nx_trust_store_load_from_certdata_e2e_test.nx
buildroot/runtime/nx_trust_store_load_from_certdata_e2e_test.nx
about
nx_trust_store_load_from_certdata_e2e_test.nx -- REAL
END-TO-END happy-path KAT for the boot-time loader.
Unlike the verdict-only sibling test, this one exercises the
FULL composed pipeline against a real on-disk file:
1. Build a real 169-byte minimal Ed25519 v1 DER cert in memory
2. Wrap it in Mozilla NSS certdata.txt PKCS#11 text format
with proper \NNN multiline-octal escape encoding of the DER
3. Write the certdata.txt content to a real temp file via
sys_openat_wr + sys_write
4. Call nx_trust_store_load_from_certdata against the path
5. Verify the returned *TrustStore has the cert populated
Stands as evidence against [[feedback-no-false-ok-substrate-
honesty-audit]] -- the verdict-only smoke shipped earlier only
hit error paths and could not have detected a bug in the happy-
path composition. This test would catch a bug ANYWHERE in:
sys_read_file
-> nx_nss_certdata_parse (octal escape decoder, state machine)
-> trust_store_alloc
-> nx_x509_trust_store_load (wire-format walker + x509_parse +
trust_store_add)
expect_exit: 0
license_tier: ORIGINAL
dependencies 4 imports · 0 importers
imports: nx_syscalls.nxnx_x509.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 35 | func emit_ed25519_algid(buf: *u8, off: i64) -> i64 called by 1: build_min_v1_cert |
| 46 | func emit_utctime(buf: *u8, off: i64, called by 1: build_min_v1_cert |
| 68 | func build_min_v1_cert(buf: *u8, off: i64, serial_byte: i64) -> i64 |
| 113 | func emit_bytes(buf: *u8, off: i64, src: *u8, n: i64) -> i64 called by 1: main |
| 125 | func emit_octal_escape(buf: *u8, off: i64, b: i64) -> i64 called by 1: main |
| 137 | func emit_u8(buf: *u8, off: i64, b: i64) -> i64 called by 1: main |
| 142 | func main() -> i64 |