. "$BST_LIB"
# BST-TIMEOUT: 400  # measured: this suite runs 129s on a host that was
# simultaneously running another engineer's bitbake, so ~3x that. It needs a
# marker at all only because sections 9's two signal bounds (30s + 75s) are
# wall-clock waits for a delivery that never comes; the other 63 cases together
# cost about 25s.

# lockfile-progs 0.1.19 (Debian; meta-oe recipes-extended) -- the command-line
# wrappers around liblockfile's advisory dot-locking. Seven binaries, all one
# program dispatching on argv[0]: lockfile-create/-remove/-touch/-check and
# mail-lock/-unlock/-touchlock. Upstream hard-links them; in the packaged image
# they arrive as seven independent 3 100 887-byte copies, each with a link count
# of 1 (measured in the staged rootfs). That is why section 1 checks each name
# for itself and section 2 checks each one's usage text -- neither an inode
# comparison nor a single "the file exists" case would say anything here.
#
# ---------------------------------------------------------------------------
# WHAT THIS PORT ACTUALLY PUTS AT RISK
#
# lockfile-progs is ~400 lines that parse options and call four liblockfile
# entry points. It adds no locking logic of its own, so what this suite measures
# is not "does the C compile" but whether the two INDEPENDENT liveness rules
# liblockfile uses to decide "is this lock still valid?" survive on this arm:
#
#   1. The AGE rule (a lock with no pid in it). lockfile_check() reads the
#      lockfile's mtime and calls the lock valid iff it is newer than 5 minutes.
#      This is the default -- `lockfile-create f` writes "0" -- and it is what
#      lockfile-touch exists to refresh.
#
#   2. The PID rule (a lock created with --use-pid). The lockfile holds the
#      caller's PARENT pid (L_PPID, not L_PID -- see cmd_lock()), and
#      lockfile_check() asks kill(pid, 0) whether that process is still alive.
#
# The two rules are not redundant: the pid branch SHORT-CIRCUITS the age rule,
# so if kill(pid,0) lies about liveness, a --use-pid lock is never reclaimed no
# matter how old it gets, while a plain lock is unaffected. Splitting the suite
# along that seam is what makes the reds below attributable to the kernel rather
# than to this port.
#
# The underlying create primitive is a hard link: lockfile_create() opens a
# uniquely-named temp file, link()s it to the lock name, then lstat()s BOTH and
# claims the lock iff (st_rdev, st_ino) match. link-primitive below measures that
# substrate directly, so a collapse there reads as the filesystem's rather than
# this port's. (82-liblockfile owns the exhaustive syscall-level version of that
# probe; this one case is here so a red in THIS suite is diagnosable without
# cross-referencing.)
#
# ---------------------------------------------------------------------------
# EXPECTED REDS ON THIS PLATFORM TODAY -- four, two causes, both already tracked
#
#   lockfile-progs/use-pid-stale-detect   lockfile-check --use-pid must report a
#                                         lock whose recorded owner is gone.
#   lockfile-progs/use-pid-stale-break    lockfile-create must then reclaim it.
#
# Both fail for one reason: brintos/linux#41 -- wasm32_sys_kill returns 0 for
# every pid when sig == 0, without looking the pid up, so kill(pid, 0) reports
# EVERY process alive (including a pid far above pid_max). lockfile_check()
# therefore never sees a dead owner. BRINTOS-259 filed and root-caused this at
# the library level; these two cases are the same defect reached through the
# shipped user-facing tools.
#
#   lockfile-progs/sigkill-substrate      SIGKILL must stop a child.
#   lockfile-progs/touch-sigterm          lockfile-touch must exit 0 on SIGTERM.
#
# Both fail for a second, INDEPENDENT reason: brintos/linux#21 -- no signal is
# delivered to anything, SIGKILL included, while kill(2) still reports success.
# #41 is the sig==0 existence probe lying; #21 is delivery not happening at all.
# The two are separable and are separated here, so each pair flips green on its
# own issue: sigkill-substrate answers "does ANY signal arrive" before
# touch-sigterm asks "does lockfile-touch handle one correctly", which is why a
# red in the second is attributable without reading another suite.
#
# None of the four is skipped or relaxed: each flips green on its own the day
# its kernel arm is fixed, and that is the regression signal this suite exists
# to buy. Every age-rule case beside them is expected GREEN, and that split is
# the evidence that the port itself is sound.
# ---------------------------------------------------------------------------

require lockfile-create lockfile-progs/present
bst_ok lockfile-progs/present

w=${TMPDIR:-/tmp}/.bst-lockfile-progs.$$
rm -rf "$w"; mkdir -p "$w" || { bst_notok lockfile-progs/workdir "cannot mkdir $w"; exit 0; }

