build: fix native CI provisioning and platform test lints

Route CI through the shared pinned installers, install NASM for Windows
assembly, and omit tools that the CI checks do not use. Retain complete
native and portable test coverage, with script regressions on Linux x86-64.

Preserve backend fixture bytes with explicit byte extraction and strict
slice bounds, and document the existing unsafe test-helper requirements.

Author: loadingalias

.config/tooling.toml

@@ -32,13 +32,22 @@ powershell = "7.6.5"
 rustup = "1.29.1"
 python = "3.14.7"
 zig = "0.16.0"
+nasm = "3.02"
 
 [linux]
 ubuntu = "26.04"
 codename = "resolute"
 snapshot = "20260906T054640Z"
 packages = ["build-essential", "ca-certificates", "curl", "git", "jq", "pkgconf", "python3", "python3-venv", "unzip", "xz-utils", "zstd", "ninja-build", "libssl-dev", "perl", "m4", "shellcheck"]
 
+[ci]
+cargo = ["just", "cargo-nextest", "cargo-deny", "cargo-audit"]
+
+[linux-ci]
+ubuntu = "24.04"
+codename = "noble"
+packages = ["build-essential", "ca-certificates", "curl", "git", "jq", "pkgconf", "python3", "cmake", "clang", "libclang-dev", "libssl-dev", "perl"]
+
 [windows]
 visual-studio = "18.9.2"
 build-version = "18.9.12120.119"
@@ -166,6 +175,10 @@ cargo = ["cargo-audit", "cargo-deny", "cargo-nextest", "cargo-mutants", "just",
 url = "https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-pc-windows-msvc/rustup-init.exe"
 sha256 = "6f4bef66261261fcb43131be8720bab817d403a09edec7455c371974b90bdb7e"
 
+[x86_64-win.assets.nasm]
+url = "https://www.nasm.us/pub/nasm/releasebuilds/3.02/win64/nasm-3.02-win64.zip"
+sha256 = "161d0bfaff53c2f9e9f3e69fd0672323ebabafd1268976a5cec11be92a19aee7"
+
 [x86_64-win.assets.cargo-binstall]
 url = "https://github.com/cargo-bins/cargo-binstall/releases/download/v1.23.0/cargo-binstall-x86_64-pc-windows-msvc.zip"
 sha256 = "f4641479477aca40387e88297e3813fab8e44a8d21f25faa44e0ff33e2bc1726"

.github/workflows/ci.yml

@@ -48,27 +48,15 @@ jobs:
       - name: Install tooling
         env:
           PLATFORM: ${{ matrix.platform }}
+        run: scripts/tooling/"$PLATFORM.sh" --ci
+      - name: Test script orchestration
+        if: matrix.platform == 'x86_64-linux'
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential ca-certificates python3 cmake clang libclang-dev libssl-dev pkg-config jq
-          installer_dir="$(mktemp -d)"
-          installer="$installer_dir/rustup-init"
-          python3 scripts/tooling/catalog.py download "$PLATFORM" rustup "$installer"
-          chmod +x "$installer"
-          "$installer" -y --no-modify-path --default-toolchain none
-          rm "$installer"
-          rmdir "$installer_dir"
-          export PATH="$HOME/.cargo/bin:$PATH"
-          host="$(python3 scripts/tooling/catalog.py get "$PLATFORM" rust-host)"
-          python3 scripts/lib/toolchain.py --install "$host"
-          export RUSTUP_TOOLCHAIN
-          RUSTUP_TOOLCHAIN="$(python3 scripts/lib/toolchain.py --target "$host")"
-          for tool in just cargo-nextest cargo-deny cargo-audit; do
-            cargo install "$tool" --version "$(python3 scripts/tooling/catalog.py get cargo "$tool")" --locked
-          done
+          source "$HOME/.local/share/rscrypto-tooling/environment.sh"
+          just test-scripts
       - name: Check and test
         run: |
-          export PATH="$HOME/.cargo/bin:$PATH"
+          source "$HOME/.local/share/rscrypto-tooling/environment.sh"
           just ci-check
           just test --all
           just test --all --portable
@@ -85,7 +73,7 @@ jobs:
       - name: Install tooling, check, and test
         shell: powershell
         run: |
-          ./scripts/tooling/x86_64-win.ps1
+          ./scripts/tooling/x86_64-win.ps1 -Ci
           just ci-check
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           just test --all

