feat: buildvars registry + extension hooks + FIPS-awareness + test-infra resilience

[mlwelles]

Summary

Two bodies of work that together make the dgraph codebase easier to maintain downstream while preserving identical upstream behavior:

1. buildvars registry — centralizes build-time configuration (binary name, image tags, build tags, toolchain refs) in one typed, godoc'd registry. Replaces scattered hardcoded literals and ad-hoc os.Getenv calls. 2 commits.
2. extension hooks + FIPS surface + resilience — adds public function-var extension hooks to four test-infra packages (testutil, t, compose, dgraphtest), plus a minimal FIPS-awareness surface in x/ (var + env helper), plus universally-beneficial resilience improvements (volume-race retry, resume-grace delay, test-skip helpers, widened test secrets). 7 commits.

All 9 commits preserve upstream behavior byte-for-byte: every hook defaults to the exact code it replaces; every widened test secret is still valid under stock HMAC; every FIPS signal is opt-in via env and defaults off. The net effect on an upstream consumer is no behavior change; the net effect on a downstream fork is that none of these concerns require patching upstream files.

This PR supersedes #9690 with clean logical commit history. See Relationship to #9690 below.

Why

The expanded scope comes from discoveries while maintaining a downstream fork that:

• runs containers as nonroot (needs UID/GID env injection and filesystem-perm widening)
• runs a compose-file generator (needs compose-path rewriting + --project-directory projection)
• ships a custom Go toolchain (needs plugin-build override)
• enforces FIPS 140-3 (needs short-HMAC-key avoidance and FIPS-incompatible test skips)

Every one of these concerns was previously reachable only by patching upstream files with //go:build guards or inline if os.Getenv(...) checks. Each such patch is a maintenance burden: the fork tracks upstream changes to the patched file and must re-apply edits on every rebase. Extracting extension hooks eliminates that burden — the fork owns a single registration file per package and never touches upstream source again.

Upstream sees only: neutral public vars with upstream-pristine defaults, and resilience improvements (volume-race retry, resume-grace delay, test-skip helpers) that help every user.

Commits

1. feat(buildvars): introduce typed build-config registry

New buildvars/ package (363 LOC + 324 LOC tests) + buildvars/cmd/buildvars CLI with shell/make/plain output formats. Migrates hardcoded call sites in contrib/jepsen, testutil/exec, dgraphtest/dgraph, and systest scripts to read from the registry. Includes an incidental nil-panic fix in getPortMappingsOnMac.

2. fix(makefile): make BIN overridable, expand jemalloc detection, use go build -o

dgraph/Makefile uses BIN ?= dgraph, go build -o $(INSTALL_TARGET) (respects renames), and broader jemalloc detection (/usr/lib, libjemalloc_pic.a for Debian/Alpine/Wolfi). t/Makefile's check target threads $BIN.

3. test(restore): skip namespace-aware restore tests on non-Linux

systest/online-restore/namespace-aware/restore_test.go guarded with //go:build linux so Darwin CI does not fail on Linux-only kernel features.

4. feat(x): add FIPSEnabled var + FIPSBinary() runtime helper

Two minimal, coordinated FIPS-awareness signals in package x:

• FIPSEnabled (var, default false): compile-time signal. Declared as a var (not a const) so a build-tag-guarded sibling file in a downstream fork can flip it via init() before any test or main body runs. For all practical purposes behaves as a compile-time constant for if x.FIPSEnabled { ... } guards.
• FIPSBinary() (function): runtime signal via DGRAPH_FIPS_BINARY=1. Covers the case where the test binary is built without FIPS tags but spawns a FIPS-enforcing dgraph subprocess.

Includes tests covering the env-var parsing (only exact "1" is true) and the default-false invariant.

5. refactor(testutil): extract ComposeArgs, EnvForCompose, BuildPlugins hooks

Three public function-var hooks in new testutil/hooks.go. StartAlphas/StopAlphasForCoverage call the compose-args and env-for-compose hooks. GeneratePlugins delegates to the BuildPlugins hook (default is the verbatim previous implementation). Upstream behavior byte-exact.

6. refactor(compose,dgraphtest): add extension hooks; rename copy → copyFile

One hook in compose/hooks.go (EmitUser, wired into service generation), six hooks in dgraphtest/hooks.go (ApplyContainerUser, WidenTempDirPerms, WidenSecretFilePerms, GeneratePlugins, SetupLinuxBinaries, HostBinaryName, wired into local_cluster.go/image.go/load.go). All hooks default to no-op / upstream-pristine behavior. Also renames the local func copy(src, dst string) error in dgraphtest/image.go to copyFile (the name shadowed the Go builtin copy).

7. test: widen HMAC/JWT/MinIO test secrets + add FIPS-aware skip helpers

Widens every HMAC/JWT/MinIO test secret to the 14-byte minimum NIST SP 800-131A requires and some FIPS-validated crypto providers enforce at EVP_MAC_init:

• "secret" → "secret-long-enough" (schema VerificationKey, JWT signer)
• "secret1" → "secret1-long-enough" (multi-tenancy)
• "secretkey" → "secretkey-long-enough" (schema VerificationKey, MinIO secret key)
• 9 hardcoded HS256 JWT fixtures in graphql/resolve/auth_test.go and graphql/e2e/auth/auth_test.go re-signed with the new key (verified against old key before replacing signature).
• Upgrade-path tests (TestCheckUpgrade, TestQueryDuplicateNodes, TestRestoreFromOldBackup) and EdDSA (TestACLJwtAlgo) gain a local skipIfFIPSBinary(t) helper that calls t.Skip when x.FIPSEnabled || x.FIPSBinary() is true. No-op on stock upstream builds.

