[secp256k1] ci, gha: Add "x86_64: Linux (Debian stable)" GitHub Actions job

Summary:
And also test gcc and clang snapshots.

------

[[bitcoin-core/secp256k1#1313 | secp256k1#1313]]

> ci: Install development snapshots of gcc and clang

bitcoin-core/secp256k1@1deecaa

> ci: Add x86_64 Linux tasks for gcc and clang snapshots

bitcoin-core/secp256k1@609093b

------

[[bitcoin-core/secp256k1#1396 | secp256k1#1396]]

> ci: Remove GCC build files and sage to reduce size of Docker image

> ci, gha: Add "x86_64: Linux (Debian stable)" GitHub Actions job

> ci: Remove "x86_64: Linux (Debian stable)" task from Cirrus CI

> ci, gha: Add `retry_builder` Docker image builder
>
> This change is aimed at significantly reducing the frequency of failures
> caused by intermittent network timeouts.

> ci, gha: Drop `driver-opts.network` input for `setup-buildx-action`

------

[[bitcoin-core/secp256k1#1719 | secp256k1#1719]] (partial)

> ci: Use YAML anchor and aliases for repeated "Checkout" steps

bitcoin-core/secp256k1@574c2f3

> ci: Use YAML anchor and aliases for repeated "CI script" steps
bitcoin-core/secp256k1@1decc49

------

Also initialize `ecount` in schnorrsig/test_impl.h to avoid a `-Wuninitialized-const-pointer` error with clang-snapshot. This will be done by core in bitcoin-core/secp256k1@b198061

This is a backport of secp256k#1313, [[bitcoin-core/secp256k1#1396 | secp256k1#1396]] and a partial backport of [[bitcoin-core/secp256k1#1719 | secp256k1#1719]]

Test Plan: push to github, check github actions run successfully

Reviewers: #bitcoin_abc, Fabien

Reviewed By: #bitcoin_abc, Fabien

Differential Revision: https://reviews.bitcoinabc.org/D19519

Author: real-or-random

src/secp256k1/.cirrus.yml

@@ -45,35 +45,7 @@ linux_container_snippet: &LINUX_CONTAINER
     # Gives us more CPUs for free if they're available.
     greedy: true
     # More than enough for our scripts.
-    memory: 1G
-
-task:
-  timeout_in: 120m
-  name: "x86_64: Linux (Debian stable)"
-  << : *LINUX_CONTAINER
-  matrix:
-    - env: {WIDEMUL:  int64,  RECOVERY: yes}
-    - env: {WIDEMUL:  int64,                 ECDH: yes, EXPERIMENTAL: yes, MULTISET: yes, SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128}
-    - env: {WIDEMUL: int128,  RECOVERY: yes,            EXPERIMENTAL: yes,                SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128,                 ECDH: yes, EXPERIMENTAL: yes, MULTISET: yes, SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128,  ASM: x86_64}
-    - env: {                  RECOVERY: yes,            EXPERIMENTAL: yes, MULTISET: yes, SCHNORRSIG: yes}
-    - env: {AUTOTOOLS_TARGET: distcheck, CMAKE_TARGET: install, WITH_VALGRIND: no, CTIMETEST: no, BENCH: no}
-    - env: {AUTOTOOLS_EXTRA_FLAGS: CPPFLAGS=-DDETERMINISTIC, CMAKE_EXTRA_FLAGS: -DCMAKE_C_FLAGS=-DDETERMINISTIC}
-    - env: {AUTOTOOLS_EXTRA_FLAGS: CFLAGS=-O0, CMAKE_EXTRA_FLAGS: -DCMAKE_BUILD_TYPE=Debug, CTIMETEST: no}
-    - env: {SCHNORR: no}
-    - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
-    - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
-  matrix:
-    - env:
-        CC: gcc
-    - env:
-        CC: clang
-  test_script:
-    - ./ci/build_autotools.sh
-    - ./ci/build_cmake.sh
-  << : *CAT_LOGS
+    memory: 2G
 
 task:
   name: "i686: Linux (Debian stable)"

src/secp256k1/.github/actions/run-in-docker-action/action.yml

@@ -14,12 +14,20 @@ runs:
   using: "composite"
   steps:
     - uses: docker/setup-buildx-action@v2
+
+    - uses: docker/build-push-action@v4
+      id: main_builder
+      continue-on-error: true
       with:
-        # See: https://github.com/moby/buildkit/issues/3969.
-        driver-opts: |
-          network=host
+        context: .
+        file: ${{ inputs.dockerfile }}
+        tags: ${{ inputs.tag }}
+        load: true
+        cache-from: type=gha
 