justfile

@@ -124,6 +124,7 @@ test-scripts:
     @scripts/lib/python.sh scripts/test/test_runner_test.py
     @scripts/lib/python.sh scripts/test/just_arguments_test.py
     @scripts/lib/python.sh scripts/tooling/toolchain_test.py
+    @scripts/lib/python.sh scripts/tooling/install_test.py
     @scripts/lib/python.sh scripts/test/fuzz_features_test.py
     @scripts/lib/python.sh scripts/check/check_runner_test.py
     @scripts/lib/python.sh scripts/test/fuzz_runner_test.py

scripts/README.md

@@ -138,7 +138,25 @@ The installers use sudo when needed. Windows uses the corresponding
 `aarch64-win.ps1` or `x86_64-win.ps1` in an elevated PowerShell session.
 macOS tools remain locally managed.
 
-All profiles install the prerequisites for `just ci-check`, `just test`, and
+CI calls these same installers with `--ci` on Linux or `-Ci` on Windows.
+The catalog's `ci` section selects the Cargo tools needed by `just ci-check`,
+`just test --all`, and `just test --all --portable`. Both test commands include
+doctests. This mode omits Cargo Rail because `--all` bypasses affected-work
+planning; use the full installer for ordinary `just test` and benchmark work.
+Linux CI uses the catalog's `linux-ci` Ubuntu release and packages from the
+same archive snapshot as development provisioning. It installs prebuilt Cargo
+tools on x86-64 and ARM64, and builds them from source on the other architectures.
+CI does not install optional profiling, mutation, or live-fuzzing tools or alter
+shell startup files. These jobs validate CI provisioning, not the full optional
+development toolset.
+
+After Linux installation, source
+`$HOME/.local/share/rscrypto-tooling/environment.sh` in each new CI step.
+Windows CI runs installation and validation in one PowerShell step to retain
+the MSVC/SDK environment. Windows x86-64 installs catalog-pinned NASM for native
+dependency assembly in both modes.
+
+All full profiles install the prerequisites for `just ci-check`, `just test`, and
 Criterion `just bench`. RISC-V, Z, and POWER install pinned Cargo tools from
 source and use snapshot-pinned native CMake/Clang. They do not install cross
 targets, Miri, browsers, or profiling tools. The shared selector in

scripts/tooling/aarch64-win.ps1

@@ -1,3 +1,4 @@
+param([switch]$Ci)
 $ErrorActionPreference = 'Stop'
-if ($args.Count -ne 0) { throw 'Usage: scripts/tooling/aarch64-win.ps1' }
-& "$PSScriptRoot/windows.ps1" -Platform aarch64-win
+if ($args.Count -ne 0) { throw 'Usage: scripts/tooling/aarch64-win.ps1 [-Ci]' }
+& "$PSScriptRoot/windows.ps1" -Platform aarch64-win -Ci:$Ci

scripts/tooling/catalog.py

@@ -89,6 +89,11 @@ def install_archive(name, asset, prefix):
 
 
 def validate(data):
+    required_ci = {'just', 'cargo-nextest', 'cargo-deny', 'cargo-audit'}
+    if not required_ci <= set(data['ci']['cargo']):
+        raise ValueError('CI: missing check/test tools')
+    if any(tool not in data['cargo'] for tool in data['ci']['cargo']):
+        raise ValueError('CI: missing Cargo tool version')
     for platform in PLATFORMS:
         config = data[platform]
         if 'miri' in config['components']:
@@ -102,6 +107,8 @@ def validate(data):
         assets = config['assets']
         if 'rustup' not in assets:
             raise ValueError(f'{platform}: missing native rustup archive')
+        if platform == 'x86_64-win' and 'nasm' not in assets:
+            raise ValueError(f'{platform}: missing NASM for native dependency assembly')
         if platform not in NATIVE_SOURCE_PLATFORMS and not {'cargo-rail', 'cargo-binstall', 'cmake', 'llvm'} <= assets.keys():
             raise ValueError(f'{platform}: missing native tool archives')
         for name, asset in assets.items():

