From d822ee8b3c1745d2257443b121a637ce6a4471db Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Sun, 3 May 2026 18:21:25 +0000
Subject: [PATCH] Validate packaging/common/fips.nft syntax in CI build phase

Add nft -c -f packaging/common/fips.nft syntax-check to both
testing/ci-local.sh and .github/workflows/ci.yml so a regression in
the 128-line firewall ruleset surfaces in the build gate rather than
when an operator activates fips-firewall.service.

testing/ci-local.sh: first step inside run_build(), before
cargo build --release. Uses command -v nft for prereq detection
mirroring the existing cargo-nextest pattern; records as nft-syntax
in RESULTS. Operator-facing message points at apt install nftables
when nft is absent.

.github/workflows/ci.yml: nftables added to the build job's existing
Linux apt-install step; new Validate fips.nft syntax (Linux only)
step gated on runner.os == 'Linux' (skips macOS/Windows matrix
slots, runs on ubuntu-latest and ubuntu-24.04-arm).

Note: nft -c -f requires netlink cache initialization on modern
nftables even in check mode, so both invocations use sudo (safe in
CI's passwordless sudo, and operator's typical local sudo). Without
sudo, nft fails with "cache initialization failed: Operation not
permitted" before reaching ruleset parse.
---
 .github/workflows/ci.yml |  6 +++++-
 testing/ci-local.sh      | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a797fdd..de14352 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,7 +87,11 @@ jobs:
 
       - name: Install system dependencies (Linux only)
         if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev nftables
+
+      - name: Validate fips.nft syntax (Linux only)
+        if: runner.os == 'Linux'
+        run: sudo nft -c -f packaging/common/fips.nft
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/testing/ci-local.sh b/testing/ci-local.sh
index 47d3b37..bbc6176 100755
--- a/testing/ci-local.sh
+++ b/testing/ci-local.sh
@@ -177,6 +177,20 @@ record() {
 run_build() {
     stage "Stage 1: Build"
 
+    info "sudo nft -c -f packaging/common/fips.nft (nftables ruleset syntax check)"
+    if command -v nft &>/dev/null; then
+        if sudo nft -c -f packaging/common/fips.nft 2>&1; then
+            record "nft-syntax" 0
+        else
+            record "nft-syntax" 1
+            return 1
+        fi
+    else
+        info "nftables not installed; install with 'apt install nftables' to validate fips.nft"
+        record "nft-syntax" 1
+        return 1
+    fi
+
     info "cargo build --release"
     if cargo build --release 2>&1; then
         record "build" 0