ci-cd opt.

.github/workflows/dirmngr.yml

@@ -79,8 +79,17 @@ jobs:
           pkg-config --exists --atleast-version=1.56 gpg-error || \
             build libgpg-error 1.56 https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.56.tar.bz2
 
-          pkg-config --exists --atleast-version=1.11.0 gcrypt || \
-            build libgcrypt 1.11.1 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.11.1.tar.bz2
+          # GnuPG master now requires libgcrypt >= 1.12.0 (configure aborts with
+          # "You need libgcrypt to build this program" otherwise). The target
+          # version keeps building against 1.11.1, which is what it was
+          # validated with.
+          if [ "${{ matrix.gnupg_ref }}" = "gnupg-2.2.41" ]; then
+            pkg-config --exists --atleast-version=1.11.0 gcrypt || \
+              build libgcrypt 1.11.1 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.11.1.tar.bz2
+          else
+            pkg-config --exists --atleast-version=1.12.0 gcrypt || \
+              build libgcrypt 1.12.4 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.12.4.tar.bz2
+          fi
 
           if [ "${{ matrix.gnupg_ref }}" = "gnupg-2.2.41" ]; then
             build libassuan 2.5.5 https://gnupg.org/ftp/gcrypt/libassuan/libassuan-2.5.5.tar.bz2

.github/workflows/fwupd.yml

@@ -93,12 +93,10 @@ jobs:
 
       - name: Build fwupd at ${{ matrix.fwupd_ref }}
         run: |
-          git clone https://github.com/fwupd/fwupd.git
-          cd fwupd
-          git checkout ${{ matrix.fwupd_ref }}
+          git clone --depth=1 --branch ${{ matrix.fwupd_ref }} https://github.com/fwupd/fwupd.git
 
       - name: Patch fwupd tests for Debian Bookworm compatibility
-        if: matrix.fwupd_ref != '1.9.26' matrix.fwupd_ref != 'master'
+        if: matrix.fwupd_ref != '1.9.26'
         working-directory: fwupd
         run: |
           # GLib in Debian Bookworm emits WARNING for invalid properties while
@@ -107,7 +105,40 @@ jobs:
           # This gets applied only for the latest version and the latest main branch,
           # target version remains untouched since it's using the correct older version
           # of glib that matches the one on debian:bookworm.
-          sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-self-test.c
+          if [ "${{ matrix.fwupd_ref }}" != "main" ]; then
+            sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-self-test.c
+          else
+            sed -i 's/GLib-GObject-CRITICAL/GLib-GObject-WARNING/g' libfwupd/fwupd-client-test.c
+          fi
+
+      - name: Patch fwupd 1.9.26 tests for Debian Bookworm's libxmlb
+        if: matrix.fwupd_ref == '1.9.26'
+        working-directory: fwupd
+        run: |
+          # Debian Bookworm updated libxmlb to 0.3.22 in a stable point release.
+          # The newer libxmlb writes an empty XML element in the short
+          # self-closing form ("<chunks />") instead of an open/close pair
+          # ("<chunks>\n</chunks>"). Both mean the same thing, but fwupd 1.9.26's
+          # fu_chunk_func test compares the exact text, so it aborts.
+          # Formatting only, unrelated to the wolfSSL/GnuTLS provider.
+          # Adjust the expected string to match the libxmlb shipped in the container.
+          sed -i 's|<chunks>\\n</chunks>\\n|<chunks />\\n|g' libfwupdplugin/fu-self-test.c
+          # Fail loudly if the pattern was not found (e.g. test source changed).
+          grep -qF '"<chunks />\n"' libfwupdplugin/fu-self-test.c
+
+      - name: Install Rust toolchain (main only)
+        if: matrix.fwupd_ref == 'main'
+        run: |
+          # fwupd main now declares Rust as a required project language
+          # (meson aborts with "Unknown compiler(s): [['rustc']]" otherwise)
+          # and needs rustc >= 1.75. Debian Bookworm ships 1.63, so install a
+          # minimal stable toolchain via rustup instead. The Rust code only
+          # contains fwupd's own crates, no crypto, so this is unrelated to the
+          # wolfSSL/GnuTLS provider.
+          sudo apt-get install -y curl
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+            sh -s -- -y --profile minimal --default-toolchain stable
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - name: Configure fwupd
         working-directory: fwupd