     - uses: docker/build-push-action@v4
+      id: retry_builder
+      if: steps.main_builder.outcome == 'failure'
       with:
         context: .
         file: ${{ inputs.dockerfile }}

src/secp256k1/.github/workflows/ci.yml

@@ -58,6 +58,58 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=min
 
+  linux_debian:
+    name: "x86_64: Linux (Debian stable)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: {WIDEMUL:  'int64',  RECOVERY: 'yes'}
+          - env_vars: {WIDEMUL:  'int64',                 ECDH: 'yes', EXPERIMENTAL: 'yes', MULTISET: 'yes', SCHNORRSIG: 'yes'}
+          - env_vars: {WIDEMUL: 'int128'}
+          - env_vars: {WIDEMUL: 'int128',  RECOVERY: 'yes',            EXPERIMENTAL: 'yes',                  SCHNORRSIG: 'yes'}
+          - env_vars: {WIDEMUL: 'int128',                 ECDH: 'yes', EXPERIMENTAL: 'yes', MULTISET: 'yes', SCHNORRSIG: 'yes'}
+          - env_vars: {WIDEMUL: 'int128',  ASM: 'x86_64'}
+          - env_vars: {                  RECOVERY: 'yes',            EXPERIMENTAL: 'yes', MULTISET: 'yes', SCHNORRSIG: 'yes'}
+          - env_vars: {AUTOTOOLS_TARGET: 'distcheck', CMAKE_TARGET: 'install', WITH_VALGRIND: 'no', CTIMETEST: 'no', BENCH: 'no'}
+          - env_vars: {AUTOTOOLS_EXTRA_FLAGS: 'CPPFLAGS=-DDETERMINISTIC', CMAKE_EXTRA_FLAGS: '-DCMAKE_C_FLAGS=-DDETERMINISTIC'}
+          - env_vars: {AUTOTOOLS_EXTRA_FLAGS: 'CFLAGS=-O0', CMAKE_EXTRA_FLAGS: '-DCMAKE_BUILD_TYPE=Debug', CTIMETEST: 'no'}
+          - env_vars: {SCHNORR: 'no'}
+          - env_vars: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+          - env_vars: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
+        cc:
+          - 'gcc'
+          - 'clang'
+          - 'gcc-snapshot'
+          - 'clang-snapshot'
+
+    env:
+      CC: ${{ matrix.cc }}
+
+    steps:
+      - &CHECKOUT
+        name: Checkout
+        uses: actions/checkout@v5
+
+      - &CI_SCRIPT_IN_DOCKER
+        name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+          command: >
+            git config --global --add safe.directory ${{ github.workspace }} &&
+            ./ci/build_autotools.sh && ./ci/build_cmake.sh
+
+      - &PRINT_ENV
+        name: CI env
+        run: env
+        if: ${{ always() }}
+
   mingw_debian:
     name: ${{ matrix.configuration.job_name }}
     runs-on: ubuntu-latest
@@ -85,22 +137,9 @@ jobs:
               HOST: 'i686-w64-mingw32'
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: CI script
-        env: ${{ matrix.configuration.env_vars }}
-        uses: ./.github/actions/run-in-docker-action
-        with:
-          dockerfile: ./ci/linux-debian.Dockerfile
-          tag: linux-debian-image
-          command: >
-            git config --global --add safe.directory ${{ github.workspace }} &&
-            ./ci/build_autotools.sh && ./ci/build_cmake.sh
-
-      - name: CI env
-        run: env
-        if: ${{ always() }}
+      - *CHECKOUT
+      - *CI_SCRIPT_IN_DOCKER
+      - *PRINT_ENV
 
   macos-native:
     name: "x86_64: macOS Sequoia"
@@ -127,8 +166,7 @@ jobs:
           # Fixme: the following task fails with error "System.IO.IOException: No space left on device" even if we run only the autotools job
           # - { AUTOTOOLS_TARGET: 'distcheck', CMAKE_TARGET: 'install' }
     steps:
-      - name: Checkout
-        uses: actions/checkout@v5
+      - *CHECKOUT
 
