#!/bin/sh
# Drive the whole resolvconf interface under a temporary root and print a
# deterministic transcript.
#
# Run identically on both sides: natively at build time to produce the expected
# transcript, and on target to produce the actual one. Everything that could
# differ for a reason that is not the port -- the root path, a pid, the host name
# -- is normalised out, so a difference in the transcript is a difference in what
# the ported bash, sed, coreutils, run-parts and flock did with the same scripts.
#
# Usage: resolvconf-scenarios.sh ROOT NORMALIZE_CORPUS [GROUP]
#
# ROOT is a tree already materialised by resolvconf-temproot.sh.
#
# GROUP is "a", "d", "b", "c" or a run of them ("abcd" is the default), selecting
# a contiguous run of phases. The letters are in the order the groups were split
# out, not alphabetical: the phase order is a, d, c, b.
# It exists because the whole matrix does not fit in ONE guest: the run costs
# ~600 process spawns, and this platform does not return memory on process exit
# (brintos/linux#21, brintos/hardwarejs#20), so a single-guest run peaked at
# 12.4 GiB and was killed by brintos_local_verify's RSS-rate bound -- reporting
# ZERO cases, which is worse than any red. Split across two guests each half is
# comfortably inside both the memory and the wall-clock bound. The halves are
# contiguous rather than interleaved so that each is a coherent story and each
# starts from its own reset_state.

set -u

R=${1:?ROOT}
CORPUS=${2:?normalize corpus}
GROUP=${3:-abcd}

case "$GROUP" in
  a|b|c|d|ad|bc|abcd) ;;
  *) echo "resolvconf-scenarios: GROUP must be a, b, c, d or a run of them (got '$GROUP')" >&2 ; exit 2 ;;
esac
in_group() { case "$GROUP" in *"$1"*) return 0 ;; *) return 1 ;; esac ; }

RC="$R/sbin/resolvconf"
LR="$R/lib/resolvconf/list-records"
NORM="$R/lib/resolvconf/normalize-resolvconf"
IFDIR="$R/run/resolvconf/interface"
DYN="$R/run/resolvconf/resolv.conf"
RCD="$R/etc/resolvconf/resolv.conf.d"

# Everything below runs with the C locale and a fixed umask: sed's character
# classes, sort order and the mode of every file resolvconf creates are all
# locale- or umask-derived, and a transcript that silently depends on the
# ambient value of either is not a comparison between two platforms.
LC_ALL=C
LANG=C
export LC_ALL LANG
umask 022

# The transcript's only escape hatch. $R differs between the two sides by
# construction, and it reaches the output through $0 in resolvconf's own warning
# text and through readlink, so it is mapped to a constant rather than kept out.
scrub() { sed -e "s|$R|@ROOT@|g" ; }

case_begin() { printf '==CASE %s==\n' "$1" ; }
case_end()   { printf '==END %s==\n' "$1" ; }

# run <label> <cmd...> -- combined stdout+stderr, then the exit status.
run() {
    _l=$1 ; shift
    case_begin "$_l"
    _o=$( "$@" 2>&1 ) ; _rc=$?
    [ -n "$_o" ] && printf '%s\n' "$_o" | scrub
    printf 'rc=%s\n' "$_rc"
    case_end "$_l"
}

# run_in <label> <stdin-file> <cmd...> -- as run, with stdin from a file.
# The redirect is inside a command substitution, which forks first: a top-level
# redirect is the shape that ends a suite early on this platform.
run_in() {
    _l=$1 ; _f=$2 ; shift 2
    case_begin "$_l"
    _o=$( "$@" < "$_f" 2>&1 ) ; _rc=$?
    [ -n "$_o" ] && printf '%s\n' "$_o" | scrub
    printf 'rc=%s\n' "$_rc"
    case_end "$_l"
}

# add <label> <iface> <record-text> -- the -a path, which reads the record from
# stdin. The record is staged under $R (tmpfs on both sides).
add() {
    _l=$1 ; _i=$2 ; _t=$3
    printf '%b' "$_t" > "$R/.stdin"
    run_in "$_l" "$R/.stdin" "$RC" -a "$_i"
}

