Fix auth-probe accuracy; add topology + rebirth discovery#1
Open
ShadMalloy wants to merge 3 commits into
Open
Conversation
Addresses code-review findings plus two related discovery features. - Anon-PUBLISH probe now confirms acceptance by waiting for the broker to redeliver the probe to our own subscription. A PUBACK alone is not proof: brokers ACK a QoS=1 publish even when an ACL denies it, so the old check could report an unauthenticated-write finding that was not real. - Report anon CONNECT/SUBSCRIBE as "not tested" (not False) when credentials were supplied — anonymous access is never exercised then, so "False" overstated the target's security posture. - Emit valid Boolean DataSet cells: bool subclasses int, so the int branch was swallowing boolean elements and producing an invalid test case. - Log skipped boundary cases via _gen_skip instead of a bare except:pass, matching every sibling generator (visible at -vv). - Add --topology-diagram: after a run, write a Mermaid graph of the discovered broker/group/node/device topology, marking fuzzed entities. - Add --request-rebirth: publish an NCMD Rebirth to discovered nodes so they re-send their non-retained NBIRTH/DBIRTH, recovering metric definitions missed when the fuzzer joins after a birth. Opt-in, active step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The suite loads sparkplug-fuzzer.py via importlib and exercises only pure-Python paths, so it needs neither paho/protobuf nor the Tahu --setup step; CI just installs requirements-dev.txt and runs pytest. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Eclipse Tahu is licensed EPL-2.0, not Apache-2.0 (confirmed from Tahu's LICENSE and the sparkplug_b.py SPDX header) — NOTICE and README wrongly claimed Apache. Also document --topology-diagram and --request-rebirth, rewrite the anon-write probe description to reflect redelivery confirmation (a PUBACK is not proof of acceptance), and state Python 3.11+ to match CI. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--topology-diagram(Mermaid graph of the discovered broker/group/node/device topology) and--request-rebirth(recover node births missed on late join), plus GitHub Actions CI (pytest on 3.11/3.13).Test plan
pytest -q— 32 passingpy_compile+--helpcleanredelivered: true)--request-rebirthrecovers a node missed on late join (node_count 0 → 1)--topology-diagramemits valid Mermaid (renders to SVG/PNG)🤖 Generated with Claude Code