keyhog 0.5.73

GPU-accelerated secret scanner for code, Git history, cloud, containers, browser assets, and live credential verification
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

#[cfg(test)]
use super::{
    fused_cpu_wave_width, fused_depth_default, gpu_runtime_policy_for_backend_override,
    gpu_runtime_policy_from_args, persistent_daemon_worker_width, require_keyhog_owned_rayon_pool,
    sanitise_thread_count, thread_pool_needs_initialization, KEYHOG_WORKER_STACK_BYTES,
};
#[cfg(test)]
use crate::args::ScanArgs;
#[cfg(test)]
use clap::Parser;
#[cfg(test)]
use keyhog_scanner::{gpu::GpuRuntimePolicy, ScanBackend};

#[cfg(test)]
#[test]
fn explicit_daemon_backend_owns_the_matching_gpu_policy() -> anyhow::Result<()> {
    assert_eq!(
        gpu_runtime_policy_for_backend_override(Some(ScanBackend::GpuCuda))?,
        GpuRuntimePolicy::Required,
    );
    assert_eq!(
        gpu_runtime_policy_for_backend_override(Some(ScanBackend::GpuWgpu))?,
        GpuRuntimePolicy::Required,
    );
    assert_eq!(
        gpu_runtime_policy_for_backend_override(Some(ScanBackend::SimdCpu))?,
        GpuRuntimePolicy::Disabled,
    );
    assert_eq!(
        gpu_runtime_policy_for_backend_override(Some(ScanBackend::CpuFallback))?,
        GpuRuntimePolicy::Disabled,
    );
    assert_eq!(
        gpu_runtime_policy_for_backend_override(None)?,
        GpuRuntimePolicy::Auto,
    );
    Ok(())
}

#[cfg(test)]
#[test]
fn explicit_scan_gpu_peers_are_required() -> anyhow::Result<()> {
    for backend in ["gpu-cuda", "gpu-wgpu"] {
        let args = ScanArgs::try_parse_from(["scan", "--backend", backend, "--stdin"])?;
        assert_eq!(
            gpu_runtime_policy_from_args(&args),
            GpuRuntimePolicy::Required,
            "explicit {backend} must never relax to automatic GPU policy"
        );
    }
    Ok(())
}

#[cfg(test)]
#[test]
fn repeated_rayon_configuration_accepts_the_live_width() -> anyhow::Result<()> {
    assert!(!thread_pool_needs_initialization(Some(16), 16, "test")?);
    assert!(thread_pool_needs_initialization(None, 16, "test")?);
    Ok(())
}

#[cfg(test)]
#[test]
fn repeated_rayon_configuration_rejects_a_different_width() -> anyhow::Result<()> {
    let error = match thread_pool_needs_initialization(Some(16), 8, "test") {
        Ok(_) => panic!("an initialized Rayon pool cannot honor a different width"),
        Err(e) => e.to_string(),
    };
    assert!(
        error.contains("already has 16 threads") && error.contains("requested 8"),
        "mismatch diagnostic must name the live and requested widths: {error}"
    );
    Ok(())
}

#[cfg(test)]
#[test]
fn sanitise_thread_count_rejects_zero() {
    assert_eq!(sanitise_thread_count(0, 16, "test"), 16);
    assert_eq!(sanitise_thread_count(0, 1, "test"), 1);
}

#[cfg(test)]
#[test]
fn fused_default_allows_only_active_and_blocked_send_batches() {
    assert_eq!(fused_depth_default(1), 0);
    assert_eq!(fused_depth_default(256), 0);
}

#[cfg(test)]
#[test]
fn fused_cpu_waves_retain_at_most_four_batches() {
    assert_eq!(fused_cpu_wave_width(0), 1);
    assert_eq!(fused_cpu_wave_width(1), 1);
    assert_eq!(fused_cpu_wave_width(4), 4);
    assert_eq!(fused_cpu_wave_width(32), 4);
}

#[cfg(test)]
#[test]
fn worker_stack_reservation_matches_the_bounded_runtime_contract() {
    assert_eq!(KEYHOG_WORKER_STACK_BYTES, 2 * 1024 * 1024);
}

#[cfg(test)]
#[test]
fn persistent_daemon_worker_width_is_bounded() {
    assert_eq!(persistent_daemon_worker_width(1), 1);
    assert_eq!(persistent_daemon_worker_width(8), 8);
    assert_eq!(persistent_daemon_worker_width(32), 8);
}

#[cfg(test)]
#[test]
fn externally_owned_same_width_rayon_pool_is_rejected() -> anyhow::Result<()> {
    let error = match require_keyhog_owned_rayon_pool(Err("already initialized"), 16, "test", || 16)
    {
        Ok(_) => panic!("same-width external Rayon ownership must be rejected"),
        Err(e) => e.to_string(),
    };
    assert!(
        error.contains("initialized outside KeyHog")
            && error.contains("KeyHog-owned pool with 16 threads")
            && error.contains("2 MiB worker stacks"),
        "same-width external ownership must fail closed with the unverifiable setting: {error}"
    );
    Ok(())
}