# show <label> <file> -- the file's content, with an explicit end marker so a
# trailing blank line is visible rather than swallowed.
show() {
    _l=$1 ; _f=$2
    case_begin "$_l"
    if [ -L "$_f" ] ; then
        printf 'symlink -> %s\n' "$(readlink "$_f" | scrub)"
    elif [ -f "$_f" ] ; then
        scrub < "$_f"
        printf '[eof]\n'
    elif [ -d "$_f" ] ; then
        printf 'directory\n'
    elif [ -e "$_f" ] ; then
        printf 'other\n'
    else
        printf 'absent\n'
    fi
    case_end "$_l"
}

# Wipe every piece of state resolvconf owns, so each phase starts from the same
# place regardless of what the previous one left behind. Records, both flag
# files, the generated file and the three resolv.conf.d inputs.
reset_state() {
    rm -rf "$IFDIR"
    mkdir -p "$IFDIR"
    rm -f "$R/run/resolvconf/enable-updates" \
          "$R/run/resolvconf/postponed-update" \
          "$R/run/resolvconf/run-lock" \
          "$DYN" \
          "$RCD/head" "$RCD/tail" "$RCD/base" \
          "$R/etc/default/resolvconf" \
          "$R/etc/resolv.conf"
}

# Phase 11 replaces interface-order to prove the file is read at all; phase 12
# needs the shipped one back. Snapshot it here, before anything has touched it.
cp "$R/etc/resolvconf/interface-order" "$R/etc/resolvconf/interface-order.orig"

if in_group a ; then
# ---------------------------------------------------------------------------
# Phase 0 -- identity, usage, and the argument contract
# ---------------------------------------------------------------------------
reset_state

run version           "$RC" --version
run help              "$RC" --help
run help-short        "$RC" -h
run no-args           "$RC"
run unknown-cmd       "$RC" --frobnicate
run add-no-iface      "$RC" -a
run del-no-iface      "$RC" -d
run iface-slash       "$RC" -a eth0/1
run iface-space       "$RC" -a "eth0 1"
run iface-dot         "$RC" -a .eth0
run iface-hyphen      "$RC" -a -eth0
run iface-tilde       "$RC" -a '~eth0'
run u-takes-no-arg    "$RC" -u eth0
run enable-takes-no-arg "$RC" --enable-updates eth0

# --version's second half: it cats a copyright file when one is readable, through
# a sed range with an embedded q. Exercised because it is the only sed range in
# the package outside normalize-resolvconf, and because the branch is invisible
# on an image that ships no copyright file -- which is this one.
mkdir -p "$R/usr/share/doc/resolvconf"
printf 'Format: dep5\nUpstream-Name: resolvconf\n\nFiles: *\nCopyright: 1999-2018 Some One <a@b.c>\n  2019 Someone Else <d@e.f>\nLicense: GPL-2.0+\n\nFiles: debian/*\nCopyright: 2020 Third Party\nLicense: GPL-2.0+\n' \
    > "$R/usr/share/doc/resolvconf/copyright"
run version-with-copyright "$RC" --version
rm -f "$R/usr/share/doc/resolvconf/copyright"

# ---------------------------------------------------------------------------
# Phase 1 -- the updates flag file
# ---------------------------------------------------------------------------
reset_state

run upd-off-initial    "$RC" --updates-are-enabled
run upd-enable         "$RC" --enable-updates
run upd-on             "$RC" --updates-are-enabled
show upd-flagfile      "$R/run/resolvconf/enable-updates"
run upd-disable        "$RC" --disable-updates
run upd-off-again      "$RC" --updates-are-enabled
show upd-flagfile-gone "$R/run/resolvconf/enable-updates"

# ---------------------------------------------------------------------------
# Phase 2 -- add, update, list: the generated file, byte for byte
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1

add  add-eth0 eth0.inet 'nameserver 10.0.0.1\nnameserver 10.0.0.2\nsearch example.com\n'
show resolv-after-eth0 "$DYN"
run  list-after-eth0   "$RC" -l
run  ifaces-after-eth0 "$RC" -i
show record-eth0       "$IFDIR/eth0.inet"

# The -a short circuit: identical content must not rewrite the record and must
# not run the update scripts. Asserted through the transcript rather than a
# timestamp, which is not comparable across the two sides.
add  add-eth0-again eth0.inet 'nameserver 10.0.0.1\nnameserver 10.0.0.2\nsearch example.com\n'
show resolv-after-readd "$DYN"

run  update-explicit   "$RC" -u
show resolv-after-u    "$DYN"

# ---------------------------------------------------------------------------
# Phase 3 -- interface priority decides nameserver order
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1

