Fix fenrir issues accross wolfSentry

.github/docker/wolfsentry-check-all/Dockerfile

@@ -0,0 +1,63 @@
+FROM ubuntu:26.04@sha256:157dc3d6e4a3e4f2c68d12df9df9ed6e808b59af6d4c3757b432b4f519916725
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        autoconf \
+        automake \
+        ca-certificates \
+        clang \
+        clang-tidy \
+        cppcheck \
+        curl \
+        doxygen \
+        dwarves \
+        gcc \
+        gcc-15 \
+        gcc-15-multilib \
+        gcc-arm-none-eabi \
+        gcc-multilib \
+        git \
+        graphviz \
+        libnewlib-arm-none-eabi \
+        libclang-rt-21-dev \
+        libnotify-dev \
+        libtool \
+        llvm \
+        make \
+        patch \
+        qemu-user \
+        texlive-fonts-recommended \
+        texlive-latex-base \
+        texlive-latex-extra \
+        texlive-latex-recommended \
+        texlive-plain-generic \
+        util-linux \
+        valgrind \
+        xz-utils \
+        zip \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG ARMEB_TOOLCHAIN=armebv7-eabihf--glibc--stable-2026.08-1
+ARG ARMEB_TOOLCHAIN_SHA256=4d93a7b26c0909ea7574e98246522cf6b77491d43a7ca7aa08ae1c29ecf07b0d
+
+# Buildroot's compiler wrapper finds its real binary from argv[0], so expose the
+# armeb-linux-gnueabihf names as exec shims, and put the sanitizer runtimes in the sysroot qemu loads from.
+RUN curl -fsSL --retry 5 --retry-all-errors -o /tmp/armeb.tar.xz \
+        "https://toolchains.bootlin.com/downloads/releases/toolchains/armebv7-eabihf/tarballs/${ARMEB_TOOLCHAIN}.tar.xz" \
+    && echo "${ARMEB_TOOLCHAIN_SHA256}  /tmp/armeb.tar.xz" | sha256sum -c - \
+    && tar -xJf /tmp/armeb.tar.xz -C /opt \
+    && rm /tmp/armeb.tar.xz \
+    && tc="/opt/${ARMEB_TOOLCHAIN}" \
+    && target="${tc}/armeb-buildroot-linux-gnueabihf" \
+    && for f in "${tc}"/bin/armeb-buildroot-linux-gnueabihf-*; do \
+           case "$f" in *.br_real) continue ;; esac; \
+           shim="/usr/local/bin/$(basename "$f" | sed 's/^armeb-buildroot-/armeb-/')"; \
+           printf '#!/bin/sh\nexec %s "$@"\n' "$f" > "$shim"; \
+           chmod +x "$shim"; \
+       done \
+    && cp -a "${target}"/lib/libasan.so* "${target}"/lib/libubsan.so* "${target}"/lib/libatomic.so* "${target}/sysroot/lib/" \
+    && ln -s "${target}/sysroot" /usr/armeb-linux-gnueabihf

.github/docker/wolfsentry-ci/Dockerfile

@@ -1,5 +1,7 @@
 FROM ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
 
+RUN echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
+
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         bubblewrap \

