From afb032e6938fe0ce7480156f65c3b487a9234dfb Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Tue, 2 Feb 2021 21:08:54 +0000
Subject: [PATCH 1/2] ci: Don't install deps if running as non-root

This way we run in Prow too.
---
 ci/installdeps.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/installdeps.sh b/ci/installdeps.sh
index 7d7c723e..6880d91d 100755
--- a/ci/installdeps.sh
+++ b/ci/installdeps.sh
@@ -7,7 +7,7 @@ set -xeuo pipefail
 # cosa buildroot container
 # https://github.com/coreos/coreos-assembler/pull/730
 # And using `yum` at all means we can flake on fetching rpm metadata
-if [ -n "${SKIP_INSTALLDEPS:-}" ]; then
+if [ -n "${SKIP_INSTALLDEPS:-}" ] || test "$(id -u)" != 0; then
     exit 0
 fi
 

From 6b5aef761298a5f750b5893c063e8f9e18e5d5c9 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Tue, 2 Feb 2021 21:04:18 +0000
Subject: [PATCH 2/2] ci: Add new build-check-sanitized.sh

All C/C++ projects should use the sanitizers (and static analysis)
in their CI.  We had this but lost it in one of our CI shuffles;
let's readd it.
---
 ci/build-check-sanitized.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100755 ci/build-check-sanitized.sh

diff --git a/ci/build-check-sanitized.sh b/ci/build-check-sanitized.sh
new file mode 100755
index 00000000..39c06f43
--- /dev/null
+++ b/ci/build-check-sanitized.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/bash
+# Build with ASAN and UBSAN + unit tests.
+
+set -xeuo pipefail
+
+dn=$(dirname $0)
+. ${dn}/libbuild.sh
+export CFLAGS='-fsanitize=address -fsanitize=undefined -fsanitize-undefined-trap-on-error'
+# We leak global state in a few places, fixing that is hard.
+export ASAN_OPTIONS='detect_leaks=0'
+${dn}/build.sh
+make check