CI: run tests in the `wireshark` group so we can test packet sizes
What the developer wrote
Authored by Rusty Russell
CI: run tests in the `wireshark` group so we can test packet sizes
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit only changes how the project's automated test system is set up. It installs the Wireshark network-packet inspection tools and runs the test suite inside a special Linux group so tests can capture network packets. There is no change to the actual Core Lightning software that users run, and nothing in the commit suggests a security vulnerability or fix.
No security action needed. Treat as a normal CI/infrastructure change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies GitHub Actions CI configuration and a setup script. It adds tshark and wireshark-common packages, configures the wireshark group with setcap on dumpcap, and wraps pytest invocations with sg wireshark. This enables tests that verify Lightning protocol packet sizes. No application code, cryptography, networking logic, or privilege model of Core Lightning itself is changed.
Changed components
.github/scripts/setup.sh.github/workflows/ci.yamlInspect captured patch +18 / −5
diff --git a/.github/scripts/setup.sh b/.github/scripts/setup.sh
index 2409cdf0..a719c520 100755
--- a/.github/scripts/setup.sh
+++ b/.github/scripts/setup.sh
@@ -52,9 +52,11 @@ sudo apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
sudo \
tcl \
tclsh \
+ tshark \
unzip \
valgrind \
wget \
+ wireshark-common \
xsltproc \
systemtap-sdt-dev \
zlib1g-dev
@@ -97,3 +99,14 @@ export PROTOC=/usr/local/bin/protoc
export PATH=$PATH:/usr/local/bin
env
ls -lha /usr/local/bin
+
+# wireshark-common normally does this, but GH runners are special, so we
+# do it explicitly
+sudo groupadd -f wireshark
+sudo chgrp wireshark /usr/bin/dumpcap
+sudo chmod 750 /usr/bin/dumpcap
+sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
+
+# Add ourselves to the wireshark group (still need "sg wireshark..." for it to take effect)
+sudo usermod -aG wireshark "$(id -nu)"
+
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7dda6172..b9a93a23 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -323,7 +323,7 @@ jobs:
run: |
env
cat config.vars
- uv run eatmydata pytest tests/test_downgrade.py -n ${PYTEST_PAR} ${PYTEST_OPTS}
+ sg wireshark "uv run eatmydata pytest tests/test_downgrade.py -n ${PYTEST_PAR} ${PYTEST_OPTS}"
- name: Upload test results
if: always()
uses: actions/upload-artifact@v4
@@ -438,7 +438,7 @@ jobs:
run: |
env
cat config.vars
- VALGRIND=0 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}
+ VALGRIND=0 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}"
- name: Upload test results
if: always()
uses: actions/upload-artifact@v4
@@ -526,7 +526,7 @@ jobs:
TEST_DEBUG: 1
PYTEST_PAR: 2
run: |
- VALGRIND=1 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS} ${{ matrix.PYTEST_OPTS }}
+ VALGRIND=1 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS} ${{ matrix.PYTEST_OPTS }}"
- name: Upload test results
if: always()
uses: actions/upload-artifact@v4
@@ -617,7 +617,7 @@ jobs:
env:
PYTEST_PAR: 2
run: |
- uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS} ${{ matrix.PYTEST_OPTS }}
+ sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS} ${{ matrix.PYTEST_OPTS }}"
- name: Upload test results
if: always()
uses: actions/upload-artifact@v4
@@ -748,7 +748,7 @@ jobs:
run: |
env
cat config.vars
- VALGRIND=0 uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}
+ VALGRIND=0 sg wireshark "uv run eatmydata pytest tests/ -n ${PYTEST_PAR} ${PYTEST_OPTS}"
- name: Upload test results
if: always()
uses: actions/upload-artifact@v4
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.