# rc_out <id> <want-rc> <needle> <cmd...> -- assert BOTH the exit status and a
# substring of the combined output. The stock helpers cannot express this pair:
# check_out demands rc 0, and every usage path here exits 1 while printing the
# text that proves WHICH of the seven argv[0] personalities ran.
rc_out() {
  _id=$1; _want=$2; _needle=$3; shift 3
  _o=$("$@" 2>&1); _rc=$?
  case "$_o" in *"$_needle"*) _h=1 ;; *) _h=0 ;; esac
  if [ "$_rc" -eq "$_want" ] && [ "$_h" -eq 1 ]; then bst_ok "$_id"
  elif bst_execfail "$_o"; then bst_unrun "$_id" "$_o"
  else bst_notok "$_id" "rc=$_rc want=$_want want:'$_needle' got:'$(_bst_1line "$_o")'"; fi
}

# first line of a file, using the shell builtin -- these run once per case and
# on this runtime the fork is the cost, not the work.
# BST-REDIRECT-OK: called only inside $( ), which forks; the argument is a .lock under $TMPDIR.
firstline() { _l=''; [ -r "$1" ] && read _l < "$1" 2>/dev/null; printf '%s' "$_l"; }

isfile() { if [ -f "$1" ]; then bst_ok "$2"; else bst_notok "$2" "missing: $1"; fi; }
gone()   { if [ -e "$1" ]; then bst_notok "$2" "still present: $1"; else bst_ok "$2"; fi; }

# --- 1. the shipped payload: seven binaries, one program -----------------------
for b in lockfile-create lockfile-remove lockfile-touch lockfile-check \
         mail-lock mail-unlock mail-touchlock; do
  if [ -x "/usr/bin/$b" ]; then bst_ok "lockfile-progs/bin-$b"
  else bst_notok "lockfile-progs/bin-$b" "not installed or not executable: /usr/bin/$b"; fi
done

# --- 2. argv[0] dispatch -------------------------------------------------------
# Each name must print ITS OWN usage. This is the only thing that proves the
# hard links / copies survived packaging as distinct personalities rather than
# collapsing to one name -- a failure mode no "the file exists" case can see.
rc_out lockfile-progs/usage-create    1 "usage: lockfile-create"    lockfile-create
rc_out lockfile-progs/usage-remove    1 "usage: lockfile-remove"    lockfile-remove
rc_out lockfile-progs/usage-touch     1 "usage: lockfile-touch"     lockfile-touch
rc_out lockfile-progs/usage-check     1 "usage: lockfile-check"     lockfile-check
rc_out lockfile-progs/usage-mail-lock 1 "usage: mail-lock"          mail-lock --lock-name
rc_out lockfile-progs/usage-mail-unlock    1 "usage: mail-unlock"    mail-unlock extra
rc_out lockfile-progs/usage-mail-touchlock 1 "usage: mail-touchlock" mail-touchlock extra

# --- 3. core lifecycle (the age rule, default) ---------------------------------
f=$w/f; touch "$f"
check    lockfile-progs/create            lockfile-create "$f"
isfile   "$f.lock"                        lockfile-progs/lock-created
check_eq lockfile-progs/lock-content-zero "0" "$(firstline "$f.lock")"
check    lockfile-progs/check-held        lockfile-check "$f"
check    lockfile-progs/touch-oneshot     lockfile-touch --oneshot "$f"
check    lockfile-progs/check-after-touch lockfile-check "$f"
check    lockfile-progs/remove            lockfile-remove "$f"
gone     "$f.lock"                        lockfile-progs/lock-removed
# an absent lock is "not locked": liblockfile returns -1, which main() hands to
# exit() as 255. Asserting the exact status keeps a future rc-mapping change
# visible -- callers script on this.
check_rc lockfile-progs/check-after-remove 255 lockfile-check "$f"

