# BST-TIMEOUT: 2400   # elapsed=640s, 172 cases (==BST-SUITE, local verify,
#                      2026-08-08). An earlier full-suite run with a bitbake image
#                      build on the same box measured 989 s, so take 989 as the
#                      loaded-host figure and 2400 as ~2.4x THAT. The gate is
#                      upstream's whole suite: 139 separate wasm32 programs, each a
#                      fresh module instantiation (~1.4 s of exec alone) on top of
#                      its own work — psa_crypto 31 s, bignum_core 10 s, ssl and
#                      x509parse 12 s each. 2400 is also BST_SUITE_TIMEOUT_MAX, so
#                      it is the whole of what a marker may ask for rather than a
#                      headroom choice: a host materially slower than this one
#                      trips it, and that is a limit of the bound, not of the port.
. "$BST_LIB"

# 76-mbedtls.test — Mbed TLS 3.6.6 (meta-networking recipes-connectivity/mbedtls)
# on wasm32-hwjs, closed on the package's own upstream test suite, which
# OpenEmbedded packages as a ptest.
#
# Numbered into the 76 slot beside 76-openssl, this image's other general-purpose
# TLS-and-crypto library, following this tree's subject grouping. The two are
# alternatives, not layers: openssl is the one most software links, mbedtls is the
# one that fits where openssl does not, and both now answer the same questions
# here about X.509, the TLS record layer and the primitive set beneath them.
#
# WHAT THE GATE IS WORTH. Unlike geoip's ptest, which had to be repaired before it
# could fail at all, meta-networking's mbedtls ptest is upstream's own harness
# nearly intact: 139 test_suite_* programs driving ~29 000 individual cases from
# their .datax data files, over 619 X.509 fixtures in framework/data_files. A
# wrong answer anywhere in the crypto, X.509 or TLS layers turns it red. Nothing
# was added to it and nothing was taken away.
#
# THE ORACLE IS A NATIVE x86_64 CONTROL of the identical source (SRCREV 0bebf8b8,
# the recipe carries no patch series beyond CVE-2025-47917), cmake-configured the
# way the recipe does it — USE_SHARED_MBEDTLS_LIBRARY=OFF, ENABLE_TESTING=ON,
# ENABLE_PROGRAMS=ON — and then staged into the SAME ptest layout the target runs
# and driven by the SAME run-ptest under dash. It reported 139 PASS / 0 FAIL.
# Every expected string below was read off that run, never off a spec.
#
# THE ONE EXPECTED RED IS test_suite_net, AND IT IS NOT mbedtls's. Its
# net_poll_beyond_FD_SETSIZE case asserts `getrlimit(RLIMIT_NOFILE, &rlim) == 0`
# before it can raise the descriptor limit, and on this kernel that syscall is
# ENOSYS: arch/wasm32/kernel/syscall_table.c populates no slot for 97 (getrlimit),
# 160 (setrlimit) or 302 (prlimit64), and do_syscall maps a NULL entry to -ENOSYS.
# Measured raw on target: syscall(97) and syscall(302) both return -1/ENOSYS while
# /proc/self/limits reads 1024/4096, because procfs reads the rlimit state
# directly rather than through a syscall. Left FAILING rather than skipped — it
# flips green on its own the day the syscalls are wired, which is the regression
# signal the case is worth. brintos.io linux#20.

ptestdir=/usr/lib/mbedtls/ptest
t=$ptestdir/tests

# ------------------------------------------------------------- packaging ---
# check_rc with `test` is an ash builtin and forks nothing, unlike check/check_out
# whose command substitution does — so the presence half of this file is free on
# an arm where every exec is a fresh wasm module instantiation.
check_rc mbedtls/lib-tls 0 test -f /usr/lib/libmbedtls.a
check_rc mbedtls/lib-x509 0 test -f /usr/lib/libmbedx509.a
check_rc mbedtls/lib-crypto 0 test -f /usr/lib/libmbedcrypto.a
check_rc mbedtls/lib-everest 0 test -f /usr/lib/libeverest.a
check_rc mbedtls/lib-p256m 0 test -f /usr/lib/libp256m.a
check_rc mbedtls/header-ssl 0 test -f /usr/include/mbedtls/ssl.h
check_rc mbedtls/header-x509 0 test -f /usr/include/mbedtls/x509_crt.h
check_rc mbedtls/header-psa 0 test -f /usr/include/psa/crypto.h
check_rc mbedtls/pkgconfig 0 test -f /usr/lib/pkgconfig/mbedtls.pc

# No shared objects on a distro that is static-only by policy. Pinned as a
# positive because the stock recipe's PACKAGECONFIG asks for
# USE_SHARED_MBEDTLS_LIBRARY=ON and the distro-wide `--disable-shared` cannot
# reach a cmake recipe: one appearing here means the bbappend's
# PACKAGECONFIG:remove stopped taking and the archives above may be stale.
if [ -e /usr/lib/libmbedtls.so ] || [ -e /usr/lib/libmbedcrypto.so ]; then
  bst_notok mbedtls/static-only "a shared libmbedtls shipped on a static-only distro"
else
  bst_ok mbedtls/static-only
fi

# Ten of the sixty programs, named rather than counted: these are the ones the
# cases below drive or that a later reader will reach for, so one silently absent
# costs coverage without costing a case. `hello` is renamed by
# update-alternatives — the recipe registers it at ${bindir}/hello and the
# alternative lands as hello.mbedtls, which is the name a target shell must use.
for p in selftest benchmark hello.mbedtls generic_sum strerror \
         ssl_client1 ssl_server cert_write pk_sign gen_key; do
  check_rc "mbedtls/prog-$p" 0 test -x "/usr/bin/$p"
done