       - name: Install Homebrew packages
         env:
@@ -146,9 +184,7 @@ jobs:
         env: ${{ matrix.env_vars }}
         run: ./ci/build_cmake.sh
 
-      - name: CI env
-        run: env
-        if: ${{ always() }}
+      - *PRINT_ENV
 
   sage:
     name: "SageMath prover"

src/secp256k1/ci/linux-debian.Dockerfile

@@ -1,4 +1,6 @@
-FROM debian:bookworm
+FROM debian:bookworm-slim
+
+SHELL ["/bin/bash", "-c"]
 
 RUN dpkg --add-architecture i386 && \
     dpkg --add-architecture s390x && \
@@ -8,7 +10,7 @@ RUN dpkg --add-architecture i386 && \
 # dkpg-dev: to make pkg-config work in cross-builds
 # llvm: for llvm-symbolizer, which is used by clang's UBSan for symbolized stack traces
 RUN apt-get update && apt-get install --no-install-recommends --no-upgrade -y \
-        git ca-certificates \
+        git ca-certificates wget\
         automake cmake default-jdk dpkg-dev libssl-dev libtool make ninja-build pkg-config python3 qemu-user valgrind \
         gcc clang llvm libclang-rt-dev libc6-dbg \
         g++ \
@@ -19,5 +21,42 @@ RUN apt-get update && apt-get install --no-install-recommends --no-upgrade -y \
         gcc-mingw-w64-x86-64-win32 wine64 wine \
         gcc-mingw-w64-i686-win32 wine32
 
+WORKDIR /root
+
+# Build and install gcc snapshot
+ARG GCC_SNAPSHOT_MAJOR=14
+RUN mkdir gcc && cd gcc && \
+    wget --progress=dot:giga --https-only --recursive --accept '*.tar.xz' --level 1 --no-directories "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}" && \
+    wget "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}/sha512.sum" && \
+    sha512sum --check --ignore-missing sha512.sum && \
+    # We should have downloaded exactly one tar.xz file
+    ls && \
+    [[ $(ls *.tar.xz | wc -l) -eq "1" ]] && \
+    tar xf *.tar.xz && \
+    mkdir gcc-build && cd gcc-build && \
+    apt-get update && apt-get install --no-install-recommends -y libgmp-dev libmpfr-dev libmpc-dev flex && \
+    ../*/configure --prefix=/opt/gcc-snapshot --enable-languages=c --disable-bootstrap --disable-multilib --without-isl && \
+    make -j $(nproc) && \
+    make install && \
+    apt-get autoremove -y libgmp-dev libmpfr-dev libmpc-dev flex && \
+    apt-get clean && \
+    cd ../.. && rm -rf gcc && \
+    ln -s /opt/gcc-snapshot/bin/gcc /usr/bin/gcc-snapshot
+
+# Install clang snapshot
+RUN wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
+    # Add repository for this Debian release
+    . /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
+    # Install clang snapshot
+    apt-get update && apt-get install --no-install-recommends -y clang && \
+    # Remove just the "clang" symlink again
+    apt-get remove -y clang && \
+    # We should have exactly two clang versions now
+    ls /usr/bin/clang* && \
+    [[    $(ls /usr/bin/clang-?? | sort | wc -l) -eq "2" ]] && \
+    # Create symlinks for them
+    ln -s $(ls /usr/bin/clang-?? | sort | tail -1) /usr/bin/clang-snapshot && \
+    ln -s $(ls /usr/bin/clang-?? | sort | head -1) /usr/bin/clang
+
 # Run a dummy command in wine to make it set up configuration
 RUN wine64-stable xcopy || true

src/secp256k1/src/modules/schnorrsig/tests_impl.h

@@ -133,7 +133,7 @@ void test_schnorrsig_api(void) {
     secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
     secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
     secp256k1_context *sttc = secp256k1_context_clone(secp256k1_context_no_precomp);
-    int ecount;
+    int ecount = 0;
 
     secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
     secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);