| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This removes the syscall cutoff thresholds, instead declaring all
syscall number constants in package ext.
This also removes two constants from package container which were
inadvertently exported for 386 and amd64.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This behaviour is counterintuitive, the responses are cached, and only
the msg object of the first call is used. This change also improves
error message formatting of these functions.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Kernel headers changed due to a documentation change in random.h,
causing rebuilds. Kernel source is now fetched from cdn.kernel.org.
A newly broken libarchive test has been disabled. A flaky git test has
been discovered while rebuilding for curl and has been disabled.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Simultaneous commits or reverts can race if they have overlapping
targets. This big lock synchronises entry into the Commit and Revert
critical sections across all cmd/hakurei processes.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This retries when seeing files opened by the dynamic linker. This will
eventually be replaced by a statically linked anchor program that never
opens any files on its own.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids getting the goroutine preempted and scheduled onto a
thread other than the tracer.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids swallowing error messages from failed container startups.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is much more precise than just simply checking the exit code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This does not reduce security, and saves the trouble of the additional
ACL setup/teardowns.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This ensures that cmd/hakurei has finished cleanup and terminated before
validating the outcome of that cleanup.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Getting ESRCH here is harmless, and has the same effect of detaching
successfully, so drop it to avoid spurious test failures.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This increases testing performance.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This was inadvertently placed inside the setscheduler loop due to
miscounting indentations.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids breaking ownership of lock files.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This implements retries of individual test cases and enables it for
pipewire and X tests. PipeWire and X server are quite flaky, and that
cannot be fixed by anything cmd/hakurei does.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These were pretty difficult to do properly in the nixos-based test
suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This runs much faster than the NixOS test suite, and is much more
precise. This also uncovered a recent severe pipewire regression.
This change removes all remaining deprecated nix code.
Closes #22.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are mostly for process lifecycle checks. This change also adds
polling for the Xwayland server in the sway helper.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This has better support for security-context metadata which can be
measured by the test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This formats into some test data.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows testing insecure configurations. This change also improves
error reporting and fixes non-startup-notification behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
PipeWire/WirePlumber had become slopware while I was not looking.
WirePlumber 0.5.15 broke SecurityContext, and it has still not been
fixed. I have filed a ticket upstream, but considering the fact that my
previous security-related ticket, filed over 10 months ago, is still
being ignored, I do not have high hopes that they will fix it.
It is no longer safe to use PipeWire. Users are advised to downgrade to
0.5.14 for now. A drop-in replacement of PipeWire might be needed for
Rosa OS.
This change also adds additional packages required by the native
cmd/hakurei integration test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Used by some tests to inspect cmd/hakurei internals.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is only really used by the sandbox test suite for seccomp
validation. Make it optional here to simplify other use cases.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The util-linux script program really messes up any terminal attached to
stdin. Since the test programs do not take any input, and stdin is a
shared resource that cannot be used anyway, this change disconnects it
from stdin.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are too noisy and are not useful outside of debugging the test
suite itself, so silence them by default.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These helpers are useful across multiple test suites.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is a useful value to customise, primarily useful for test suites
but can also generally improve exit latency for stubborn applications.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This remains unsupported, but is useful during testing, or when
packaging for some particularly stubborn distros.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This affects arm64.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is very platform-specific and seems to be broken on anything other
than amd64. So far only tickets for riscv64 and i586 exist, and it is
only fixed for riscv64. Nobody seems to be running the test suite on
arm64 for some reason.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The Gitea web interface is no longer publicly accessible, so it no
longer matters that this code style does not render well on Gitea.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
A successful chmod clobbers acl mask, breaking the fast path. This
change also fixes the ACL race.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids TOCTOU during hakurei_update_acl.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
For acquiring a write lock on a directory.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This slightly reduces startup latency.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also removes the interval and fixes the mustStart search criteria.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Kernel compilation is no longer failing on the amd dc dml frame size
warning, and the corresponding patch has been removed. Kernel headers
have been bumped due to amdgpu, landlock and intel avs changes.
Glslang had its stack size increased to 1 MiB to avoid crashing against
latest spirv-tools. Muon has been updated to 0.7.0, however the newly
added clang-cl support has been completely removed due to it insisting
on using clang-cl for everything. It is also now patched to respect
CLICOLOR_FORCE. The util-linux package has been updated, and the
backport patch has been removed.
The long-awaited openssl 4 update, blocked by python for months, is
finally added. Python 3.15 broke the test suite of package python-wheel,
it has been patched to forcefully disable output colours.
LLVM has been updated. A newly-broken test is disabled.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
It is much easier to obtain these dist tarballs via cmd/mbf, and gitea
has been acting up again, taking minutes of retrying before finally
accepting the artifacts. This change removes them altogether and reverts
to contacting the cmd/mbf CI service.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids having to reinstall packages on every run.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This exposes a race during simultaneous startup between chmod and
acl_set_file, where the ACL mask is clobbered by chmod.
This remained undiscovered until now due to the previous integration
test suite's complete inability to handle concurrency (the nixos vm test
machinery could not even support python multithreading).
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids having multiple runs getting in the way of each other with
their Xwayland abstract socket.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This gets the cache action working without having to keep the init net
namespace.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is cleaner than contacting the cmd/mbf CI service on every run,
although also slightly slower in some cases.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This improves compatibility. This change also improves error messages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This structure is a lot less clumsy than the old nix-centric layout.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Nix stuff is being removed, most of the flake.nix stuff is no longer
used by anything, so remove them here. This change also replaces a
hardcoded gcc command.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is no reason to keep using sudo here, now that processes are
spawned natively. This change removes all use of sudo.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
