| Age | Commit message (Collapse) | Author |
|---|
|
These are mostly for process lifecycle checks. This change also adds
polling for the Xwayland server in the sway helper.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This has better support for security-context metadata which can be
measured by the test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This formats into some test data.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows testing insecure configurations. This change also improves
error reporting and fixes non-startup-notification behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
PipeWire/WirePlumber had become slopware while I was not looking.
WirePlumber 0.5.15 broke SecurityContext, and it has still not been
fixed. I have filed a ticket upstream, but considering the fact that my
previous security-related ticket, filed over 10 months ago, is still
being ignored, I do not have high hopes that they will fix it.
It is no longer safe to use PipeWire. Users are advised to downgrade to
0.5.14 for now. A drop-in replacement of PipeWire might be needed for
Rosa OS.
This change also adds additional packages required by the native
cmd/hakurei integration test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Used by some tests to inspect cmd/hakurei internals.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is only really used by the sandbox test suite for seccomp
validation. Make it optional here to simplify other use cases.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The util-linux script program really messes up any terminal attached to
stdin. Since the test programs do not take any input, and stdin is a
shared resource that cannot be used anyway, this change disconnects it
from stdin.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are too noisy and are not useful outside of debugging the test
suite itself, so silence them by default.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These helpers are useful across multiple test suites.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is a useful value to customise, primarily useful for test suites
but can also generally improve exit latency for stubborn applications.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This remains unsupported, but is useful during testing, or when
packaging for some particularly stubborn distros.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This affects arm64.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is very platform-specific and seems to be broken on anything other
than amd64. So far only tickets for riscv64 and i586 exist, and it is
only fixed for riscv64. Nobody seems to be running the test suite on
arm64 for some reason.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The Gitea web interface is no longer publicly accessible, so it no
longer matters that this code style does not render well on Gitea.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
A successful chmod clobbers acl mask, breaking the fast path. This
change also fixes the ACL race.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids TOCTOU during hakurei_update_acl.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
For acquiring a write lock on a directory.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This slightly reduces startup latency.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also removes the interval and fixes the mustStart search criteria.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Kernel compilation is no longer failing on the amd dc dml frame size
warning, and the corresponding patch has been removed. Kernel headers
have been bumped due to amdgpu, landlock and intel avs changes.
Glslang had its stack size increased to 1 MiB to avoid crashing against
latest spirv-tools. Muon has been updated to 0.7.0, however the newly
added clang-cl support has been completely removed due to it insisting
on using clang-cl for everything. It is also now patched to respect
CLICOLOR_FORCE. The util-linux package has been updated, and the
backport patch has been removed.
The long-awaited openssl 4 update, blocked by python for months, is
finally added. Python 3.15 broke the test suite of package python-wheel,
it has been patched to forcefully disable output colours.
LLVM has been updated. A newly-broken test is disabled.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
It is much easier to obtain these dist tarballs via cmd/mbf, and gitea
has been acting up again, taking minutes of retrying before finally
accepting the artifacts. This change removes them altogether and reverts
to contacting the cmd/mbf CI service.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids having to reinstall packages on every run.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This exposes a race during simultaneous startup between chmod and
acl_set_file, where the ACL mask is clobbered by chmod.
This remained undiscovered until now due to the previous integration
test suite's complete inability to handle concurrency (the nixos vm test
machinery could not even support python multithreading).
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids having multiple runs getting in the way of each other with
their Xwayland abstract socket.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This gets the cache action working without having to keep the init net
namespace.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is cleaner than contacting the cmd/mbf CI service on every run,
although also slightly slower in some cases.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This improves compatibility. This change also improves error messages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This structure is a lot less clumsy than the old nix-centric layout.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Nix stuff is being removed, most of the flake.nix stuff is no longer
used by anything, so remove them here. This change also replaces a
hardcoded gcc command.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is no reason to keep using sudo here, now that processes are
spawned natively. This change removes all use of sudo.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also cleans up its API and improves error messages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This replaces procps in the replacement test suite and enables faster
and much more precise matching.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also cleans up their API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also improves its API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is less ambiguous, and more consistent with upcoming integration
test suite changes.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids re-downloading packages on every run.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is mostly useful for the integration test suites.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This was missed when migrating the test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This keeps archives deterministic across multiple jobs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This runs tests directly in the container, significantly reducing
overhead introduced by virtualisation.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also migrates from the unmaintained release action and improves
configuration so the new release is created as a draft, and the tag
annotation is automatically added as the release body.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This can happen under some edge cases and is expected.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There will eventually be more endpoints for other CI workloads.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This requires a lot of specialised setup to run, so document that here
for future reference.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This replaces the nix-based dist job.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This enables use of non-cache cmd/mbf utils as root.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This obtains a fresh file descriptor on each attempt. Without resetting
it would end up endlessly appending to the buffer.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are unstable across different kernel configurations or versions,
so strip them here alongside the others.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
