5d51591b6d
Some checks failed
joule-moq-remote host agent / joule-moq-remote, every target (linux-arm64) (push) Has been cancelled
joule-moq-remote host agent / joule-moq-remote, every target (macos) (push) Has been cancelled
joule-moq-room room service / joule-moq-room, every target (push) Has been cancelled
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (push) Has been cancelled
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Has been cancelled
wai-app and Create / wai-app · tests, clippy, the line language's verifier (linux) (push) Has been cancelled
wai-app and Create / wai-app · Create, browser end-to-end (macos) (push) Has been cancelled
wai-audit collector and player integration / collector · linux (push) Has been cancelled
wai-audit collector and player integration / collector, player integration and the browser end to end · macos (push) Has been cancelled
WAI operation catalogue / the catalogue and every door · linux (push) Has been cancelled
wai-fleet service / service · linux (push) Has been cancelled
wai-fleet service / service · macos (push) Has been cancelled
wai-key-proxy / proxy · linux (push) Has been cancelled
wai-ledger service / does this change touch it (push) Has been cancelled
wai-ledger service / service · linux (push) Has been cancelled
wai-ledger service / service · macos (push) Has been cancelled
wai-quantum for JavaScript / does this change touch it (push) Has been cancelled
wai-quantum for JavaScript / javascript · linux (push) Has been cancelled
wai-quantum energy-landscape jobs / does this change touch it (push) Has been cancelled
wai-quantum energy-landscape jobs / reader, kernels, answers and the stated result · linux, release (push) Has been cancelled
wai-quantum energy-landscape jobs / the same bits · linux-arm64 (push) Has been cancelled
wai-quantum energy-landscape jobs / the same bits · macos (push) Has been cancelled
wai-quantum energy-landscape jobs / the module under wasm32-wasip2 (wasmtime) (push) Has been cancelled
wai-quantum energy-landscape jobs / native against WebAssembly, over many seeds (push) Has been cancelled
wai-quantum studio and desktop / does this change touch it (push) Has been cancelled
wai-quantum studio and desktop / studio · browser (push) Has been cancelled
wai-quantum studio and desktop / desktop app · macos (push) Has been cancelled
wai-quantum studio and desktop / desktop app · linux (push) Has been cancelled
wai-quantum studio and desktop / desktop app · windows (push) Has been cancelled
wai-sink-android native sink library / does this change touch it (push) Has been cancelled
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (push) Has been cancelled
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (push) Has been cancelled
wai-sink-swift native sink package / does this change touch it (push) Has been cancelled
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (push) Has been cancelled
WAI Studio / does this change touch it (push) Has been cancelled
WAI Studio / the catalogue's actions, the unit tests and the core · linux (push) Has been cancelled
WAI Studio / Studio in Chromium and Firefox · macos (push) Has been cancelled
WAI Studio / Studio in WebKit · linux (push) Has been cancelled
joule-moq-remote host agent / joule-moq-remote · does this change touch it (push) Has been cancelled
wai-app and Create / wai-app · does this change touch it (push) Has been cancelled
wai-audit collector and player integration / does this change touch it (push) Has been cancelled
WAI operation catalogue / does this change touch it (push) Has been cancelled
joule-moq-room room service / joule-moq-room · does this change touch it (push) Has been cancelled
wai-key-proxy / does this change touch it (push) Has been cancelled
joule-moq-web browser client / joule-moq-web · does this change touch it (push) Has been cancelled
wai-fleet service / does this change touch it (push) Has been cancelled
joule-code conformance gate / joule-moq-relay, its own energy on a counter (macos) (push) Successful in 51s
joule-code conformance gate / Build + round-trip C1-C4 vectors (push) Has been cancelled
joule-code conformance gate / joule-moq-relay, every target (push) Has been cancelled
joule-code conformance gate / joule-moq-ingest, every target (push) Has been cancelled
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 18s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 1m44s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Successful in 6m32s