scripts/tooling/install_test.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Exercise Linux provisioning with substitute host and installation commands."""
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import tomllib
+import unittest
+
+ROOT = Path(__file__).resolve().parents[2]
+BASH = shutil.which('bash')
+CATALOG = tomllib.loads((ROOT / '.config/tooling.toml').read_text())
+
+STUB = r'''import json, os, pathlib, subprocess, sys
+name = pathlib.Path(sys.argv[0]).name
+args = sys.argv[1:]
+with open(os.environ['INSTALL_LOG'], 'a') as log:
+    log.write(json.dumps([name, *args]) + '\n')
+if name == 'uname':
+    print('Linux' if args == ['-s'] else os.environ['INSTALL_ARCH'])
+elif name == 'id':
+    print('0')
+elif name == 'apt-cache':
+    print(args[-1] + ' | 1.0 | snapshot')
+elif name == 'apt-get':
+    if os.environ.get('INSTALL_FAIL_APT'):
+        sys.exit(42)
+elif name == 'python3':
+    script = pathlib.Path(args[0]).name
+    if script == 'catalog.py' and args[1] == 'download':
+        pathlib.Path(args[-1]).write_text('#!/bin/sh\nexit 0\n')
+    elif script == 'catalog.py' and args[1] == 'install-archive':
+        directory = pathlib.Path(args[-1]) / args[-2]
+        directory.mkdir(parents=True, exist_ok=True)
+        executable = directory / 'cargo-binstall'
+        executable.write_text('#!/bin/sh\nexit 0\n')
+        executable.chmod(0o755)
+        print(directory)
+    elif script == 'toolchain.py' and '--install' in args:
+        pass
+    else:
+        sys.exit(subprocess.run([sys.executable, *args]).returncode)
+'''
+
+
+class LinuxInstall(unittest.TestCase):
+    def provision(self, platform, fail=False):
+        temporary = tempfile.TemporaryDirectory(prefix='rscrypto installer ')
+        self.addCleanup(temporary.cleanup)
+        root = Path(temporary.name)
+        binaries = root / 'bin'
+        binaries.mkdir()
+        for name in ('uname', 'id', 'apt-get', 'apt-cache', 'cargo', 'clang', 'cmake', 'python3'):
+            script = binaries / name
+            script.write_text('#!' + sys.executable + '\n' + STUB)
+            script.chmod(0o755)
+        bash_env = root / 'bash-env'
+        bash_env.write_text('''source() {
+  if [[ "$1" == /etc/os-release ]]; then
+    ID=ubuntu
+    VERSION_ID=24.04
+    PRETTY_NAME=fixture
+  else
+    builtin source "$@"
+  fi
+}
+''')
+        arch = platform.removesuffix('-linux').replace('powerpc64le', 'ppc64le')
+        env = {**os.environ, 'HOME': str(root), 'CARGO_HOME': str(root / 'custom cargo'),
+               'PATH': str(binaries) + os.pathsep + os.environ['PATH'],
+               'BASH_ENV': str(bash_env), 'INSTALL_ARCH': arch,
+               'INSTALL_LOG': str(root / 'commands.jsonl')}
+        if fail:
+            env['INSTALL_FAIL_APT'] = '1'
+        result = subprocess.run([BASH, str(ROOT / 'scripts/tooling/linux.sh'), platform, '--ci'],
+                                env=env, capture_output=True, text=True)
+        calls = [json.loads(line) for line in (root / 'commands.jsonl').read_text().splitlines()]
+        return result, calls, root
+
+    def test_ci_profiles_install_only_required_tools(self):
+        for platform in ('x86_64-linux', 'aarch64-linux', 's390x-linux', 'powerpc64le-linux', 'riscv64-linux'):
+            with self.subTest(platform=platform):
+                result, calls, root = self.provision(platform)
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                installs = [c for c in calls if c[0] == 'cargo' and ('install' in c or 'binstall' in c)]
+                self.assertEqual(len(installs), len(CATALOG['ci']['cargo']))
+                binary = platform in ('x86_64-linux', 'aarch64-linux')
+                for command, tool in zip(installs, CATALOG['ci']['cargo']):
+                    self.assertIn('binstall' if binary else 'install', command)
+                    self.assertEqual(command[-1], f"{tool}@{CATALOG['cargo'][tool]}" if binary else tool)
+                    self.assertIn('--locked', command)
+                    self.assertIn(CATALOG[platform]['rust-host'], command)
+                apt = next(c for c in calls if c[0] == 'apt-get' and '--allow-downgrades' in c)
+                self.assertEqual([a for a in apt if a.endswith('=1.0')],
+                                 [p + '=1.0' for p in CATALOG['linux-ci']['packages']])
+                environment = (root / '.local/share/rscrypto-tooling/environment.sh').read_text()
+                self.assertIn('custom\\ cargo/bin', environment)
+                self.assertFalse((root / '.bashrc').exists())
+                self.assertFalse((root / '.profile').exists())
+
+    def test_package_failure_stops_before_rust_installation(self):
+        result, calls, _ = self.provision('x86_64-linux', fail=True)
+        self.assertEqual(result.returncode, 42)
+        self.assertFalse(any(c[0] == 'cargo' or 'download' in c for c in calls))
+
+
+if __name__ == '__main__':
+    unittest.main()

