feat(ci): Bump to upstream v1.102.5

.gitattributes

@@ -1,2 +1,60 @@
-go.mod filter=go-mod
-*.go  diff=golang
+go.mod filter=go-mod eol=lf text
+*.go  diff=golang eol=lf text
+*.adml eol=lf text
+*.admx eol=lf text
+*.bash eol=lf text
+*.c eol=lf text
+*.cgi eol=lf text
+*.conf eol=lf text
+*.css eol=lf text
+*.csv eol=lf text
+*.desktop eol=lf text
+*.fish eol=lf text
+*.gitattributes eol=lf text
+*.gitignore eol=lf text
+*.gitkeep eol=lf text
+*.go eol=lf text
+*.h eol=lf text
+*.helmignore eol=lf text
+*.htaccess eol=lf text
+*.html eol=lf text
+*.hujson eol=lf text
+*.in eol=lf text
+*.init eol=lf text
+*.js eol=lf text
+*.json eol=lf text
+*.lock eol=lf text
+*.lua eol=lf text
+*.md eol=lf text
+*.mod eol=lf text
+*.nix eol=lf text
+*.openrc eol=lf text
+*.pbxproj eol=lf text
+*.pem eol=lf text
+*.plg eol=lf text
+*.plist eol=lf text
+*.rc eol=lf text
+*.resolved eol=lf text
+*.rev eol=lf text
+*.rs eol=lf text
+*.sc eol=lf text
+*.service eol=lf text
+*.sh eol=lf text
+*.socket eol=lf text
+*.stignore eol=lf text
+*.sum eol=lf text
+*.svg eol=lf text
+*.swift eol=lf text
+*.tmpl eol=lf text
+*.toml eol=lf text
+*.ts eol=lf text
+*.tsx eol=lf text
+*.txt eol=lf text
+*.version eol=lf text
+*.xcscheme eol=lf text
+*.xcsettings eol=lf text
+*.xib eol=lf text
+*.xml eol=lf text
+*.yaml eol=lf text
+*.yml eol=lf text
+*.zsh eol=lf text

.github/workflows/check-cherry-picks.yml

@@ -0,0 +1,61 @@
+name: check-cherry-picks
+
+on:
+  pull_request:
+    branches:
+      - "release-branch/*"
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    # Company policy requires that all cherry-picks onto release
+    # branches be made with "git cherry-pick -x" so the commit message
+    # records the original commit. Commits that are intentionally not
+    # cherry-picks (version bumps, release-only fixes) can be exempted
+    # by adding the "not-a-cherry-pick" label to the PR.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'not-a-cherry-pick') }}
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Full history so that both the PR commits and origin/main
+          # are available for the ancestry check below.
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check commits for cherry-pick markers
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          failed=0
+          for commit in $(git rev-list --no-merges "$BASE_SHA".."$HEAD_SHA"); do
+            subject=$(git log -1 --format=%s "$commit")
+            orig=$(git log -1 --format=%B "$commit" |
+                   sed -ne 's/^(cherry picked from commit \([0-9a-f]\{40\}\))$/\1/p' |
+                   tail -n1)
+            if [ -z "$orig" ]; then
+              echo "::error::Commit $commit (\"$subject\") is missing a \"(cherry picked from commit ...)\" line."
+              failed=1
+            elif ! git merge-base --is-ancestor "$orig" origin/main 2>/dev/null; then
+              echo "::error::Commit $commit (\"$subject\") says it was cherry-picked from $orig, but that commit is not on main."
+              failed=1
+            fi
+          done
+          if [ "$failed" -ne 0 ]; then
+            echo "Cherry-picks onto release branches must be made with \"git cherry-pick -x\"."
+            echo "If this PR is intentionally not a cherry-pick, add the \"not-a-cherry-pick\" label."
+            exit 1
+          fi

.github/workflows/codeql-analysis.yml

@@ -49,7 +49,7 @@ jobs:
 
     # Install a more recent Go that understands modern go.mod content.
     - name: Install Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # zizmor: ignore[cache-poisoning] v6.3.0
       with:
         go-version-file: go.mod
 

.github/workflows/govulncheck.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install govulncheck
-        run: ./tool/go install golang.org/x/vuln/cmd/govulncheck@latest
+        run: ./tool/go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # 1.3.0
 
       - name: Scan source code for known vulnerabilities
         run: PATH=$PWD/tool/:$PATH "$(./tool/go env GOPATH)/bin/govulncheck" -test ./...