- relay, a kind of its own, with the suite moqt in the live area: the new corpus moqt-conformance/cases.json lists the eight interop test cases and wai-receipts, each with the drafts it is a test at, so a record names its corpus by digest. joule-moq-interop runs each case against the relay's moqt:// or https:// URL at --draft 22, 18 or 16, and its TAP version 14 is read as the cases: ok passes; not ok, TODO, no point, exit 127 or a timeout fails; a skip passes only at a draft the case lists no test for. The client is found as wai dev finds its daemons (WAI_MOQ_INTEROP_BIN, beside wai, PATH). The record's adapter is command, its impl the client's command line with the URL and draft, its files the client. - joule-moq-interop closes every session's endpoint and waits it idle after each test: run a test a process, it exited before the CONNECTION_CLOSE left, the relay kept the dead publisher's namespace, and subscribe-before-announce and announce-subscribe failed against wai-relay at every draft. Now every case passes at 22, 18 and 16 over QUIC and at 22 over WebTransport. - verifier pq: pq-conformance case by case, each case given as the corpus with it alone; its independent verifier pq_verify.py now has its verdicts file in its # independent: line. - wai conformance gen --suite <corpus>[,...] [--verify] [--bin-dir <dir>] (conformance.generate, maintainer toolset): build.rs reads .github/wai-conformance/corpora/*.txt into the table of generators, and a corpus file whose dir: names no corpus, or whose bin: is no [[bin]] of wai-rs, fails the build. The files gain gen: where a tool's generator is not its gen mode (pin, staged-measure; oer: none). One cargo build serves every tool a run names. - wai-breaking.yml runs the new tests with pq_signatures, pq_verify.py through wai conform beside the claim, JWP and signer verifiers, and the reference relay at each draft, every record admitted. Co-Authored-By: Claude Opus 5.5 <[email protected]>
32 lines
2.2 KiB
Shell
32 lines
2.2 KiB
Shell
# step: hybrid signatures · wai-rs and pq_verify.py
|
|
# order: 710
|
|
# build: pq
|
|
# features: pq_signatures synthesis,pq_signatures
|
|
# paths: wai/extensions/pq-signatures.md
|
|
# independent: pq trust needs=cryptography verdicts=pq-conformance/vectors.json python3 -I pq-conformance/pq_verify.py pq-conformance
|
|
#
|
|
# Hybrid signatures (extensions/pq-signatures.md): the reference module's unit tests (its
|
|
# ML-DSA-65 against FIPS 204's ACVP vectors — keyGen, deterministic sigGen and sigVer —
|
|
# vendored in pq-conformance/acvp and pinned by SHA-256, and the composite against the
|
|
# draft's own vector, before anything is built on them), the synthesis reader's hybrid
|
|
# records, and tests/pq_signatures.rs (vectors.json regenerates byte for byte, every case
|
|
# reaches its verdict, §8 lists exactly the reference's codes, each given); and, in the
|
|
# step of every independent verifier above, the
|
|
# corpus's second implementation, pq_verify.py, written from the extension's text and
|
|
# sharing no code with wai-rs, which verifies ML-DSA-65 from FIPS 204's text in pure
|
|
# Python (_mldsa.py), checks every ACVP verification vector and signature and the draft's
|
|
# vector, every case, the sizes §9 states and §8's table, requires every mutated case to be
|
|
# refused and the corpus to catch it with any one of its checks dropped; run isolated (-I).
|
|
# Last, the two give every case the same verdict.
|
|
#
|
|
# The paths this step brings to the workflow's trigger, and why:
|
|
# wai/extensions/pq-signatures.md: tests/pq_signatures.rs requires this extension's §8 to list the
|
|
# codes the reference reports, pq_verify.py reads that table, and the registry's wire
|
|
# identifiers test reads its §2.
|
|
set -euo pipefail
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib pq_sig::)
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib synthesis::pq_tests)
|
|
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --test pq_signatures)
|
|
python3 -I pq-conformance/pq_verify.py verdicts pq-conformance/vectors.json > "$RUNNER_TEMP/pq-py.tsv"
|
|
(cd wai-rs && "$RUNNER_TEMP/wai-bins/pq/wai_pq_vectors" verdicts ../pq-conformance/vectors.json) > "$RUNNER_TEMP/pq-rs.tsv"
|
|
diff "$RUNNER_TEMP/pq-py.tsv" "$RUNNER_TEMP/pq-rs.tsv"
|