Changes

OBS: build_srcpkg.Dockerfile: add dh-runit

Add dh-runit, so we can build source packages of newer versions of
pcsc-lite.

Related: https://salsa.debian.org/debian/pcsc-lite/-/commit/c7c40df72dc3c754341501e34aa096fd72a61cef
Change-Id: I8d852cebb9decb3c881fd3ff9b530213bade0216

jobs/master-builds.yml: add missing job type 'distcheck'

We do have this job type in gerrit-verifications.yml, so it's executed
for each patch submitted to Gerrit.  However, we are not executing
'distcheck' during the daily master builds - fix this.

Change-Id: I4898ba712a29a6afc34bc22adec6a3131ce8c794
Fixes: 31fd5cf0 ("gerrit-verifications: execute 'distcheck' job for pysim")

jobs/gerrit-verifications.yml: pysim: allow skipping card tests

I've already implemented this logic in 6a3b8a0, however by mistake
I added it to master-builds.yml instead of gerrit-verifications.yml.
This is wrong because we specifically need this feature for Jenkins
verification, not for the master builds.

For daily master builds, on the other hand, we specifically want to
execute all existing job types, so revert my recent changes from
master-builds.yml, but keep the new job type.

Change-Id: I986d88545f64e13cd571ba9ff56bc924822e39a0
Fixes: 6a3b8a0 ("jobs/master-builds.yml: pysim: allow skipping card tests")

OBS: build_srcpkg.Dockerfile: add dh-cmake

Add dh-cmake, so we can build source packages of programs using cmake,
such as kamailio.

Change-Id: I8b5debce4f2fc0c41c69f861822394e139ac5dfc

jobs/master-builds.yml: pysim: separate JOB_TYPE for card tests

Change-Id: Ia48d1b468f65d7c2e6b4128eeac36d0f3d03c45e
Depends: pysim.git If76d812ee43b7eb3b57fdc660c60bf31fbff5b16

jobs/master-builds.yml: pysim: allow skipping card tests

Skip tests requiring physical cards ("card-test") for commits
having a special marker in the COMMIT_MSG:

  Jenkins: skip-card-tests

This speeds up the build verification significantly, and may be
useful for patches that do not modify the core logic (such as
documentation improvements and misc fixes).

Change-Id: I591717a2e2659c02447087dec23aa279cfd55551

jobs/master-builds.yml: fix typo: crad-test -> card-test

Change-Id: I0686af6c026e298c86d3a64cc161e5c84ec7dc57
Fixes: ee1ef65 ("jobs/master-builds.yml: pysim: separate JOB_TYPE for card tests")

jobs/gerrit-verifications: fix hwtest param

This must be a bool instead of a string. Without this patch, the
condition checking for the bool is always true.

Fixes: 986c2648 ("jobs/gerrit: run osmo-ccid-firmware-hwtest")
Change-Id: I3117ddab888dd226ed57b62b9b9e672f1cb9127d

jobs/gerrit: fix artifacts logic

The previous logic failed when there are no artifacts for archiving,
for multiple reasons. Fix all of them:

* "allow-empty" needs to be set, so jenkins doesn't fail the job when it
  can't find any artifacts to archive.
* The "artifacts" string must not be empty even if "allow-empty" is set,
  as otherwise it assumes a configuration error.
* The jenkins jobs fails in the archiving step if the workspace dir
  doesn't exist.

Fixes: 4c392b9e ("jobs/gerrit: archive osmo-ccid-firmware artifacts")
Change-Id: If7a051d7be2beb617c2eda4fd1a669565c2c5b55

jobs/gerrit: archive osmo-ccid-firmware artifacts

Prepare to use the built firmware in a new hwtest job.

Related: SYS#7963
Change-Id: Ib220f708725e502724ef0375130e7db77c6e91fa

jenkins-gerrit/artifacts_download: new script

Add a script for downloading artifacts from the build job in a gerrit
pipeline, so it can be used in the hwtest job job.

pipeline: <--- URL to the pipeline is passed to all jobs
  parallel:
    sequential:
      build  <--- artifacts are here
      hwtest <--- will call the new script with the pipeline URL
    lint
    binpkgs
    ...