# --------------------------------------------------------- ptest payload ---
check_rc mbedtls/ptest-runptest 0 test -x "$ptestdir/run-ptest"
check_rc mbedtls/ptest-testdir 0 test -d "$t"
check_rc mbedtls/ptest-datafiles 0 test -d "$ptestdir/framework/data_files"

# 139 programs and 139 .datax beside them: each binary reads its own data file
# from the working directory, so a binary without its .datax is not a missing
# file but a program that exits at its first read. Counted rather than named
# because the set is upstream's and moves with the version; a count that drops is
# what a rebase silently losing suites looks like.
nbin=0; ndat=0
for f in "$t"/test_suite_*; do
  case "$f" in *.datax) ndat=$((ndat+1)); continue ;; esac
  [ -x "$f" ] && nbin=$((nbin+1))
done
check_eq mbedtls/ptest-progs 139 "$nbin"
check_eq mbedtls/ptest-datax 139 "$ndat"

# The X.509 fixture tree the parse/write suites read as ../framework/data_files.
ndf=0
for f in "$ptestdir"/framework/data_files/*; do ndf=$((ndf+1)); done
if [ "$ndf" -ge 619 ]; then bst_ok mbedtls/ptest-fixtures
else bst_notok mbedtls/ptest-fixtures "only $ndf files under framework/data_files, expected at least 619"; fi

# THIS LAYER'S run-ptest, NOT meta-networking's. Upstream's enumerates the ptest
# directory with `find *`, which passes all 278 names as a 9210-byte argv against
# an 8192-byte __wasm32_args_buf; HardwareJS's spawn path posts an error and
# returns without starting the process, so run-ptest waits forever on a child that
# never ran. Not a wrong verdict — a hang, and no timeout on this guest can break
# it (relative timers do not fire, linux-in-the-browser#120). Pinned here so a
# rebase that quietly restores upstream's copy is one red rather than a wedged
# gate with no report at all. Anchored on the `find` line, not the string anywhere in the file:
# our copy explains the fix in a comment that necessarily quotes the bad form.
if grep -qE '^[[:space:]]*tests=.*find \*' "$ptestdir/run-ptest" 2>/dev/null; then
  bst_notok mbedtls/ptest-runptest-argv "run-ptest enumerates with \`find *\`; 278 names exceed the 8192-byte __wasm32_args_buf and the guest wedges"
else
  bst_ok mbedtls/ptest-runptest-argv
fi

# ------------------------------------------------ the tools, against control ---
# The three programs that make this port visible from a target shell and answer
# deterministically. Every expected string was measured on the native control.
check_out mbedtls/tool-hello "MD5('Hello, world!') = 6cd3556deb0da54bca060b4c39479839" hello.mbedtls

# generic_sum is the library's hash surface reached through a CLI: same digest a
# caller would get from mbedtls_md(), over a file we write here so the input is
# not an assumption about the image.
gs=${TMPDIR:-/tmp}/bst-mbedtls-gs.$$
printf 'brintOS\n' > "$gs"
check_out mbedtls/tool-generic-sum \
  "b2cd9b3c304e23a05b4791057c64f74ce122296d3dd20974ce342eb02e1474e2" \
  generic_sum SHA256 "$gs"
rm -f "$gs"

# strerror decodes a library error code from the string tables, so it is a
# statement about the X.509 module being compiled in at all.
check_out mbedtls/tool-strerror "X509 - Certificate verification failed" strerror 0x2700

# mbedtls's OWN built-in self-tests — a different harness from the ptest and a
# cheap one (0.19 s native): each module's self_test() over its published test
# vectors, in the shipped library rather than in a test binary.
check_out mbedtls/tool-selftest-pass "[ All tests PASS ]" selftest
check_out mbedtls/tool-selftest-count "Executed 30 test suites" selftest

# ------------------------------------------------- upstream's own test suite ---
# THE GATE. ptest-runner is the harness the ticket closes on. -t is set well past
# ptest-runner's 300 s DEFAULT_TIMEOUT because the whole suite is ~1000 s here; it
# bounds nothing in practice (relative timers do not fire,
# linux-in-the-browser#120), so a tight value would be an assertion about nothing.
if [ ! -x /usr/bin/ptest-runner ]; then
  bst_notok mbedtls/ptest-suite "no ptest-runner on the image -- the suite cannot be run"
else
  out=$(/usr/bin/ptest-runner -t 20000 mbedtls 2>&1)

  # Per-program verdicts, one case each, enumerated from what actually shipped so
  # a program present but unreported is distinguishable from one that is absent.
  # The id drops the shared test_suite_ prefix to keep 139 lines inside the tty's
  # line discipline.
  for f in "$t"/test_suite_*; do
    case "$f" in *.datax) continue ;; esac
    [ -x "$f" ] || continue
    b=${f##*/}
    id="mbedtls/c-${b#test_suite_}"
    case "$out" in
      *"PASS: $b"*) bst_ok "$id" ;;
      *"FAIL: $b"*) bst_notok "$id" "upstream program failed on target; the native x86_64 control passes it" ;;
      *)            bst_notok "$id" "program not reported at all -- run-ptest did not reach it" ;;
    esac
  done

  # ptest-runner's own framing, checked in addition to the loop because the two
  # fail differently: a program dropped from run-ptest's walk shows up above, a
  # harness that never ran shows up here. run-ptest exits 0 whatever the programs
  # did, so FAIL: 0 is a statement about the harness, not about the suite.
  case "$out" in
    *"TOTAL: 1 FAIL: 0"*) bst_ok mbedtls/ptest-suite ;;
    *)                    bst_notok mbedtls/ptest-suite "ptest-runner did not report TOTAL: 1 FAIL: 0" ;;
  esac
fi