Verification#

The CI workflows run unit tests, protocol checks and integration stands. Each layer checks a different boundary: broker logic, agent behavior, database and TLS integration, or packet enforcement in a Linux kernel.

Broker#

Run the broker unit suite on the supported Python versions:

tox -e py310,py312,py313

Functional tests require PostgreSQL. Attestation tests require libtss2-dev and tpm2-pytss; NAC_REQUIRE_ATTESTATION=1 makes missing attestation support an error instead of skipping those cases:

NAC_REQUIRE_ATTESTATION=1 tox -e py312-functional
NAC_REQUIRE_ATTESTATION=1 tox -e attestation

The CI suite also checks protocol fixture digests, lint and types, documentation links, the example policy, nginx configuration and nftables compilation. Run the local gates with:

tox -e contract,ruff-check,mypy,docs-build

Integration stands#

The broker workflows apply grants through real nftables in Linux network namespaces. The stands cover one enforced network, two office networks, agent package updates, and a VPN tunnel. They require root, nftables, conntrack, network namespaces and nginx; the database-backed stands also require PostgreSQL. The tunnel workflow checks out exordos_nac_agent and exordos_vpn beside this repository.

The scripts are under tools/stand/: e2e.sh, office-e2e.sh, update-e2e.sh and vpn-e2e.sh. Their matching *-up.sh scripts prepare stand resources; reap.sh removes resources left by an interrupted run.

Agent#

The endpoint agent has its own CI in exordos_nac_agent. It runs:

make fixtures-check
make vet
make test
make selftest
make testbed

The testbed uses swtpm to exercise TPM lifecycle and key-loss scenarios. Set NAC_REQUIRE_SWTPM=1 when running it locally if skipping TPM tests would make the result misleading. Platform packaging and service installation are checked by the agent repository's platform-specific CI jobs.