.github/workflows/check-all.yml

@@ -0,0 +1,90 @@
+name: make check-all
+
+run-name: ${{ inputs.nightly_run_id || github.workflow }}
+
+on:
+  push:
+    branches: [ 'master', 'release/**' ]
+  pull_request:
+    branches: [ '**' ]
+  workflow_dispatch:
+    inputs:
+      nightly_run_id:
+        description: Nightly coordinator run ID
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash -e {0}
+
+jobs:
+  check-all:
+    name: make check-all
+    runs-on: ubuntu-latest
+    timeout-minutes: 240
+    env:
+      # built from .github/docker/wolfsentry-check-all by publish-ci-image.yml
+      CHECK_ALL_IMAGE: ghcr.io/wolfssl/wolfsentry-check-all@sha256:99be2efa32df4ea09a87706286b914e949e4b636787759dd4ae806f4b1aaae84
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+        path: wolfsentry
+        fetch-depth: 0
+    - uses: actions/checkout@v4
+      with:
+        repository: FreeRTOS/FreeRTOS-Kernel
+        ref: dbf70559b27d39c1fdb68dfb9a32140b6a6777a0
+        path: third/FreeRTOS/FreeRTOS/Source
+    - uses: actions/checkout@v4
+      with:
+        repository: lwip-tcpip/lwip
+        ref: 3fe8d2fc43a9b69f7ed28c63d44a7744f9c0def9
+        path: third/lwip
+    - uses: actions/checkout@v4
+      with:
+        repository: json-schema-org/JSON-Schema-Test-Suite
+        ref: 245a45abc90190c0bff04d97e6d2b541b4bb9f12
+        path: JSON-Schema-Test-Suite
+    - uses: actions/checkout@v4
+      with:
+        repository: wolfSSL/wolfssl
+        ref: master
+        path: wolfssl
+    - name: Apply the lwIP packet filter patch
+      run: patch --directory third/lwip --strip 1 < wolfsentry/lwip/LWIP_PACKET_FILTER_API.patch
+    # stand-in until the maintainer's local scripts/analyzer-config.sh is available; cppcheck needs the file to exist
+    - name: Provide scripts/analyzer-config.sh
+      run: touch wolfsentry/scripts/analyzer-config.sh
+    - name: Lower mmap randomization for ThreadSanitizer
+      run: sudo sysctl -w vm.mmap_rnd_bits=28
+    - name: Pull the check-all image
+      run: |
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry docker pull "$CHECK_ALL_IMAGE"
+    # make pre-push-check runs scripts/pre-push.sh, which runs make check-all on this commit.
+    # gcc 14 arm-none-eabi needs larger FreeRTOS image limits; the JSON corpus sits on tmpfs because
+    # qemu-user cannot pass ext4's 64-bit directory cookies to the 32-bit armeb tests.
+    - name: make pre-push-check
+      run: |
+        docker run --rm \
+          --volume "$GITHUB_WORKSPACE:/workspace" \
+          --workdir /workspace/wolfsentry \
+          --mount type=tmpfs,destination=/workspace/wolfsentry/tests/JSON-Schema-Test-Suite \
+          --env TMPDIR=/tmp \
+          --env CLANG_PATH=/usr/bin \
+          --env NOTIFICATION_SANDBOX= \
+          --env FREERTOS_ARM32_MAX_IMAGE_SIZE=270000 \
+          --env FREERTOS_ARM32_MAX_SECTIONS_SIZE=145000 \
+          --env FREERTOS_ARM32_THUMB_MAX_SECTIONS_SIZE=145000 \
+          "$CHECK_ALL_IMAGE" \
+          bash -ec 'cp -a /workspace/JSON-Schema-Test-Suite/. tests/JSON-Schema-Test-Suite/; git config --global --add safe.directory "*"; make pre-push-check'

.github/workflows/examples.yml

@@ -36,7 +36,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - name: Build and start the lwIP network
-      run: docker compose up --build --detach
+      run: |
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry docker compose up --build --detach
     - name: Exercise allowed and rejected traffic
       run: |
         for attempt in $(seq 1 30); do
@@ -94,7 +96,8 @@ jobs:
         path: wolfip
     - name: Build the wolfSentry CI image
       run: |
-        docker build \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry docker build \
           --file wolfsentry/.github/docker/wolfsentry-ci/Dockerfile \
           --tag wolfsentry-ci:local wolfsentry
     - name: Build and run the wolfIP example
@@ -146,7 +149,8 @@ jobs:
         path: wolfssl
     - name: Build the wolfSentry CI image
       run: |
-        docker build \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry docker build \
           --file wolfsentry/.github/docker/wolfsentry-ci/Dockerfile \
           --tag wolfsentry-ci:local wolfsentry
     - name: Build and exercise the notification demo
@@ -195,7 +199,8 @@ jobs:
         path: lwip
     - name: Check out lwIP contrib
       run: |
-        git clone --branch STABLE-2_1_0_RELEASE --depth 1 \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry git clone --branch STABLE-2_1_0_RELEASE --depth 1 \
           https://git.savannah.nongnu.org/git/lwip/lwip-contrib.git \
           lwip/contrib
         test "$(git -C lwip/contrib rev-parse HEAD)" = \

