quote issue again

Signed-off-by: Pratik Mankawde <pratikmankawde@gmail.com>

.github/actions/build-deps/action.yml

@@ -21,6 +21,10 @@ inputs:
     description: "The logging verbosity."
     required: false
     default: "verbose"
+  sanitizers:
+    description: "The sanitizers to enable ('Address', 'Thread')."
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -33,11 +37,13 @@ runs:
         BUILD_OPTION: ${{ inputs.force_build == 'true' && '*' || 'missing' }}
         BUILD_TYPE: ${{ inputs.build_type }}
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
+        SANITIZERS: ${{ inputs.sanitizers }}
       run: |
         echo 'Installing dependencies.'
         mkdir -p "${BUILD_DIR}"
         cd "${BUILD_DIR}"
         conan install \
+          --profile ci \
           --output-folder . \
           --build="${BUILD_OPTION}" \
           --options:host='&:tests=True' \

.github/actions/setup-conan/action.yml

@@ -28,7 +28,7 @@ runs:
       shell: bash
       run: |
         echo 'Installing profile.'
-        conan config install conan/profiles/default -tf $(conan config home)/profiles/
+        conan config install conan/profiles/ -tf $(conan config home)/profiles/
 
         echo 'Conan profile:'
         conan profile show

.github/scripts/strategy-matrix/generate.py

@@ -2,11 +2,12 @@
 import argparse
 import itertools
 import json
-from pathlib import Path
 from dataclasses import dataclass
+from pathlib import Path
 
 THIS_DIR = Path(__file__).parent.resolve()
 
+
 @dataclass
 class Config:
     architecture: list[dict]
@@ -14,7 +15,8 @@ class Config:
     build_type: list[str]
     cmake_args: list[str]
 
-'''
+
+"""
 Generate a strategy matrix for GitHub Actions CI.
 
 On each PR commit we will build a selection of Debian, RHEL, Ubuntu, MacOS, and
@@ -27,19 +29,23 @@ We will further set additional CMake arguments as follows:
 - All release builds will have the `assert` option.
 - Certain Debian Bookworm configurations will change the reference fee, enable
   codecov, and enable voidstar in PRs.
-'''
+"""
+
+
 def generate_strategy_matrix(all: bool, config: Config) -> list:
     configurations = []
-    for architecture, os, build_type, cmake_args in itertools.product(config.architecture, config.os, config.build_type, config.cmake_args):
+    for architecture, os, build_type, cmake_args in itertools.product(
+        config.architecture, config.os, config.build_type, config.cmake_args
+    ):
         # The default CMake target is 'all' for Linux and MacOS and 'install'
         # for Windows, but it can get overridden for certain configurations.
-        cmake_target = 'install' if os["distro_name"] == 'windows' else 'all'
+        cmake_target = "install" if os["distro_name"] == "windows" else "all"
 
         # We build and test all configurations by default, except for Windows in
         # Debug, because it is too slow, as well as when code coverage is
         # enabled as that mode already runs the tests.
         build_only = False
-        if os['distro_name'] == 'windows' and build_type == 'Debug':
+        if os["distro_name"] == "windows" and build_type == "Debug":
             build_only = True
 
         # Only generate a subset of configurations in PRs.
@@ -54,21 +60,46 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             # - Bookworm using Clang 17: Release and no Unity on linux/amd64,
             #   set the reference fee to 1000.
             # - Bookworm using Clang 20: Debug and Unity on linux/amd64.
-            if os['distro_name'] == 'debian':
+            if os["distro_name"] == "debian":
                 skip = True
-                if os['distro_version'] == 'bookworm':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-13' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
-                        cmake_args = f'-DUNIT_TEST_REFERENCE_FEE=500 {cmake_args}'
+                if os["distro_version"] == "bookworm":
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-13"
+                        and build_type == "Release"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
+                        cmake_args = f"-DUNIT_TEST_REFERENCE_FEE=500 {cmake_args}"
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-15' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-15"
+                        and build_type == "Debug"
+                        and "-Dunity=OFF" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-16' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
-                        cmake_args = f'-Dvoidstar=ON {cmake_args}'
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-16"
+                        and build_type == "Debug"
+                        and "-Dunity=OFF" in cmake_args
+                        and architecture["platform"] == "linux/arm64"
+                    ):
+                        cmake_args = f"-Dvoidstar=ON {cmake_args}"
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-17' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
-                        cmake_args = f'-DUNIT_TEST_REFERENCE_FEE=1000 {cmake_args}'
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-17"
+                        and build_type == "Release"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
+                        cmake_args = f"-DUNIT_TEST_REFERENCE_FEE=1000 {cmake_args}"
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-20' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-20"
+                        and build_type == "Debug"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
                 if skip:
                     continue
@@ -76,13 +107,23 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             # RHEL:
             # - 9 using GCC 12: Debug and Unity on linux/amd64.
             # - 10 using Clang: Release and no Unity on linux/amd64.
-            if os['distro_name'] == 'rhel':
+            if os["distro_name"] == "rhel":
                 skip = True
-                if os['distro_version'] == '9':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                if os["distro_version"] == "9":
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-12"
+                        and build_type == "Debug"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
-                elif os['distro_version'] == '10':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-any' and build_type == 'Release' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                elif os["distro_version"] == "10":
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-any"
+                        and build_type == "Release"
+                        and "-Dunity=OFF" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
                 if skip:
                     continue
@@ -92,104 +133,307 @@ def generate_strategy_matrix(all: bool, config: Config) -> list:
             # - Noble using GCC 14: Release and Unity on linux/amd64.
             # - Noble using Clang 18: Debug and no Unity on linux/amd64.
             # - Noble using Clang 19: Release and Unity on linux/arm64.
-            if os['distro_name'] == 'ubuntu':
+            if os["distro_name"] == "ubuntu":
                 skip = True
-                if os['distro_version'] == 'jammy':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-12' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/arm64':
+                if os["distro_version"] == "jammy":
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-12"
+                        and build_type == "Debug"
+                        and "-Dunity=OFF" in cmake_args
+                        and architecture["platform"] == "linux/arm64"
+                    ):
                         skip = False
-                elif os['distro_version'] == 'noble':
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-14' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/amd64':
+                elif os["distro_version"] == "noble":
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-14"
+                        and build_type == "Release"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-18' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-18"
+                        and build_type == "Debug"
+                        and "-Dunity=OFF" in cmake_args
+                        and architecture["platform"] == "linux/amd64"
+                    ):
                         skip = False
-                    if f'{os['compiler_name']}-{os['compiler_version']}' == 'clang-19' and build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'linux/arm64':
+                    if (
+                        f"{os['compiler_name']}-{os['compiler_version']}" == "clang-19"
+                        and build_type == "Release"
+                        and "-Dunity=ON" in cmake_args
+                        and architecture["platform"] == "linux/arm64"
+                    ):
                         skip = False
                 if skip:
                     continue
 
             # MacOS:
             # - Debug and no Unity on macos/arm64.
-            if os['distro_name'] == 'macos' and not (build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'macos/arm64'):
+            if os["distro_name"] == "macos" and not (
+                build_type == "Debug"
+                and "-Dunity=OFF" in cmake_args
+                and architecture["platform"] == "macos/arm64"
+            ):
                 continue
 
             # Windows:
             # - Release and Unity on windows/amd64.
-            if os['distro_name'] == 'windows' and not (build_type == 'Release' and '-Dunity=ON' in cmake_args and architecture['platform'] == 'windows/amd64'):
+            if os["distro_name"] == "windows" and not (
+                build_type == "Release"
+                and "-Dunity=ON" in cmake_args
+                and architecture["platform"] == "windows/amd64"
+            ):
                 continue
 
-
         # Additional CMake arguments.
-        cmake_args = f'{cmake_args} -Dtests=ON -Dwerr=ON -Dxrpld=ON'
-        if not f'{os['compiler_name']}-{os['compiler_version']}' in ['gcc-12', 'clang-16']:
-            cmake_args = f'{cmake_args} -Dwextra=ON'
-        if build_type == 'Release':
-            cmake_args = f'{cmake_args} -Dassert=ON'
+        cmake_args = f"{cmake_args} -Dtests=ON -Dwerr=ON -Dxrpld=ON"
+        if not f"{os['compiler_name']}-{os['compiler_version']}" in [
+            "gcc-12",
+            "clang-16",
+        ]:
+            cmake_args = f"{cmake_args} -Dwextra=ON"
+        if build_type == "Release":
+            cmake_args = f"{cmake_args} -Dassert=ON"
 
         # We skip all RHEL on arm64 due to a build failure that needs further
         # investigation.
-        if os['distro_name'] == 'rhel' and architecture['platform'] == 'linux/arm64':
+        if os["distro_name"] == "rhel" and architecture["platform"] == "linux/arm64":
             continue
 
         # We skip all clang 20+ on arm64 due to Boost build error.
-        if f'{os['compiler_name']}-{os['compiler_version']}' in ['clang-20', 'clang-21'] and architecture['platform'] == 'linux/arm64':
+        if (
+            f"{os['compiler_name']}-{os['compiler_version']}"
+            in ["clang-20", "clang-21"]
+            and architecture["platform"] == "linux/arm64"
+        ):
             continue
 
-        # Enable code coverage for Debian Bookworm using GCC 15 in Debug and no
+        cxx_flags = "-g"
+        # Enable code coverage for Debian Bookworm using GCC 14 in Debug and no
         # Unity on linux/amd64
-        if f'{os['compiler_name']}-{os['compiler_version']}' == 'gcc-15' and build_type == 'Debug' and '-Dunity=OFF' in cmake_args and architecture['platform'] == 'linux/amd64':
-            cmake_args = f'-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0 {cmake_args}'
+        if (
+            f"{os['compiler_name']}-{os['compiler_version']}" == "gcc-14"
+            and build_type == "Debug"
+            and "-Dunity=OFF" in cmake_args
+            and architecture["platform"] == "linux/amd64"
+        ):
+            cmake_args = f"-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 {cmake_args}"
+            cxx_flags = f"-O0 {cxx_flags}"
 
