Tests: skip Go-oracle CLI interop on Windows

The frozen Go version cannot sync directories there.

.gitattributes

@@ -0,0 +1,2 @@
+# Test vectors are compared byte for byte; never convert line endings.
+tests/vectors/** -text

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel, windows-2025]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5
       # The Go toolchain builds the test-only oracle; vault itself needs no Go.

Cargo.lock

@@ -1132,7 +1132,7 @@ checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
 [[package]]
 name = "vault"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "aes",
  "argon2",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vault"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 rust-version = "1.99"
 license = "GPL-3.0-or-later"

fuzz/Cargo.lock

@@ -1091,7 +1091,7 @@ checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
 [[package]]
 name = "vault"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "argon2",
  "base64",

src/util.rs

@@ -526,12 +526,13 @@ mod tests {
         );
         assert_eq!(Instant::parse_rfc3339("2023-02-29T00:00:00Z"), None);
         assert!(Instant::parse_rfc3339("2024-02-29T00:00:00Z").is_some());
-        let neg = Instant::from_system(std::time::UNIX_EPOCH - Duration::new(0, 1));
+        // 100 ns: Windows' SystemTime resolution.
+        let neg = Instant::from_system(std::time::UNIX_EPOCH - Duration::new(0, 100));
         assert_eq!(
             neg,
             Instant {
                 secs: -1,
-                nanos: 999_999_999
+                nanos: 999_999_900
             }
         );
         assert_eq!(Instant::from_system(neg.to_system()), neg);

tests/cli.rs

@@ -24,7 +24,13 @@ struct Env {
 
 impl Env {
     fn new(tag: &str) -> Env {
-        let dir = std::env::temp_dir().join(format!(
+        // Not temp_dir(): macOS's long $TMPDIR pushes the agent socket path
+        // past SUN_LEN.
+        #[cfg(unix)]
+        let base = PathBuf::from("/tmp");
+        #[cfg(not(unix))]
+        let base = std::env::temp_dir();
+        let dir = base.join(format!(
             "vault-cli-{tag}-{}-{}",
             std::process::id(),
             std::time::SystemTime::now()
@@ -48,6 +54,10 @@ impl Env {
         if let Some(p) = pass {
             c.env("VAULT_PASSPHRASE", p);
         }
+        // No console, as Unix tests have no terminal: CI runners have a
+        // hidden one, where a prompt would wait forever.
+        #[cfg(windows)]
+        std::os::windows::process::CommandExt::creation_flags(&mut c, 0x0000_0008); // DETACHED_PROCESS
         c
     }
 
@@ -152,7 +162,7 @@ fn rust_lifecycle() {
 #[test]
 fn go_made_rust_used() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     lifecycle(go.to_str().unwrap(), RUST);
 }
@@ -160,7 +170,7 @@ fn go_made_rust_used() {
 #[test]
 fn rust_made_go_used() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     lifecycle(RUST, go.to_str().unwrap());
 }
@@ -169,7 +179,7 @@ fn rust_made_go_used() {
 #[test]
 fn boundary_sizes_interop() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     let go = go.to_str().unwrap();
     let e = Env::new("bounds");
@@ -382,7 +392,7 @@ fn lock_contention(holder: &str, waiter: &str) {
 #[test]
 fn lock_rust_waits_for_go() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     lock_contention(go.to_str().unwrap(), RUST);
 }
@@ -391,7 +401,7 @@ fn lock_rust_waits_for_go() {
 #[test]
 fn lock_go_waits_for_rust() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     lock_contention(RUST, go.to_str().unwrap());
 }
@@ -431,7 +441,7 @@ fn agent_rust() {
 #[test]
 fn agent_go_client_rust_agent() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     agent_roundtrip(RUST, go.to_str().unwrap());
 }
@@ -440,27 +450,19 @@ fn agent_go_client_rust_agent() {
 #[test]
 fn agent_rust_client_go_agent() {
     let Some(go) = common::go_oracle() else {
-        return common::skip("go not installed");
+        return common::skip("no Go oracle");
     };
     agent_roundtrip(go.to_str().unwrap(), RUST);
 }
 
 #[cfg(unix)]
 fn agent_pids(sock_dir: &Path) -> Vec<u32> {
-    let mut pids = Vec::new();
-    for e in std::fs::read_dir("/proc").into_iter().flatten().flatten() {
-        let Ok(pid) = e.file_name().to_string_lossy().parse::<u32>() else {
-            continue;
-        };
-        let Ok(cmd) = std::fs::read(e.path().join("cmdline")) else {
-            continue;
-        };
-        let cmd = String::from_utf8_lossy(&cmd);
-        if cmd.contains("__agent") && cmd.contains(&*sock_dir.to_string_lossy()) {
-            pids.push(pid);
-        }
-    }
-    pids
+    // pgrep, not /proc: macOS has no /proc.
+    let o = Command::new("pgrep")
+        .args(["-f", &format!("__agent {}", sock_dir.display())])
+        .output()
+        .unwrap();
+    String::from_utf8_lossy(&o.stdout).lines().filter_map(|l| l.parse().ok()).collect()
 }
 
 #[cfg(target_os = "linux")]

tests/common/mod.rs

@@ -31,10 +31,14 @@ pub fn go_oracle() -> Option<PathBuf> {
         if let Some(p) = std::env::var_os("VAULT_GO_ORACLE") {
             return Some(PathBuf::from(p));
         }
-        if !have_go() {
+        // The frozen Go version cannot sync directories on Windows ("Access
+        // is denied"), so its vaults cannot be shared there.
+        if cfg!(windows) || !have_go() {
             return None;
         }
-        let out = root().join("target").join("vault-go-oracle");
+        let out = root()
+            .join("target")
+            .join(format!("vault-go-oracle{}", std::env::consts::EXE_SUFFIX));
         let st = Command::new("go")
             .args(["build", "-o"])
             .arg(&out)