scripts/tooling/linux.sh

@@ -5,7 +5,9 @@ export PYTHONDONTWRITEBYTECODE=1
 
 platform="${1:?native platform is required}"
 shift
-[[ "$#" -eq 0 ]] || { echo "usage: scripts/tooling/$platform.sh" >&2; exit 64; }
+ci=false
+if [[ "${1:-}" == --ci ]]; then ci=true; shift; fi
+[[ "$#" -eq 0 ]] || { echo "usage: scripts/tooling/$platform.sh [--ci]" >&2; exit 64; }
 machine="${platform%-linux}"
 [[ "$machine" != powerpc64le ]] || machine=ppc64le
 case "$platform" in
@@ -21,9 +23,11 @@ cd "$REPO_ROOT"
 # Ubuntu Server supplies Python; install it from the selected archive if absent.
 # Read only the two bootstrap strings before the full TOML reader is available.
 catalog="$REPO_ROOT/.config/tooling.toml"
-bootstrap_value() { sed -n '/^\[linux\]$/,/^\[/s/^'"$1"' = "\([^"]*\)"$/\1/p' "$catalog"; }
+linux_section=linux
+[[ "$ci" == false ]] || linux_section=linux-ci
+bootstrap_value() { sed -n '/^\['"${2:-$linux_section}"'\]$/,/^\[/s/^'"$1"' = "\([^"]*\)"$/\1/p' "$catalog"; }
 ubuntu="$(bootstrap_value ubuntu)"
-snapshot="$(bootstrap_value snapshot)"
+snapshot="$(bootstrap_value snapshot linux)"
 # shellcheck source=/dev/null
 source /etc/os-release
 [[ "$ID" == ubuntu && "$VERSION_ID" == "$ubuntu" ]] || {
@@ -53,9 +57,11 @@ apt=("${sudo_cmd[@]}" env DEBIAN_FRONTEND=noninteractive apt-get "${apt_options[
 "${apt[@]}" update
 catalog_get() { python3 "$SCRIPT_DIR/catalog.py" get "$@"; }
 python3 "$SCRIPT_DIR/catalog.py" validate
-mapfile -t packages < <(catalog_get linux packages)
-mapfile -t native_packages < <(catalog_get "$platform" packages)
-packages+=("${native_packages[@]}")
+mapfile -t packages < <(catalog_get "$linux_section" packages)
+if [[ "$ci" == false ]]; then
+  mapfile -t native_packages < <(catalog_get "$platform" packages)
+  packages+=("${native_packages[@]}")
+fi
 # Exact candidates come from the selected snapshot, including repeat installations.
 pinned_packages=()
 for package in "${packages[@]}"; do
@@ -66,28 +72,41 @@ done
 "${apt[@]}" install -y --allow-downgrades "${pinned_packages[@]}"
 