         # Generate a unique name for the configuration, e.g. macos-arm64-debug
         # or debian-bookworm-gcc-12-amd64-release-unity.
-        config_name = os['distro_name']
-        if (n := os['distro_version']) != '':
-            config_name += f'-{n}'
-        if (n := os['compiler_name']) != '':
-            config_name += f'-{n}'
-        if (n := os['compiler_version']) != '':
-            config_name += f'-{n}'
-        config_name += f'-{architecture['platform'][architecture['platform'].find('/')+1:]}'
-        config_name += f'-{build_type.lower()}'
-        if '-Dunity=ON' in cmake_args:
-            config_name += '-unity'
+        config_name = os["distro_name"]
+        if (n := os["distro_version"]) != "":
+            config_name += f"-{n}"
+        if (n := os["compiler_name"]) != "":
+            config_name += f"-{n}"
+        if (n := os["compiler_version"]) != "":
+            config_name += f"-{n}"
+        config_name += (
+            f"-{architecture['platform'][architecture['platform'].find('/')+1:]}"
+        )
+        config_name += f"-{build_type.lower()}"
+        if "-Dunity=ON" in cmake_args:
+            config_name += "-unity"
 
         # Add the configuration to the list, with the most unique fields first,
         # so that they are easier to identify in the GitHub Actions UI, as long
         # names get truncated.
-        configurations.append({
-            'config_name': config_name,
-            'cmake_args': cmake_args,
-            'cmake_target': cmake_target,
-            'build_only': build_only,
-            'build_type': build_type,
-            'os': os,
-            'architecture': architecture,
-        })
+        # Add Address and Thread (both coupled with UB) sanitizers when the distro is bookworm.
+        if os[
+            "distro_version"
+        ] == "bookworm" and f"{os['compiler_name']}-{os['compiler_version']}" in {
+            "gcc-15",
+            "clang-20",
+        }:
+            addSanitizerConfigs(
+                architecture,
+                os,
+                build_type,
+                cmake_args,
+                config_name,
+                build_only,
+                cmake_target,
+                cxx_flags,
+                configurations,
+            )
+        else:
+            if cxx_flags:
+                cmake_args_flags = f"{cmake_args} -DCMAKE_CXX_FLAGS={cxx_flags}"
+            else:
+                cmake_args_flags = f"{cmake_args}"
+            configurations.append(
+                {
+                    "config_name": config_name,
+                    "cmake_args": cmake_args_flags,
+                    "cmake_target": cmake_target,
+                    "build_only": build_only,
+                    "build_type": build_type,
+                    "os": os,
+                    "architecture": architecture,
+                }
+            )
 
     return configurations
 
 
+def addSanitizerConfigs(
+    architecture: dict,
+    os: dict,
+    build_type: str,
+    cmake_args: str,
+    config_name: str,
+    build_only: bool,
+    cmake_target: str,
+    cxx_flags: str,
+    configurations: list[dict],
+):
+    extra_warning_flags = ""
+    linker_relocation_flags = ""
+    linker_flags = ""
+
+    # Use large code model to avoid relocation errors with large binaries
+    # Only for x86-64 (amd64) - ARM64 doesn't support -mcmodel=large
+    if architecture["platform"] == "linux/amd64" and os["compiler_name"] == "gcc":
+        # Add -mcmodel=large to both compiler AND linker flags
+        # This is needed because sanitizers create very large binaries and
+        # large model removes the 2GB limitation that medium model has
+        cxx_flags += " -mcmodel=large -fno-PIC"
+        linker_relocation_flags += " -mcmodel=large -fno-PIC"
+
+    # Create default sanitizer flags
+    sanitizers_flags = "undefined,float-divide-by-zero"
+
+    if os["compiler_name"] == "gcc":
+        # Suppress false positive warnings in GCC with stringop-overflow
+        extra_warning_flags += " -Wno-stringop-overflow"
+        # Disable mold, gold and lld linkers.
+        # Use default linker (bfd/ld) which is more lenient with mixed code models
+        cmake_args += " -Duse_mold=OFF -Duse_gold=OFF -Duse_lld=OFF"
+        # Add linker flags for Sanitizers
+        linker_flags += f" -DCMAKE_EXE_LINKER_FLAGS='{linker_relocation_flags} -fsanitize=address,{sanitizers_flags}'"
+        linker_flags += f" -DCMAKE_SHARED_LINKER_FLAGS='{linker_relocation_flags} -fsanitize=address,{sanitizers_flags}'"
+    elif os["compiler_name"] == "clang":
+        # Note: We use $GITHUB_WORKSPACE environment variable which will be expanded by the shell
+        # before CMake processes it. This ensures the compiler receives an absolute path.
+        # CMAKE_SOURCE_DIR won't work here because it's inside CMAKE_CXX_FLAGS string.
+        # GCC doesn't support ignorelist.
+        cxx_flags += " -fsanitize-ignorelist=$GITHUB_WORKSPACE/sanitizers/suppressions/sanitizer-ignorelist.txt"
+        sanitizers_flags = (
+            f"{sanitizers_flags},signed-integer-overflow,unsigned-integer-overflow"
+        )
+        linker_flags += (
+            f" -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address,{sanitizers_flags}'"
+        )
+        linker_flags += (
+            f" -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=address,{sanitizers_flags}'"
+        )
+
+    # Sanitizers recommend minimum of -O1 for reasonable performance
+    cxx_flags += " -O1"
+
+    # First create config for asan
+    cmake_args_flags = f'{cmake_args} -DCMAKE_CXX_FLAGS="-fsanitize=address,{sanitizers_flags} -fno-omit-frame-pointer {cxx_flags} {extra_warning_flags}" {linker_flags}'
+
+    # Add config with asan
+    configurations.append(
+        {
+            "config_name": config_name + "_asan",
+            "cmake_args": cmake_args_flags,
+            "cmake_target": cmake_target,
+            "build_only": build_only,
+            "build_type": build_type,
+            "os": os,
+            "architecture": architecture,
+            "sanitizers": "Address",
+        }
+    )
+    # Since TSAN runs are crashing with seg faults(could be compatibility issues with latest compilers)
+    # We deactivate it for now. But I would keep the code, since it took some effort to find the correct set of config needed to run this.
+    # This will be useful when we decide to activate it again in future.
+    activateTSAN = False
+    if activateTSAN:
+        linker_flags = ""
+        # Update configs for tsan
+        # gcc doesn't supports atomic_thread_fence with tsan. Suppress warnings.
+        # Also tsan doesn't work well with mcmode=large and bfd linker
+        if os["compiler_name"] == "gcc":
+            extra_warning_flags += " -Wno-tsan"
+            cxx_flags = cxx_flags.replace("-mcmodel=large", "-mcmodel=medium")
+            linker_relocation_flags = linker_relocation_flags.replace(
+                "-mcmodel=large", "-mcmodel=medium"
+            )
+            # Add linker flags for Sanitizers
+            linker_flags += f" -DCMAKE_EXE_LINKER_FLAGS='{linker_relocation_flags} -fsanitize=thread,{sanitizers_flags}'"
+            linker_flags += f" -DCMAKE_SHARED_LINKER_FLAGS='{linker_relocation_flags} -fsanitize=thread,{sanitizers_flags}'"
+        elif os["compiler_name"] == "clang":
+            linker_flags += (
+                f" -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=thread,{sanitizers_flags}'"
+            )
+            linker_flags += (
+                f" -DCMAKE_SHARED_LINKER_FLAGS='-fsanitize=thread,{sanitizers_flags}'"
+            )
+
+        cmake_args_flags = f"{cmake_args} -DCMAKE_CXX_FLAGS='-fsanitize=thread,{sanitizers_flags} -fno-omit-frame-pointer {cxx_flags} {extra_warning_flags}' {linker_flags}"
+
+        configurations.append(
+            {
+                "config_name": config_name + "_tsan",
+                "cmake_args": cmake_args_flags,
+                "cmake_target": cmake_target,
+                "build_only": build_only,
+                "build_type": build_type,
+                "os": os,
+                "architecture": architecture,
+                "sanitizers": "Thread",
+            }
+        )
+
+
 def read_config(file: Path) -> Config:
     config = json.loads(file.read_text())
-    if config['architecture'] is None or config['os'] is None or config['build_type'] is None or config['cmake_args'] is None:
-        raise Exception('Invalid configuration file.')
+    if (
+        config["architecture"] is None
+        or config["os"] is None
+        or config["build_type"] is None
+        or config["cmake_args"] is None
+    ):
+        raise Exception("Invalid configuration file.")
 
     return Config(**config)
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     parser = argparse.ArgumentParser()
-    parser.add_argument('-a', '--all', help='Set to generate all configurations (generally used when merging a PR) or leave unset to generate a subset of configurations (generally used when committing to a PR).', action="store_true")
-    parser.add_argument('-c', '--config', help='Path to the JSON file containing the strategy matrix configurations.', required=False, type=Path)
+    parser.add_argument(
+        "-a",
+        "--all",
+        help="Set to generate all configurations (generally used when merging a PR) or leave unset to generate a subset of configurations (generally used when committing to a PR).",
+        action="store_true",
+    )
+    parser.add_argument(
+        "-c",
+        "--config",
+        help="Path to the JSON file containing the strategy matrix configurations.",
+        required=False,
+        type=Path,
+    )
     args = parser.parse_args()
 
     matrix = []
-    if args.config is None or args.config == '':
-        matrix += generate_strategy_matrix(args.all, read_config(THIS_DIR / "linux.json"))
-        matrix += generate_strategy_matrix(args.all, read_config(THIS_DIR / "macos.json"))
-        matrix += generate_strategy_matrix(args.all, read_config(THIS_DIR / "windows.json"))
+    if args.config is None or args.config == "":
+        matrix += generate_strategy_matrix(
+            args.all, read_config(THIS_DIR / "linux.json")
+        )
+        matrix += generate_strategy_matrix(
+            args.all, read_config(THIS_DIR / "macos.json")
+        )
+        matrix += generate_strategy_matrix(
+            args.all, read_config(THIS_DIR / "windows.json")
+        )
     else:
         matrix += generate_strategy_matrix(args.all, read_config(args.config))
 
