comrade: update to 0.1.16, add a comrade-tests package and test.sh

Upstream history:
https://github.com/dangowrt/comrade/compare/v0.1.1...v0.1.16

Also adds comrade-tests, a separate package carrying comrade's compiled
test suite (its unit tests, comrade-e2e, and its end-to-end scenario
scripts) so none of it reaches an end-user comrade install. CI's own
test.sh wires up the unit tests through comrade-tests' own
run-unit-tests.sh; both discover what to run from what was actually
installed rather than a hardcoded list, so neither goes stale as
upstream's own suite grows. stream_cc_test and natstream_test are
skipped there instead of run: the first asserts a throughput floor
QEMU user-mode emulation can't reliably clear, the second does real
ICE/NAT gathering, so run-unit-tests.sh skips both by default;
COMRADE_SKIP= run-unit-tests.sh runs them too, e.g. on real hardware,
and comrade-tests' own description now says so. The variable is
namespaced rather than a plain SKIP, matching COMRADE_E2E_NET below,
so it can't collide with whatever else a CI harness's environment
happens to define. run-unit-tests.sh also warns if a listed test ever
matches no installed binary, so a rename or removal upstream surfaces
as a message instead of silent drift. Each test runs under busybox
timeout with a 600 second bound, 5x upstream's largest CTest TIMEOUT
of 120 seconds with margin left for the slowest emulated targets, so
a test that wedges under QEMU fails in minutes and by name rather
than holding the job to its six-hour limit. The end-to-end scenarios
need real network or multicast conditions, and some a live DHT, that
CI's QEMU emulation cannot promise, so they ship for manual use on
real hardware instead.

PKG_SOURCE_URL now points at the release's own tarball instead of
GitHub's codeload archive: codeload's compression is not guaranteed
byte-stable release to release, which broke a hash pinned against
v0.1.12 within hours of that release going out, while a release asset
is frozen the moment the tag's release is published. The tarball is
still produced with `git archive`, so it still carries no submodule
content and deps/always-online-stun still arrives empty for
Build/Prepare to fill.

The STUN list pin matches this release's own deps/always-online-stun
commit. comrade tries every server in the pool in rotation now, not
just the first entry, but a pool with many dead entries still degrades
public-IPv4 discovery, so this still wants refreshing on every bump.

Signed-off-by: Daniel Golle <redacted>

diff --git a/net/comrade/Makefile b/net/comrade/Makefile
index 36b48bf267522eb781ea4298a9d71f92f83b885e..1294ce2adf7846451176e6752c7e8aa06b6392fb 100644 (file)
--- a/net/comrade/Makefile
+++ b/net/comrade/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=comrade
-PKG_VERSION:=0.1.1
+PKG_VERSION:=0.1.16
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://codeload.github.com/dangowrt/comrade/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=b778bbc4aa61e6e77632f4931557a2831eb80ef981f099d175d48b40324d4619
+PKG_SOURCE_URL:=https://github.com/dangowrt/comrade/releases/download/v$(PKG_VERSION)
+PKG_HASH:=1054b4b3df410401caa0b35d64b35c0f95c5dce91f617f25fbccb03bdd60553a
 
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_LICENSE:=AGPL-3.0-or-later
@@ -24,29 +24,25 @@ PKG_BUILD_FLAGS:=gc-sections lto
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
 
-# The GitHub source archive used above carries no submodule content, so
-# deps/always-online-stun arrives as an empty directory; without the file
-# below CMake falls back to three hard-coded servers. This is the same list
-# that submodule would provide, pinned to the commit the v$(PKG_VERSION) tag
-# references. Either way "comrade stun-update" refreshes the pool at
-# runtime into the user's data directory.
-STUN_LIST_VERSION:=0932114f96cd80886f559994545692870df73804
+# The release tarball above is minted with `git archive` in upstream's own
+# release CI, not GitHub's codeload archive-on-demand, but that carries no
+# submodule content either; deps/always-online-stun arrives as an empty
+# directory, and the file below is the same hourly-validated list that
+# submodule provides, pinned to the exact commit v$(PKG_VERSION)'s own
+# deps/always-online-stun points at. comrade tries every server in the
+# pool in rotation, but a pool with many dead entries still degrades
+# public-IPv4 discovery.
+STUN_LIST_VERSION:=4dc3b52cffa8ca9532a56274d8ac789f5e2be175
 STUN_LIST_FILE:=always-online-stun-$(STUN_LIST_VERSION)-valid_nat_testing_hosts.txt
 
 define Download/stunlist
   FILE:=$(STUN_LIST_FILE)
   URL:=https://raw.githubusercontent.com/pradt2/always-online-stun/$(STUN_LIST_VERSION)
   URL_FILE:=valid_nat_testing_hosts.txt
-  HASH:=0aee95ad2cb98a2def9886045d241a62cca64541f77697a010bf0477e02a7322
+  HASH:=40fd158296353730a6e79ac6219ea2efb8c166c7188e9cfbbaf3997e814ef376
 endef
 $(eval $(call Download,stunlist))
 