# no temp-file residue: lockfile_create() unlinks its .lk<pid><time><host> temp
# on both the success and the give-up path.
resid=$(ls -a "$w" 2>/dev/null | grep -c '^\.lk')
check_eq lockfile-progs/no-temp-residue "0" "$resid"

# --- 4. --lock-name: the argument IS the lock ----------------------------------
L=$w/plain.lock
check    lockfile-progs/lockname-create lockfile-create --lock-name "$L"
isfile   "$L"                           lockfile-progs/lockname-exact
gone     "$L.lock"                      lockfile-progs/lockname-no-suffix
check    lockfile-progs/lockname-check  lockfile-check  --lock-name "$L"
check    lockfile-progs/lockname-remove lockfile-remove --lock-name "$L"
# short form of the same switch
S=$w/short.lock
check    lockfile-progs/lockname-short  lockfile-create -l "$S"
isfile   "$S"                           lockfile-progs/lockname-short-exact
lockfile-remove -l "$S" 2>/dev/null

# --- 5. --use-pid: the pid rule ------------------------------------------------
g=$w/g; touch "$g"
check lockfile-progs/use-pid-create lockfile-create --use-pid "$g"
pv=$(firstline "$g.lock")
# the recorded value must be a non-zero integer -- this is getppid() reaching the
# lockfile, and it is what distinguishes a pid lock from a plain one.
case "$pv" in
  ''|*[!0-9]*) bst_notok lockfile-progs/use-pid-writes-pid "not an integer: '$pv'" ;;
  0)           bst_notok lockfile-progs/use-pid-writes-pid "wrote 0; getppid() did not reach the lockfile" ;;
  *)           bst_ok    lockfile-progs/use-pid-writes-pid ;;
esac
lockfile-remove "$g" 2>/dev/null

# short form
gs=$w/gs; touch "$gs"
lockfile-create -p "$gs" 2>/dev/null
pvs=$(firstline "$gs.lock")
case "$pvs" in
  ''|*[!0-9]*|0) bst_notok lockfile-progs/use-pid-short "-p did not record a pid: '$pvs'" ;;
  *)             bst_ok    lockfile-progs/use-pid-short ;;
esac
lockfile-remove "$gs" 2>/dev/null

# A LIVE owner must read as held. Both commands run under one `sh -c`, so the
# recorded parent is that shell and it is demonstrably alive for both -- doing
# this through the bst helpers instead would be shell-dependent, because the
# helpers run their command inside $( ), and whether the pid recorded is the
# subshell's or the test shell's turns on an exec optimisation that dash and
# bash resolve differently (measured: dash 0, bash 255 on the same binary).
lv=$w/live; touch "$lv"
check_rc lockfile-progs/use-pid-live-owner 0 \
  sh -c "lockfile-create --use-pid '$lv' && lockfile-check --use-pid '$lv'"
lockfile-remove "$lv" 2>/dev/null

# A DEAD owner must read as stale. 999999 is above this guest's pid_max, so no
# such process can exist and kill(pid,0) must report ESRCH.
#   EXPECTED RED -- brintos/linux#41 (kill(pid,0) reports every pid alive).
d=$w/dead; touch "$d"; printf '999999\n' > "$d.lock"
check_rc lockfile-progs/use-pid-stale-detect 255 lockfile-check --use-pid "$d"
# ...and having seen it stale, lockfile-create must reclaim it. --retry 0 keeps
# the give-up path fast (the default retry of 9 sleeps up to ~3 minutes).
#   EXPECTED RED -- same cause: the lock never reads as stale, so it is never broken.
check_rc lockfile-progs/use-pid-stale-break 0 lockfile-create --retry 0 --use-pid "$d"
lockfile-remove "$d" 2>/dev/null; rm -f "$d.lock"

# The pid branch is opt-in per CALL, not a property of the lock: the same
# dead-owner lockfile read WITHOUT --use-pid falls through to the age rule and,
# being freshly written, reads as held. This is green today and stays green when
# #41 lands -- it is what proves the two rules are genuinely independent.
d2=$w/dead2; touch "$d2"; printf '999999\n' > "$d2.lock"
check lockfile-progs/no-use-pid-ignores-pid lockfile-check "$d2"
rm -f "$d2.lock"