     # Generate the strategy matrix.
-    print(f'matrix={json.dumps({"include": matrix})}')
+    print(f"matrix={json.dumps({'include': matrix})}")

.github/workflows/reusable-build-test-config.yml

@@ -50,6 +50,12 @@ on:
         type: number
         default: 2
 
+      sanitizers:
+        description: "The sanitizers to enable ('Address+UndefinedBehaviour' or 'Thread+UndefinedBehaviour')."
+        required: false
+        type: string
+        default: "None"
+
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -68,6 +74,7 @@ jobs:
     env:
       ENABLED_VOIDSTAR: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
       ENABLED_COVERAGE: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
+      ENABLED_SANITIZERS: ${{ contains(inputs.cmake_args, '-fsanitize') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
@@ -102,19 +109,18 @@ jobs:
           # Set the verbosity to "quiet" for Windows to avoid an excessive
           # amount of logs. For other OSes, the "verbose" logs are more useful.
           log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
+          sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
         working-directory: ${{ inputs.build_dir }}
         env:
           BUILD_TYPE: ${{ inputs.build_type }}
-          CMAKE_ARGS: ${{ inputs.cmake_args }}
         run: |
-          cmake \
+          cmake .. \
             -G '${{ runner.os == 'Windows' && 'Visual Studio 17 2022' || 'Ninja' }}' \
             -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
             -DCMAKE_BUILD_TYPE="${BUILD_TYPE}" \
-            ${CMAKE_ARGS} \
-            ..
+            ${{ inputs.cmake_args }}
 
       - name: Build the binary
         working-directory: ${{ inputs.build_dir }}
@@ -141,7 +147,7 @@ jobs:
           if-no-files-found: error
 
       - name: Check linking (Linux)
-        if: ${{ runner.os == 'Linux' }}
+        if: ${{ runner.os == 'Linux' && env.ENABLED_SANITIZERS == 'false' }}
         working-directory: ${{ inputs.build_dir }}
         run: |
           ldd ./rippled
@@ -166,6 +172,10 @@ jobs:
           BUILD_TYPE: ${{ inputs.build_type }}
           PARALLELISM: ${{ runner.os == 'Windows' && '1' || steps.nproc.outputs.nproc }}
         run: |
+          export ASAN_OPTIONS="detect_container_overflow=0 suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/asan.supp"
+          export TSAN_OPTIONS="second_deadlock_stack=1 halt_on_error=0 suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/tsan.supp"
+          export UBSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/ubsan.supp"
+          export LSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/lsan.supp"
           ctest \
             --output-on-failure \
             -C "${BUILD_TYPE}" \
@@ -177,6 +187,10 @@ jobs:
         env:
           BUILD_NPROC: ${{ steps.nproc.outputs.nproc }}
         run: |
+          export ASAN_OPTIONS="detect_container_overflow=0 suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/asan.supp"
+          export TSAN_OPTIONS="second_deadlock_stack=1 halt_on_error=0 suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/tsan.supp"
+          export UBSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/ubsan.supp"
+          export LSAN_OPTIONS="suppressions=$GITHUB_WORKSPACE/sanitizers/suppressions/lsan.supp"
           ./rippled --unittest --unittest-jobs "${BUILD_NPROC}"
 
       - name: Debug failure (Linux)

.github/workflows/reusable-build-test.yml

@@ -54,5 +54,6 @@ jobs:
       runs_on: ${{ toJSON(matrix.architecture.runner) }}
       image: ${{ contains(matrix.architecture.platform, 'linux') && format('ghcr.io/xrplf/ci/{0}-{1}:{2}-{3}-sha-{4}', matrix.os.distro_name, matrix.os.distro_version, matrix.os.compiler_name, matrix.os.compiler_version, matrix.os.image_sha) || '' }}
       config_name: ${{ matrix.config_name }}
+      sanitizers: ${{ matrix.sanitizers }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.pre-commit-config.yaml

@@ -31,6 +31,11 @@ repos:
     hooks:
       - id: prettier
 
+  - repo: https://github.com/psf/black-pre-commit-mirror
+    rev: 25.11.0
+    hooks:
+      - id: black
+
 exclude: |
   (?x)^(
       external/.*|

BUILD.md

@@ -88,6 +88,13 @@ These instructions assume a basic familiarity with Conan and CMake. If you are
 unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
 [Getting Started][3] walkthrough.
 
+#### Conan lockfile
+
+To achieve reproducible dependencies, we use a [Conan lockfile](https://docs.conan.io/2/tutorial/versioning/lockfiles.html),
+which has to be updated every time dependencies change.
+
+Please see the [instructions on how to regenerate the lockfile](conan/lockfile/README.md).
+
 #### Default profile
 
 We recommend that you import the provided `conan/profiles/default` profile:
@@ -360,6 +367,18 @@ tools.build:cxxflags=['-DBOOST_ASIO_DISABLE_CONCEPTS']
    conan install .. --output-folder . --build missing --settings build_type=Debug
    ```
 
+   If you would like to activate `asan+ubsan`(`Address`) or `tsan+ubsan`(`Thread`) for the build,
+   declare an environment variable as follows and use the `sanitizers`
+   profile in the `conan install` command. Make sure you clear your conan cache before doing so.
+   Command: `conan cache clean "*"`
+
+   ```
+   SANITIZERS=Address conan install .. --output-folder . --profile sanitizers --build missing --settings build_type=Debug
+   ```
+
+   Available options for SANITIZERS: `Address` and `Thread`
+   More details here: [sanitizers](./docs/build/sanitizers.md)
+
    To build Debug, in the next step, be sure to set `-DCMAKE_BUILD_TYPE=Debug`
 
    For a single-configuration generator, e.g. `Unix Makefiles` or `Ninja`,
@@ -450,33 +469,6 @@ tools.build:cxxflags=['-DBOOST_ASIO_DISABLE_CONCEPTS']
    The location of `rippled` binary in your build directory depends on your
    CMake generator. Pass `--help` to see the rest of the command line options.
 
-#### Conan lockfile
-
-To achieve reproducible dependencies, we use [Conan lockfile](https://docs.conan.io/2/tutorial/versioning/lockfiles.html).
-
-The `conan.lock` file in the repository contains a "snapshot" of the current dependencies.
-It is implicitly used when running `conan` commands, you don't need to specify it.
-
-You have to update this file every time you add a new dependency or change a revision or version of an existing dependency.
-
-> [!NOTE]
-> Conan uses local cache by default when creating a lockfile.
->
-> To ensure, that lockfile creation works the same way on all developer machines, you should clear the local cache before creating a new lockfile.
-
-To create a new lockfile, run the following commands in the repository root:
-
-```bash
-conan remove '*' --confirm
-rm conan.lock
-# This ensure that xrplf remote is the first to be consulted
-conan remote add --force --index 0 xrplf https://conan.ripplex.io
-conan lock create . -o '&:jemalloc=True' -o '&:rocksdb=True'
-```
-
-> [!NOTE]
-> If some dependencies are exclusive for some OS, you may need to run the last command for them adding `--profile:all <PROFILE>`.
-
 ## Coverage report
 
 The coverage report is intended for developers using compilers GCC

conan.lock

@@ -7,31 +7,32 @@
         "soci/4.0.3#a9f8d773cd33e356b5879a4b0564f287%1756234262.318",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246",
         "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1762797952.535",
-        "re2/20230301#dfd6e2bf050eb90ddd8729cfb4c844a4%1756234257.976",
-        "protobuf/3.21.12#d927114e28de9f4691a6bbcdd9a529d1%1756234251.614",
+        "re2/20230301#ca3b241baec15bd31ea9187150e0b333%1764175362.029",
+        "protobuf/3.21.12#44ee56c0a6eea0c19aeeaca680370b88%1764175361.456",
         "openssl/3.5.4#a1d5835cc6ed5c5b8f3cd5b9b5d24205%1760106486.594",
         "nudb/2.0.9#fb8dfd1a5557f5e0528114c2da17721e%1763150366.909",
         "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1756234228.999",
         "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1756223727.64",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1756230911.03",
-        "libarchive/3.8.1#5cf685686322e906cb42706ab7e099a8%1756234256.696",
+        "libarchive/3.8.1#ffee18995c706e02bf96e7a2f7042e0d%1764175360.142",
         "jemalloc/5.3.0#e951da9cf599e956cebc117880d2d9f8%1729241615.244",
         "grpc/1.50.1#02291451d1e17200293a409410d1c4e1%1756234248.958",
         "doctest/2.4.12#eb9fb352fb2fdfc8abb17ec270945165%1762797941.757",
-        "date/3.0.4#f74bbba5a08fa388256688743136cb6f%1756234217.493",
-        "c-ares/1.34.5#b78b91e7cfb1f11ce777a285bbf169c6%1756234217.915",
-        "bzip2/1.0.8#00b4a4658791c1f06914e087f0e792f5%1756234261.716",
+        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1763584497.32",
+        "c-ares/1.34.5#5581c2b62a608b40bb85d965ab3ec7c8%1764175359.429",
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1764175359.429",
         "boost/1.88.0#8852c0b72ce8271fb8ff7c53456d4983%1756223752.326",
-        "abseil/20230802.1#f0f91485b111dc9837a68972cb19ca7b%1756234220.907"
+        "abseil/20230802.1#90ba607d4ee8fb5fb157c3db540671fc%1764175359.429"
     ],
     "build_requires": [
         "zlib/1.3.1#b8bc2603263cf7eccbd6e17e66b0ed76%1756234269.497",
         "strawberryperl/5.32.1.1#707032463aa0620fa17ec0d887f5fe41%1756234281.733",
-        "protobuf/3.21.12#d927114e28de9f4691a6bbcdd9a529d1%1756234251.614",
+        "protobuf/3.21.12#44ee56c0a6eea0c19aeeaca680370b88%1764175361.456",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1756234232.901",
         "msys2/cci.latest#5b73b10144f73cc5bfe0572ed9be39e1%1751977009.857",
-        "m4/1.4.19#f119296e5c4772b3bb7ab060ae8f417b%1760707875.678",
-        "cmake/3.31.8#dde3bde00bb843687e55aea5afa0e220%1756234232.89",
+        "m4/1.4.19#70dc8bbb33e981d119d2acc0175cf381%1763158052.846",
+        "cmake/4.2.0#ae0a44f44a1ef9ab68fd4b3e9a1f8671%1764175359.44",
+        "cmake/3.31.10#313d16a1aa16bbdb2ca0792467214b76%1764175359.429",
         "b2/5.3.3#107c15377719889654eb9a162a673975%1756234226.28",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86"
@@ -48,14 +49,11 @@
         "boost/1.83.0": [
             "boost/1.88.0"
         ],
-        "sqlite3/[>=3.44 <4]": [
+        "sqlite3/3.44.2": [
             "sqlite3/3.49.1"
         ],
         "lz4/[>=1.9.4 <2]": [
             "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504"
-        ],
-        "sqlite3/3.44.2": [
-            "sqlite3/3.49.1"
         ]
     },
     "config_requires": []

