mrambossekandClaude Fable 5
2521d39989
big_send now forces the Don't-Fragment bit for the whole burst by default, so the largest size that arrives IS the downstream path MTU rather than "fragments got through" — two different measurements the schema already separates. Sizes above our own egress MTU (from the startup self-test) are refused up front and reported as max_df_bytes, because absence caused by our kernel must not be read as a limit of the client's path. Uploads: one JSON file per run under the state dir, with the policy the operator actually cares about — who may upload (off / anonymous / account), how large, how long to keep, and the least anonymization accepted. The profile advertises all of it so the app can present the switch honestly instead of discovering the rules by failing. `account` refuses today rather than falling back to anonymous: picking the strict setting before OIDC lands must not silently mean the loose one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
48 lines
2.1 KiB
Bash
48 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: 2026 Echolot contributors
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
#
|
|
# Runs core-protocol's LiveServerTest against the deployed fmr server: mints an
|
|
# enrollment token over SSH (admin is localhost-only), enrolls over the public
|
|
# control plane, computes the SPKI pin from the served cert, and hands the
|
|
# whole lot to the Gradle test. Proves the Kotlin client talks to the real
|
|
# server over the wire.
|
|
#
|
|
# Usage: JAVA_HOME=... echolot-app/scripts/test-fmr.sh [gradle-task] [test-filter]
|
|
# e.g. ... test-fmr.sh :core-engine:test '*LiveGrantedTest*'
|
|
set -euo pipefail
|
|
|
|
SSH_HOST="${ECHOLOT_SSH:-claude-echolot}"
|
|
CTL_HOST="${ECHOLOT_CTL_HOST:-fmr-1.echo-lot.app}"
|
|
CTL_PORT="${ECHOLOT_CTL_PORT:-8443}"
|
|
UDP_PORT="${ECHOLOT_UDP_PORT:-8442}"
|
|
CTL_URL="https://${CTL_HOST}:${CTL_PORT}"
|
|
|
|
echo "· minting enrollment token on ${SSH_HOST} ..."
|
|
TOKEN=$(ssh -o BatchMode=yes "$SSH_HOST" \
|
|
'curl -s -X POST http://127.0.0.1:8444/admin/enroll-tokens' \
|
|
| python -c 'import json,sys;print(json.load(sys.stdin)["token"])')
|
|
|
|
echo "· enrolling over ${CTL_URL} ..."
|
|
CRED=$(curl -sk -X POST "${CTL_URL}/v1/enroll" -H "Authorization: Bearer ${TOKEN}" \
|
|
| python -c 'import json,sys;print(json.load(sys.stdin)["credential"])')
|
|
|
|
echo "· computing SPKI pin from served cert ..."
|
|
PIN=$(echo | openssl s_client -connect "${CTL_HOST}:${CTL_PORT}" 2>/dev/null \
|
|
| openssl x509 -pubkey -noout \
|
|
| openssl pkey -pubin -outform der 2>/dev/null \
|
|
| openssl dgst -sha256 -binary | openssl base64)
|
|
|
|
echo "· pin=${PIN}"
|
|
TASK="${1:-:core-protocol:test}"
|
|
FILTER="${2:-*LiveServerTest*}"
|
|
echo "· running ${TASK} ${FILTER} ..."
|
|
cd "$(dirname "$0")/.."
|
|
ECHOLOT_LIVE_URL="$CTL_URL" \
|
|
ECHOLOT_LIVE_PIN="$PIN" \
|
|
ECHOLOT_LIVE_CRED="$CRED" \
|
|
ECHOLOT_LIVE_UDP="${CTL_HOST}:${UDP_PORT}" \
|
|
ECHOLOT_LIVE_TARGET="${ECHOLOT_LIVE_TARGET:-fmr}" \
|
|
./gradlew "$TASK" --tests "$FILTER" --info --rerun-tasks --console=plain \
|
|
2>&1 | grep -E "profile:|capabilities:|session:|echo |primed|mtu probe|downtrain|big_send|largest|observations bytes|Live[A-Za-z]*Test|BUILD|FAIL|PASS|^e:" || true
|