Related: SYS#7963
Change-Id: Ia96951d62b464b2e0b80f8e555cb77e5b9e52f78

jobs/gerrit-osmo-ccid-firmware-hwtest: new job

Add a new test that flashes the firmware from the previous build job and
runs tests against it. Tests are intentionally from the master branch
for security reasons.

Related: SYS#7963
Depends: osmo-ccid-firmware I9445d6d5e4723bf6a87d4bffcdc638560471328b
Change-Id: I736b2b194813e6edff0197145fe08168c3e66903

jobs/gerrit: run osmo-ccid-firmware-hwtest

Related: SYS#7963
Change-Id: I438239f65f4b52fb5c77654b366b3c3254fcb44f

ansible/hosts: update simtest

Change-Id: Ica3c229ddf617b61e88774d3b330263307f84e97

ansible/setup-simtest: merge apt tasks

Do apt update and installing packages in one task, similar to how we do
it in other ansible yml files.

Change-Id: I269b368fdca682814976b2cda1c14c33529650b7

ansible/setup-simtest: sort packages

Change-Id: I9fac58407b7c5a38e2ed56e6e5718ce13ed23973

ansible/setup-simtest: add sudo and wget

Both are needed for the new openjdk install logic.

Related: OS#6998#note-3
Change-Id: I4d5c400daec9c74d069c60a6221ae57e8c6f7953

ansible: openjdk: add mkdir ~/jenkins

Ensure the JDK can always be installed to /home/{{ jenkins_user
}}/jenkins/jdk/bin/java, even if ~/jenkins does not exist yet at this
point. This could be because jenkins didn't connect to the node yet, or
because the jenkins dir isn't set to ~/jenkins.

Related: OS#6998#note-4
Change-Id: I384398e2fe45988eaac32d61095c989914699245

ansible/simtest: remove pip install logic

The pip install logic fails with:
  :stderr: error: externally-managed-environment

Remove this. Dependencies are installed venv/virtualenv:
https://gitea.osmocom.org/sim-card/pysim/src/commit/c50f4b4a0222a964710ce3124a66fe13c804be65/contrib/jenkins.sh#L25-L30

Change-Id: I460e22d78966d14e02b639efc4f74d7356e22f28

ansible: jenkins: update install openjdk logic

New jenkins versions require newer java versions to be installed on the
jenkins nodes. Install openjdk from download.java.net instead of using
distribution packages, so we are not limited by what the distribution
offers (which is oftentimes not recent enough).

Related: OS#6998
Change-Id: I1de9a67aafe71e8c8b77c57baddb09611cb2e1fd

ansible: debian: remove logic for jessie

This is a really old release we don't use anymore, so clean up related
commands from the ansible tasks.

Change-Id: Ifad5e9088e026a61b2e3463936c1ba602f4a99df

ansible: lx2-raspbian{12 => 13}build-ansible

Related: OS#6998
Change-Id: I66afdc0ba86cfde6613226abba900c31e486f846

ansible: docker: update apt key install method

Fix that the deprecated method for installing the apt key for the docker
repository was still used.

Fix for (with debian 13):
  Failed to find required executable "apt-key" in paths: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Related: OS#6998
Change-Id: I8184b6f9369886b79a3cf015ceee6e46e38b089c

ansible: add Debian-13.yml

Related: OS#6998
Change-Id: I34db89aba34e7c49843db0aa39fd593e35f4700a

ansible: ntpd: update for debian 13

Use the openntpd package, as there isn't a ntp package anymore. The
service gets enabled and started automatically after installing it, so
remove the block that did it manually.

Change-Id: I7dad2f0cc034f487d4c97ec37325dab667f24ce3

jobs/octsim_osmo-ccid-firmware: add email param

Allow configuring the email notifications before starting a job, so no
notifications can be set while testing changes to the jenkins job. Add
jenkins-notifications@lists.osmocom.org while at it, as we have it with
almost all other jobs.

