test/fixtures/README.md

1# Native TLS integration matrix

3The driver includes the production TLS implementation and invokes its public

4native entry points in a real Sigil VM. It installs only the test CA in that

5process, keeping certificate and hostname verification enabled. This is

6necessary because the current library searches system CA files before the

7SSL_CERT_FILE override. It does not set SIGIL_TLS_INSECURE.

9Compile tls-client.c against the same sigil-lib and sigil-crypto headers and

10archives as the build under test, with MBEDTLS_CONFIG_FILE defined as

11"sigil_mbedtls_config.h". For example, with a configured C compiler:

13```sh

14cc -O2 -DMBEDTLS_CONFIG_FILE='"sigil_mbedtls_config.h"' \

15 -I"$SIGIL_LIB_DIR/include" -I"$SIGIL_LIB_DIR/src" \

16 -I"$SIGIL_CRYPTO_DIR/vendor/mbedtls/include" \

17 -I"$SIGIL_CRYPTO_DIR/vendor/mbedtls" \

18 test/fixtures/tls-client.c "$SIGIL_LIB_ARCHIVE" "$SIGIL_CRYPTO_ARCHIVE" \

19 -lm -lpthread -o /tmp/sigil-tls-client

20node test/fixtures/tls-matrix.cjs /tmp/sigil-tls-client

21```

23Node and OpenSSL are fixture dependencies; OPENSSL may select an explicit

24OpenSSL executable. Each child has a 15-second watchdog. The matrix generates

25a private test certificate and checks both TLS 1.2 and TLS 1.3: forty verified

26connections with encrypted roundtrips, wrong-host and untrusted certificates,

27and a successful reconnect after certificate rejection. A failure exits

28nonzero. The ordinary Sigil suite separately covers handshake deadlines and

29socket ownership for both connect and upgrade.