privatae-bastion/docs/build.md

Build, test and fuzz

Cloning and building are in the README.

Cross-compile the way the release pipeline does:

GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-X main.clientVersion=dev" -o privatae-bastion-darwin-arm64 .

Run the tests:

go test ./...

Most parsing and judgement logic is in files with no build tag and runs under go test on any OS. Some platform parsers and the Linux sandbox are in tagged files, and their tests run only on that OS.

The walls a host's input has to get through also have fuzz targets (client-go/fuzz_*_test.go): the path sandbox for store reads and move plans, an op's declared effects and path params, service slot names, which capability family lets a pairing run an op, and every signed record and approval the bastion verifies. Each target states the property the wall exists for. go test runs their seed inputs; to let the fuzzer search for an input that breaks one, run each target for a bounded time:

deploy/fuzz.sh        # 20 seconds per target; deploy/fuzz.sh 300 for longer