Change-Id: Ifcd580873479fc259119139d47447ba0e21b21f4

jobs/octsim_osmo-ccid-firmware: don't use axis

There is only one node, so we can specify it directly instead of using a
build axis.

Change-Id: I552c8f1b244c8e8b0f902720698fbb6ba660fb72

jobs/octsim_osmo-ccid-firmware: various tweaks

* move name and desc up (in preparation to adding another job in the same file)
* remove "concurrent: false": the octsimtest node is already configured
  to only accept one job. if we had multiple octsimtest nodes, we
  wouldn't need this limitation of not running concurrently, so this
  isn't useful.
* remove options without effect (block-downstream, block-upstream,
  disabled, build-blocker, etc.)
* add "scm checkout" comment to retry-count as we have it in other files

Change-Id: If64787efbe4a1305cd60941b69e9416960d056a2

jobs/octsim_osmo-ccid-firmware: remove timer

This job already gets triggered once a day from
master-osmo-ccid-firmware. Running it once a day like all other master
jobs should be enough, remove the timed trigger that caused it to run
twice a day.

Change-Id: Ia4fdb6d504c7a08cf258e82436627894602f7301

jobs/octsim_osmo-ccid-firmware: add branch param

Change-Id: I05321cd2c174060381e099aa49d5932f9cafdd28

jobs/octsim_osmo-ccid-firmware: PYTHONUNBUFFERED=1

Ensure that the python output is getting displayed directly when running
in jenkins.

Change-Id: Iffe74b270f33286f394db1be03e6ce1953aff4bf

osmo_git_clone_url(): add Gitea mirrors for libnftnl and nftables

Change-Id: I830a16c8bf7f595b16113bf2ba5e81bae56533dd
Related: osmo-upf.git I28950d823dfd91e8e2ac23a19e5a86d1027096b3

scripts: fix deprecation warnings

scripts/verify_value_string_arrays_are_terminated.py:22: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:22: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:23: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:23: SyntaxWarning:
    "\s" is an invalid escape sequence. Such sequences will not work in the future.
    Did you mean "\\s"? A raw string is also an option.
scripts/verify_value_string_arrays_are_terminated.py:30: DeprecationWarning:
    codecs.open() is deprecated. Use open() instead.

Change-Id: Ie78b84dd556266f96780a4232f95b58e0e3eabc0

lint/lint_diff: test_ruff: add pyosmocom

Ruff is very fast and detects some additional things that pylint (which
is already used with pyosmocom) does not.

Depends: pyosmocom I2ca3135f1ce38dcc06dc95c38f4b6258a60121cd
Change-Id: I2fdb36c79efbd0f0fb4bdce3cd0045bb35d4cf64

jobs/octsim_osmo-ccid-firmware: add 30 min timeout

I just stopped a job run that was going for 2 days 16 h. When
successful, the job finishes in 10 min, so let it abort automatically
after 30 min.

Change-Id: Iaccc96b8b29880c9e115e52561fcd43f7b6a8f77

OBS: pyhss_download_deps: add python 3.14

Download binary package dependencies for python 3.14 too, so we can
build the package for Ubuntu 26.04.

Related: OS#6983
Related: https://gitea.osmocom.org/osmocom/pyhss/commit/2125f52c5eb1b3e66b1ebe2febadb7c886536681
Change-Id: Ic23d52c081f68fb8d6f7d9e370883236ca9bf35f

OBS: nightly: add ".0" after versions on git tags

Fix that with the current logic of generating version numbers for
nightly, a version done on a tag can be higher than the following
version:

on tag:                    1.14.0.202603231800
on tag (with this patch):  1.14.0.0.202603231800
next commit after the tag: 1.14.0.1.abcd.202603241800

Fixes: OS#6981
Change-Id: Id140d8ea76bf98357711587a9909d54097250fd6