ScottW514
11031ad87f
The gnutls bbappend builds GnuTLS with --enable-ktls and installs /etc/gnutls/config with ktls = true, so after the handshake the kernel seals and opens forgectrl's HTTPS records (the kernel side is meta-openglow's CONFIG_TLS and patch 0016). It also backports GnuTLS dc016daf: 3.8.4 hands the kernel the record sequence number where a TLS 1.2 ChaCha20-Poly1305 connection's IV belongs, so every such connection failed the kernel's first decryption. forgectrl is the only program on the image that links GnuTLS. forgectrl.tls-records, in its own module (suite/tlsrec.py), reads the result from the outside with openssl s_client on loopback: a desktop offer (AES-GCM first) gets ChaCha20-Poly1305 over TLS 1.3 and 1.2 and the kernel takes both directions' keys; an AES-128-GCM-only offer, three times over each protocol, gets it, the kernel takes its keys, and the CAAM's job-ring interrupt counts the records; a TLS 1.2 CBC-only offer connects and stays in GnuTLS (the control for the kernel's counters); every copy of the panel page equals the plain-HTTP copy byte for byte, with no decrypt error; the kernel's drivers are rfc7539(chacha20-neon,poly1305-neon) and ctr-aes-caam with ghash-ce. Proof: on the image before these fixes the test failed on both bugs it names (the TLS 1.2 ChaCha20 page arrived empty with a decrypt error; the AES-GCM pages arrived damaged); on image 20260927224418 it passes. The unit suite (500 tests) and the coverage lint (0 uncovered paths) pass on the host.
forgetest - the ForgeFIRM release acceptance tool
The daemon behind http://<machine>:8090/ on the dev image: runs the
acceptance catalog against the machine, keeps the append-only result log,
decides which results still apply to the image that is running, exports
the release artifact scripts/release.sh gates on, and serves the bench
diagnostics page. The contract - catalog, campaigns, fingerprints,
inheritance, the gate, the coverage rule - is
the Acceptance page of the documentation site.
Run the host tests
cd forgetest
python3 -m unittest discover -s tests -v
Run the daemon on a workstation (against a mock or a manifest file)
FORGETEST_DATA=/tmp/ft FORGETEST_MANIFEST=../tree-manifest.json \
FORGECTRL_URL=http://<machine> python3 -m forgetest --port 8090
scripts/manifest-from-tree.py produces tree-manifest.json from the recipe
pins; the coverage lint is python3 -m forgetest.coverage --manifest ....
Environment
| Variable | Default | Purpose |
|---|---|---|
FORGETEST_DATA |
/data/forgetest |
results.jsonl, bench.jsonl, token, export/ |
FORGETEST_MANIFEST |
/etc/forgefirm-manifest.json |
the image manifest |
FORGETEST_PORT, FORGETEST_HOST |
8090, 0.0.0.0 | listener |
FORGETEST_BENCH_DIR |
/usr/share/forgetest/bench |
the installed bench scripts |
FORGETEST_BENCH_DATA |
<FORGETEST_DATA>/bench |
passed to bench tools: where they keep their data files (with GF_HOST=127.0.0.1 and the panel token in GF_TOKEN) |
FORGETEST_MARKER |
/run/forgetest.active |
takeover marker |
FORGECTRL_URL, FORGECTRL_TOKEN_FILE |
http://127.0.0.1, /data/forgefirm/panel.token |
forgectrl client (HTTP; the token authorizes writes from the board) |
FORGECTRL_TLS_URL |
https://127.0.0.1 |
forgectrl over HTTPS (self-signed, unverified), for the login test |
GF_SYSFS_ROOT |
/sys/glowforge/ |
kernel module sysfs |
GRBL_HOST, GRBL_PORT |
127.0.0.1, 23 | Grbl TCP |
Adding a test
Register it in the subsystem module under forgetest/suite/ with
@test(...): id subsystem.name, kind, hardware, mode (the controller
mode the test needs; the runner switches to it first), covers,
requires, always, steps. The body gets a Context (log, check, fail,
prompt, confirm, instruct, sleep, evidence, forgectrl, sysfs,
grbl, takeover). Return normally for PASS, raise runner.Failed for
FAIL. Then run the unit tests and the coverage lint.