# --- 6. the age rule under a stale mtime ---------------------------------------
# Backdate mtime while leaving atime NOW. Both halves matter: lockfile_check()
# prefers "the atime observed after reading the file" as its notion of now (to
# survive noatime mounts), so backdating BOTH -- the obvious way to write this --
# makes the lock read as FRESH and the case silently proves nothing.
#
# busybox's touch applet ignores -m/-a and stamps mtime AND atime together, so
# it cannot express this state at all; where the shell resolves `touch` to that
# applet we take coreutils by absolute path instead, and if neither can do it we
# SKIP rather than assert. The verification below deliberately reads the FINAL
# state (mtime still old, atime strictly newer): checking it between the two
# touches passes on busybox and then silently loses the aging.
TOUCH=touch
[ -x /usr/bin/touch ] && TOUCH=/usr/bin/touch

stale_mtime() {
  _f=$1
  _old=$(( $(date +%s) - 900 ))
  $TOUCH -m -d "@$_old" "$_f" 2>/dev/null || return 1
  $TOUCH -a "$_f" 2>/dev/null || return 1
  _m=$(stat -c %Y "$_f" 2>/dev/null); _a=$(stat -c %X "$_f" 2>/dev/null)
  [ "$_m" = "$_old" ] || return 1
  [ -n "$_a" ] && [ "$_a" -gt "$_m" ] 2>/dev/null || return 1
  return 0
}

a=$w/aged; touch "$a"
lockfile-create "$a" 2>/dev/null
if stale_mtime "$a.lock"; then
  check_rc lockfile-progs/age-stale-detect 255 lockfile-check "$a"
  # lockfile-touch is the documented cure: refresh the mtime, lock valid again.
  check_rc lockfile-progs/age-touch-refreshes 0 \
    sh -c "lockfile-touch --oneshot '$a' && lockfile-check '$a'"
  # and an aged lock must be reclaimable by a new caller
  if stale_mtime "$a.lock"; then
    check_rc lockfile-progs/age-stale-break 0 lockfile-create --retry 0 "$a"
  else
    bst_skip lockfile-progs/age-stale-break "could not re-age the lockfile"
  fi
else
  for c in age-stale-detect age-touch-refreshes age-stale-break; do
    bst_skip "lockfile-progs/$c" "touch -d @EPOCH unsupported here; cannot age a lockfile"
  done
fi
lockfile-remove "$a" 2>/dev/null

# --- 7. contention: a fresh lock is NOT stealable ------------------------------
h=$w/held; touch "$h"
lockfile-create "$h" 2>/dev/null
rc_out lockfile-progs/contend-maxtrys 4 "exceeded maximum number of lock attempts" \
  lockfile-create --retry 0 "$h"
# -q silences the diagnostic but must not change the verdict
qo=$(lockfile-create -q --retry 0 "$h" 2>&1); qrc=$?
if [ "$qrc" -eq 4 ] && [ -z "$qo" ]; then bst_ok lockfile-progs/contend-quiet
else bst_notok lockfile-progs/contend-quiet "rc=$qrc out:'$(_bst_1line "$qo")' (want rc=4, no output)"; fi
# the holder's own lock survived both failed attempts
isfile "$h.lock" lockfile-progs/contend-holder-intact
lockfile-remove "$h" 2>/dev/null

# --- 8. error paths ------------------------------------------------------------
rc_out lockfile-progs/err-missing-dir 2 "cannot create temporary lockfile" \
  lockfile-create /nonexistent-dir-brintos390/x
# removing a lock that is not there is success, not an error (ENOENT -> 0)
check    lockfile-progs/err-remove-absent  lockfile-remove "$w/never-locked"
check_rc lockfile-progs/err-check-absent   255 lockfile-check "$w/never-locked"
rc_out lockfile-progs/err-two-args    1 "usage: lockfile-create" lockfile-create a b
rc_out lockfile-progs/err-bad-option  1 "usage: lockfile-create" lockfile-create --bogus "$w/x"
# option/action combinations the parser rejects before any locking happens
rc_out lockfile-progs/err-oneshot-on-create 1 "usage: lockfile-create" \
  lockfile-create --oneshot "$w/x"
rc_out lockfile-progs/err-usepid-on-touch   1 "usage: lockfile-touch" \
  lockfile-touch --use-pid --oneshot "$w/x"
rc_out lockfile-progs/err-retry-on-remove   1 "usage: lockfile-remove" \
  lockfile-remove --retry 3 "$w/x"
rc_out lockfile-progs/err-retry-bad-value   1 "bad retry-count value" \
  lockfile-create --retry notanumber "$w/x"