# The loopback address deliberately is NOT used here: 127.* triggers the
# truncation rule of phase 4, which would collapse the file to one line and hide
# the ordering this phase exists to assert.
add  prio-eth0 eth0.inet 'nameserver 10.0.0.1\n'
add  prio-wlan wlan0.inet 'nameserver 10.0.0.9\n'
add  prio-lo   lo.inet 'nameserver 10.0.0.53\n'
show resolv-priority "$DYN"
run  list-priority   "$RC" -l
run  ifaces-priority "$RC" -i

# The same three records added in the opposite order must produce the same file:
# order is a property of interface-order, not of arrival.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  prio-rev-lo   lo.inet 'nameserver 10.0.0.53\n'
add  prio-rev-wlan wlan0.inet 'nameserver 10.0.0.9\n'
add  prio-rev-eth0 eth0.inet 'nameserver 10.0.0.1\n'
show resolv-priority-reversed "$DYN"

# ---------------------------------------------------------------------------
# Phase 4 -- the two truncation rules
# ---------------------------------------------------------------------------
# Rule one: no more than three nameservers, in priority order.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  trunc-a eth0.inet 'nameserver 10.0.0.1\nnameserver 10.0.0.2\n'
add  trunc-b eth1.inet 'nameserver 10.0.0.3\nnameserver 10.0.0.4\n'
add  trunc-c eth2.inet 'nameserver 10.0.0.5\n'
show resolv-truncated-at-three "$DYN"

# Rule two: the list stops after a loopback address, because a resolver that
# reaches one will never consult what follows.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  loop-lo   lo.inet 'nameserver 127.0.0.53\n'
add  loop-eth0 eth0.inet 'nameserver 8.8.8.8\n'
show resolv-truncated-at-loopback "$DYN"

# ... and the same for IPv6 ::1, which is a separate arm of the same case.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  loop6-lo   lo.inet6 'nameserver ::1\n'
add  loop6-eth0 eth0.inet 'nameserver 8.8.8.8\n'
show resolv-truncated-at-loopback6 "$DYN"

# The override that turns rule two off. /etc/default/resolvconf is sourced by
# update.d/libc, so this is also the only case that proves the file is read.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
printf 'TRUNCATE_NAMESERVER_LIST_AFTER_LOOPBACK_ADDRESS=no\n' > "$R/etc/default/resolvconf"
add  loop-off-lo   lo.inet 'nameserver 127.0.0.53\n'
add  loop-off-eth0 eth0.inet 'nameserver 8.8.8.8\n'
show resolv-loopback-override "$DYN"

# The deprecated spelling of the same variable, which update.d/libc still honours.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
printf 'TRUNCATE_NAMESERVER_LIST_AFTER_127=no\n' > "$R/etc/default/resolvconf"
add  loop-old-lo   lo.inet 'nameserver 127.0.0.53\n'
add  loop-old-eth0 eth0.inet 'nameserver 8.8.8.8\n'
show resolv-loopback-legacy-override "$DYN"

fi   # in_group a

if in_group d ; then
# ---------------------------------------------------------------------------
# Phase 5 -- de-duplication, search merging, pass-through
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1

add  dedup-eth0 eth0.inet 'nameserver 10.0.0.1\nsearch a.example. b.example\n'
add  dedup-eth1 eth1.inet 'nameserver 10.0.0.1\nnameserver 10.0.0.2\ndomain b.example\n'
add  dedup-eth2 eth2.inet 'search c.example\noptions ndots:2\nsortlist 10.0.0.0/8\n'
show resolv-dedup "$DYN"

# Everything that is neither a nameserver nor a search/domain line is copied
# through verbatim, after the compiled lines, in record order -- and comments and
# blank lines are dropped. Both halves are asserted here.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  passthru eth0.inet '# a comment\n\nnameserver 10.0.0.1\n\noptions timeout:1 attempts:2\n# another comment\nsortlist 10.0.0.0/8 192.168.0.0/16\n'
show resolv-passthrough "$DYN"
show record-passthrough "$IFDIR/eth0.inet"

# ---------------------------------------------------------------------------
# Phase 6 -- head, base and tail
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1

printf '# HEAD LINE ONE\n# HEAD LINE TWO\n' > "$RCD/head"
printf 'nameserver 192.0.2.53\nsearch base.example\n' > "$RCD/base"
printf '# TAIL LINE\n' > "$RCD/tail"
add  hbt-eth0 eth0.inet 'nameserver 10.0.0.1\nsearch iface.example\n'
show resolv-head-base-tail "$DYN"

