Run tor in the background for the tor-connect job
What the developer wrote
Authored by Matt Corallo
Run tor in the background for the tor-connect job
The runner image ships the tor package but has no sudo to start the
system service, so the previous `sudo apt install -y tor` step cannot
work. Instead, start tor in the background within the test step, wait
for it to fully bootstrap (the test routes real traffic, including to a
.onion address, through the proxy), run the test, and kill tor on exit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This commit is a routine fix to the project's CI (continuous integration) workflow. It changes how the Tor proxy is started during automated testing so that tests can run on a new runner image that lacks sudo privileges. There is no indication this change affects the actual Lightning Dev Kit software or its users' security.
No security action required. Review as normal infrastructure/maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .forgejo/workflows/build.yml, replacing a CI step that ran sudo apt install -y tor with an inline background launch of the tor daemon inside the test step. It adds bootstrapping checks, a timeout loop, and an EXIT trap to kill tor. The change is purely operational/test infrastructure and does not alter any application code, cryptography, networking logic, or secrets handling.
Changed components
.forgejo/workflows/build.yml CI workflowInspect captured patch +22 / −3
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index e55a951..0374580 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -352,14 +352,33 @@ jobs:
steps:
- name: Checkout source code
uses: actions/checkout@v4
- - name: Install tor
- run: |
- sudo apt install -y tor
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
- name: Test tor connections using lightning-net-tokio
run: |
+ set -eu
+ # tor is preinstalled in the runner image, but we have no sudo to
+ # start the system service, so run it in the background for this step.
+ # The test routes real traffic (including to a .onion address) through
+ # the proxy, so we must wait until tor is fully bootstrapped.
+ TOR_DATA="$(mktemp -d)"
+ tor --SocksPort 9050 --DataDirectory "$TOR_DATA" \
+ --Log "notice file $TOR_DATA/tor.log" &
+ TOR_PID=$!
+ trap 'kill "$TOR_PID" 2>/dev/null || true' EXIT
+ for _ in $(seq 1 90); do
+ if grep -q "Bootstrapped 100%" "$TOR_DATA/tor.log" 2>/dev/null; then
+ break
+ fi
+ if ! kill -0 "$TOR_PID" 2>/dev/null; then
+ echo "tor exited before bootstrapping:"; cat "$TOR_DATA/tor.log"; exit 1
+ fi
+ sleep 2
+ done
+ if ! grep -q "Bootstrapped 100%" "$TOR_DATA/tor.log"; then
+ echo "tor failed to bootstrap within timeout:"; cat "$TOR_DATA/tor.log"; exit 1
+ fi
TOR_PROXY="127.0.0.1:9050" RUSTFLAGS="--cfg=tor" cargo test --verbose --color always -p lightning-net-tokio
notify-failure:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.