# --- 9. lockfile-touch in daemon mode honours SIGTERM --------------------------
# Without --oneshot lockfile-touch loops forever (touch, sleep 60) and installs a
# SIGTERM handler that exits with the touch status.
#
# Waiting for that exit must not be bounded by a watchdog that kills the daemon,
# and must not use `wait`: signal delivery is the thing under test, so a bound
# built out of kill(2) is built out of what is broken. Measured, not reasoned
# about -- an earlier revision did exactly that and this suite stopped at this
# case in BOTH a 900s and an 1800s run, the same 54 cases each time. Equal case
# counts at different bounds is the signature of a block, not of slowness.
#
# The daemon's exit is therefore observed through a file its wrapper writes,
# polled for a fixed number of seconds, so nothing here can outlive the poll.
#   EXPECTED RED -- brintos/linux#21 (kill(2) reports success and delivers
#   nothing; SIGKILL and self-signalling included).
#
# The daemon is left running when the signal does not take -- there is by
# definition no way to reap it. It sleeps 60s between touches and its lockfile
# lives under $w, so the cost is one idle process for the rest of the boot.
#
# Two rules here, both forced by brintos/linux#48, and neither optional.
#
# 1. Every bound is WALL CLOCK read from date(1), never a count of sleeps.
# 2. Every delay uses $SLEEP -- /bin/sleep, the coreutils binary -- never the
#    shell's builtin.
#
# The builtin returns IMMEDIATELY, reporting success, in any shell that has
# already forked and reaped a child; and it stays broken for the life of that
# shell. Measured on this image, same boot, same shell: builtin `sleep 10` = 0s
# while `/bin/sleep 10` = 10s. This suite forks constantly, so by section 9 the
# builtin is guaranteed to be in that state. An earlier revision used it and
# scored a false GREEN on sigkill-substrate -- it read the result file before
# the child it was watching had run at all.
# BRINTOS-WORKAROUND: linux#48 revisit -- the builtin sleep returns at once,
# reporting success, once the shell has forked and reaped a child, so both rules
# above exist only for #48. Revisit, not remove: when it closes, confirm the
# builtin actually sleeps again before trusting it -- a wrong answer here scores
# a false green rather than a red, as it already did once on sigkill-substrate.
SLEEP=sleep
[ -x /bin/sleep ] && SLEEP=/bin/sleep

bounded_wait() {   # bounded_wait <seconds> <file>; 0 = the file appeared
  _end=$(( $(date +%s) + $1 ))
  while [ "$(date +%s)" -lt "$_end" ]; do
    [ -s "$2" ] && return 0
    $SLEEP 1
  done
  [ -s "$2" ]
}

# Diagnosability, the same argument as link-primitive below: SIGKILL cannot be
# caught, blocked or ignored, so a child that runs to completion after one
# separates "lockfile-touch's handler is wrong" from "no signal reaches any
# process here" without cross-referencing another suite. The control runs first
# and is not optional -- without it, a child that never started at all would
# read as a signal that worked.
kc=$w/kill.ctl
sh -c '"$0" 5; echo alive > "$1"' "$SLEEP" "$kc" >/dev/null 2>&1 &
if bounded_wait 30 "$kc"; then bst_ok lockfile-progs/sigkill-control
else bst_notok lockfile-progs/sigkill-control "an un-killed child did not write within 30s; the substrate case below cannot mean anything"; fi

kf=$w/kill.out
sh -c '"$0" 5; echo alive > "$1"' "$SLEEP" "$kf" >/dev/null 2>&1 & kp=$!
kill -9 $kp 2>/dev/null
if bounded_wait 30 "$kf"; then
  bst_notok lockfile-progs/sigkill-substrate "child ran to completion after SIGKILL; no signal is delivered on this arm"
else
  bst_ok lockfile-progs/sigkill-substrate
fi

