internal/cryptoTestSealOpenRoundtrip (merged in #9) asserts, for a 1-byte plaintext, that the plaintext byte is absent from the ~36-byte encrypted frame. With a random key/nonce the ciphertext byte can equal the plaintext byte purely by chance, so the assertion fails ~11% of the time.
Impact: this test is on main, so ~11% of everyci run (on every PR) can fail spuriously — causing random auto-merge failures and wasted re-runs across the whole pipeline. Surfaced during #14 development.
Fix
Make the assertion deterministic. Keep the round-trip (Open(Seal(x)) == x) and the "ciphertext differs from plaintext" intent, but stop asserting byte-absence on a 1-byte input. E.g. assert the ciphertext as a whole differs from the plaintext, and/or use a multi-byte/longer plaintext for any differs-from-plaintext check, and/or pin a deterministic key+nonce for a known-answer.
Touch only internal/crypto/crypto_test.go (or its helpers). No production-code change.
Acceptance criteria
The test is deterministic (0% spurious failure) and go test ./internal/crypto/... passes reliably across many reruns.
## Context
`internal/crypto` `TestSealOpenRoundtrip` (merged in #9) asserts, for a **1-byte** plaintext, that the plaintext byte is absent from the ~36-byte encrypted frame. With a random key/nonce the ciphertext byte can equal the plaintext byte purely by chance, so the assertion fails **~11% of the time**.
**Impact:** this test is on `main`, so ~11% of **every** `ci` run (on every PR) can fail spuriously — causing random auto-merge failures and wasted re-runs across the whole pipeline. Surfaced during #14 development.
## Fix
- [ ] Make the assertion deterministic. Keep the round-trip (`Open(Seal(x)) == x`) and the "ciphertext differs from plaintext" intent, but stop asserting byte-absence on a 1-byte input. E.g. assert the ciphertext **as a whole** differs from the plaintext, and/or use a multi-byte/longer plaintext for any differs-from-plaintext check, and/or pin a deterministic key+nonce for a known-answer.
- [ ] Touch only `internal/crypto/crypto_test.go` (or its helpers). No production-code change.
## Acceptance criteria
- The test is deterministic (0% spurious failure) and `go test ./internal/crypto/...` passes reliably across many reruns.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context
internal/cryptoTestSealOpenRoundtrip(merged in #9) asserts, for a 1-byte plaintext, that the plaintext byte is absent from the ~36-byte encrypted frame. With a random key/nonce the ciphertext byte can equal the plaintext byte purely by chance, so the assertion fails ~11% of the time.Impact: this test is on
main, so ~11% of everycirun (on every PR) can fail spuriously — causing random auto-merge failures and wasted re-runs across the whole pipeline. Surfaced during #14 development.Fix
Open(Seal(x)) == x) and the "ciphertext differs from plaintext" intent, but stop asserting byte-absence on a 1-byte input. E.g. assert the ciphertext as a whole differs from the plaintext, and/or use a multi-byte/longer plaintext for any differs-from-plaintext check, and/or pin a deterministic key+nonce for a known-answer.internal/crypto/crypto_test.go(or its helpers). No production-code change.Acceptance criteria
go test ./internal/crypto/...passes reliably across many reruns.