use /etc/clonetab to provide devices to be cloned

.clang-tidy

@@ -15,6 +15,7 @@ Checks: '
     bugprone-suspicious-string-compare,
     bugprone-swapped-arguments,
     bugprone-tautological-type-limits,
+    bugprone-unsafe-functions,
     bugprone-unused-return-value,
     misc-header-include-cycle,
     misc-include-cleaner,
@@ -50,6 +51,23 @@ CheckOptions:
     varlink-io\.systemd\..*;
     varlink-idl-common\.h;
     unistd\.h
+'
+  bugprone-unsafe-functions.ReportDefaultFunctions: false
+  bugprone-unsafe-functions.CustomFunctions: '
+    ^fgets$,read_line(),is potentially dangerous;
+    ^strtok$,extract_first_word(),is potentially dangerous;
+    ^strsep$,extract_first_word(),is potentially dangerous;
+    ^dup$,fcntl() with F_DUPFD_CLOEXEC,is potentially dangerous;
+    ^htonl$,htobe32(),is confusing;
+    ^htons$,htobe16(),is confusing;
+    ^ntohl$,be32toh(),is confusing;
+    ^ntohs$,be16toh(),is confusing;
+    ^strerror$,STRERROR() or printf %m,is not thread-safe;
+    ^accept$,accept4(),is not O_CLOEXEC-safe;
+    ^dirname$,path_extract_directory(),is icky;
+    ^basename$,path_extract_filename(),is icky;
+    ^setmntent$,libmount_parse_fstab(),libmount parser should be used instead;
+    ^getmntent$,mnt_table_next_fs(),libmount parser should be used instead
 '
   misc-header-include-cycle.IgnoredFilesList: 'glib-2.0'
 WarningsAsErrors: '*'

.clangd

@@ -1,4 +1,16 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
+# Strip GCC-only flags from compile_commands.json before clang sees them.
+# clangd reports these as driver-level "unknown argument" errors which can't
+# be silenced via Diagnostics.Suppress, so they must be removed instead.
+#   -fwide-exec-charset:        used by EFI boot code to make L"..." literals UTF-16
+#   -maccumulate-outgoing-args: GCC x86 codegen flag, no clang equivalent
+CompileFlags:
+  Remove: [-fwide-exec-charset=*, -maccumulate-outgoing-args]
+
 Diagnostics:
   UnusedIncludes: Strict
+  # __no_reorder__ is a GCC-only attribute (see _no_reorder_ in
+  # src/fundamental/macro-fundamental.h). Meson detects it during configure
+  # with GCC and enables it unconditionally, so clangd flags every use.
+  Suppress: [unknown-attributes]

.gitattributes

@@ -1,4 +1,5 @@
 *.[ch] whitespace=tab-in-indent,trailing-space
+src/include/uapi/**/*.[ch] whitespace=trailing-space
 *.gpg  binary generated
 *.bmp  binary
 *.base64 generated

.github/labeler.yml

@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 # vi: sw=2 ts=2 et:
 
+changed-files-labels-limit: 5
 analyze:
   - changed-files:
     - any-glob-to-any-file: 'src/analyze/*'

.github/workflows/build-test.sh

@@ -12,7 +12,7 @@ success() { echo >&2 -e "\033[32;1m$1\033[0m"; }
 ARGS=(
     "--optimization=0 -Dopenssl=disabled -Dtpm=true -Dtpm2=enabled"
     "--optimization=s -Dutmp=false -Dc_args='-DOPENSSL_NO_UI_CONSOLE=1'"
-    "--optimization=2 -Dc_args=-Wmaybe-uninitialized -Ddns-over-tls=openssl"
+    "--optimization=2 -Ddns-over-tls=openssl"
     "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
     "--optimization=3 -Db_lto=false -Dtpm2=disabled -Dlibfido2=disabled -Dp11kit=disabled -Defi=false -Dbootloader=disabled"
     "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
@@ -108,6 +108,11 @@ elif [[ "$COMPILER" == gcc ]]; then
     CFLAGS=""
     CXXFLAGS=""
 
+    # -Wmaybe-uninitialized works badly in old gcc versions
+    if [[ "$COMPILER_VERSION" -lt 14 ]]; then
+        CFLAGS="$CFLAGS -Wno-maybe-uninitialized"
+    fi
+
     if ! apt-get -y install --dry-run "gcc-$COMPILER_VERSION" >/dev/null; then
         # Latest gcc stack deb packages provided by
         # https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
@@ -162,11 +167,6 @@ ninja --version
 for args in "${ARGS[@]}"; do
     SECONDS=0
 
-    if [[ "$COMPILER" == clang && "$args" =~ Wmaybe-uninitialized ]]; then
-        # -Wmaybe-uninitialized is not implemented in clang
-        continue
-    fi
-
     info "Checking build with $args"
     # shellcheck disable=SC2086
     if ! AR="$AR" \