-# comrade adds no crypto library of its own: it reads the DT_NEEDED entries
-# out of libssh and follows whatever backend that already uses. OpenWrt's
-# libssh is built against mbedTLS, which implements neither BLAKE2b nor
-# Ed25519, so this resolves to monocypher (~70 kB) rather than dragging in
-# libcrypto. Should libssh ever move to OpenSSL, the backend follows it and
-# libmonocypher below has to become libopenssl.
 define Package/comrade
   SECTION:=net
   CATEGORY:=Network
@@ -70,14 +66,35 @@ define Package/comrade/description
   boxes that will host.
 endef
 
-# With no -DCOMRADE_DHT_DIR the build finds and links the shared libdht,
-# which is what we want: comrade is an ordinary consumer of the packaged
-# library, exactly as transmission is. comrade defines the four symbols
-# libdht deliberately leaves undefined (dht_hash, dht_random_bytes,
-# dht_blacklisted, dht_sendto) and the dynamic linker resolves them back
-# into the executable.
+define Package/comrade-tests
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=SSH
+  TITLE:=Serverless peer-to-peer terminal sharing (test suite)
+  URL:=https://github.com/dangowrt/comrade
+  DEPENDS:=+libssh +libjuice +libdht +libkcp +libmonocypher +libpthread
+endef
+
+define Package/comrade-tests/description
+  comrade's compiled test suite, kept out of the comrade package so it
+  never reaches an end-user install.
+
+  The deterministic unit tests are wired into this package's own CI
+  test.sh, which runs run-unit-tests.sh automatically -- except for a
+  couple that need real network/timing conditions QEMU can't promise;
+  run-unit-tests.sh skips those by default, run COMRADE_SKIP=
+  run-unit-tests.sh to include them too, e.g. on real hardware. The
+  end-to-end scenarios (comrade-e2e plus its *.sh drivers) need real
+  network or multicast conditions, and some a live DHT
+  (COMRADE_E2E_NET=1), that CI's QEMU emulation cannot promise, so they
+  are shipped for manual use on real hardware instead, not run
+  automatically.
+  Usage: /usr/share/comrade/tests/run-unit-tests.sh
+         /usr/share/comrade/tests/<scenario>.sh /usr/share/comrade/tests/comrade-e2e
+endef
+
 CMAKE_OPTIONS += \
-       -DBUILD_TESTING=OFF
+       -DBUILD_TESTING=ON
 
 define Build/Prepare
        $(Build/Prepare/Default)
@@ -91,4 +108,17 @@ define Package/comrade/install
        $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/comrade $(1)/usr/bin/
 endef
 
+define Package/comrade-tests/install
+       $(INSTALL_DIR) $(1)/usr/share/comrade/tests
+       for t in $(PKG_BUILD_DIR)/*_test; do \
+               $(INSTALL_BIN) "$$$${t}" $(1)/usr/share/comrade/tests/ || exit 1; \
+       done
+       $(INSTALL_BIN) $(PKG_BUILD_DIR)/comrade-e2e $(1)/usr/share/comrade/tests/
+       for s in $(PKG_BUILD_DIR)/tests/*.sh; do \
+               $(INSTALL_BIN) "$$$${s}" $(1)/usr/share/comrade/tests/ || exit 1; \
+       done
+       $(INSTALL_BIN) ./files/run-unit-tests.sh $(1)/usr/share/comrade/tests/
+endef
+
 $(eval $(call BuildPackage,comrade))
+$(eval $(call BuildPackage,comrade-tests))

