[GH-ISSUE #2419] test(ghidra): derive ELF probe sizes from fixture bytes to repair latest-main CI #811

New issue

Closed

opened 2026-10-15 18:28:41 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:41 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2419

Originally assigned to: @N0zoM1z0 on GitHub.

The latest main CI is failing three deterministic Ghidra native-decompiler admission tests because their ELF64 probe fixtures contain 64 bytes but report a total file size of 52 bytes. This is test-data drift after the shared ELF fixed-header validator was strengthened, rather than evidence that valid foreign executables are now accepted.

Evidence and reproduction

Baseline: c462a4ebd3a10e59253bcf38353a0914b176738b.

Main CI: https://github.com/morluto/rea/actions/runs/38326444005
Linux shard 4/6 and the Windows capability/package lane fail the same three cases in src/ghidra/GhidraInstallation.test.ts.
The merged Linux report contains 1,002 test files and 10,309 cases: 10,214 passed, 3 failed, 92 skipped. These are the only failing cases in that report.
Fresh local install with repository-pinned Node 24.18.0, followed by npm run test:local -- src/ghidra/GhidraInstallation.test.ts, reproduces exactly 3 failures and 42 passes in about half a second.

Affected assertions:

Reject a Linux x86-64 ELF decompiler placed at the macOS arm64 path.
Explain a matching Linux x86-64 decompiler using its observed executable header.
Name the observed foreign executable format and required host format in the refusal.

Root cause and ownership

src/domain/binaryTarget.fixture.ts::elf(2, 1, 62) now produces a complete 64-byte ELF64 fixed header with valid identification/header versions and e_ehsize. The three Ghidra test seams still return { bytes: elf(2, 1, 62), size: 52 }.

src/domain/elfFixedHeader.ts::readElfFixedHeader correctly rejects totalBytes < bytes.length and ELF64 images smaller than 64 bytes. The production Ghidra probe obtains bytes and total size from the same opened file. Malformed or unreadable headers deliberately remain unknown in optional installation diagnosis; only an established incompatible format is rejected. Consequently these inconsistent mock observations cannot substantiate the incompatibility assertions.

The ELF32 case also hard-codes 52. It currently passes but duplicates the same size assumption and should share the corrected fixture boundary.

Proposed correction

Build each ELF probe observation from one byte buffer and derive size from that buffer. Preserve all admission/refusal assertions and production validation. Inspect related fixture consumers for equivalent mismatches; retain explicit malformed-header coverage rather than weakening the validator or treating unknown as established compatibility.

Acceptance criteria

The original Ghidra file passes all existing cases with coherent ELF32 and ELF64 observations.
Shared executable-format tests still reject malformed/truncated fixed headers and recognize valid headers.
Fresh complete Linux coverage suite, static checks, test discovery, LLDB producer contracts, and documentation checks pass.
Ready-for-review PR CI verifies Linux shards and the Windows curated lane before merge.