sg=$w/sig; touch "$sg"
lockfile-create "$sg" 2>/dev/null
rcf=$w/sig.rc
# "$0" is $SLEEP: the builtin would return at once here (#48), firing the
# SIGTERM before lockfile-touch had installed its handler and making the red
# mean something else entirely.
sh -c 'lockfile-touch "$1" & p=$!; "$0" 3; kill -TERM $p 2>/dev/null; wait $p; echo $? > "$2"' \
  "$SLEEP" "$sg" "$rcf" >/dev/null 2>&1 &
# 75s is chosen to exceed lockfile-touch's OWN 60s touch interval, so a red here
# says the signal was never delivered rather than merely not delivered until the
# daemon next woke up. That distinction is the whole diagnostic value of the case.
if bounded_wait 75 "$rcf"; then
  trc=$(firstline "$rcf")
  if [ "$trc" = "0" ]; then bst_ok lockfile-progs/touch-sigterm
  else bst_notok lockfile-progs/touch-sigterm "lockfile-touch exited $trc on SIGTERM (want 0)"; fi
else
  bst_notok lockfile-progs/touch-sigterm "still running 75s after SIGTERM, past its own 60s touch interval: the signal was never delivered, not merely delayed"
fi
lockfile-remove "$sg" 2>/dev/null

# --- 10. mail-* against the real spool ----------------------------------------
# The mail-* personalities take NO path argument: they derive it from
# getpwuid(geteuid()) as /var/spool/mail/<username>, so this also exercises NSS
# on the target. Everything on this image runs as root.
spool=/var/spool/mail
if mkdir -p "$spool" 2>/dev/null && touch "$spool/root" 2>/dev/null; then
  check  lockfile-progs/mail-lock      mail-lock
  isfile "$spool/root.lock"            lockfile-progs/mail-lock-created
  check  lockfile-progs/mail-touchlock mail-touchlock --oneshot
  check  lockfile-progs/mail-unlock    mail-unlock
  gone   "$spool/root.lock"            lockfile-progs/mail-unlock-removed
  rm -f "$spool/root"
else
  for c in mail-lock mail-lock-created mail-touchlock mail-unlock mail-unlock-removed; do
    bst_skip "lockfile-progs/$c" "cannot create $spool/root on this image"
  done
fi

# --- 11. the substrate the create primitive rests on ---------------------------
# lockfile_create() claims the lock iff the temp file and the lock name lstat()
# to the same inode. If link() is not a real hard link here, or st_ino is not
# stable per file, that comparison stops meaning anything -- and it fails OPEN
# (every caller "wins" the lock at once), which no return code would reveal.
p1=$w/link-a; p2=$w/link-b; touch "$p1"
if ln "$p1" "$p2" 2>/dev/null; then
  i1=$(stat -c %i "$p1" 2>/dev/null); i2=$(stat -c %i "$p2" 2>/dev/null)
  if [ -n "$i1" ] && [ "$i1" = "$i2" ]; then bst_ok lockfile-progs/link-primitive
  else bst_notok lockfile-progs/link-primitive "hard link reports a different inode: $i1 vs $i2"; fi
else
  bst_notok lockfile-progs/link-primitive "link() failed; lockfile_create() cannot work here"
fi

# --- 12. the man pages upstream ships ------------------------------------------
# lockfile-progs-doc IS produced -- upstream's eight man1 pages, every one a copy
# of lockfile-progs.1 -- but this image installs no -doc package anywhere: its
# 448-package manifest carries none, and the only man1 pages present belong to
# glibc's own package. So an absent page is this image's policy, not a gap in the
# port, and asserting it as a failure would blame the port for a distro decision.
# Written as a conditional rather than deleted so it becomes a real check by
# itself the day the image starts shipping docs. Same shape as lockdev/man.
for mp in lockfile-create mail-lock; do
  if [ -f "/usr/share/man/man1/$mp.1" ]; then
    bst_ok "lockfile-progs/man-$mp"
  else
    bst_skip "lockfile-progs/man-$mp" "image installs no -doc package; lockfile-progs-doc is built but not installed"
  fi
done

rm -rf "$w"