# libpam 1.5.3 (Linux-PAM) -- BRINTOS-514.
#
# Drives UPSTREAM's own ptest suite under ptest-runner and scores it against a
# native x86_64 control built from the identical tarball (data/libpam-native.txt,
# regenerated by src/libpam_mknative.sh). The control is what fixes the case names
# and the expected count BEFORE the image is booted, so a target red is a statement
# about this arm rather than about the suite.
#
# It then asserts what the ptest structurally CANNOT speak for. Every tst-* here is
# statically linked, so the whole suite would pass unchanged on an image where the
# shipped library, headers and module archives were all missing -- the ptest tests
# the code, not the port.
#
# BST-TIMEOUT: 300   # 17 short programs, but each is a fresh guest process and
#                    # ptest-runner adds its own per-suite setup; 60 s is tight on a
#                    # loaded host and a trip costs the whole run's sentinel.
. "$BST_LIB"

PT=/usr/lib/libpam/ptest
CTL=$BST_DATA/libpam-native.txt

require ptest-runner libpam/present

# ---------------------------------------------------------------------------
# 1. What the port ships. The ptest cannot fail on any of these being absent.
# ---------------------------------------------------------------------------
check libpam/archive-libpam      test -s /lib/libpam.a
check libpam/archive-misc        test -s /lib/libpam_misc.a
check libpam/archive-pamc        test -s /lib/libpamc.a
check libpam/header-appl         test -s /usr/include/security/pam_appl.h
check libpam/header-modules      test -s /usr/include/security/pam_modules.h
check libpam/header-modutil      test -s /usr/include/security/pam_modutil.h
check libpam/header-ext          test -s /usr/include/security/pam_ext.h

# The bare libpam package IS this file: FILES:${PN} is a .so glob that matches
# nothing on a static-only arm plus ${nonarch_libdir}/tmpfiles.d, so asserting it by
# content is the only way to notice the package going empty.
check_out libpam/tmpfiles "/run/sepermit" cat /usr/lib/tmpfiles.d/pam.conf

# The PAM service configuration, from libpam-runtime. It is load-bearing for the 8
# cases below that call pam_start(): with no /etc/pam.d at all pam_start returns 26
# (PAM_ABORT) and every one of them fails, so its absence must read as its own red
# rather than as eight mysterious case failures.
check libpam/pamd-other        test -s /etc/pam.d/other
check libpam/pamd-common-auth  test -s /etc/pam.d/common-auth
check libpam/helper-chkpwd     test -x /usr/sbin/unix_chkpwd

# The 40 PAM modules build and ship as archives even though nothing can dlopen them
# here (HWJS-5). Bound from below: a count that only ever grows is not a tripwire.
nmod=$(ls /lib/security/pam_*.a 2>/dev/null | wc -l)
if [ "$nmod" -ge 40 ]; then bst_ok libpam/modules-shipped
else bst_notok libpam/modules-shipped "want >=40 pam_*.a in /lib/security, got $nmod"; fi

# The suite payload itself, so a truncated ptest package is not read as a short run.
check libpam/ptest-runptest      test -x $PT/run-ptest
check libpam/ptest-confdir       test -s $PT/tests/confdir

# ---------------------------------------------------------------------------
# 2. Upstream's suite, under ptest-runner, joined against the native control.
# ---------------------------------------------------------------------------
if [ ! -s "$CTL" ]; then
    bst_notok libpam/control-present "native control $CTL missing or empty"
    return 0 2>/dev/null || exit 0
fi
bst_ok libpam/control-present

out=$(ptest-runner libpam 2>&1)

# Every case the CONTROL proved green natively is required green here; anything else
# is named with what the target actually said. Cases are driven from the control, not
# from the target's output, so a case the target never emitted is a red rather than a
# silently shorter run.
while read -r verdict name; do
    [ "$verdict" = "PASS:" ] || continue
    if printf '%s\n' "$out" | grep -qx "PASS: $name"; then
        bst_ok "libpam/case-$name"
    else
        got=$(printf '%s\n' "$out" | grep -xE "(FAIL|SKIP): $name" | head -1)
        bst_notok "libpam/case-$name" "native PASS, target: ${got:-<not emitted>}"
    fi
done < "$CTL"

# Completeness: the run reported as many cases as the control has. This is what
# catches a TRUNCATED run whose visible cases all happen to be green, which a
# per-case-only report cannot see.
nctl=$(grep -c '^PASS: ' "$CTL")
ntgt=$(printf '%s\n' "$out" | grep -cE '^(PASS|FAIL|SKIP): tst-')
check_eq libpam/join-complete "$nctl" "$ntgt"

# Upstream's run-ptest prints its own summary and -- see the design doc -- ALWAYS
# exits 0, so ptest-runner's TOTAL/FAIL tally cannot be the gate. This line is the
# suite's own verdict in its own words.
case "$out" in
    *"All $nctl tests passed"*) bst_ok libpam/suite-all-passed ;;
    *) bst_notok libpam/suite-all-passed \
         "$(printf '%s\n' "$out" | grep -E 'tests (passed|failed)' | head -1)" ;;
esac

# ptest-runner reached the end of the suite rather than dying inside it.
case "$out" in
    *"END: /usr/lib/libpam/ptest"*) bst_ok libpam/ptest-completed ;;
    *) bst_notok libpam/ptest-completed "no END marker; $(_bst_1line "$out")" ;;
esac