conan/lockfile/README.md

@@ -0,0 +1,12 @@
+# Conan lockfile
+
+To achieve reproducible dependencies, we use a [Conan lockfile](https://docs.conan.io/2/tutorial/versioning/lockfiles.html).
+
+The `conan.lock` file in the repository contains a "snapshot" of the current
+dependencies. It is implicitly used when running `conan` commands, so you don't
+need to specify it.
+
+You have to update this file every time you add a new dependency or change a
+revision or version of an existing dependency.
+
+To update a lockfile, run from the repository root: `./conan/lockfile/regenerate.sh`

conan/lockfile/linux.profile

@@ -0,0 +1,8 @@
+[settings]
+arch=x86_64
+build_type=Release
+compiler=gcc
+compiler.cppstd=20
+compiler.libcxx=libstdc++11
+compiler.version=13
+os=Linux

conan/lockfile/macos.profile

@@ -0,0 +1,8 @@
+[settings]
+arch=armv8
+build_type=Release
+compiler=apple-clang
+compiler.cppstd=20
+compiler.libcxx=libc++
+compiler.version=17.0
+os=Macos

conan/lockfile/regenerate.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -ex
+
+TEMP_DIR=$(mktemp -d)
+trap "rm -rf $TEMP_DIR" EXIT
+
+echo "Using temporary CONAN_HOME: $TEMP_DIR"
+
+# We use a temporary Conan home to avoid polluting the user's existing Conan
+# configuration and to not use local cache (which leads to non-reproducible lockfiles).
+export CONAN_HOME="$TEMP_DIR"
+
+# Ensure that the xrplf remote is the first to be consulted, so any recipes we
+# patched are used. We also add it there to not created huge diff when the
+# official Conan Center Index is updated.
+conan remote add --force --index 0 xrplf https://conan.ripplex.io
+
+# Delete any existing lockfile.
+rm -f conan.lock
+
+# Create a new lockfile that is compatible with Linux, macOS, and Windows. The
+# first create command will create a new lockfile, while the subsequent create
+# commands will merge any additional dependencies into the created lockfile.
+conan lock create . \
+  --options '&:jemalloc=True' \
+  --options '&:rocksdb=True' \
+  --profile:all=conan/lockfile/linux.profile
+conan lock create . \
+  --options '&:jemalloc=True' \
+  --options '&:rocksdb=True' \
+  --profile:all=conan/lockfile/macos.profile
+conan lock create . \
+  --options '&:jemalloc=True' \
+  --options '&:rocksdb=True' \
+  --profile:all=conan/lockfile/windows.profile

conan/lockfile/windows.profile

@@ -0,0 +1,9 @@
+[settings]
+arch=x86_64
+build_type=Release
+compiler=msvc
+compiler.cppstd=20
+compiler.runtime=dynamic
+compiler.runtime_type=Release
+compiler.version=194
+os=Windows

conan/profiles/ci

@@ -0,0 +1 @@
+ include(sanitizers)

conan/profiles/sanitizers

@@ -0,0 +1,41 @@
+include(default)
+{% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
+{% set default_sanitizer_flags = "undefined,float-divide-by-zero" %}
+{% set sanitizers = os.getenv("SANITIZERS") %}
+
+[conf]
+
+{% if compiler == "gcc" %}
+{% set asan_sanitizer_flags = "-fsanitize=address,"~default_sanitizer_flags~" -mcmodel=large -fno-PIC" %}
+{% set tsan_sanitizer_flags = "-fsanitize=thread,"~default_sanitizer_flags~" -mcmodel=medium -fno-PIC" %}
+
+{% if sanitizers == "Address" %}
+tools.build:cxxflags+=['{{asan_sanitizer_flags}} -fno-omit-frame-pointer -O1 -Wno-stringop-overflow']
+tools.build:sharedlinkflags+=['{{asan_sanitizer_flags}}']
+tools.build:exelinkflags+=['{{asan_sanitizer_flags}}']
+
+{% elif sanitizers == "Thread" %}
+tools.build:cxxflags+=['{{tsan_sanitizer_flags}} -fno-omit-frame-pointer -O1 -Wno-stringop-overflow -Wno-tsan']
+tools.build:sharedlinkflags+=['{{tsan_sanitizer_flags}}']
+tools.build:exelinkflags+=['{{tsan_sanitizer_flags}}']
+
+{% endif %}
+
+{% elif compiler == "apple-clang" or compiler == "clang" %}
+{% set asan_sanitizer_flags = "-fsanitize=address,"~default_sanitizer_flags~",unsigned-integer-overflow -fno-PIC" %}
+{% set tsan_sanitizer_flags = "-fsanitize=thread,"~default_sanitizer_flags~",unsigned-integer-overflow -fno-PIC" %}
+{% if sanitizers == "Address" %}
+tools.build:cxxflags+=['{{asan_sanitizer_flags}} -fno-omit-frame-pointer -O1']
+tools.build:sharedlinkflags+=['{{asan_sanitizer_flags}}']
+tools.build:exelinkflags+=['{{asan_sanitizer_flags}}']
+
+{% elif sanitizers == "Thread" %}
+tools.build:cxxflags+=['{{tsan_sanitizer_flags}} -fno-omit-frame-pointer -O1']
+tools.build:sharedlinkflags+=['{{tsan_sanitizer_flags}}']
+tools.build:exelinkflags+=['{{tsan_sanitizer_flags}}']
+
+{% endif %}
+
+{% endif %}
+
+tools.info.package_id:confs+=["tools.build:cxxflags", "tools.build:exelinkflags", "tools.build:sharedlinkflags"]

conanfile.py

@@ -1,149 +1,155 @@
-from conan import ConanFile, __version__ as conan_version
-from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 import re
 
-class Xrpl(ConanFile):
-    name = 'xrpl'
+from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 
-    license = 'ISC'
-    author = 'John Freeman <jfreeman@ripple.com>'
-    url = 'https://github.com/xrplf/rippled'
-    description = 'The XRP Ledger'
-    settings = 'os', 'compiler', 'build_type', 'arch'
+from conan import ConanFile
+from conan import __version__ as conan_version
+
+
+class Xrpl(ConanFile):
+    name = "xrpl"
+
+    license = "ISC"
+    author = "John Freeman <jfreeman@ripple.com>"
+    url = "https://github.com/xrplf/rippled"
+    description = "The XRP Ledger"
+    settings = "os", "compiler", "build_type", "arch"
     options = {
-        'assertions': [True, False],
-        'coverage': [True, False],
-        'fPIC': [True, False],
-        'jemalloc': [True, False],
-        'rocksdb': [True, False],
-        'shared': [True, False],
-        'static': [True, False],
-        'tests': [True, False],
-        'unity': [True, False],
-        'xrpld': [True, False],
+        "assertions": [True, False],
+        "coverage": [True, False],
+        "fPIC": [True, False],
+        "jemalloc": [True, False],
+        "rocksdb": [True, False],
+        "shared": [True, False],
+        "static": [True, False],
+        "tests": [True, False],
+        "unity": [True, False],
+        "xrpld": [True, False],
     }
 
     requires = [
-        'grpc/1.50.1',
-        'libarchive/3.8.1',
-        'nudb/2.0.9',
-        'openssl/3.5.4',
-        'soci/4.0.3',
-        'zlib/1.3.1',
+        "grpc/1.50.1",
+        "libarchive/3.8.1",
+        "nudb/2.0.9",
+        "openssl/3.5.4",
+        "soci/4.0.3",
+        "zlib/1.3.1",
     ]
 
     test_requires = [
-        'doctest/2.4.12',
+        "doctest/2.4.12",
     ]
 
     tool_requires = [
-        'protobuf/3.21.12',
+        "protobuf/3.21.12",
     ]
 
