mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
4c345f3ffd
Two test helpers piped a heredoc into `docker exec <container> python3 -` with no `-i`. Without it docker attaches no stdin, so `python3 -` reads an empty program, runs nothing and exits 0; `set -euo pipefail` cannot catch a success. Measured on this host at docker 29.1.3 against a live container: without the flag the program produced no output and returned 0, with it the program ran. The relay half is the serious one. The publisher it silently skipped is the malformed Kind-37195 event that phase 3 exists to inject, and the three assertions that follow hold whether or not anything was injected, so the phase has passed in all 51 archived runs without exercising the path it covers. The NAT half only makes a diagnostic vacuous, but it did real damage once: every tcpdump wrapped around the STUN probe reported 0 packets captured, and that was read as a packet leaving the node and vanishing. Adding `-i` alone is not enough. The publisher printed its completion line unconditionally, after reading the relay's reply and discarding it, so a refused event would still have satisfied a check that only looked for that line. strfry verifies the event id and the signature and answers ["OK",<id>,false,"invalid: ..."] on refusal, and a refused event is never stored and never broadcast. The publisher now parses the relay's verdict and exits non-zero on anything but an acceptance, and phase 3 reds unless the relay reports the event stored. The verdict is read by decoding the websocket frame rather than by matching a substring. NIP-01's OK is a four-element array whose message is mandatory even on success, so `,true]` never occurs in a conformant acceptance; and a 91-byte payload puts a literal '[' in the frame's length byte, so searching for the JSON finds the header. Both were found by testing the guard against frames built the way a relay builds them. Three comments are corrected while here. The publisher's header claimed the daemons log a parse error and that the content fails to deserialize; neither holds, because the `protocol` tag is checked first and the discard emits no diagnostic. The kind and `d` tag are now documented as duplicating the consumers' subscription filter, which is what makes them able to drift. Expect phase 3 to exercise the missing-protocol-tag branch for the first time. A red there is a finding rather than a regression this introduces.