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2419 Originally assigned to: @N0zoM1z0 on GitHub. The latest main CI is failing three deterministic Ghidra native-decompiler admission tests because their ELF64 probe fixtures contain 64 bytes but report a total file size of 52 bytes. This is test-data drift after the shared ELF fixed-header validator was strengthened, rather than evidence that valid foreign executables are now accepted. ## Evidence and reproduction Baseline: `c462a4ebd3a10e59253bcf38353a0914b176738b`. - Main CI: https://github.com/morluto/rea/actions/runs/38326444005 - Linux shard 4/6 and the Windows capability/package lane fail the same three cases in `src/ghidra/GhidraInstallation.test.ts`. - The merged Linux report contains 1,002 test files and 10,309 cases: 10,214 passed, 3 failed, 92 skipped. These are the only failing cases in that report. - Fresh local install with repository-pinned Node 24.18.0, followed by `npm run test:local -- src/ghidra/GhidraInstallation.test.ts`, reproduces exactly 3 failures and 42 passes in about half a second. Affected assertions: 1. Reject a Linux x86-64 ELF decompiler placed at the macOS arm64 path. 2. Explain a matching Linux x86-64 decompiler using its observed executable header. 3. Name the observed foreign executable format and required host format in the refusal. ## Root cause and ownership `src/domain/binaryTarget.fixture.ts::elf(2, 1, 62)` now produces a complete 64-byte ELF64 fixed header with valid identification/header versions and `e_ehsize`. The three Ghidra test seams still return `{ bytes: elf(2, 1, 62), size: 52 }`. `src/domain/elfFixedHeader.ts::readElfFixedHeader` correctly rejects `totalBytes < bytes.length` and ELF64 images smaller than 64 bytes. The production Ghidra probe obtains bytes and total size from the same opened file. Malformed or unreadable headers deliberately remain unknown in optional installation diagnosis; only an established incompatible format is rejected. Consequently these inconsistent mock observations cannot substantiate the incompatibility assertions. The ELF32 case also hard-codes 52. It currently passes but duplicates the same size assumption and should share the corrected fixture boundary. ## Proposed correction Build each ELF probe observation from one byte buffer and derive `size` from that buffer. Preserve all admission/refusal assertions and production validation. Inspect related fixture consumers for equivalent mismatches; retain explicit malformed-header coverage rather than weakening the validator or treating unknown as established compatibility. ## Acceptance criteria - The original Ghidra file passes all existing cases with coherent ELF32 and ELF64 observations. - Shared executable-format tests still reject malformed/truncated fixed headers and recognize valid headers. - Fresh complete Linux coverage suite, static checks, test discovery, LLDB producer contracts, and documentation checks pass. - Ready-for-review PR CI verifies Linux shards and the Windows curated lane before merge.

bsakaguchi

2026-10-15 18:28:41 +00:00

closed this issue
added the
area: tests
label

bsakaguchi commented

2026-10-15 18:28:42 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 13, 2026):

Superseded by the fix already merged in #2324 as 37b7550ecc916acc8619fa72e5c05af45702733f while this latest-main audit was running. The new main uses a typed headerProbe(bytes) helper that derives size from the buffer for ELF and other complete-file probes. I inspected the resulting source and independently reran the new-main Ghidra installation suite: all 45 cases pass with the original admission/refusal assertions intact.

Our duplicate PR's final commit f620dbb14099327e07b99997e68d2cc931f3c47d also completed CI successfully: all 21 selected jobs passed, 15 unrelated lanes were skipped, and the Linux coverage report contains 1,002 files / 10,309 cases (10,217 passed, 92 skipped, zero failures). Windows curated and package checks passed as well. No second merge is necessary; closing this duplicate PR and the issue as resolved by #2324.

The audit continues on new main, including its fresh full CI run: https://github.com/morluto/rea/actions/runs/38328721720. The original local full-coverage run remains pinned to the earlier base and will be reported separately from latest-main evidence.

@N0zoM1z0 commented on GitHub (Oct 13, 2026): Superseded by the fix already merged in #2324 as `37b7550ecc916acc8619fa72e5c05af45702733f` while this latest-main audit was running. The new main uses a typed `headerProbe(bytes)` helper that derives `size` from the buffer for ELF and other complete-file probes. I inspected the resulting source and independently reran the new-main Ghidra installation suite: all 45 cases pass with the original admission/refusal assertions intact. Our duplicate PR's final commit `f620dbb14099327e07b99997e68d2cc931f3c47d` also completed CI successfully: all 21 selected jobs passed, 15 unrelated lanes were skipped, and the Linux coverage report contains 1,002 files / 10,309 cases (10,217 passed, 92 skipped, zero failures). Windows curated and package checks passed as well. No second merge is necessary; closing this duplicate PR and the issue as resolved by #2324. The audit continues on new main, including its fresh full CI run: https://github.com/morluto/rea/actions/runs/38328721720. The original local full-coverage run remains pinned to the earlier base and will be reported separately from latest-main evidence.

bsakaguchi referenced this issue

2026-10-16 21:02:34 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:16:23 +00:00

[PR #811] [MERGED] fix(browser): identify NodeNext TypeScript original source artifacts #2258

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #815] [MERGED] fix: integrate 24 reviewed browser/native/semantics corrections #2262