     default_options = {
-        'assertions': False,
-        'coverage': False,
-        'fPIC': True,
-        'jemalloc': False,
-        'rocksdb': True,
-        'shared': False,
-        'static': True,
-        'tests': False,
-        'unity': False,
-        'xrpld': False,
-
-        'date/*:header_only': True,
-        'grpc/*:shared': False,
-        'grpc/*:secure': True,
-        'libarchive/*:shared': False,
-        'libarchive/*:with_acl': False,
-        'libarchive/*:with_bzip2': False,
-        'libarchive/*:with_cng': False,
-        'libarchive/*:with_expat': False,
-        'libarchive/*:with_iconv': False,
-        'libarchive/*:with_libxml2': False,
-        'libarchive/*:with_lz4': True,
-        'libarchive/*:with_lzma': False,
-        'libarchive/*:with_lzo': False,
-        'libarchive/*:with_nettle': False,
-        'libarchive/*:with_openssl': False,
-        'libarchive/*:with_pcreposix': False,
-        'libarchive/*:with_xattr': False,
-        'libarchive/*:with_zlib': False,
-        'lz4/*:shared': False,
-        'openssl/*:shared': False,
-        'protobuf/*:shared': False,
-        'protobuf/*:with_zlib': True,
-        'rocksdb/*:enable_sse': False,
-        'rocksdb/*:lite': False,
-        'rocksdb/*:shared': False,
-        'rocksdb/*:use_rtti': True,
-        'rocksdb/*:with_jemalloc': False,
-        'rocksdb/*:with_lz4': True,
-        'rocksdb/*:with_snappy': True,
-        'snappy/*:shared': False,
-        'soci/*:shared': False,
-        'soci/*:with_sqlite3': True,
-        'soci/*:with_boost': True,
-        'xxhash/*:shared': False,
+        "assertions": False,
+        "coverage": False,
+        "fPIC": True,
+        "jemalloc": False,
+        "rocksdb": True,
+        "shared": False,
+        "static": True,
+        "tests": False,
+        "unity": False,
+        "xrpld": False,
+        "date/*:header_only": True,
+        "grpc/*:shared": False,
+        "grpc/*:secure": True,
+        "libarchive/*:shared": False,
+        "libarchive/*:with_acl": False,
+        "libarchive/*:with_bzip2": False,
+        "libarchive/*:with_cng": False,
+        "libarchive/*:with_expat": False,
+        "libarchive/*:with_iconv": False,
+        "libarchive/*:with_libxml2": False,
+        "libarchive/*:with_lz4": True,
+        "libarchive/*:with_lzma": False,
+        "libarchive/*:with_lzo": False,
+        "libarchive/*:with_nettle": False,
+        "libarchive/*:with_openssl": False,
+        "libarchive/*:with_pcreposix": False,
+        "libarchive/*:with_xattr": False,
+        "libarchive/*:with_zlib": False,
+        "lz4/*:shared": False,
+        "openssl/*:shared": False,
+        "protobuf/*:shared": False,
+        "protobuf/*:with_zlib": True,
+        "rocksdb/*:enable_sse": False,
+        "rocksdb/*:lite": False,
+        "rocksdb/*:shared": False,
+        "rocksdb/*:use_rtti": True,
+        "rocksdb/*:with_jemalloc": False,
+        "rocksdb/*:with_lz4": True,
+        "rocksdb/*:with_snappy": True,
+        "snappy/*:shared": False,
+        "soci/*:shared": False,
+        "soci/*:with_sqlite3": True,
+        "soci/*:with_boost": True,
+        "xxhash/*:shared": False,
     }
 
     def set_version(self):
         if self.version is None:
-            path = f'{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp'
-            regex = r'versionString\s?=\s?\"(.*)\"'
-            with open(path, encoding='utf-8') as file:
+            path = f"{self.recipe_folder}/src/libxrpl/protocol/BuildInfo.cpp"
+            regex = r"versionString\s?=\s?\"(.*)\""
+            with open(path, encoding="utf-8") as file:
                 matches = (re.search(regex, line) for line in file)
                 match = next(m for m in matches if m)
                 self.version = match.group(1)
 
     def configure(self):
-        if self.settings.compiler == 'apple-clang':
-            self.options['boost'].visibility = 'global'
-        if self.settings.compiler in ['clang', 'gcc']:
-            self.options['boost'].without_cobalt = True
+        if self.settings.compiler == "apple-clang":
+            self.options["boost"].visibility = "global"
+        if self.settings.compiler in ["clang", "gcc"]:
+            self.options["boost"].without_cobalt = True
 
     def requirements(self):
         # Conan 2 requires transitive headers to be specified
-        transitive_headers_opt = {'transitive_headers': True} if conan_version.split('.')[0] == '2' else {}
-        self.requires('boost/1.88.0', force=True, **transitive_headers_opt)
-        self.requires('date/3.0.4', **transitive_headers_opt)
-        self.requires('lz4/1.10.0', force=True)
-        self.requires('protobuf/3.21.12', force=True)
-        self.requires('sqlite3/3.49.1', force=True)
+        transitive_headers_opt = (
+            {"transitive_headers": True} if conan_version.split(".")[0] == "2" else {}
+        )
+        self.requires("boost/1.88.0", force=True, **transitive_headers_opt)
+        self.requires("date/3.0.4", **transitive_headers_opt)
+        self.requires("lz4/1.10.0", force=True)
+        self.requires("protobuf/3.21.12", force=True)
+        self.requires("sqlite3/3.49.1", force=True)
         if self.options.jemalloc:
-            self.requires('jemalloc/5.3.0')
+            self.requires("jemalloc/5.3.0")
         if self.options.rocksdb:
-            self.requires('rocksdb/10.5.1')
-        self.requires('xxhash/0.8.3', **transitive_headers_opt)
+            self.requires("rocksdb/10.5.1")
+        self.requires("xxhash/0.8.3", **transitive_headers_opt)
 
     exports_sources = (
-        'CMakeLists.txt',
-        'cfg/*',
-        'cmake/*',
-        'external/*',
-        'include/*',
-        'src/*',
+        "CMakeLists.txt",
+        "cfg/*",
+        "cmake/*",
+        "external/*",
+        "include/*",
+        "src/*",
     )
 
     def layout(self):
         cmake_layout(self)
         # Fix this setting to follow the default introduced in Conan 1.48
         # to align with our build instructions.
-        self.folders.generators = 'build/generators'
+        self.folders.generators = "build/generators"
+
+    generators = "CMakeDeps"
 
-    generators = 'CMakeDeps'
     def generate(self):
         tc = CMakeToolchain(self)
-        tc.variables['tests'] = self.options.tests
-        tc.variables['assert'] = self.options.assertions
-        tc.variables['coverage'] = self.options.coverage
-        tc.variables['jemalloc'] = self.options.jemalloc
-        tc.variables['rocksdb'] = self.options.rocksdb
-        tc.variables['BUILD_SHARED_LIBS'] = self.options.shared
-        tc.variables['static'] = self.options.static
-        tc.variables['unity'] = self.options.unity
-        tc.variables['xrpld'] = self.options.xrpld
+        tc.variables["tests"] = self.options.tests
+        tc.variables["assert"] = self.options.assertions
+        tc.variables["coverage"] = self.options.coverage
+        tc.variables["jemalloc"] = self.options.jemalloc
+        tc.variables["rocksdb"] = self.options.rocksdb
+        tc.variables["BUILD_SHARED_LIBS"] = self.options.shared
+        tc.variables["static"] = self.options.static
+        tc.variables["unity"] = self.options.unity
+        tc.variables["xrpld"] = self.options.xrpld
         tc.generate()
 
     def build(self):
@@ -158,40 +164,40 @@ class Xrpl(ConanFile):
         cmake.install()
 
     def package_info(self):
-        libxrpl = self.cpp_info.components['libxrpl']
+        libxrpl = self.cpp_info.components["libxrpl"]
         libxrpl.libs = [
-            'xrpl',
-            'xrpl.libpb',
-            'ed25519',
-            'secp256k1',
+            "xrpl",
+            "xrpl.libpb",
+            "ed25519",
+            "secp256k1",
         ]
         # TODO: Fix the protobufs to include each other relative to
         # `include/`, not `include/ripple/proto/`.
-        libxrpl.includedirs = ['include', 'include/ripple/proto']
+        libxrpl.includedirs = ["include", "include/ripple/proto"]
         libxrpl.requires = [
-            'boost::headers',
-            'boost::chrono',
-            'boost::container',
-            'boost::coroutine',
-            'boost::date_time',
-            'boost::filesystem',
-            'boost::json',
-            'boost::program_options',
-            'boost::process',
-            'boost::regex',
-            'boost::system',
-            'boost::thread',
-            'date::date',
-            'grpc::grpc++',
-            'libarchive::libarchive',
-            'lz4::lz4',
-            'nudb::nudb',
-            'openssl::crypto',
-            'protobuf::libprotobuf',
-            'soci::soci',
-            'sqlite3::sqlite',
-            'xxhash::xxhash',
-            'zlib::zlib',
+            "boost::headers",
+            "boost::chrono",
+            "boost::container",
+            "boost::coroutine",
+            "boost::date_time",
+            "boost::filesystem",
+            "boost::json",
+            "boost::program_options",
+            "boost::process",
+            "boost::regex",
+            "boost::system",
+            "boost::thread",
+            "date::date",
+            "grpc::grpc++",
+            "libarchive::libarchive",
+            "lz4::lz4",
+            "nudb::nudb",
+            "openssl::crypto",
+            "protobuf::libprotobuf",
+            "soci::soci",
+            "sqlite3::sqlite",
+            "xxhash::xxhash",
+            "zlib::zlib",
         ]
         if self.options.rocksdb:
-            libxrpl.requires.append('rocksdb::librocksdb')
+            libxrpl.requires.append("rocksdb::librocksdb")

