From 934704d7843bbdd90dc2794145172db8334ca145 Mon Sep 17 00:00:00 2001 From: Paul Hitt Date: Sun, 6 Sep 2026 15:20:24 -0400 Subject: [PATCH] Fetch the protocol vectors in CI, which never had them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Turning off the build cache exposed twenty failures that had been there all along: AccountKdfTest, PQVectorTest and PublishedVectorsTest look for a sibling `flamenet-e2e` checkout. That exists on a developer's machine and has never existed in a build directory, so every one of them has been failing in CI since it was written — and CI reported green, because the cache was replaying passes computed here. These are the cross-implementation conformance tests. They are what says this engine derives the same keys as the one iPhone runs; twenty of them silently not running is the worst possible thing to find in the suite that guarantees the two platforms can talk. They fail rather than skip when the file is missing — deliberately, exactly so this could not hide. It still hid, one layer up, in a cache. `flamenet-e2e` is public, so the job shallow-clones it and points the three environment variables at the result. The paths are checked before the suite runs: a variable pointing at nothing would put the tests back where they were, and the failure would read as a protocol bug rather than a missing file. Cloned at its tip rather than pinned. The vectors are normative and shared with iOS, so if the published protocol changes this suite SHOULD go red without a commit here — that is a real divergence, not a stale pin. Verified the variables are actually honoured, rather than assuming: with one pointed at an empty JSON file the test reddens even though the sibling checkout is present. 539 engine tests pass against the cloned vectors. Co-Authored-By: Claude Opus 5 --- .gitlab-ci.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index f055931..b03b548 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -22,6 +22,31 @@ unit-tests: script: - export JAVA_HOME=/opt/homebrew/opt/openjdk@21 - export ANDROID_HOME=$HOME/Library/Android/sdk + # 🔴 **The protocol vectors are not in this repo, and CI never had them.** + # `AccountKdfTest`, `PQVectorTest` and `PublishedVectorsTest` look for a + # sibling `flamenet-e2e` checkout. That exists on a developer's machine and + # has never existed in a build directory, so all twenty of them have been + # failing here since they were written — invisibly, because the build cache + # replayed a local pass. They fail rather than skip when the file is + # missing, exactly so this could not hide; it took `--rerun-tasks` to let + # them say so. + # + # ⚠️ Cloned at its tip rather than pinned. These vectors are normative and + # shared with iOS: if the published protocol changes, this suite SHOULD go + # red without a commit here, because that is a real divergence and not a + # stale pin. `flamenet-e2e` is public, so no credentials are needed. + - rm -rf "$CI_PROJECT_DIR/.ci-vectors" + - git clone --depth 1 https://gitlab.com/paulhitt/flamenet-e2e.git "$CI_PROJECT_DIR/.ci-vectors" + - export FLAMENET_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/protocol-v1.json" + - export FLAMENET_PQ_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/pqx3dh-v2.json" + - export FLAMENET_ACCOUNT_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/account-kdf-v1.json" + # ⚠️ Checked before the suite runs. A path that silently does not exist puts + # the tests straight back where they were, and the failure would read as a + # protocol bug rather than a missing file. + - | + for f in "$FLAMENET_VECTORS" "$FLAMENET_PQ_VECTORS" "$FLAMENET_ACCOUNT_VECTORS"; do + [ -f "$f" ] || { echo "GATE: vector file missing: $f"; exit 1; } + done # 🔴 **Clear old results before running, or the gate counts ghosts.** The # runner reuses its build directory, so XML from a previous pipeline # survives — and a suite that stopped running entirely would still be