From fa49dc1210f039d068986046855b25c3ac137c30 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Sun, 26 Jul 2026 13:54:14 +0000 Subject: [PATCH] Retire the mesh-public static test topology The mesh-public profile ran in neither runner: ci-local's static suite list carries only static-mesh and static-chain, and the GitHub matrix has only mesh and chain. It also added no coverage over static-mesh. ping-test.sh and iperf-test.sh branched mesh and mesh-public together and exercised the same 20 directed pairs among node-a through node-e, and no script referenced the external node at all. The convergence waits even used mesh's peer counts rather than mesh-public's, so the extra link to the public node was never counted, let alone asserted. Running it would therefore have added a dependency on a live internet host (test-us01.fips.network) in exchange for zero additional assertions. Remove the topology, its five compose services, the script branches that aliased it to mesh, and the documentation rows. An invocation using the old profile name now fails on ping-test.sh's unknown-profile guard instead of silently behaving as mesh. The config generator's external-node support (external_ip, is_external_node) stays. It has no consumer now, but it is woven into the config path every remaining topology uses, so removing it would put the gating suites at risk for no present gain. --- testing/README.md | 1 - testing/static/README.md | 5 +- .../configs/topologies/mesh-public.yaml | 51 ----------------- testing/static/docker-compose.yml | 56 ------------------- testing/static/scripts/bench-multirun.sh | 2 +- testing/static/scripts/generate-configs.sh | 2 +- testing/static/scripts/iperf-test.sh | 4 +- testing/static/scripts/ping-test.sh | 6 +- 8 files changed, 8 insertions(+), 119 deletions(-) delete mode 100644 testing/static/configs/topologies/mesh-public.yaml diff --git a/testing/README.md b/testing/README.md index 6933a43..bd1ba48 100644 --- a/testing/README.md +++ b/testing/README.md @@ -16,7 +16,6 @@ configurations. | ----------- | ----- | --------- | -------------------------------- | | mesh | 5 | UDP | Sparse mesh, 6 links, multi-hop | | chain | 5 | UDP | Linear chain, max 4-hop paths | -| mesh-public | 5+1 | UDP | Mesh with external public node | | tcp-chain | 3 | TCP | Linear chain over TCP (port 8443) | | rekey | 5 | UDP | Rekey integration test topology | diff --git a/testing/static/README.md b/testing/static/README.md index bde3f05..27980ed 100644 --- a/testing/static/README.md +++ b/testing/static/README.md @@ -119,15 +119,12 @@ testing/static/ │ └── topologies/ │ ├── mesh.yaml # Mesh topology definition │ ├── chain.yaml # Chain topology definition -│ ├── mesh-public.yaml # Mesh + external public node │ ├── tcp-chain.yaml # TCP chain (3 nodes, port 8443) │ └── rekey.yaml # Rekey integration test (5 nodes) ├── generated-configs/ # Auto-generated, run-scoped (gitignored) │ ├── npubs.env # NPUB_A=..., NPUB_B=..., etc. │ ├── mesh/ │ │ ├── node-a.yaml ... node-e.yaml -│ ├── mesh-public/ -│ │ ├── node-a.yaml ... node-e.yaml │ ├── chain/ │ │ ├── node-a.yaml ... node-e.yaml │ └── tcp-chain/ @@ -219,7 +216,7 @@ each mesh needs unique node identities to avoid key conflicts. The optional # Or generate configs directly ./testing/static/scripts/generate-configs.sh mesh my-mesh-1 -./testing/static/scripts/generate-configs.sh mesh-public my-mesh-1 +./testing/static/scripts/generate-configs.sh chain my-mesh-1 ``` ### How It Works diff --git a/testing/static/configs/topologies/mesh-public.yaml b/testing/static/configs/topologies/mesh-public.yaml deleted file mode 100644 index 1630241..0000000 --- a/testing/static/configs/topologies/mesh-public.yaml +++ /dev/null @@ -1,51 +0,0 @@ -# Mesh Topology Definition -# -# Five nodes with 6 bidirectional UDP links forming a sparse, fully connected -# graph. Not all nodes are direct peers — non-adjacent pairs require -# discovery-driven multi-hop routing to establish end-to-end sessions. - -nodes: - a: - nsec: "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20" - npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m" - docker_ip: "172.20.0.10" - peers: [d, e, pub] - - b: - nsec: "b102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fb0" - npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le" - docker_ip: "172.20.0.11" - peers: [c, pub] - - c: - nsec: "c102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fc0" - npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6" - docker_ip: "172.20.0.12" - peers: [b, d, e, pub] - - d: - nsec: "d102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fd0" - npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl" - docker_ip: "172.20.0.13" - peers: [a, c, e] - - e: - nsec: "e102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fe0" - npub: "npub1wf8akf8lu2zdkjkmwhl75pqvven654mpv4sz2x2tprl5265mgrzq8nhak4" - docker_ip: "172.20.0.14" - peers: [a, c, d] - - # External/public node (not a Docker container) - pub: - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98" - external_ip: "test-us01.fips.network" - peers: [a, b, c] - -# Spanning Tree Structure (rooted at node A): -# - A — D (tree edge, D's parent is A) -# - A — E (tree edge, E's parent