile.in

@@ -173,6 +173,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

man/Makefile.in

@@ -203,6 +203,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

src/Makefile.am

@@ -86,8 +86,9 @@ libhtsjava_la_SOURCES = htsjava.c htsjava.h
 libhtsjava_la_LIBADD = $(THREADS_LIBS) $(DL_LIBS) libhttrack.la
 # This thin JNI wrapper reaches libc only through libhttrack, so the direct
 # libc edge is dropped from DT_NEEDED (library-not-linked-against-libc). Force
-# libc to be recorded as a dependency.
-libhtsjava_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO) -Wl,--push-state,--no-as-needed,-lc,--pop-state
+# libc back as a dependency; configure gates the flag since only a GNU-style
+# linker accepts it (LIBC_FORCE_LINK is empty on e.g. macOS).
+libhtsjava_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO) $(LIBC_FORCE_LINK)
 
 EXTRA_DIST = httrack.h webhttrack \
 		coucal/murmurhash3.h.diff \

src/Makefile.in

@@ -361,6 +361,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
@@ -537,8 +538,9 @@ libhtsjava_la_SOURCES = htsjava.c htsjava.h
 libhtsjava_la_LIBADD = $(THREADS_LIBS) $(DL_LIBS) libhttrack.la
 # This thin JNI wrapper reaches libc only through libhttrack, so the direct
 # libc edge is dropped from DT_NEEDED (library-not-linked-against-libc). Force
-# libc to be recorded as a dependency.
-libhtsjava_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO) -Wl,--push-state,--no-as-needed,-lc,--pop-state
+# libc back as a dependency; configure gates the flag since only a GNU-style
+# linker accepts it (LIBC_FORCE_LINK is empty on e.g. macOS).
+libhtsjava_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO) $(LIBC_FORCE_LINK)
 EXTRA_DIST = httrack.h webhttrack \
 		coucal/murmurhash3.h.diff \
 		coucal/murmurhash3.h.orig \

templates/Makefile.in

@@ -202,6 +202,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

tests/01_engine-cache.test

@@ -1,5 +1,8 @@
 #!/bin/bash
 #
+# Keep this POSIX-portable: the harness runs it via $(BASH), which is a plain
+# POSIX /bin/sh on some platforms (e.g. macOS), so avoid bashisms and GNU-only
+# tool flags despite the #!/bin/bash above.
 
 # Cache create/read/update logic (driven by 'httrack -#A <dir>').
 #
@@ -38,9 +41,12 @@ test -e "$dir/hts-cache/new.zip" || {
 # Sanity-check the cache footprint: the few-thousand-entry pass is expected to
 # weigh ~1-2 MB. Fail if it balloons well past that (e.g. a per-entry overhead
 # regression or runaway growth), so the cache size stays bounded.
-ceiling=$((4 * 1024 * 1024))
-bytes=$(du -sb "$dir/hts-cache" | cut -f1)
-test "$bytes" -le "$ceiling" || {
-    echo "cache footprint $bytes bytes exceeds ${ceiling} ceiling" >&2
+# du -sk (1024-byte units) is portable; GNU's -b (apparent bytes) is rejected
+# by BSD/macOS du. Block-allocated size is an upper bound on apparent size,
+# which is all a ceiling check needs.
+ceiling=$((4 * 1024)) # KiB
+kbytes=$(du -sk "$dir/hts-cache" | cut -f1)
+test "$kbytes" -le "$ceiling" || {
+    echo "cache footprint ${kbytes} KiB exceeds ${ceiling} KiB ceiling" >&2
     exit 1
 }

tests/02_manpage-regen.test

@@ -3,6 +3,10 @@
 # The committed man/httrack.1 must match what man/makeman.sh produces from the
 # current "httrack --help" output. This catches a --help change that was not
 # followed by "make -C man regen-man".
+#
+# Keep this POSIX-portable: the harness runs it via $(BASH), which is a plain
+# POSIX /bin/sh on some platforms (e.g. macOS), so avoid bashisms (such as
+# process substitution) despite the #!/bin/bash above.
 
 : "${top_srcdir:=..}"
 
@@ -20,7 +24,9 @@ command -v httrack >/dev/null 2>&1 || {
 }
 
 tmp=$(mktemp) || exit 1
-trap 'rm -f "$tmp"' EXIT
+committed_clean=$(mktemp) || exit 1
+generated_clean=$(mktemp) || exit 1
+trap 'rm -f "$tmp" "$committed_clean" "$generated_clean"' EXIT
 
 README="$top_srcdir/README" bash "$gen" httrack >"$tmp" 2>/dev/null || {
     echo "makeman.sh failed" >&2
@@ -28,12 +34,15 @@ README="$top_srcdir/README" bash "$gen" httrack >"$tmp" 2>/dev/null || {
 }
 
 # Ignore the two intentionally date-dependent lines (page date, copyright year).
+# Temp files, not process substitution, so this works under a POSIX /bin/sh.
 strip_volatile() { grep -vE '^\.TH httrack |^Copyright \(C\) 1998-'; }
+strip_volatile <"$committed" >"$committed_clean"
+strip_volatile <"$tmp" >"$generated_clean"
 
-if diff <(strip_volatile <"$committed") <(strip_volatile <"$tmp") >/dev/null; then
+if diff "$committed_clean" "$generated_clean" >/dev/null; then
     exit 0
 fi
 
 echo "man/httrack.1 is out of date. Regenerate with: make -C man regen-man" >&2
-diff <(strip_volatile <"$committed") <(strip_volatile <"$tmp") | head -40 >&2
+diff "$committed_clean" "$generated_clean" | head -40 >&2
 exit 1

tests/Makefile.in

@@ -380,6 +380,7 @@ LD = @LD@
 LDFLAGS = @LDFLAGS@
 LDFLAGS_PIE = @LDFLAGS_PIE@
 LFS_FLAG = @LFS_FLAG@
+LIBC_FORCE_LINK = @LIBC_FORCE_LINK@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@

tools/mkdeb.sh

@@ -118,7 +118,10 @@ main() {
     git -C "$repo/src/coucal" archive --format=tar --prefix=src/coucal/ HEAD |
         tar -x -C "$export_dir"
 
-    # Refresh build system and man page, then build and validate the tarball.
+    # Refresh build system and man page, then build the tarball. We build here
+    # only because regen-man needs the compiled binaries; the test suite is not
+    # run in this pass. debuild (below) runs the full suite once, with the online
+    # tests enabled, so a check here would just be a slower, offline-only repeat.
     info "regenerating build system and man page"
     (
         cd "$export_dir"
@@ -126,8 +129,6 @@ main() {
         ./configure --quiet
         make -s -j"$(nproc)"
         make -s -C man regen-man
-        info "running test suite"
-        make -s check
         # Build the tarball from a clean tree so no object files leak into it.
         make -s clean
         make -s dist