# base is consulted for its content but is NOT a record: it sorts after every
# interface record, which is what puts its nameserver last.
run  list-with-base "$RC" -l
run  ifaces-with-base "$RC" -i

# ---------------------------------------------------------------------------
# Phase 7 -- normalization happens on the way in
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1

add  norm-on-add eth0.inet '   nameserver   010.000.000.001   # trailing comment\n\n\tnameserver\t0:0:0:0:0:0:0:1\t\nsearch   x.example    y.example  \n'
show record-normalized "$IFDIR/eth0.inet"
show resolv-normalized "$DYN"

# ---------------------------------------------------------------------------
# Phase 8 -- delete
# ---------------------------------------------------------------------------
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  del-setup-eth0 eth0.inet 'nameserver 10.0.0.1\n'
add  del-setup-eth1 eth1.inet 'nameserver 10.0.0.2\n'
show resolv-before-delete "$DYN"
run  del-eth0         "$RC" -d eth0.inet
show resolv-after-delete "$DYN"
show record-deleted   "$IFDIR/eth0.inet"
run  del-again        "$RC" -d eth0.inet
run  del-absent       "$RC" -d nosuch.inet
show resolv-after-noop-delete "$DYN"

# A record file that exists but is empty is removed without running the update
# scripts: list-records never listed it, so nothing it contributed can be lost.
: > "$IFDIR/empty.inet"
run  del-empty-record "$RC" -d empty.inet
show record-empty-gone "$IFDIR/empty.inet"

fi   # in_group d

if in_group b ; then
# ---------------------------------------------------------------------------
# Phase 9 -- postponed updates
# ---------------------------------------------------------------------------
reset_state

# With updates disabled, -a stores the record and postpones; the generated file
# must not appear.
add  postpone-add eth0.inet 'nameserver 10.0.0.1\n'
show record-postponed   "$IFDIR/eth0.inet"
show resolv-postponed   "$DYN"
show flag-postponed     "$R/run/resolvconf/postponed-update"

# Enabling updates runs the pending update immediately.
run  postpone-enable    "$RC" --enable-updates
show resolv-after-enable "$DYN"
show flag-postponed-gone "$R/run/resolvconf/postponed-update"

# -d and -u postpone in exactly the same way.
"$RC" --disable-updates >/dev/null 2>&1
run  postpone-del       "$RC" -d eth0.inet
show flag-postponed-del "$R/run/resolvconf/postponed-update"
"$RC" --disable-updates >/dev/null 2>&1
run  postpone-u         "$RC" -u
show flag-postponed-u   "$R/run/resolvconf/postponed-update"

# ---------------------------------------------------------------------------
# Phase 10 -- the /etc/resolv.conf symlink check
# ---------------------------------------------------------------------------
# Absent symlink: a warning on stderr, and the generated file is still written.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
add  symlink-absent eth0.inet 'nameserver 10.0.0.1\n'
show resolv-symlink-absent "$DYN"

# The warning silenced by the documented variable.
reset_state
printf 'REPORT_ABSENT_SYMLINK=no\n' > "$R/etc/default/resolvconf"
"$RC" --enable-updates >/dev/null 2>&1
add  symlink-absent-quiet eth0.inet 'nameserver 10.0.0.1\n'

# The deprecated spelling of the same variable.
reset_state
printf 'REPORT_ALTERED_SYMLINK=no\n' > "$R/etc/default/resolvconf"
"$RC" --enable-updates >/dev/null 2>&1
add  symlink-absent-quiet-legacy eth0.inet 'nameserver 10.0.0.1\n'

# Symlink in place: no warning, and update.d/libc reaches its notify branch.
# readlink -f has to follow it to the dynamic file for that to happen, which is
# what poky's 0001-avoid-using-m-option-for-readlink.patch changed.
reset_state
"$RC" --enable-updates >/dev/null 2>&1
: > "$DYN"
ln -snf "$DYN" "$R/etc/resolv.conf"
show symlink-in-place "$R/etc/resolv.conf"
add  symlink-present eth0.inet 'nameserver 10.0.0.1\n'
show resolv-symlink-present "$DYN"