is A) -# - C — D (tree edge, C's parent is D) -# - B — C (tree edge, B's parent is C) -# - D — E (non-tree link) -# - C — E (non-tree link) - diff --git a/testing/static/docker-compose.yml b/testing/static/docker-compose.yml index 602c037..74b7912 100644 --- a/testing/static/docker-compose.yml +++ b/testing/static/docker-compose.yml @@ -98,62 +98,6 @@ services: networks: fips-net: - # ── Mesh-public topology (mesh + external public node) ──────── - pub-a: - <<: *fips-common - profiles: ["mesh-public"] - container_name: fips-node-a${FIPS_CI_NAME_SUFFIX:-} - hostname: node-a - volumes: - - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro - networks: - fips-net: - - pub-b: - <<: *fips-common - profiles: ["mesh-public"] - container_name: fips-node-b${FIPS_CI_NAME_SUFFIX:-} - hostname: node-b - volumes: - - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro - networks: - fips-net: - - pub-c: - <<: *fips-common - profiles: ["mesh-public"] - container_name: fips-node-c${FIPS_CI_NAME_SUFFIX:-} - hostname: node-c - volumes: - - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro - networks: - fips-net: - - pub-d: - <<: *fips-common - profiles: ["mesh-public"] - container_name: fips-node-d${FIPS_CI_NAME_SUFFIX:-} - hostname: node-d - volumes: - - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro - networks: - fips-net: - - pub-e: - <<: *fips-common - profiles: ["mesh-public"] - container_name: fips-node-e${FIPS_CI_NAME_SUFFIX:-} - hostname: node-e - volumes: - - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro - networks: - fips-net: - # ── Chain topology (A-B-C-D-E) ──────────────────────────────── chain-a: <<: *fips-common diff --git a/testing/static/scripts/bench-multirun.sh b/testing/static/scripts/bench-multirun.sh index d2a138b..a96186a 100755 --- a/testing/static/scripts/bench-multirun.sh +++ b/testing/static/scripts/bench-multirun.sh @@ -137,7 +137,7 @@ ping_path() { # steady state, which is what real-world FIPS deployments see. To # force on-wire multihop, isolate nodes on distinct docker networks. case "$PROFILE" in - mesh|mesh-public) + mesh) # Static-peer paths only — without mDNS / a Nostr relay in the # test container set, non-adjacent pairs (A↔B, A↔C) can't # establish direct UDP and the bench would either fail diff --git a/testing/static/scripts/generate-configs.sh b/testing/static/scripts/generate-configs.sh index 529ec12..696a432 100755 --- a/testing/static/scripts/generate-configs.sh +++ b/testing/static/scripts/generate-configs.sh @@ -2,7 +2,7 @@ # Generate FIPS node configuration files from template and topology definition. # # Usage: ./generate-configs.sh [mesh-name] -# topology: mesh, mesh-public, chain, etc. +# topology: mesh, chain, etc. # mesh-name: optional; when given, docker node identities are derived # deterministically via sha256(mesh-name|node-id) diff --git a/testing/static/scripts/iperf-test.sh b/testing/static/scripts/iperf-test.sh index 124803e..9cf30ad 100755 --- a/testing/static/scripts/iperf-test.sh +++ b/testing/static/scripts/iperf-test.sh @@ -89,7 +89,7 @@ echo "" # nodes — labels DO NOT encode hop count, since peer discovery # converges every same-subnet pair onto a direct UDP path within a # few ticks regardless of the static `peers:` list. -if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then +if [ "$PROFILE" = "mesh" ]; then echo "Topology (static \`peers:\` from mesh.yaml):" echo " A peers with: D, E" echo " B peers with: C" @@ -109,7 +109,7 @@ echo "" echo "Waiting ${SETTLE_SECONDS}s for mesh convergence..." sleep "$SETTLE_SECONDS" -if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then +if [ "$PROFILE" = "mesh" ]; then echo "" echo "Testing mesh topology paths:" iperf_test node-d node-a "$NPUB_D" "A→D" diff --git a/testing/static/scripts/ping-test.sh b/testing/static/scripts/ping-test.sh index fb6069c..2c2e383 100755 --- a/testing/static/scripts/ping-test.sh +++ b/testing/static/scripts/ping-test.sh @@ -93,7 +93,7 @@ if [ "$PROFILE" = "chain" ]; then wait_for_peers fips-node-c${FIPS_CI_NAME_SUFFIX:-} 2 20 || true wait_for_peers fips-node-d${FIPS_CI_NAME_SUFFIX:-} 2 20 || true wait_for_peers fips-node-e${FIPS_CI_NAME_SUFFIX:-} 1 20 || true -elif [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then +elif [ "$PROFILE" = "mesh" ]; then # Mesh: check all nodes reach their configured peer counts wait_for_peers fips-node-a${FIPS_CI_NAME_SUFFIX:-} 2 20 || true wait_for_peers fips-node-b${FIPS_CI_NAME_SUFFIX:-} 1 20 || true @@ -105,7 +105,7 @@ else # section below is guarded by these same profile names, so the script # ran no assertion at all and exited 0. A typo in the caller's profile # argument produced a green run that tested nothing. - echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh, mesh-public)" >&2 + echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh)" >&2 exit 2 fi # Wait for full pairwise connectivity, progress-aware: the actual pings @@ -119,7 +119,7 @@ wait_until_connected ping_all_quiet 45 15 || true PASSED=0 FAILED=0 -if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then +if [ "$PROFILE" = "mesh" ]; then # Sparse mesh topology: A-B, B-C, C-D, D-E, E-A, A-D # Test all 20 directed pairs (5 nodes × 4 targets each) echo ""