diff --git a/net/comrade/files/run-unit-tests.sh b/net/comrade/files/run-unit-tests.sh
new file mode 100755 (executable)
index 0000000..fda0c82
--- /dev/null
+++ b/net/comrade/files/run-unit-tests.sh
@@ -0,0 +1,97 @@
+#!/bin/sh
+# Runs comrade's deterministic unit test binaries, installed next to this
+# script by the comrade-tests package. Not the end-to-end scenarios, and
+# not the few *_test binaries in SKIP below: all of those need real
+# network/timing conditions QEMU CI can't promise, and are meant for
+# manual runs on real hardware instead (see the comrade-tests package
+# description).
+#
+# A test exiting 77 is the CTest/Automake skip convention (sig_rebuild_test
+# uses it when it cannot get a socket); this script honours the same
+# convention rather than treating it as a failure.
+#
+# What to run is discovered from what comrade-tests/install in the Makefile
+# actually put next to this script (every *_test binary), not a separate
+# list kept here: the two can never disagree about what was installed.
+
+# shellcheck shell=busybox
+
+set -u
+
+DIR=$(dirname "$0")
+
+# QEMU-emulated CI can hang or run too slow for these: stream_cc_test
+# asserts a throughput floor, natstream_test does real ICE/NAT gathering.
+# Manual runs on real hardware can opt back in with COMRADE_SKIP= (an
+# explicitly empty value, not just unset, so the default below still
+# applies).
+SKIP="${COMRADE_SKIP-stream_cc_test natstream_test}"
+skip_seen=""
+
+# sig_rebuild_test persists its node cache under XDG_DATA_HOME; give it a
+# throwaway directory instead of whatever this shell's real one is.
+XDG_DATA_HOME=$(mktemp -d)
+export XDG_DATA_HOME
+cleanup() { rm -rf "$XDG_DATA_HOME"; }
+trap cleanup EXIT INT TERM
+
+failed=0
+skipped=0
+passed=0
+
+for t in "$DIR"/*_test; do
+       [ -e "$t" ] || continue
+       name=$(basename "$t")
+
+       case " $SKIP " in
+       *" $name "*)
+               echo "SKIP $name (needs real hardware)"
+               skipped=$((skipped + 1))
+               skip_seen="$skip_seen $name"
+               continue
+               ;;
+       esac
+
+       if [ ! -x "$t" ]; then
+               echo "FAIL $name (not executable)"
+               failed=$((failed + 1))
+               continue
+       fi
+
+       # A wedged test must fail in minutes and by name, not hang CI to the
+       # job's six-hour limit. 600s is 5x upstream's largest CTest TIMEOUT
+       # (120s), with margin for QEMU emulation of the slowest targets.
+       timeout 600 "$t"
+       ret=$?
+       if [ "$ret" -eq 0 ]; then
+               echo "PASS $name"
+               passed=$((passed + 1))
+       elif [ "$ret" -eq 77 ]; then
+               echo "SKIP $name"
+               skipped=$((skipped + 1))
+       else
+               echo "FAIL $name (exit $ret)"
+               failed=$((failed + 1))
+       fi
+done
+
+# A SKIP entry that never matched an installed binary is itself drift: a
+# rename or removal upstream, silently leaving the entry to skip nothing.
+for s in $SKIP; do
+       case " $skip_seen " in
+       *" $s "*) ;;
+       *) echo "warn: SKIP entry '$s' matched no installed *_test binary" >&2 ;;
+       esac
+done
+
+echo
+echo "$passed passed, $skipped skipped, $failed failed"
+
+# A glob that matched nothing looks identical to an all-pass run otherwise
+# ($failed stays 0) -- refuse to report success for a suite that never ran.
+if [ "$((passed + skipped + failed))" -eq 0 ]; then
+       echo "no *_test binaries found next to $0" >&2
+       exit 1
+fi
+
+[ "$failed" -eq 0 ]

diff --git a/net/comrade/test.sh b/net/comrade/test.sh
new file mode 100755 (executable)
index 0000000..17d923d
--- /dev/null
+++ b/net/comrade/test.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+#
+# comrade: no package-specific test -- the generic checks (executable,
+#   version banner, no hardcoded paths, stripped, linked libs) already cover
+#   this binary; there is no comrade-specific behaviour worth grepping
+#   arbitrary --help/show text for, which is free to change independently of
+#   this file.
+# comrade-tests: run the deterministic unit test suite (run-unit-tests.sh).
+#   The end-to-end scenarios shipped alongside it are not run here: they need
+#   real network/multicast conditions this CI's QEMU emulation cannot
+#   promise, and several also need a live DHT. They are for manual use on
+#   real hardware, see the comrade-tests package description.
+
+# shellcheck shell=busybox
+
+set -e
+
+case "$1" in
+comrade)
+       ;;
+
+comrade-tests)
+       /usr/share/comrade/tests/run-unit-tests.sh
+       ;;
+
+*)
+       echo "test.sh: unknown subpackage '$1' -- refusing to silently pass" >&2
+       echo "test.sh: update net/comrade/test.sh to cover this subpackage" >&2
+       exit 1
+       ;;
+esac