Testing

Build with the C++20 module toolchain described in Building, then run:

ctest --test-dir build --output-on-failure --output-junit junit.xml

The 12 CTest groups cover these workflows. They do not require a Docker daemon
or internet connection. Blob Streams tests require permission to bind loopback
sockets. Tests create temporary fixtures and compare decoded bytes with the input.

Area	Checks
Core API and CLI	All 21 modes; AES mode/KDF combinations; binary files; ZIP recovery; map conversion; image/ZIP-derived seeds without a seed argument
Map boundaries	Single-row seed metadata, narrow maps, signed seed extremes, legacy metadata, indexed ZIP chunks and missing-chunk failures
Image credentials and URLs	Either image unlocks; wrong images and corrupt slots fail; exact capacity and overflow; PNG Base64 URLs and malformed input
Ciphers and C++20 interface	All 11 registry entries through the shared encoder; known-answer ChaCha20-Poly1305 and AES-GCM vectors; binary boundaries; tampering, wrong keys, streaming and finish states
Cipher CLI integration	All ten new choices through files, ZIPs, URLs, image pairs and Docker PNGs; chunked ZIP maps; unsupported/conflicting options
Docker	Archive metadata/digests, input limits, tampering and truncation, key-file errors, filesystem/symlink failures, argument forwarding with a fake Docker executable
Blob Streams	Mutual authentication, bidirectional encrypted transfer, direct and HTTP relay transport, close/finish behavior, overflow, malformed relay requests, fragmentation and timeout recovery
CLI basics	Help and version

Optional checks

Compare an older executable and the new build in both directions. This checks
existing AES image modes/KDFs, image credentials, and AES Docker PNG compatibility:

python3 tests/test_backward_compat.py /path/to/old/csha ./build/csha

Use a running Docker daemon and an already installed image containing /bin/sh:

python3 tests/test_docker_live.py ./build/csha redis:7.4-alpine camellia-eax

This does not pull images. It creates a uniquely tagged scratch image, removes
it, restores it from its encrypted PNG, and checks its image ID. It also packs
the supplied local image and runs a command from the PNG with networking disabled.
Only resources with the test's unique names are removed. Omit the last argument
to test the existing AES format.

For sanitizer checks, configure a separate build with both C and C++ flags
-fsanitize=address,undefined -fno-omit-frame-pointer and executable linker flags
-fsanitize=address,undefined. Build csha_cipher_tests and run
csha_cipher_tests '~[integration]' to check cipher implementations and the
imported interface independently of map generation and third-party Cubiomes.

Passing these tests establishes the listed behavior on the tested toolchain;
it is not a cryptographic audit or exhaustive coverage of every possible input.

Optional checks#

Optional checks