Add integration tests based on testcontainers
This commit is contained in:
@@ -0,0 +1,134 @@
|
||||
# Milestone 8 reproducible evidence
|
||||
|
||||
This report records disposable Alpine fixture results. It does not claim
|
||||
production or systemd/D-Bus behavior. Current acceptance state is in
|
||||
[PLANS.md](../../PLANS.md); superseded attempts are in the
|
||||
[history](../history/milestone-8-before-workflow-cleanup.md) and focused
|
||||
[diagnostics](../diagnostics/milestone-8.md).
|
||||
|
||||
## M8.5 import/reissue and preceding scenarios
|
||||
|
||||
- Recorded: 2026-10-24T23:14:00+03:00. Run occurred earlier on 2026-10-24;
|
||||
an exact start timestamp was not captured.
|
||||
- Source identity: Git HEAD
|
||||
`2ccd67d64cd9ef4210ac3dc369473b3849319649` with dirty tracked and
|
||||
untracked M8 files. The reproducible input fingerprint is SHA256
|
||||
`e7aeaf13444ac6350db66cd6c34fb3a46f4ee0723eb18b8ebe0b0054e1672fd0`.
|
||||
It was identical before the pinned driver build and after the real run. The
|
||||
fingerprint was generated by:
|
||||
|
||||
```sh
|
||||
rg --files src tests/support tests/containers tests/testcontainers_wireguard.rs Cargo.toml Cargo.lock | sort | xargs sha256sum | sha256sum
|
||||
```
|
||||
|
||||
- Builder: `rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02`,
|
||||
target `x86_64-unknown-linux-musl`; Rust 1.97.1. The locked, offline driver
|
||||
build passed:
|
||||
|
||||
```sh
|
||||
docker run --rm --platform linux/amd64 --mount type=bind,src=/home/sasa/share/rust/wireguard-admin,dst=/src,readonly --mount type=bind,src=/tmp,dst=/out -e CARGO_TARGET_DIR=/out/wga-m8-build-target -e CARGO_HOME=/out/wga-m8-cargo-home -w /src rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02 cargo test --locked --offline --lib --no-run --target x86_64-unknown-linux-musl
|
||||
```
|
||||
|
||||
- Driver: `/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031`,
|
||||
SHA256 `e250d8eb60db0ad262b404624fa7f9d984f807d8688c055e9f8629178c00b151`.
|
||||
- Runtime image: `wireguard-admin-alpine:3.22.7`, image ID
|
||||
`sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`,
|
||||
Linux/amd64. Selected disposable local Docker daemon:
|
||||
`unix:///var/run/docker.sock`, ID
|
||||
`1baad80e-d79d-49ab-b19a-fb00fd3662d7`, Docker Server 29.1.3,
|
||||
host Linux `6.18.18-gentoo` x86_64.
|
||||
- Exact selected-daemon command:
|
||||
|
||||
```sh
|
||||
DOCKER_HOST=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ENDPOINT=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ID=1baad80e-d79d-49ab-b19a-fb00fd3662d7 WIREGUARD_ADMIN_TESTCONTAINERS=1 WIREGUARD_ADMIN_TEST_DRIVER=/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031 cargo test --locked --test testcontainers_wireguard selected_daemon_wireguard_and_application_smoke -- --ignored --exact --test-threads=1
|
||||
```
|
||||
|
||||
- Result: exit 0, 1 passed, 0 failed, 0 ignored, 25 filtered out, 82.06s.
|
||||
The integrated scenario exercised existing and new IPv4 peers, Commit and
|
||||
delivered-file traffic, saved deletion and explicit fixture Apply, two
|
||||
previewed password-free restores with saved/runtime separation, and import
|
||||
of matched/conflicting/invalid private sources followed by password-gated
|
||||
reissue and traffic from the reissued bytes. It used the real Rustix reader
|
||||
for peer/routes/handshake/counter assertions. Exact-name Docker container
|
||||
and network listings were empty after the run.
|
||||
- Independent disposition: M8.5-IMP-01 closed on re-review after checking all
|
||||
three source-file byte comparisons and the regression for a changed invalid
|
||||
candidate. Earlier traffic, deletion and restore slice findings were closed
|
||||
independently as recorded in the plan.
|
||||
- Limit: this is one Alpine fixture result for the fingerprint above. Later
|
||||
source edits invalidate it as final integrated evidence. User-directed IPv6
|
||||
capability/traffic tests were skipped. No real systemd job was exercised.
|
||||
|
||||
## M8.5 mandatory-backup failure
|
||||
|
||||
- Source-input fingerprint: SHA256
|
||||
`b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2`, stable
|
||||
before the pinned driver build and after the real run. Driver SHA256:
|
||||
`ad45dc3f6b0987b075ac522e171c82c6651124c3d01c65c14df90595fe552815`.
|
||||
- Builder: `rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02`.
|
||||
Runtime image: `wireguard-admin-alpine:3.22.7`, ID
|
||||
`sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`.