 prefix="$HOME/.local/share/rscrypto-tooling"
-mkdir -p "$prefix/bin"
+mkdir -p "$prefix"
 python3 "$SCRIPT_DIR/catalog.py" download "$platform" rustup "$temporary/rustup-init"
 chmod +x "$temporary/rustup-init"
 host="$(catalog_get "$platform" rust-host)"
 channel="$(python3 "$SCRIPT_DIR/../lib/toolchain.py")"
 "$temporary/rustup-init" -y --no-modify-path --default-host "$host" --default-toolchain none
-export PATH="$HOME/.cargo/bin:$PATH"
-mapfile -t components < <(catalog_get "$platform" components)
+cargo_bin="${CARGO_HOME:-$HOME/.cargo}/bin"
+export PATH="$cargo_bin:$PATH"
+components=()
+if [[ "$ci" == false ]]; then mapfile -t components < <(catalog_get "$platform" components); fi
 component_args=()
 for component in "${components[@]}"; do component_args+=(--component "$component"); done
 python3 "$SCRIPT_DIR/../lib/toolchain.py" --install "$host" "${component_args[@]}"
 export RUSTUP_TOOLCHAIN="$channel"
 # Archive tools retain their complete directory layouts, including LLVM and Zig libraries.
-python3 "$SCRIPT_DIR/catalog.py" install-archives "$platform" "$prefix" > "$temporary/archives"
+if [[ "$ci" == true ]]; then
+  : > "$temporary/archives"
+  if [[ "$platform" == aarch64-linux || "$platform" == x86_64-linux ]]; then
+    directory="$(python3 "$SCRIPT_DIR/catalog.py" install-archive "$platform" cargo-binstall "$prefix")"
+    printf 'cargo-binstall\t%s\n' "$directory" > "$temporary/archives"
+  fi
+else
+  python3 "$SCRIPT_DIR/catalog.py" install-archives "$platform" "$prefix" > "$temporary/archives"
+fi
 tool_paths=()
 while IFS=$'\t' read -r name directory; do
   if [[ -d "$directory/bin" ]]; then tool_paths+=("$directory/bin"); else tool_paths+=("$directory"); fi
   if [[ "$name" == llvm ]]; then export LIBCLANG_PATH="$directory/lib"; fi
 done < "$temporary/archives"
-PATH="$(IFS=:; echo "${tool_paths[*]}"):$prefix/bin:$HOME/.cargo/bin:$PATH"
-export PATH
-mapfile -t cargo_tools < <(catalog_get "$platform" cargo)
+tool_paths+=("$cargo_bin")
+path_prefix="$(IFS=:; echo "${tool_paths[*]}")"
+export PATH="$path_prefix:$PATH"
+tool_section="$platform"
+[[ "$ci" == false ]] || tool_section=ci
+mapfile -t cargo_tools < <(catalog_get "$tool_section" cargo)
 for tool in "${cargo_tools[@]}"; do
   version="$(catalog_get cargo "$tool")"
   # Cargo's install registry verifies exact installed package versions on reruns.
@@ -99,23 +118,25 @@ for tool in "${cargo_tools[@]}"; do
       cargo +"$channel" install --locked --target "$(catalog_get "$platform" rust-host)" --version "$version" "$tool"
   fi
 done
-if [[ "$platform" != aarch64-linux && "$platform" != x86_64-linux ]]; then
+if [[ "$ci" == false && "$platform" != aarch64-linux && "$platform" != x86_64-linux ]]; then
   env -u RUSTC_WRAPPER -u CARGO_ENCODED_RUSTFLAGS \
     cargo +"$channel" install --locked --target "$(catalog_get "$platform" rust-host)" --version "$(catalog_get versions cargo-rail)" cargo-rail
 fi
 
 # Persistent paths are shared by interactive shells and non-interactive Bash recipes.
 environment="$prefix/environment.sh"
 {
-  printf "export PATH=%q:\"\$PATH\"\n" "$(IFS=:; echo "${tool_paths[*]}"):$prefix/bin:$HOME/.cargo/bin"
+  printf "export PATH=%q:\"\$PATH\"\n" "$path_prefix"
   if [[ -n "${LIBCLANG_PATH:-}" ]]; then printf 'export LIBCLANG_PATH=%q\n' "$LIBCLANG_PATH"; fi
 } > "$environment"
-for startup in "$HOME/.profile" "$HOME/.bashrc"; do
-  line="source \"$environment\""
-  touch "$startup"
-  grep -Fxq "$line" "$startup" || printf '\n%s\n' "$line" >> "$startup"
-done
-if [[ "$platform" == aarch64-linux || "$platform" == x86_64-linux ]]; then
+if [[ "$ci" == false ]]; then
+  for startup in "$HOME/.profile" "$HOME/.bashrc"; do
+    line="source \"$environment\""
+    touch "$startup"
+    grep -Fxq "$line" "$startup" || printf '\n%s\n' "$line" >> "$startup"
+  done
+fi
+if [[ "$ci" == false && ( "$platform" == aarch64-linux || "$platform" == x86_64-linux ) ]]; then
 # Linux profiling is available to the runner account, including non-root perf/samply.
 "${sudo_cmd[@]}" tee /etc/sysctl.d/99-rscrypto-profiling.conf >/dev/null <<'CONF'
 kernel.perf_event_paranoid = -1
@@ -132,6 +153,6 @@ samply --version
 fi
 clang --version
 cmake --version
-cargo rail --version
+if [[ "$ci" == false ]]; then cargo rail --version; fi
 cargo nextest --version
-printf 'Installed %s tooling. New shells load %s.\n' "$platform" "$environment"
+printf 'Installed %s tooling. Load with: source "%s"\n' "$platform" "$environment"