tsunagiandClaude Opus 5
ea7aaa2b69
The first IP plugin, built on the data plane boundary the core already had. Plugin: - one X25519 key per network in the plugin's own wireguard.sqlite, separate from the iroh identity and from the network secret; a damaged store is an error, never a silently regenerated identity - deterministic IPv6 ULA overlay: every member derives the same /64 from the network id and its own /128 from its WireGuard public key, so no coordinator allocates addresses - AllowedIPs are derived locally, never taken from a peer's announcement, so a member cannot claim another member's overlay address; a mismatched claim is rejected - bounded, versioned, validated announcement carried as the existing opaque capability payload, which the core still never parses - each agent builds its own full-mesh configuration (N-1 peers) and reconciles on every change and on a timer, repairing drift - WireguardBackend abstraction: RecordingBackend in memory, and WgToolBackend driving real wg/ip on Linux, split into a pure planner plus parsers and a thin executor so everything interesting is testable without root Core, three generic additions the plugin needed: - IpPlugin::on_network_activated, so per-network state is ready before peers - PluginContext for re-announcements and error reports from plugin tasks, with errors counted by the owning network runtime - IpPlugin::shutdown, awaited with a grace period, so system objects go away 94 tests pass offline with no privileges: 35 new WireGuard unit tests and 12 integration tests over real iroh connections. The real wg/ip backend needs root and is behind --ignored in tests/wireguard_system.rs; it was not run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
79 lines
2.3 KiB
YAML
79 lines
2.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
RUSTFLAGS: -D warnings
|
|
# The default test set must not need the internet, a DHT, a public relay,
|
|
# administrator rights or changes to OS network settings.
|
|
RUST_BACKTRACE: 1
|
|
|
|
jobs:
|
|
check:
|
|
name: fmt + clippy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --locked --workspace --all-targets -- -D warnings
|
|
|
|
test:
|
|
name: test (${{ matrix.os }})
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo test --locked --workspace --all-targets
|
|
- name: run the examples
|
|
run: |
|
|
cargo run --locked --example two_agents
|
|
cargo run --locked --example wireguard_mesh
|
|
|
|
# The real wg/ip backend changes the host's network and needs
|
|
# CAP_NET_ADMIN, so it is never part of the default job above. It is run on
|
|
# demand only.
|
|
wireguard-system:
|
|
name: wireguard system backend (opt-in)
|
|
if: github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: sudo apt-get update && sudo apt-get install -y wireguard-tools
|
|
- run: sudo -E $(which cargo) test --locked --test wireguard_system -- --ignored --test-threads=1
|
|
|
|
docs:
|
|
name: rustdoc
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo doc --locked --workspace --no-deps
|
|
env:
|
|
RUSTDOCFLAGS: -D warnings
|
|
|
|
msrv:
|
|
name: minimum supported Rust version
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@1.91.0
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo check --locked --workspace --all-targets
|