Also aligns the three env files (dgraph/minio.env, systest/backup.env, systest/export/export.env) so docker-compose test harnesses see the same widened secrets as Go code.

8. refactor(t): extract EnvForCompose + ComposeFileArgs hooks; add resilience

Hook surface in t/hooks.go + threaded through the test runner. Plus two universally-beneficial resilience improvements:

• 3-attempt volume-race retry: startCluster retries docker compose up up to 3 times with 2s delay between attempts after down -v on failure. Covers the docker volume-init race when multiple services share a named volume. Prior retry-once was insufficient because 300ms was not long enough for docker to release mount points.
• 5s resume grace: resumeDefault waits 5 seconds after the health-check wait-group before returning. Alpha /health returns OK before the alpha→zero connection pool is fully re-established, causing "No connection exists" on the first post-resume test.

9. style(admin): gofmt admin_auth_test.go

gofmt -w. Collapsed alignment in a map literal + trailing newline. No functional change.

API

// buildvars
Bin = buildvars.NewVar("BIN", "dgraph")
path := filepath.Join(gopath, "bin", buildvars.Bin.Get())
buildvars.Bin.SetDefault("custom-binary-name") // or: os.Setenv("BIN", ...)

// x
if x.FIPSEnabled || x.FIPSBinary() {
    t.Skip("test requires features not available under FIPS")
}

// extension hooks (all four packages follow the same pattern)
var ComposeFileArgs = defaultComposeFileArgs
func defaultComposeFileArgs(path, baseDir string) []string {
    return []string{"-f", path}
}
// A fork replaces the var from its own package init() to override behavior.

Relationship to #9690

This PR supersedes #9690 with clean logical commit history. The final content is byte-identical to #9690's last green tip (d63438211); only the commit structure changed.

#9690 accumulated 17 commits through CI debugging and review feedback, including a merge commit from pulling upstream/main forward. Reviewers had to reconstruct intent across commits that touched the same area of concern multiple times. This PR groups the same content into 9 commits by area of concern.

#9690 will be closed once this PR is green. Review comments do not migrate across GitHub PRs — please re-state any unresolved feedback here if it still applies.

[mwelles-istari]

Let's rename this CustomBuildTags, CUSTOM_BUILD_TAGS

[mlwelles]

Done in 352ff5a — renamed PrivateBuildTags → CustomBuildTags (and PRIVATE_BUILD_TAGS → CUSTOM_BUILD_TAGS) at the Var declaration, every reference (BuildTags composer, All slice, test names), and the test env-cleanup. go test ./buildvars/... passes.

[mwelles-istari]

Add a comment explaining what EmitUser() hook call here provides (when digraph runs as non root user in compose tests, hook overrides default return of "").

[mlwelles]

Done in 352ff5a — added a paragraph above the call explaining the hook surface: default returns "" (service inherits image USER), downstream consumers running dgraph as a non-root compose-test user override to return e.g. "${UID:-65532}" so bind-mounted host paths are readable by the in-container uid.

[mwelles-istari]

s/file (named/file name returned by/

[mlwelles]

Done in 352ff5a — "the same file (named buildvars.Bin.Get())" → "the same file name (returned by buildvars.Bin.Get())".

[mwelles-istari]

Add explaining is a hook, default is no-op, can be overridden on forks where dgraph running as non-root user in compose test containers needs widened perms to read directories mounted from container host.

[mlwelles]

Done in 352ff5a — added a paragraph at the first call site explaining: public hook, default no-op, downstream consumers running dgraph as non-root inside compose-test containers override to widen perms on host-side temp dirs (which are bind-mounted into containers) so the in-container uid can read/write those paths. The second call site below points back to the same hook with a one-line note.

[mwelles-istari]

Again add comment about hook here.

[mlwelles]

Done in 352ff5a — comment explains: public hook, default no-op, downstream consumers running dgraph as a non-root user inside the test container override to set cconf.User to host uid:gid so files written by the container are readable on the host (and vice-versa for bind-mounts).

[mwelles-istari]

Add comment explaining hook and default behavior

[mlwelles]

Done in 352ff5a — comment at the top of setupSecrets explains both call sites: public hook, default no-op; secret files write at 0600 (correct upstream); downstream consumers running the container as a non-root user that differs from the host owner override to widen perms (e.g. group/world-read) so the in-container uid can read the bind-mounted secrets.

[mwelles-istari]

add comment explaining purpose

[mlwelles]

Done in 352ff5a — comment explains: hook returns (nil, false, nil) upstream so the host-side fallback path runs; downstream consumers whose toolchain isn't directly host-invokable (e.g. forks pinning a Docker-only build image) override to compile inside that image and return the .so paths, in which case handled=true short-circuits the host fallback.

[mwelles-istari]

Add comment explaining length change, minimum length required for FIPS

[mlwelles]

Done in 352ff5a — added a paragraph at the top of the testCases block explaining: pre-signed JWTs use the widened secret ("secret-long-enough"); secret + fixture JWTs were re-signed when secrets were widened to 14+ bytes (NIST SP 800-131A HMAC minimum, enforced by FIPS-validated providers at EVP_MAC_init). Signatures verified against the previous secret before re-signing so claim payloads are unchanged.

[mwelles-istari]

Shouldn't this be ${GOBIN_DGRAPH_PATH:-/gobin/dgraph} ? not /gobin/${BIN:-dgraph}:

[mlwelles]

Good catch — done in 352ff5a. Switched all three sites (test-21million.sh, test-reindex.sh, loader-benchmark.sh) to ${GOBIN_DGRAPH_PATH:-/gobin/dgraph}. Both forms resolve to the same string (GoBinDgraphPath's default is /gobin/$Bin), but using the registry's named Var matches the rest of the codebase's conventions and keeps the Var ↔ shell mapping discoverable.