|
||||
Selected disposable daemon: `unix:///var/run/docker.sock`, ID
|
||||
`1baad80e-d79d-49ab-b19a-fb00fd3662d7`.
|
||||
- Exact selected-daemon command:
|
||||
|
||||
```sh
|
||||
DOCKER_HOST=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ENDPOINT=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ID=1baad80e-d79d-49ab-b19a-fb00fd3662d7 WIREGUARD_ADMIN_TESTCONTAINERS=1 WIREGUARD_ADMIN_TEST_DRIVER=/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031 cargo test --locked --test testcontainers_wireguard selected_daemon_wireguard_and_application_smoke -- --ignored --exact --test-threads=1
|
||||
```
|
||||
|
||||
- Result: exit 0, 1 passed, 0 failed in 81.45s. The scenario required a typed
|
||||
backup error and verified unchanged saved/runtime state, no fixture apply,
|
||||
retained address reservation, and the expected reader missing-interface and
|
||||
deadline errors. Exact-name checks found no remaining test containers or
|
||||
networks.
|
||||
- Limit: this was a completed M8.5 slice result before the final gates and
|
||||
repeated full scenario runs recorded below. IPv6 capability/traffic was
|
||||
excluded by user direction; no real systemd job was exercised.
|
||||
|
||||
## M8.7 integrated gates and repeated Alpine scenario
|
||||
|
||||
- Recorded: 2026-10-25T20:40:51+03:00. Git HEAD remained
|
||||
`2ccd67d64cd9ef4210ac3dc369473b3849319649` with dirty milestone files.
|
||||
The source-input fingerprint command above returned
|
||||
`b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2`
|
||||
before the rebuilt driver and after all three successful real runs.
|
||||
- The pinned Alpine runtime image rebuilt entirely from cached layers (ID
|
||||
`sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`,
|
||||
linux/amd64). Networkless, read-only, capability-dropped readiness exited 0;
|
||||
`apk info -v` listed the 33 constrained packages. The pinned Rust 1.97.1
|
||||
Alpine builder produced the x86_64 musl test driver in 1m38s using the host's
|
||||
cached public Cargo registry mounted read-only after the earlier `/tmp` cache
|
||||
disappeared. The static PIE driver's SHA256 was
|
||||
`ad45dc3f6b0987b075ac522e171c82c6651124c3d01c65c14df90595fe552815`.
|
||||
The exact rebuild command was:
|
||||
|
||||
```sh
|
||||
docker run --rm --platform linux/amd64 --mount type=bind,src=/home/sasa/share/rust/wireguard-admin,dst=/src,readonly --mount type=bind,src=/tmp,dst=/out --mount type=bind,src=/home/sasa/.cargo/registry,dst=/out/wga-m8-cargo-home/registry,readonly -e CARGO_TARGET_DIR=/out/wga-m8-build-target -e CARGO_HOME=/out/wga-m8-cargo-home -w /src rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02 cargo test --locked --offline --lib --no-run --target x86_64-unknown-linux-musl
|
||||
```
|
||||
|
||||
- Integrated host gates on this source revision: `cargo fmt --all -- --check`,
|
||||
`cargo clippy --locked --all-targets -- -D warnings`, `cargo test --locked`,
|
||||
`cargo build --locked --release`, release `--help` and `--version`, and
|
||||
`git diff --check` all exited 0. Default tests included 258 passing library
|
||||
tests with two explicitly ignored driver tests, five delivery, nine
|
||||
Commit/restore, nine configuration, two runtime, 25 host harness with one
|
||||
ignored container scenario, six TUI, five vault import, and two doctests.
|
||||
Default tests did not execute the real-container scenario.
|
||||
- The selected-daemon command in the preceding section ran twice against this
|
||||
fingerprint with fresh mutable resources: exit 0, 1/1 passed each time,
|
||||
80.77s and 80.77s. The documented unfiltered
|
||||
`cargo test --locked --test testcontainers_wireguard -- --ignored --test-threads=1`
|
||||
form then ran with the same `DOCKER_HOST` and `WIREGUARD_ADMIN_TEST_*` values:
|
||||
exit 0, 1/1 passed in 81.87s; 25 nonignored host tests were filtered out.
|
||||
Each run exercised the full M8.5 scenario, including real IPv4 traffic and
|
||||
Rustix observations, saved/runtime separation, deletion and verified
|
||||
reservation release, both restores, import/reissue, and mandatory-backup
|
||||
failures. Exact-name container and network listings were empty after each.
|
||||
- Independent integrated review found no code defect. Its R1 stale testing and
|
||||
evidence statements, R2 general IPv6 gate, and R3 stale milestone summary
|
||||
were corrected and each closed on independent re-review. M8 acceptance state
|
||||
is recorded in PLANS.md.
|
||||
- Scope: fixture Apply is test-only and does not prove a systemd/D-Bus job.
|
||||
IPv6 capability and traffic were deliberately not tested by user direction;
|
||||
production dual-stack behavior is still specified and unverified here. No
|
||||
production configuration, key, or service was accessed.
|
||||
Reference in New Issue
Block a user