docs/build/sanitizers.md

@@ -0,0 +1,175 @@
+# Sanitizer Configuration for Rippled
+
+This document explains how to properly configure and run sanitizers (AddressSanitizer, UndefinedBehaviorSanitizer, ThreadSanitizer) with the rippled project.
+Corresponding suppression files are located in the `sanitizers/suppressions` directory.
+
+- [Sanitizer Configuration for Rippled](#sanitizer-configuration-for-rippled)
+  - [Building with Sanitizers](#building-with-sanitizers)
+    - [AddressSanitizer (ASan) + UndefinedBehaviorSanitizer (UBSan)](#addresssanitizer-asan--undefinedbehaviorsanitizer-ubsan)
+    - [ThreadSanitizer (TSan) + UndefinedBehaviorSanitizer (UBSan)](#threadsanitizer-tsan--undefinedbehaviorsanitizer-ubsan)
+- [Running Tests with Sanitizers](#running-tests-with-sanitizers)
+  - [AddressSanitizer (ASan)](#addresssanitizer-asan)
+  - [ThreadSanitizer (TSan)](#threadsanitizer-tsan)
+  - [LeakSanitizer (LSan)](#leaksanitizer-lsan)
+- [Suppression Files](#suppression-files)
+  - [asan.supp](#asansupp)
+  - [lsan.supp](#lsansupp)
+  - [ubsan.supp](#ubsansupp)
+  - [tsan.supp](#tsansupp)
+  - [Ignorelist](#sanitizer-ignorelisttxt)
+- [Known False Positives](#known-false-positives)
+- [References](#references)
+
+## Building with Sanitizers
+
+### Summary
+
+Follow the same instructions as mentioned in [BUILD.md](../../BUILD.md) but with following changes:
+
+1. Make sure you have clean build directory.
+2. Use `--profile sanitizers` to configure build options to include sanitizer flags. [sanitizes](../../conan/profiles/sanitizers) profile contains settings for all sanitizers.
+3. Set `ASAN_OPTIONS`, `LSAN_OPTIONS` ,`UBSAN_OPTIONS` and `TSAN_OPTIONS` environment variables to configure sanitizer behavior when running executables.
+
+---
+
+### Build steps:
+
+```bash
+  cd /path/to/rippled
+  rm -rf .build
+  mkdir .build
+  cd .build
+```
+
+#### AddressSanitizer (ASan) + UndefinedBehaviorSanitizer (UBSan)
+
+Build with AddressSanitizer. This also builds rippled with UndefinedBehavior sanitizer.
+
+```bash
+SANITIZERS=Address conan install .. --output-folder . --profile sanitizers --build missing --settings build_type=Release
+```
+
+#### ThreadSanitizer (TSan) + UndefinedBehaviorSanitizer (UBSan)
+
+```bash
+# Build dependencies with Thread sanitizer
+SANITIZERS=Thread conan install .. --output-folder . --profile sanitizers --build missing --settings build_type=Release
+```
+
+Use `--profile:all sanitizers` if you would like to build all dependencies and libraries (boost etc.) with sanitizers. This might take long time but you won't see some false-positives on sanitizer reports since whole binary will be instrumented.
+
+To build with Thread+UndefinedBehavior Sanitizer, replace `SANITIZERS=Address` with `SANITIZERS=Thread`.
+
+# Configure CMake
+
+```bash
+cmake .. -G Ninja -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake -Dunity=ON -Dtests=ON -Dxrpld=ON
+
+# Build
+cmake --build . --parallel 4
+```
+
+## Running Tests with Sanitizers
+
+### AddressSanitizer (ASan)
+
+**IMPORTANT**: ASan with Boost produces many false positives. Use these options:
+
+```bash
+export ASAN_OPTIONS="detect_container_overflow=0 suppressions=path/to/asan.supp halt_on_error=0 log_path=asan.log"
+export UBSAN_OPTIONS="suppressions=path/to/ubsan.supp print_stacktrace=1 halt_on_error=0 log_path=ubsan.log"
+export LSAN_OPTIONS="suppressions=path/to/lsan.supp halt_on_error=0 log_path=lsan.log"
+
+# Run tests
+./rippled --unittest --unittest-jobs=5
+```
+
+**Why `detect_container_overflow=0`?**
+
+- Boost intrusive containers (used in `aged_unordered_container`) trigger false positives
+- Boost context switching (used in `Workers.cpp`) confuses ASan's stack tracking
+- Since we usually don't build boost(because we don't want to instrument boost and detect issues in boost code) with asan but use boost containers in ASAN instrumented rippled code, it generates false positives.
+- See: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow
+
+### ThreadSanitizer (TSan) + UndefinedBehaviorSanitizer (UBSan)
+
+```bash
+export TSAN_OPTIONS="suppressions=path/to/tsan.supp halt_on_error=0 log_path=tsan.log"
+
+# Run tests
+./rippled --unittest --unittest-jobs=5
+```
+
+### LeakSanitizer (LSan)
+
+LSan is automatically enabled with ASan. To disable it:
+
+```bash
+export ASAN_OPTIONS="detect_leaks=0"
+```
+
+## Suppression Files
+
+### `asan.supp`
+
+- **Purpose**: Suppress AddressSanitizer (ASan) errors only
+- **Format**: `interceptor_name:<pattern>` where pattern matches file names. Supported suppression types are:
+  - interceptor_name
+  - interceptor_via_fun
+  - interceptor_via_lib
+  - odr_violation
+- **More info**: [AddressSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizer)
+- **Note**: Cannot suppress stack-buffer-overflow, container-overflow, etc.
+
+### `lsan.supp`
+
+- **Purpose**: Suppress LeakSanitizer (LSan) errors only
+- **Format**: `leak:<pattern>` where pattern matches function/file names
+- **More info**: [LeakSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizerLeakSanitizer)
+
+### `ubsan.supp`
+
+- **Purpose**: Suppress UndefinedBehaviorSanitizer errors
+- **Format**: `<error_type>:<pattern>` (e.g., `unsigned-integer-overflow:protobuf`)
+- **Covers**: Intentional overflows in sanitizers/suppressions libraries (protobuf, gRPC, stdlib)
+
+### `tsan.supp`
+
+- **Purpose**: Suppress ThreadSanitizer data race warnings
+- **Format**: `race:<pattern>` where pattern matches function/file names
+- **More info**: [ThreadSanitizerSuppressions](https://github.com/google/sanitizers/wiki/ThreadSanitizerSuppressions)
+
+### `sanitizer-ignorelist.txt`
+
+- **Purpose**: Compile-time ignorelist for all sanitizers
+- **Usage**: Passed via `-fsanitize-ignorelist=absolute/path/to/sanitizer-ignorelist.txt`
+- **Format**: `<level>:<pattern>` (e.g., `src:Workers.cpp`)
+
+## Troubleshooting
+
+### "ASan is ignoring requested \_\_asan_handle_no_return" warnings
+
+These warnings appear when using Boost context switching and are harmless. They indicate potential false positives.
+
+### Sanitizer Mismatch Errors
+
+If you see undefined symbols like `___tsan_atomic_load` when building with ASan:
+
+**Problem**: Dependencies were built with a different sanitizer than the main project.
+
+**Solution**: Rebuild everything with the same sanitizer:
+
+```bash
+rm -rf .build
+# Then follow the build instructions above
+```
+
+Then review the log files: `asan.log.*`, `ubsan.log.*`, `tsan.log.*`
+
+## References
+
+- [AddressSanitizer Wiki](https://github.com/google/sanitizers/wiki/AddressSanitizer)
+- [AddressSanitizer Flags](https://github.com/google/sanitizers/wiki/AddressSanitizerFlags)
+- [Container Overflow Detection](https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow)
+- [UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html)
+- [ThreadSanitizer](https://github.com/google/sanitizers/wiki/ThreadSanitizerCppManual)

sanitizers/suppressions/asan.supp

@@ -0,0 +1,32 @@
+# The idea is to empty this file gradually by fixing the underlying issues and removing suppresions.
+#
+# ASAN_OPTIONS="detect_container_overflow=0 suppressions=sanitizers/suppressions/asan.supp halt_on_error=0"
+#
+# The detect_container_overflow=0 option disables false positives from:
+# - Boost intrusive containers (slist_iterator.hpp, hashtable.hpp, aged_unordered_container.h)
+# - Boost context/coroutine stack switching (Workers.cpp, thread.h)
+#
+# See: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow
+
+# Suprpress voilations in sanitizers/suppressions code
+interceptor_name:^sanitizers/suppressions
+
+# Boost
+interceptor_name:boost/asio
+
+# Leaks in Doctest tests: xrpl.test.*
+interceptor_name:src/libxrpl/net/HTTPClient.cpp
+interceptor_name:src/libxrpl/net/RegisterSSLCerts.cpp
+interceptor_name:src/tests/libxrpl/net/HTTPClient.cpp
+interceptor_name:xrpl/net/AutoSocket.h
+interceptor_name:xrpl/net/HTTPClient.h
+interceptor_name:xrpl/net/HTTPClientSSLContext.h
+interceptor_name:xrpl/net/RegisterSSLCerts.h
+
+# Suppress false positive stack-buffer errors in thread stack allocation
+# Related to ASan's __asan_handle_no_return warnings (github.com/google/sanitizers/issues/189)
+# These occur during multi-threaded test initialization on macOS
+interceptor_name:memcpy
+interceptor_name:__bzero
+interceptor_name:__asan_memset
+interceptor_name:__asan_memcpy

sanitizers/suppressions/lsan.supp

@@ -0,0 +1,16 @@
+# The idea is to empty this file gradually by fixing the underlying issues and removing suppresions.
+
+# Suppress leaks detected by asan in rippled code.
+leak:src/libxrpl/net/HTTPClient.cpp
+leak:src/libxrpl/net/RegisterSSLCerts.cpp
+leak:src/tests/libxrpl/net/HTTPClient.cpp
+leak:xrpl/net/AutoSocket.h
+leak:xrpl/net/HTTPClient.h
+leak:xrpl/net/HTTPClientSSLContext.h
+leak:xrpl/net/RegisterSSLCerts.h
+leak:ripple::HTTPClient
+leak:ripple::HTTPClientImp
+
+# Suppress leaks detected by asan in boost code.
+leak:boost::asio
+leak:boost/asio