# With the symlink in place, update-libc.d is run-parts'd. A script dropped in it
# is the proof that the notify branch executed at all.
mkdir -p "$R/etc/resolvconf/update-libc.d"
printf '#!/bin/sh\necho "update-libc.d ran: $*"\n' > "$R/etc/resolvconf/update-libc.d/zz-probe"
chmod 0755 "$R/etc/resolvconf/update-libc.d/zz-probe"
add  notify-hook eth0.inet 'nameserver 10.0.0.2\n'
rm -rf "$R/etc/resolvconf/update-libc.d"

fi   # in_group b -- part 1

if in_group c ; then
# ---------------------------------------------------------------------------
# Phase 11 -- the interface-order matrix
# ---------------------------------------------------------------------------
# This is the extglob arm. Every record below is chosen to land on a different
# pattern in interface-order, including the ones that need +(...), @(...), !(...)
# and the [^.] character class -- none of which any ash has, which is why
# list-records is the package's one bash script.
RC_ORDER_RECORDS="zzz-unmatched ppp0 ppp1 eth0 eth0.inet eth0.inet6 eth0.dhclient
           eth0.ip6.dhcpcd br0.inet wlan0 wlan0.inet wlan0.inet6 wlp3s0.inet
           enp0s3.inet enp0s3.inet6 ath0.inet wifi0 tun0 tap0 hso0 vpn0
           em1 em1_2 p1p1 lo lo.inet lo.inet6 lo.dnsmasq lo.pdnsd lo.pdns
           lo.pdns-recursor lo.other"
reset_state
for rec in $RC_ORDER_RECORDS ; do
    printf 'nameserver 10.1.1.1\n' > "$IFDIR/$rec"
done
run order-matrix "$LR"

# Everything from here runs against a SMALL record set, not the 32 above. Each
# list-records call is a bash process doing extglob expansion over every record
# against every pattern, and that is measured to be the single most expensive
# thing in this suite -- 4.8 GiB across seven calls, enough to have the guest
# killed. --after and the degenerate-file case assert option handling, which
# eight records demonstrate exactly as well as thirty-two; the full set is kept
# only where the assertion is ABOUT the full set, which is order-matrix above and
# order-custom-file below.
reset_state
for rec in lo.inet6 lo.inet lo eth0.inet eth0 wlan0.inet ppp0 zzz-unmatched ; do
    printf 'nameserver 10.1.1.1\n' > "$IFDIR/$rec"
done
run order-small       "$LR"
run order-after-flag  "$LR" --after lo.inet
run order-after-equal "$LR" --after=eth0.inet
run order-after-absent "$LR" --after nosuch

# A zero-length record is never listed, whatever it is called.
: > "$IFDIR/lo.zero"
run order-skips-empty "$LR"
rm -f "$IFDIR/lo.zero"

# The shipped interface-order is read rather than assumed: replacing it with a
# file that inverts the two classes must invert the listing. If list-records ever
# fell back to its built-in copy this is the case that notices.
# The inversion case goes back to the full set: what it asserts IS that the whole
# ordering follows the file, so a small set would leave most of it unexercised.
reset_state
for rec in $RC_ORDER_RECORDS ; do
    printf 'nameserver 10.1.1.1\n' > "$IFDIR/$rec"
done
printf '# custom\n@(br|eth)*\nwl+([bcosxpP])*\nlo\n*\n' > "$R/etc/resolvconf/interface-order"
run order-custom-file "$LR"
printf '# empty of patterns\n' > "$R/etc/resolvconf/interface-order"
run order-degenerate-file "$LR"

fi   # in_group c

if in_group b ; then
# ---------------------------------------------------------------------------
# Phase 12 -- interface-order(5) matches list-records' built-in copy
# ---------------------------------------------------------------------------
# resolvconf keeps the pattern list twice: once in etc/resolvconf/interface-order
# and once as a fallback literal inside bin/list-records. Upstream ships a test
# that they agree (debian/test-correct-interface-order); it is reproduced here
# because the copy that ships to target is the only one this port can check.
case_begin builtin-vs-file
(
    cd "$R" || exit 1
    # Restore the shipped file, which phase 11 replaced.
    cp "$R/etc/resolvconf/interface-order.orig" "$R/etc/resolvconf/interface-order"
    eval "$(sed -n '/^PATTERNS=/,/"/p' "$LR")"
    printf '# interface-order(5)\n%s\n' "$PATTERNS" > "$R/.builtin"
    if diff -u "$R/etc/resolvconf/interface-order" "$R/.builtin" \
            --label interface-order --label list-records ; then
        printf 'identical\n'
    fi
) 2>&1 | scrub
case_end builtin-vs-file