.github/workflows/gst-libav1.0.yml

@@ -84,9 +84,8 @@ jobs:
         if: steps.cache-gstreamer.outputs.cache-hit != 'true'
         run: |
           pip3 install --break-system-packages meson ninja
-          git clone https://github.com/GStreamer/gstreamer.git gstreamer-source
+          git clone --depth=1 --branch 1.26.2 https://github.com/GStreamer/gstreamer.git gstreamer-source
           cd gstreamer-source
-          git checkout 1.26.2
           meson setup build \
             --prefix=/opt/gstreamer \
             --libdir=lib \
@@ -108,9 +107,8 @@ jobs:
       - name: Build FFmpeg with GnuTLS & MPEG-4 encoder
         run: |
           cd $RUNNER_WORKSPACE
-          git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg-gnutls
+          git clone --depth=1 --branch n8.1 https://github.com/FFmpeg/FFmpeg.git ffmpeg-gnutls
           cd ffmpeg-gnutls
-          git checkout n8.1
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:/opt/gstreamer/lib/pkgconfig"
           export CPPFLAGS="-I/opt/gnutls/include -I/opt/gstreamer/include"
           export LDFLAGS="-L/opt/gnutls/lib -L/opt/gstreamer/lib -Wl,-rpath,/opt/gnutls/lib -Wl,-rpath,/opt/gstreamer/lib"
@@ -141,10 +139,7 @@ jobs:
           done
       - name: Clone & checkout gst-libav1.0 @ ${{ matrix.gst_ref }}
         run: |
-          git clone https://salsa.debian.org/gstreamer-team/gst-libav1.0.git gst-libav
-          cd gst-libav
-          git fetch --tags
-          git checkout ${{ matrix.gst_ref }}
+          git clone --depth=1 --branch ${{ matrix.gst_ref }} https://salsa.debian.org/gstreamer-team/gst-libav1.0.git gst-libav
       - name: Build gst-libav1.0 (${{ matrix.gst_ref }})
         working-directory: gst-libav
         run: |

.github/workflows/libcamera.yml

@@ -76,11 +76,7 @@ jobs:
 
       - name: Checkout libcamera at ${{ matrix.libcamera_ref }}
         run: |
-          git clone https://git.libcamera.org/libcamera/libcamera.git
-          cd libcamera
-          if [ "${{ matrix.libcamera_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libcamera_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libcamera_ref }} https://gitlab.freedesktop.org/camera/libcamera.git
 
       - name: Configure and build libcamera
         working-directory: libcamera

.github/workflows/libcups.yml

@@ -77,9 +77,8 @@ jobs:
       - name: Clone and build LibCUPS latest release
         if: matrix.cups_version == 'latest'
         run: |
-          git clone --recurse-submodules https://github.com/OpenPrinting/libcups.git
+          git clone --depth=1 --branch v3.0rc4 --recurse-submodules --shallow-submodules https://github.com/OpenPrinting/libcups.git
           cd libcups
-          git checkout v3.0rc4
 
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:$PKG_CONFIG_PATH"
           export CPPFLAGS="-I/opt/gnutls/include $CPPFLAGS"
@@ -96,9 +95,8 @@ jobs:
       - name: Clone and build CUPS target release (v2.4.2)
         if: matrix.cups_version == 'target'
         run: |
-          git clone https://github.com/OpenPrinting/cups.git
+          git clone --depth=1 --branch v2.4.2 https://github.com/OpenPrinting/cups.git
           cd cups
-          git checkout v2.4.2
 
           export PKG_CONFIG_PATH="/opt/gnutls/lib/pkgconfig:$PKG_CONFIG_PATH"
           export CPPFLAGS="-I/opt/gnutls/include $CPPFLAGS"

.github/workflows/libjcat.yml

@@ -76,11 +76,7 @@ jobs:
 
       - name: Checkout libjcat at ${{ matrix.libjcat_ref }}
         run: |
-          git clone https://github.com/hughsie/libjcat.git
-          cd libjcat
-          if [ "${{ matrix.libjcat_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libjcat_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libjcat_ref }} https://github.com/hughsie/libjcat.git
 
       - name: Configure and build libjcat
         working-directory: libjcat

.github/workflows/libnice.yml

@@ -51,11 +51,7 @@ jobs:
 
       - name: Clone libnice @ ref
         run: |
-          git clone https://github.com/libnice/libnice.git
-          cd libnice
-          if [ "${{ matrix.libnice_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libnice_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libnice_ref }} https://github.com/libnice/libnice.git
 
       - name: Configure & build with Meson/Ninja
         working-directory: libnice

.github/workflows/libvnc.yml

@@ -71,11 +71,7 @@ jobs:
 
       - name: Checkout libvnc at ${{ matrix.libvnc_ref }}
         run: |
-          git clone https://github.com/LibVNC/libvncserver.git
-          cd libvncserver
-          if [ "${{ matrix.libvnc_ref }}" != "master" ]; then
-            git checkout ${{ matrix.libvnc_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.libvnc_ref }} https://github.com/LibVNC/libvncserver.git
 
       - name: Configure and build libvncserver
         working-directory: libvncserver

.github/workflows/libvte.yml

@@ -74,11 +74,7 @@ jobs:
 
       - name: Checkout VTE at ${{ matrix.vte_ref }}
         run: |
-          git clone https://github.com/GNOME/vte.git
-          cd vte
-          if [ "${{ matrix.vte_ref }}" != "master" ]; then
-            git checkout ${{ matrix.vte_ref }}
-          fi
+          git clone --depth=1 --branch ${{ matrix.vte_ref }} https://github.com/GNOME/vte.git
 
       - name: Configure and build VTE
         working-directory: vte