sanitizers/suppressions/sanitizer-ignorelist.txt

@@ -0,0 +1,27 @@
+deadlock:libxrpl/beast/utility/beast_Journal.cpp
+deadlock:libxrpl/beast/utility/beast_Journal.cpp
+deadlock:libxrpl/beast/utility/beast_PropertyStream.cpp
+deadlock:test/beast/beast_PropertyStream_test.cpp
+deadlock:xrpld/core/detail/Workers.cpp
+deadlock:xrpld/core/JobQueue.cpp
+
+race:libxrpl/beast/utility/beast_Journal.cpp
+race:libxrpl/beast/utility/beast_Journal.cpp
+race:libxrpl/beast/utility/beast_PropertyStream.cpp
+race:test/beast/beast_PropertyStream_test.cpp
+race:xrpld/core/detail/Workers.cpp
+race:xrpld/core/JobQueue.cpp
+
+signal:libxrpl/beast/utility/beast_Journal.cpp
+signal:libxrpl/beast/utility/beast_Journal.cpp
+signal:libxrpl/beast/utility/beast_PropertyStream.cpp
+signal:test/beast/beast_PropertyStream_test.cpp
+signal:xrpld/core/detail/Workers.cpp
+signal:xrpld/core/JobQueue.cpp
+
+src:beast/utility/beast_Journal.cpp
+src:beast/utility/beast_PropertyStream.cpp
+src:core/detail/Workers.cpp
+src:core/JobQueue.cpp
+src:libxrpl/beast/utility/beast_Journal.cpp
+src:test/beast/beast_PropertyStream_test.cpp

sanitizers/suppressions/tsan.supp

@@ -0,0 +1,102 @@
+# The idea is to empty this file gradually by fixing the underlying issues and removing suppresions.
+
+# Suppress race in Boost ASIO scheduler detected by GCC-15
+# This is a false positive in Boost's internal pipe() synchronization
+race:boost/asio/
+race:boost/context/
+race:boost/asio/executor.hpp
+race:boost::asio
+
+# Suppress tsan related issues in rippled code.
+race:src/libxrpl/basics/make_SSLContext.cpp
+race:src/libxrpl/basics/Number.cpp
+race:src/libxrpl/json/json_value.cpp
+race:src/libxrpl/json/to_string.cpp
+race:src/libxrpl/ledger/OpenView.cpp
+race:src/libxrpl/net/HTTPClient.cpp
+race:src/libxrpl/nodestore/backend/NuDBFactory.cpp
+race:src/libxrpl/protocol/InnerObjectFormats.cpp
+race:src/libxrpl/protocol/STParsedJSON.cpp
+race:src/libxrpl/resource/ResourceManager.cpp
+race:src/test/app/Flow_test.cpp
+race:src/test/app/LedgerReplay_test.cpp
+race:src/test/app/NFToken_test.cpp
+race:src/test/app/Offer_test.cpp
+race:src/test/app/ValidatorSite_test.cpp
+race:src/test/consensus/NegativeUNL_test.cpp
+race:src/test/jtx/impl/Env.cpp
+race:src/test/jtx/impl/JSONRPCClient.cpp
+race:src/test/jtx/impl/pay.cpp
+race:src/test/jtx/impl/token.cpp
+race:src/test/rpc/Book_test.cpp
+race:src/xrpld/app/ledger/detail/InboundTransactions.cpp
+race:src/xrpld/app/main/Application.cpp
+race:src/xrpld/app/main/BasicApp.cpp
+race:src/xrpld/app/main/GRPCServer.cpp
+race:src/xrpld/app/misc/detail/AmendmentTable.cpp
+race:src/xrpld/app/misc/FeeVoteImpl.cpp
+race:src/xrpld/app/rdb/detail/Wallet.cpp
+race:src/xrpld/overlay/detail/OverlayImpl.cpp
+race:src/xrpld/peerfinder/detail/PeerfinderManager.cpp
+race:src/xrpld/peerfinder/detail/SourceStrings.cpp
+race:src/xrpld/rpc/detail/ServerHandler.cpp
+race:xrpl/server/detail/Door.h
+race:xrpl/server/detail/Spawn.h
+race:xrpl/server/detail/ServerImpl.h
+race:xrpl/nodestore/detail/DatabaseNodeImp.h
+race:src/libxrpl/beast/utility/beast_Journal.cpp
+race:src/test/beast/LexicalCast_test.cpp
+race:ripple::ServerHandler
+
+# More suppressions in external library code.
+race:crtstuff.c
+race:pipe
+
+# Deadlock / lock-order-inversion suppressions
+# Note: GCC's TSAN may not fully support all deadlock suppression patterns
+deadlock:src/libxrpl/beast/utility/beast_Journal.cpp
+deadlock:src/libxrpl/beast/utility/beast_PropertyStream.cpp
+deadlock:src/test/beast/beast_PropertyStream_test.cpp
+deadlock:src/xrpld/core/detail/Workers.cpp
+deadlock:src/xrpld/app/misc/detail/Manifest.cpp
+deadlock:src/xrpld/app/misc/detail/ValidatorList.cpp
+deadlock:src/xrpld/app/misc/detail/ValidatorSite.cpp
+
+signal:src/libxrpl/beast/utility/beast_Journal.cpp
+signal:src/xrpld/core/detail/Workers.cpp
+signal:src/xrpld/core/JobQueue.cpp
+signal:ripple::Workers::Worker
+
+# Aggressive suppressing of deadlock tsan errors
+deadlock:pthread_create
+deadlock:pthread_rwlock_rdlock
+deadlock:boost::asio
+
+# Suppress SEGV crashes in TSAN itself during stringbuf operations
+# This appears to be a GCC-15 TSAN instrumentation issue with basic_stringbuf::str()
+# Commonly triggered in beast::Journal::ScopedStream destructor
+signal:std::__cxx11::basic_stringbuf
+signal:basic_stringbuf
+signal:basic_ostringstream
+
+called_from_lib:libclang_rt
+race:ostreambuf_iterator
+race:basic_ostream
+
+# Suppress SEGV in Boost ASIO memory allocation with GCC-15 TSAN
+signal:boost::asio::aligned_new
+signal:boost::asio::detail::memory
+
+# Suppress SEGV in execute_native_thread_routine
+signal:execute_native_thread_routine
+
+# Suppress data race in Boost Context fiber management
+# This is a false positive in Boost's exception state management during fiber context switching
+race:__cxxabiv1::manage_exception_state
+race:boost::context::fiber::resume
+race:boost::asio::detail::spawned_fiber_thread
+race:boost::asio::detail::spawned_fiber_thread::suspend_with
+race:boost::asio::detail::spawned_fiber_thread::destroy
+
+# Suppress data race in __tsan_memcpy called from Boost fiber operations
+race:__tsan_memcpy

