Makefile

# SPDX-License-Identifier: BSD-3-Clause
# oring — local gate runner: how oring is built, tested, and proven.
#
#   make            same as `make check`
#   make doctor     check prerequisites (rustc + the musl target)
#   make check      the gate: fmt + clippy + test (what CI runs)
#   make build      release static-musl binary with an embedded auditable SBOM
#   make test       the test suite (the ring tests need a Landlock kernel)
#   make verify     Kani symbolic proofs (the x32 seccomp guard, the ABI clamp)
#   make audit      scan the shipped binary's SBOM against RustSec
#   make clean      remove build artifacts
#
# Tooling, installed once as needed:
#   rustup target add x86_64-unknown-linux-musl                # build
#   cargo install cargo-auditable cargo-audit --locked         # build, audit
#   cargo install --locked kani-verifier && cargo kani setup   # verify
#   z3 (system)                                                # the seccomp SMT gate in `make test`

CARGO  := cargo
TARGET := x86_64-unknown-linux-musl
BIN    := target/$(TARGET)/release/oring

.PHONY: all help doctor check build test verify audit clean

all: check

help:
	@echo "oring — make <target>"
	@echo "  make doctor   check prerequisites (rustc + the musl target)"
	@echo "  make check    the gate: fmt + clippy + test"
	@echo "  make build    release static-musl binary with an embedded auditable SBOM"
	@echo "  make test     the test suite (the ring tests need a Landlock kernel)"
	@echo "  make verify   Kani symbolic proofs (x32 guard, ABI clamp)"
	@echo "  make audit    scan the shipped binary's SBOM against RustSec"
	@echo "  make clean    remove build artifacts"

doctor:
	@command -v cargo >/dev/null 2>&1 && echo "✓ cargo $$(cargo --version | cut -d' ' -f2)" || { echo "✗ cargo not found — https://rustup.rs"; exit 1; }
	@rustup target list --installed 2>/dev/null | grep -qx $(TARGET) && echo "✓ musl target present" || echo "… missing musl target — run: rustup target add $(TARGET)"
	@echo "✓ ready"

# The everyday gate — the same fmt/clippy/test CI runs. clippy uses --features
# bpf-dump (the analysis-only code), NOT --all-features: resolve-unix needs the
# out-of-tree V9 fork and cannot compile against the published crate.
check:
	@echo "== FMT =="
	$(CARGO) fmt --check
	@echo "== CLIPPY =="
	$(CARGO) clippy --all-targets --features bpf-dump --locked
	@echo "== TEST =="
	$(CARGO) test --locked
	@echo "== oring: gate passed (fmt + clippy + test) =="

# Release build with an embedded, auditable dependency SBOM: the static binary
# carries its full dependency tree, so `make audit` (or any consumer) can scan the
# SHIPPED artifact against RustSec, not just Cargo.lock.
build:
	$(CARGO) auditable build --release --locked --target $(TARGET)

test:
	$(CARGO) test --locked

# Formal proof — opt-in (Kani, minutes). See docs/VERIFICATION.md.
verify:
	$(CARGO) kani --harness x32_guard_total
	$(CARGO) kani --harness abi_from_version_clamp

# Scan the shipped binary's embedded SBOM against the RustSec advisory database.
audit:
	$(CARGO) audit bin $(BIN)

clean:
	$(CARGO) clean

.DEFAULT_GOAL := help