.github/workflows/installer.yml

@@ -37,8 +37,6 @@ jobs:
           - "elementary/docker:stable"
           - "elementary/docker:unstable"
           - "parrotsec/core:latest"
-          - "kalilinux/kali-rolling"
-          - "kalilinux/kali-dev"
           - "oraclelinux:9"
           - "oraclelinux:8"
           - "fedora:latest"
@@ -61,14 +59,17 @@ jobs:
           - { image: "debian:stable-slim", deps: "curl" }
           - { image: "ubuntu:24.04", deps: "curl" }
           - { image: "fedora:latest", deps: "curl" }
+          # Kali doesn't have ca-certificates installed by default anymore
+          - { image: "kalilinux/kali-dev", "deps": "curl ca-certificates"}
+          - { image: "kalilinux/kali-rolling", "deps": "curl ca-certificates"}
           # Test TAILSCALE_VERSION pinning on a subset of distros.
           # Skip Alpine as community repos don't reliably keep old versions.
           - { image: "debian:stable-slim", deps: "curl", version: "1.80.0" }
           - { image: "ubuntu:24.04", deps: "curl", version: "1.80.0" }
           - { image: "fedora:latest", deps: "curl", version: "1.80.0" }
     runs-on: ubuntu-latest
     container:
-      image: ${{ matrix.image }}
+      image: ${{ matrix.image }} # zizmor: ignore[unpinned-images]
       options: --user root
     steps:
     - name: install dependencies (pacman)

.github/workflows/natlab-integrationtest.yml → .github/workflows/natlab-basic.yml

@@ -1,6 +1,7 @@
-# Run some natlab integration tests.
+# Run a single natlab smoke test on every PR. The full natlab suite
+# is opt-in and lives in .github/workflows/natlab-test.yml.
 # See https://github.com/tailscale/tailscale/issues/13038
-name: "natlab-integrationtest"
+name: "natlab-basic"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -17,7 +18,7 @@ on:
     branches:
       - "main"
 jobs:
-  natlab-integrationtest:
+  EasyEasy:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
@@ -41,4 +42,4 @@ jobs:
           make -C gokrazy natlab
       - name: Run natlab integration tests
         run: |
-          ./tool/go test -v -run=^TestEasyEasy$ -timeout=3m -count=1 ./tstest/integration/nat  --run-vm-tests
+          ./tool/go test -v -run=^TestEasyEasy$ -timeout=3m -count=1 ./tstest/natlab/vmtest --run-vm-tests