sanitizers/suppressions/ubsan.supp

@@ -0,0 +1,234 @@
+# The idea is to empty this file gradually by fixing the underlying issues and removing suppresions.
+
+# Suppress UBSan errors in external code by source file path
+# This matches any source file under the external/ directory
+alignment:external
+bool:external
+bounds:external
+cfi:external
+enum:external
+float-cast-overflow:external
+float-divide-by-zero:external
+function:external
+implicit-integer-sign-change:external
+implicit-signed-integer-truncation::external
+implicit-signed-integer-truncation:external
+implicit-unsigned-integer-truncation:external
+integer-divide-by-zero:external
+invalid-builtin-use:external
+invalid-objc-cast:external
+nonnull-attribute:external
+null:external
+nullability-arg:external
+nullability-assign:external
+nullability-return:external
+object-size:external
+pointer-overflow:external
+return:external
+returns-nonnull-attribute:external
+shift-base:external
+shift-exponent:external
+signed-integer-overflow:external
+undefined:external
+unreachable:external
+unsigned-integer-overflow:external
+vla-bound:external
+vptr_check:external
+vptr:external
+
+# Suppress all UBSan errors in Boost libraries
+# This matches any files containing "boost" in its path or name
+alignment:boost
+bool:boost
+bounds:boost
+cfi:boost
+enum:boost
+float-cast-overflow:boost
+float-divide-by-zero:boost
+function:boost
+implicit-integer-sign-change:boost
+implicit-signed-integer-truncation:boost
+implicit-unsigned-integer-truncation:boost
+integer-divide-by-zero:boost
+invalid-builtin-use:boost
+invalid-objc-cast:boost
+nonnull-attribute:boost
+null:boost
+nullability-arg:boost
+nullability-assign:boost
+nullability-return:boost
+object-size:boost
+pointer-overflow:boost
+return:boost
+returns-nonnull-attribute:boost
+shift-base:boost
+shift-exponent:boost
+signed-integer-overflow:boost
+undefined:boost
+unreachable:boost
+unsigned-integer-overflow:boost
+vla-bound:boost
+vptr_check:boost
+vptr:boost
+
+# Google protobuf
+undefined:protobuf
+
+# Suppress UBSan errors in rippled code by source file path
+undefined:src/libxrpl/basics/base64.cpp
+undefined:src/libxrpl/basics/Number.cpp
+undefined:src/libxrpl/beast/utility/beast_Journal.cpp
+undefined:src/libxrpl/crypto/RFC1751.cpp
+undefined:src/libxrpl/ledger/ApplyView.cpp
+undefined:src/libxrpl/ledger/View.cpp
+undefined:src/libxrpl/protocol/Permissions.cpp
+undefined:src/libxrpl/protocol/STAmount.cpp
+undefined:src/libxrpl/protocol/STPathSet.cpp
+undefined:src/libxrpl/protocol/tokens.cpp
+undefined:src/libxrpl/shamap/SHAMap.cpp
+undefined:src/test/app/Batch_test.cpp
+undefined:src/test/app/Invariants_test.cpp
+undefined:src/test/app/NFToken_test.cpp
+undefined:src/test/app/Offer_test.cpp
+undefined:src/test/app/Path_test.cpp
+undefined:src/test/basics/XRPAmount_test.cpp
+undefined:src/test/beast/LexicalCast_test.cpp
+undefined:src/test/jtx/impl/acctdelete.cpp
+undefined:src/test/ledger/SkipList_test.cpp
+undefined:src/test/rpc/Subscribe_test.cpp
+undefined:src/tests/libxrpl/basics/RangeSet.cpp
+undefined:src/xrpld/app/main/BasicApp.cpp
+undefined:src/xrpld/app/main/BasicApp.cpp
+undefined:src/xrpld/app/misc/detail/AmendmentTable.cpp
+undefined:src/xrpld/app/misc/NetworkOPs.cpp
+undefined:src/libxrpl/json/json_value.cpp
+undefined:src/xrpld/app/paths/detail/StrandFlow.h
+undefined:src/xrpld/app/tx/detail/NFTokenMint.cpp
+undefined:src/xrpld/app/tx/detail/SetOracle.cpp
+undefined:src/xrpld/core/detail/JobQueue.cpp
+undefined:src/xrpld/core/detail/Workers.cpp
+undefined:src/xrpld/rpc/detail/Role.cpp
+undefined:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
+undefined:xrpl/basics/base_uint.h
+undefined:xrpl/basics/DecayingSample.h
+undefined:xrpl/beast/test/yield_to.h
+undefined:xrpl/beast/xor_shift_engine.h
+undefined:xrpl/nodestore/detail/varint.h
+undefined:xrpl/peerfinder/detail/Counts.h
+undefined:xrpl/protocol/nft.h
+
+# basic_string.h:483:51: runtime error: unsigned integer overflow
+unsigned-integer-overflow:basic_string.h
+unsigned-integer-overflow:bits/chrono.h
+unsigned-integer-overflow:bits/random.h
+unsigned-integer-overflow:bits/random.tcc
+unsigned-integer-overflow:bits/stl_algobase.h
+unsigned-integer-overflow:bits/uniform_int_dist.h
+unsigned-integer-overflow:string_view
+
+# runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'std::size_t' (aka 'unsigned long')
+unsigned-integer-overflow:src/libxrpl/basics/base64.cpp
+unsigned-integer-overflow:src/libxrpl/basics/Number.cpp
+unsigned-integer-overflow:src/libxrpl/crypto/RFC1751.cpp
+unsigned-integer-overflow:rc/libxrpl/json/json_value.cpp
+unsigned-integer-overflow:src/libxrpl/ledger/ApplyView.cpp
+unsigned-integer-overflow:src/libxrpl/ledger/View.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/Permissions.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/STAmount.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/STPathSet.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/tokens.cpp
+unsigned-integer-overflow:src/libxrpl/shamap/SHAMap.cpp
+unsigned-integer-overflow:src/test/app/Batch_test.cpp
+unsigned-integer-overflow:src/test/app/Invariants_test.cpp
+unsigned-integer-overflow:src/test/app/NFToken_test.cpp
+unsigned-integer-overflow:src/test/app/Offer_test.cpp
+unsigned-integer-overflow:src/test/app/Path_test.cpp
+unsigned-integer-overflow:src/test/basics/XRPAmount_test.cpp
+unsigned-integer-overflow:src/test/beast/LexicalCast_test.cpp
+unsigned-integer-overflow:src/test/jtx/impl/acctdelete.cpp
+unsigned-integer-overflow:src/test/ledger/SkipList_test.cpp
+unsigned-integer-overflow:src/test/rpc/Subscribe_test.cpp
+unsigned-integer-overflow:src/tests/libxrpl/basics/RangeSet.cpp
+unsigned-integer-overflow:src/xrpld/app/main/BasicApp.cpp
+unsigned-integer-overflow:src/xrpld/app/misc/detail/AmendmentTable.cpp
+unsigned-integer-overflow:src/xrpld/app/misc/NetworkOPs.cpp
+unsigned-integer-overflow:src/xrpld/app/paths/detail/StrandFlow.h
+unsigned-integer-overflow:src/xrpld/app/tx/detail/NFTokenMint.cpp
+unsigned-integer-overflow:src/xrpld/app/tx/detail/SetOracle.cpp
+unsigned-integer-overflow:src/xrpld/rpc/detail/Role.cpp
+unsigned-integer-overflow:src/xrpld/rpc/handlers/GetAggregatePrice.cpp
+unsigned-integer-overflow:xrpl/basics/base_uint.h
+unsigned-integer-overflow:xrpl/basics/DecayingSample.h
+unsigned-integer-overflow:xrpl/beast/test/yield_to.h
+unsigned-integer-overflow:xrpl/beast/xor_shift_engine.h
+unsigned-integer-overflow:xrpl/nodestore/detail/varint.h
+unsigned-integer-overflow:xrpl/peerfinder/detail/Counts.h
+unsigned-integer-overflow:xrpl/protocol/nft.h
+
+# Rippled intentional overflows and operations
+# STAmount uses intentional negation of INT64_MIN and overflow in arithmetic
+signed-integer-overflow:src/libxrpl/protocol/STAmount.cpp
+unsigned-integer-overflow:src/libxrpl/protocol/STAmount.cpp
+
+# XRPAmount test intentional overflows
+signed-integer-overflow:src/test/basics/XRPAmount_test.cpp
+
+# Peerfinder intentional overflow in counter arithmetic
+unsigned-integer-overflow:src/xrpld/peerfinder/detail/Counts.h
+
+# Signed integer overflow suppressions
+signed-integer-overflow:src/test/beast/LexicalCast_test.cpp
+
+# External library suppressions
+unsigned-integer-overflow:nudb/detail/xxhash.hpp
+
+# Protobuf intentional overflows in hash functions
+# Protobuf uses intentional unsigned overflow for hash computation (stringpiece.h:393)
+unsigned-integer-overflow:google/protobuf/stubs/stringpiece.h
+
+# gRPC intentional overflows
+# gRPC uses intentional overflow in timer calculations
+unsigned-integer-overflow:grpc
+unsigned-integer-overflow:timer_manager.cc
+
+# Standard library intentional overflows
+# These are intentional overflows in random number generation and character conversion
+unsigned-integer-overflow:__random/seed_seq.h
+unsigned-integer-overflow:__charconv/traits.h
+
+
+# Suppress errors in RocksDB
+# RocksDB uses intentional unsigned integer overflows in hash functions and CRC calculations
+unsigned-integer-overflow:rocks*/b/src/util/xxhash.h
+unsigned-integer-overflow:rocks*/b/src/util/xxph3.h
+unsigned-integer-overflow:rocks*/b/src/util/hash.cc
+unsigned-integer-overflow:rocks*/b/src/util/crc32c.cc
+unsigned-integer-overflow:rocks*/b/src/util/crc32c.h
+unsigned-integer-overflow:rocks*/b/src/include/rocksdb/utilities/options_type.h
+unsigned-integer-overflow:rocks*/b/src/table/format.h
+unsigned-integer-overflow:rocks*/b/src/table/format.cc
+unsigned-integer-overflow:rocks*/b/src/table/block_based/block_based_table_builder.cc
+unsigned-integer-overflow:rocks*/b/src/table/block_based/reader_common.cc
+unsigned-integer-overflow:rocks*/b/src/db/version_set.cc
+
+# RocksDB misaligned loads (intentional for performance on ARM64)
+alignment:rocks*/b/src/util/crc32c_arm64.cc
+
+# nudb intentional overflows in hash functions
+unsigned-integer-overflow:nudb/detail/xxhash.hpp
+alignment:nudb/detail/xxhash.hpp
+
+# Snappy compression library intentional overflows
+unsigned-integer-overflow:snapp*/b/src/snappy.cc
+
+# Abseil intentional overflows
+unsigned-integer-overflow:abse*/b/src/absl/strings/numbers.cc
+unsigned-integer-overflow:abse*/b/src/absl/strings/internal/cord_rep_flat.h
+
+# Standard library intentional overflows in chrono duration arithmetic
+unsigned-integer-overflow:__chrono/duration.h
+
+# Suppress undefined errors in RocksDB and nudb
+undefined:rocks.*/b/src/util/crc32c_arm64.cc
+undefined:rocks.*/b/src/util/xxhash.h
+undefined:nudb

tests/conan/conanfile.py

@@ -1,28 +1,29 @@
 from pathlib import Path
 
-from conan import ConanFile
 from conan.tools.build import can_run
 from conan.tools.cmake import CMake, cmake_layout
 
+from conan import ConanFile
+
+
 class Example(ConanFile):
+    name = "example"
+    license = "ISC"
+    author = "John Freeman <jfreeman08@gmail.com>, Michael Legleux <mlegleux@ripple.com"
 
-    name = 'example'
-    license = 'ISC'
-    author = 'John Freeman <jfreeman08@gmail.com>, Michael Legleux <mlegleux@ripple.com'
-
-    settings = 'os', 'compiler', 'build_type', 'arch'
+    settings = "os", "compiler", "build_type", "arch"
 
     requires = ["xrpl/head"]
 
     default_options = {
-        'xrpl/*:xrpld': False,
+        "xrpl/*:xrpld": False,
     }
 
-    generators = ['CMakeDeps', 'CMakeToolchain']
+    generators = ["CMakeDeps", "CMakeToolchain"]
 
     def set_version(self):
         if self.version is None:
-            self.version = '0.1.0'
+            self.version = "0.1.0"
 
     def layout(self):
         cmake_layout(self)