HOVEL // module 01.04
Module 01.04 Payload provider / Integrated

Testing picblobs

The original Bazel, Python, CLI, payload, and generated-file tests are available through root Task targets so they run inside the Hovel build.

Primary Checks

task picblobs:generate-check
task picblobs:test
task picblobs:ci

picblobs:test runs the Bazel-integrated test suite; picblobs:ci adds representative cross-platform builds. Keep Bazel options after -- when extra diagnostics are needed, for example task picblobs:test -- --test_output=errors.

Payload Checks

Payload tests require staged blobs and runners. Run task picblobs:stage first for the full matrix, or pass --targets and --configs to stage a focused subset during local iteration.

Mbed/NaCl Checks

Use these Task-backed commands for focused developer iteration:

task bazel:test -- \
  --config=picblobs_ci \
  //modules/picblobs/tests:nacl_e2e_mbed

task bazel:test -- \
  --config=picblobs_ci \
  //modules/picblobs/mbed:target_compile_test

task bazel:test -- \
  --config=picblobs_ci \
  //modules/picblobs/mbed:compile_mbed_os_test \
  //modules/picblobs/mbed:materialize_blobs_test
Check Evidence
nacl_e2e_mbed Runs the actual hosted Cortex-M4 server and client blobs under QEMU through the real platform_mbed.cpp vtable with POSIX-backed Mbed APIs.
Wire capture Requires two framed messages in each direction, four nonzero unique 24-byte nonces, the 16-byte secretbox authentication overhead, no client plaintext on the outbound wire, and no ACK plaintext on the return wire.
Authentication failures Flips the client-to-server application ciphertext and the server-to-client ACK ciphertext in separate runs; each receiving side must reject the frame and must not report a secure channel.
Bounded I/O Connects a silent peer and requires the server to fail closed within the 5000 ms Mbed socket timeout and the test's 12-second outer bound.
Materializer/compiler units Exercise key, port, IPv4, config-template, stale-code, artifact, compiler-version, build-lock, version, and Git checkout validation.
target_compile_test Builds complete server and client NUCLEO-F429ZI firmware with the pinned real Mbed OS 5.15.9 SDK and GCC ARM 9-2019-q4 declared as Bazel inputs.

What CI Proves

CI proves that the real Cortex-M4 blob machine code executes the symmetric encrypted exchange, authenticates and decrypts both directions, rejects ciphertext modification both ways, uses unique captured nonces, closes tracked sockets, and times out a silent peer. It also proves that the application adapter and both complete firmware roles compile against the pinned target SDK and supported compiler from declared inputs.

CI does not prove runtime behavior of physical NUCLEO-F429ZI boards. QEMU uses POSIX-backed Mbed mocks, while the real firmware compile does not boot. A two-board hardware smoke test is still required to validate target TRNG behavior and entropy, Ethernet PHY/DHCP/LWIP operation, flash and boot, serial output, real timing, and the MPU and cache-maintenance path on the installed silicon.

  1. Materialize one matched key, port, and server IPv4 configuration.
  2. Build and flash the server and client role images to separate boards.
  3. Start the server first on an authorized isolated network.
  4. Require both expected decrypted values and both secure channel OK lines on serial.
  5. Repeat after reset to exercise fresh ephemeral keys and nonces.

See the operator workflow and runtime reference for the configuration and memory-policy details behind these checks.