-
Notifications
You must be signed in to change notification settings - Fork 15
refactor(tests): adding KMS test material generator with isolated tests infrastructure #270
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
4054c6c to
8b35898
Compare
Consolidated Tests Results 2025-11-27 - 07:36:15Test ResultsDetails
Failed Testskms test-reporter: Run #1501
❌ Some tests failed!
TestsView All Tests
🍂 No flaky tests in this run. Github Test Reporter by CTRF 💚 🔄 This comment has been updated |
9e041b2 to
61e950c
Compare
|
I temporarily triggered nightly k8s tests in chore(ci): temporary enable k8s tests which will be reverted once I see that these tests successfully executed within this PR |
This reverts commit be3de6b.
07acfb9 to
bbaf58e
Compare
bbaf58e to
8618b88
Compare
Description of changes
This PR replaces Docker Compose-based integration tests with native isolated tests that run directly without Docker, improving test speed, reliability, and developer experience.
What Changed
Test Migration - Complete List
Migrates all Docker-based tests to native isolated execution:
1. Core Service Library Tests (
core/service/src/client/tests/)Centralized Isolated Tests (5 tests):
test_central_health_endpoint_availability_isolated- Health endpoint verificationtest_central_close_after_drop_isolated- Server shutdown on droptest_largecipher_isolated- Large ciphertext handling (slow_tests)test_insecure_central_dkg_backup_isolated- DKG backup/restoretest_insecure_central_autobackup_after_deletion_isolated- Auto-backup after deletionThreshold Isolated Tests (14 tests):
test_insecure_dkg_isolated- Insecure DKG with Test params (4 parties)default_insecure_dkg_isolated- Insecure DKG with Default params (4 parties)secure_threshold_keygen_isolated- Secure keygen with preprocessing (PRSS)secure_threshold_keygen_crash_online_isolated- Crash recovery during online phasesecure_threshold_keygen_crash_preprocessing_isolated- Crash recovery during preprocessingtest_insecure_threshold_decompression_keygen_isolated- Decompression key generationtest_threshold_health_endpoint_availability_isolated- Health endpoint verificationtest_threshold_close_after_drop_isolated- Server shutdown on droptest_threshold_shutdown_isolated- Graceful shutdownnightly_test_insecure_threshold_dkg_backup_isolated- DKG backup/restore (nightly)nightly_test_insecure_threshold_autobackup_after_deletion_isolated- Auto-backup after deletion (nightly)test_insecure_threshold_crs_backup_isolated- CRS backup/restoretest_threshold_restore_from_backup_isolated- Threshold backup/restoretest_threshold_restore_from_backup_with_custodian_isolated- Custodian-based restoreExample Tests (4 tests):
test_centralized_isolated_example- Centralized test pattern demotest_threshold_isolated_example- Threshold test pattern demo (4 parties)test_different_material_types- Material type validationtest_material_validation- Material existence validation2. CLI Integration Tests (
core-client/tests/integration_tests.rs)Centralized CLI Tests (4 tests):
test_centralized_insecure- Keygen + decryption workflowtest_centralized_crsgen_secure- CRS generationtest_centralized_restore_from_backup- Backup/restore flowtest_centralized_custodian_backup- Custodian backup (5 custodians)Threshold CLI Tests (11 tests):
test_threshold_insecure- Keygen + decryption (PRSS-enabled, 4 parties)test_threshold_concurrent_crs- Concurrent CRS generation (4 parties)nightly_tests_threshold_sequential_crs- Sequential CRS generation (4 parties)test_threshold_restore_from_backup- Backup/restore flow (4 parties)test_threshold_custodian_backup- Custodian backup (5 custodians, 4 parties)nightly_tests_threshold_sequential_preproc_keygen- Sequential preprocessing (PRSS, 4 parties)test_threshold_concurrent_preproc_keygen- Concurrent preprocessing (PRSS, 4 parties)full_gen_tests_default_threshold_sequential_preproc_keygen- Full keygen with Default params (PRSS, 4 parties)full_gen_tests_default_threshold_sequential_crs- Full CRS with Default params (4 parties)test_threshold_mpc_context_init- MPC context initialization (4 parties, renamed fromtest_threshold_mpc_context)test_threshold_mpc_context_switch_6- MPC context switching with 6 parties (PRSS-enabled)Test Migration - Key Generation
Migrated all 6 threshold key generation tests to isolated infrastructure:
Migrated Tests:
test_insecure_dkg→test_insecure_dkg_isolateddefault_insecure_dkg→default_insecure_dkg_isolatedsecure_threshold_keygen_test→secure_threshold_keygen_isolatedsecure_threshold_keygen_test_crash_online→secure_threshold_keygen_crash_online_isolatedsecure_threshold_keygen_test_crash_preprocessing→secure_threshold_keygen_crash_preprocessing_isolatedtest_insecure_threshold_decompression_keygen→test_insecure_threshold_decompression_keygen_isolatedFile Reorganization:
key_gen_tests.rs→key_gen_helpers.rs(renamed to reflect purpose as helper library)#[ignore]with migration notesKey Features:
run_prss: trueKeySetConfigandKeySetAddedInfofor decompression keysFile Changes
Core Changes:
core-client/tests/integration_test.rs- Deleted (Docker-based)core-client/tests/integration_tests.rs- Added (Native isolated, 15 CLI tests)core/service/src/client/tests/centralized/*_isolated.rs- Added (5 tests)core/service/src/client/tests/threshold/key_gen_tests_isolated.rs- Added (6 keygen tests)core/service/src/client/tests/threshold/key_gen_helpers.rs- Renamed fromkey_gen_tests.rs(helper functions only)core/service/src/client/tests/threshold/misc_tests_isolated.rs- Added (3 tests)core/service/src/client/tests/threshold/restore_from_backup_tests_isolated.rs- Added (2 tests)core/service/src/client/tests/threshold/misc_tests.rs- Updated (removed 2 redundant tests)core/service/src/client/tests/threshold/restore_from_backup_tests.rs- Deleted (all tests redundant)core/service/src/client/tests/threshold/mod.rs- Updated (module declarations)core/service/src/client/tests/threshold/common.rs- Addedthreshold_key_gen_secure_isolatedhelpercore/service/src/client/tests/isolated_test_example.rs- Added (4 example tests)core/service/src/util/key_setup/test_material_spec.rs- Added (test material specification system)core/service/src/util/key_setup/test_material_manager.rs- Added (material copying utilities)tools/generate-test-material/- Complete pre-generation tool with CLICI/CD Changes:
.github/workflows/main.yml- Updated test matrix with required features.github/workflows/common-testing.yml- Added test material generation + kms-custodian buildMakefile- Added test material generation and isolated test targets:generate-test-material-all- Generate all material (testing + default)generate-test-material-testing- Generate fast testing material onlygenerate-test-material-default- Generate production-like materialvalidate-test-material- Validate existing materialclean-test-material- Clean generated materialtest-isolated- Run all isolated teststest-isolated-centralized- Run centralized tests onlytest-isolated-threshold- Run threshold tests onlytest-isolated-integration- Run CLI integration testsbackward-compatibility/generate-v0.13.0/Cargo.toml- Updated to current branch commitHow It Works
Test Execution Flow
Native isolated tests run KMS servers as in-process native Rust processes (no Docker), with automatic lifecycle management:
Key Points:
Test Architecture
Each test uses
TestMaterialManagerto copy pre-generated cryptographic material into isolated temporary directories:Key Features:
Threshold Tests (Multi-Party):
For threshold tests, the setup returns a
HashMap<u32, ServerHandle>instead of a singleServerHandle:Each party runs as a separate native process with its own ports, simulating a real distributed threshold setup.
Test Material Generation
The test infrastructure includes a comprehensive pre-generation system that creates all cryptographic material needed for tests.
Test Material Tool (
tools/generate-test-material/)A standalone CLI tool that generates cryptographic material for isolated tests:
Key Features:
Material Types:
testing- Fast generation with Test parameters (default for local dev)default- Production-like generation with Default parameters (slower, for comprehensive testing)all- Generates both testing and default materialKey Types Generated:
ClientKeys- FHE client keysSigningKeys- Client signing keysServerSigningKeys- Server signing keysFheKeys- Complete FHE key setsCrsKeys- Common Reference String keysPublicKeys- Public key componentsDecompressionKeys- Decompression keys (slow_tests only)Note: PRSS (Pseudo-Random Secret Sharing) setup is not pre-generated. It's created at runtime when KMS servers start with
run_prss: truein the test configuration.Makefile Targets
Tool Usage
CI Integration
CI generates test material before running tests to avoid generation overhead:
Material Structure
Note: PRSS setup is not stored in test-material. It's generated at runtime by KMS servers when tests configure
run_prss: true.CI Configuration
Updated test matrix to include required features and proper test filtering:
Integration Tests (2 parallel jobs):
Feature Flags Explained:
k8s_tests- PRSS Test Gating#[cfg_attr(not(feature = "k8s_tests"), ignore)]on PRSS teststesting- Test Helper Functions#[cfg(any(test, feature = "testing"))]on helper modulesTestMaterialManager,setup_isolated_*functions, test material generationFeature flags - Two scenarios:
Scenario A: Run all tests (including PRSS):
k8s_tests: Enables PRSS tests (5 tests with network coordination)testing: Compiles test helper functions--test-threads=1: Sequential execution for PRSS testsScenario B: Run non-PRSS tests only:
k8s_tests)Why both features?
testing: Test code won't compile (helper functions are feature-gated)k8s_tests: PRSS tests will be ignored (safe for local development)Party counts: Most tests use 4 parties, one test uses 6 parties (MPC context switch)
Other Skips:
isolated_test_example- Demonstration tests (not part of test suite)k8s_- Kubernetes cluster tests (run separately inkind-testing.yml)nightly- Slow comprehensive tests (run only in scheduled builds)full_gen_tests- Full parameter tests (run only in scheduled builds)Unit Tests:
--features k8s_tests,testing -- --skip centralized --skip threshold --skip isolated_test_example --skip k8s_Nightly Tests (comprehensive, scheduled only):
--features k8s_tests,testing -- --skip k8s_ --skip isolated_test_examplenightly_*andfull_gen_tests_*Running Tests
Local Development
Developer Guide
Writing New Tests
Centralized Test:
Threshold Test:
PRSS Test (Sequential, K8s CI Only):
Issue ticket number and link
PR Checklist
I attest that all checked items are satisfied. Any deviation is clearly justified above.
chore: ...).TODO(#issue).unwrap/expect/paniconly in tests or for invariant bugs (documented if present).devopslabel + infra notified + infra-team reviewer assigned.!and affected teams notified.Zeroize+ZeroizeOnDropimplemented.unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.Dependency Update Questionnaire (only if deps changed or added)
Answer in the
Cargo.tomlnext to the dependency (or here if updating):More details and explanations for the checklist and dependency updates can be found in CONTRIBUTING.md