# ---------------------------------------------------------------------------
# Phase 13 -- normalize-resolvconf, against upstream's own corpus
# ---------------------------------------------------------------------------
# The 22 cases below are transcribed from debian/test-normalization, which ships
# in the source but not in any binary package. They carry upstream's OWN expected
# strings, so this phase has an oracle that does not depend on the build host's
# sed at all: `match=` is a comparison against the specification, and the actual
# text is printed beside it so the two sides can also be diffed against each
# other. A red in one but not the other separates a sed difference from a
# transcription error.
rm -rf "$R/norm" ; mkdir -p "$R/norm"

# The whole corpus goes through normalize-resolvconf in ONE pass, and the split
# is done by two awk invocations rather than by 21 iterations of two.
#
# Not an optimisation for its own sake: the per-case shape spawned 42 gawk and 21
# sed processes, and this platform does not return memory on process exit
# (brintos/linux#21, brintos/hardwarejs#20). Measured -- that phase alone drove
# the guest to 13.7 GiB at 5153 MiB/min and brintos_local_verify killed it on two
# consecutive boots, reporting ZERO cases for the suite. Batched, the same
# assertions cost three processes.
#
# Batching is sound because normalize-resolvconf is stateless per line: it is a
# sed program whose every command is a substitution or a branch within one cycle,
# with no hold space, no ranges and no `N`. A separator line that the program
# leaves untouched -- @@RCnn@@ is not blank, carries no #, no blanks and does not
# begin with "nameserver" -- therefore partitions the output exactly as 21
# separate runs would. The equivalence was checked against the per-case form
# before this replaced it.
awk -F'|' -v dir="$R/norm" '
    function dec(s) { gsub(/\\t/, "\t", s); gsub(/\\n/, "\n", s); return s }
    /^#/ { next }
    NF >= 3 {
        printf "@@RC%s@@\n%s", $1, dec($2) > (dir "/batch.in")
        printf "%s", dec($3)                > (dir "/" $1 ".want")
        print $1                            > (dir "/names")
    }
' "$CORPUS"

"$NORM" < "$R/norm/batch.in" > "$R/norm/batch.out" 2>&1

# One awk emits the whole phase: per case, the actual text and a match= line
# against upstream's own expected string. Reading the .want files here rather
# than in the shell is what keeps this to a single process.
awk -v dir="$R/norm" '
    BEGIN {
        while ((getline nm < (dir "/names")) > 0) { order[++n] = nm }
        close(dir "/names")
    }
    /^@@RC.*@@$/ {
        cur = substr($0, 5, length($0) - 6)
        got[cur] = ""
        seen[cur] = 1
        next
    }
    # Written as an if rather than `got[cur] (...)`: mawk parses an identifier
    # immediately followed by "(" as a FUNCTION CALL, not as concatenation, and
    # dies with "Call to undefined function". gawk accepts both, which is exactly
    # how the form below reached a build -- the check that passed ran under gawk
    # and the awk on this build host is mawk.
    cur != "" {
        if (got[cur] == "") { got[cur] = $0 } else { got[cur] = got[cur] "\n" $0 }
    }
    END {
        for (i = 1; i <= n; i++) {
            nm = order[i]
            want = ""
            first = 1
            while ((getline l < (dir "/" nm ".want")) > 0) {
                if (first) { want = l ; first = 0 } else { want = want "\n" l }
            }
            close(dir "/" nm ".want")
            printf "==CASE norm-%s==\n", nm
            printf "%s\n", got[nm]
            printf "match=%s\n", (got[nm] == want ? "yes" : "no")
            printf "==END norm-%s==\n", nm
        }
    }
' "$R/norm/batch.out"

# Upstream's own "check that we are actually testing something" step, kept for
# the same reason it exists there: a comparison that cannot fail is not evidence.
# This one asserts the harness reports a mismatch when there is one.
case_begin norm-negative-control
_got=$( printf 'nameserver 127.0.0.1\n' | "$NORM" 2>&1 )
if [ "$_got" = "bogusstring" ] ; then printf 'match=yes\n' ; else printf 'match=no\n' ; fi
case_end norm-negative-control

fi   # in_group b

printf '==TRANSCRIPT-END==\n'
exit 0