.github/workflows/nightly.yml

@@ -33,6 +33,7 @@ jobs:
           const POLL_TIMEOUT_MS = 120 * 60 * 1000;
           const dispatchToken = `nightly-${context.runId}-${context.runAttempt}`;
           const workflows = [
+            'check-all.yml',
             'codeql.yml',
             'coverage.yml',
             'examples.yml',

.github/workflows/publish-ci-image.yml

@@ -5,6 +5,7 @@ on:
     branches: [ '**' ]
     paths:
       - '.github/docker/wolfsentry-ci/**'
+      - '.github/docker/wolfsentry-check-all/**'
       - '.github/workflows/publish-ci-image.yml'
   workflow_dispatch:
 
@@ -80,3 +81,68 @@ jobs:
           scan-build --help > /dev/null
           /usr/bin/python3 -c 'import dbus, gi'
           make -j2 test
+
+  publish-check-all:
+    name: Publish check-all image
+    if: github.repository == 'wolfSSL/wolfsentry'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push image
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: .github/docker/wolfsentry-check-all/Dockerfile
+          platforms: linux/amd64
+          pull: true
+          push: true
+          tags: |
+            ghcr.io/wolfssl/wolfsentry-check-all:sha-${{ github.sha }}
+            ghcr.io/wolfssl/wolfsentry-check-all:${{ github.ref == 'refs/heads/master' && 'latest' || 'edge' }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          cache-from: type=registry,ref=ghcr.io/wolfssl/wolfsentry-check-all:latest
+          cache-to: type=inline
+
+  smoke-check-all:
+    name: Test published check-all image
+    needs: publish-check-all
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      packages: read
+    container:
+      image: ghcr.io/wolfssl/wolfsentry-check-all@${{ needs.publish-check-all.outputs.digest }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    defaults:
+      run:
+        shell: bash -e {0}
+    steps:
+      - name: Exercise image
+        run: |
+          echo "digest: ${{ needs.publish-check-all.outputs.digest }}"
+          gcc-15 --version
+          clang --version
+          clang-tidy --version
+          cppcheck --version
+          arm-none-eabi-gcc --version
+          armeb-linux-gnueabihf-gcc --version
+          qemu-armeb --version
+          test -e /usr/armeb-linux-gnueabihf/lib/libasan.so.8

.github/workflows/wolfssl-versions.yml

@@ -37,9 +37,10 @@ jobs:
     - name: Build matrix
       id: versions
       run: |
-        LATEST=$(git ls-remote --tags --refs \
-          https://github.com/wolfSSL/wolfssl.git 'v*-stable' \
-          | awk -F/ '{print $NF}' | sort -V | tail -n 1)
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        TAGS=$(retry git ls-remote --tags --refs \
+          https://github.com/wolfSSL/wolfssl.git 'v*-stable')
+        LATEST=$(awk -F/ '{print $NF}' <<<"$TAGS" | sort -V | tail -n 1)
         test -n "$LATEST"
         if [[ ! "$LATEST" =~ ^v[0-9]+(\.[0-9]+)+-stable$ ]]; then
           echo "Unexpected wolfSSL stable tag: $LATEST" >&2
@@ -83,7 +84,8 @@ jobs:
       env:
         WOLFSSL_REF: ${{ matrix.ref }}
       run: |
-        git clone --depth 1 --branch "$WOLFSSL_REF" \
+        retry() { for attempt in 1 2 3; do "$@" && return 0; [ "$attempt" -lt 3 ] && sleep $((attempt * 15)); done; return 1; }
+        retry git clone --depth 1 --branch "$WOLFSSL_REF" \
           https://github.com/wolfSSL/wolfssl.git "$HOME/wolfssl"
         cd "$HOME/wolfssl"
         ./autogen.sh