.github/workflows/natlab-test.yml

@@ -0,0 +1,182 @@
+# Run the full natlab/vmtest opt-in test suite. These tests boot QEMU VMs
+# (gokrazy, Ubuntu, FreeBSD) and exercise vnet-driven networking scenarios.
+# They are gated behind --run-vm-tests because they need KVM and are slow.
+#
+# This workflow runs:
+#   - on demand (workflow_dispatch)
+#   - on PRs that carry the "run-natlab-tests" label
+#   - on main, every 12 hours, via cron
+#
+# Layout:
+#   - "prepare" builds the gokrazy VM image, downloads the cloud images
+#     (Ubuntu, FreeBSD), and discovers every Test* function in the two
+#     opt-in packages.
+#   - "test" is a per-TestFoo matrix that depends on prepare. Each matrix
+#     job restores the shared caches and runs a single test. Adding a new
+#     TestFoo automatically gets its own job — no workflow edits needed.
+#
+# A separate workflow (.github/workflows/natlab-basic.yml) runs a single
+# canary natlab test on every PR; this one runs the full suite.
+name: "natlab-test"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [labeled, synchronize, reopened]
+  schedule:
+    # Every 12 hours, off-the-hour to avoid GitHub's :00 cron-stampede window.
+    - cron: "23 3,15 * * *"
+
+jobs:
+  # prepare warms the per-workflow-run caches (gokrazy image, cloud VM
+  # images) and emits the dynamic matrix of test names. By doing the work
+  # once here, the matrix test jobs never race to rebuild or re-download
+  # the same artifacts on a cold cache.
+  prepare:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'schedule' ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-natlab-tests'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      matrix: ${{ steps.list.outputs.matrix }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # The cloud VM image cache is keyed only on images.go (image URLs and
+      # SHAs), so it survives across workflow runs and is invalidated only
+      # when a new image source is added.
+      - name: Cache cloud VM images
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ~/.cache/tailscale/vmtest/images
+          key: natlab-vmimages-${{ hashFiles('tstest/natlab/vmtest/images.go') }}
+
+      # The gokrazy VM image is keyed by github.sha. That means we rebuild
+      # it once per commit but matrix test jobs in the same run all share
+      # the result. Per-PR re-runs of the same sha (e.g. a rerun-failed)
+      # also get the cache.
+      - name: Cache gokrazy VM image
+        id: gokrazy-cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: gokrazy/natlabapp.qcow2
+          key: natlab-gokrazy-${{ github.sha }}
+
+      # qemu-utils provides qemu-img, which the gokrazy Makefile uses to
+      # convert natlabapp.img to qcow2. Only install if we need it (cache
+      # miss); the test matrix jobs install qemu separately for the runtime.
+      - name: Install qemu-utils
+        if: steps.gokrazy-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo rm -f /var/lib/man-db/auto-update
+          sudo apt-get -y update
+          sudo apt-get -y remove man-db
+          sudo apt-get install -y qemu-utils
+
+      - name: Download cloud VM images
+        # natlabprep is idempotent: it checks the cache before downloading.
+        run: |
+          ./tool/go run ./tstest/natlab/vmtest/cmd/natlabprep
+
+      - name: Build gokrazy VM image
+        if: steps.gokrazy-cache.outputs.cache-hit != 'true'
+        run: |
+          make -C gokrazy natlab
+
+      - name: Discover tests
+        id: list
+        # Grep the test files directly rather than invoking `go test -list`
+        # so we don't pay the cost of compiling the test binaries here. The
+        # only test functions in these packages use the canonical
+        # `func TestFoo(t *testing.T)` signature.
+        #
+        # exclude is the set of tests that need special invocation
+        # (extra flags, a specific environment) and don't fit the
+        # single-test-per-matrix-job model. They stay runnable locally.
+        run: |
+          set -euo pipefail
+          exclude='^(TestGrid|TestVnetPerf.*)$'
+          tmp=$(mktemp)
+          for pkg_dir in tstest/natlab/vmtest tstest/integration/nat; do
+            pkg="./${pkg_dir}/"
+            for f in "${pkg_dir}"/*_test.go; do
+              [ -e "$f" ] || continue
+              { grep -hE '^func Test[A-Z][A-Za-z0-9_]*\(t \*testing\.T\)' "$f" || true; } \
+                | sed -E 's/^func (Test[A-Za-z0-9_]+).*/\1/' \
+                | { grep -vE "$exclude" || true; } \
+                | while read -r t; do
+                    jq -nc --arg pkg "$pkg" --arg test "$t" \
+                      '{pkg: $pkg, test: $test}' >> "$tmp"
+                  done
+            done
+          done
+          matrix=$(jq -s -c . "$tmp")
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+          echo "Discovered tests:"
+          jq . "$tmp"
+
+  test:
+    needs: prepare
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    name: "${{ matrix.test }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Install qemu
+        run: |
+          sudo rm -f /var/lib/man-db/auto-update
+          sudo apt-get -y update
+          sudo apt-get -y remove man-db
+          sudo apt-get install -y qemu-system-x86 qemu-utils
+
+      # restore-only: prepare is the single writer of these caches, so
+      # matrix jobs don't write back. fail-on-cache-miss would be too
+      # strict for the gokrazy cache (e.g. a non-fatal cache eviction
+      # between prepare and us); we just rebuild on miss instead.
+      - name: Restore cloud VM images
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: ~/.cache/tailscale/vmtest/images
+          key: natlab-vmimages-${{ hashFiles('tstest/natlab/vmtest/images.go') }}
+
+      - name: Restore gokrazy VM image
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: gokrazy/natlabapp.qcow2
+          key: natlab-gokrazy-${{ github.sha }}
+
+      # The gokrazy-based tests boot the kernel directly from
+      # vmlinuz that ships in the gokrazy/kernel.amd64 module.
+      # Tests look it up under GOMODCACHE via findKernelPath, so the
+      # module has to be present even though no Go source imports it
+      # in the test package itself.
+      - name: Download kernel.amd64 module
+        run: |
+          ./tool/go mod download github.com/gokrazy/kernel.amd64
+
+      - name: Run ${{ matrix.test }}
+        # Per-test timeout is well above the few-minute typical runtime
+        # but small enough that a stuck test fails fast instead of holding
+        # the runner for the job's 20-minute budget.
+        run: |
+          ./tool/go test -v -timeout=15m -count=1 ${{ matrix.pkg }} \
+            -run='^${{ matrix.test }}$' --run-vm-tests