CI Tests: valgrind-pam-1

[Darren Tucker]

On Sat, 5 Sept 2026 at 00:06, Chris Rapier <rapier at psc.edu> wrote:
> Quick question about the regression test setup used in the github CI
> tests. valgrind-pam-1 seems to run the entire suite of regression tests
> instead of just those tests that PAM would impact. Is that intentional?

Yes.   PAM is not just authentication but also session management, so
every test involving sshd (with UsePAM=yes) will go through a
pam_open_session.  Is it likely that something like a kex test would
get tripped up by that?  No, but we occasionally get surprised by what
gets caught by the tests[0].

We could potentially cut out tests that don't involve sshd at all (eg
sftp) but that would be time and effort both of which are currently in
short supply, and so far it hasn't been worth it.

[0] we also sometimes get surprised by what doesn't get caught by a
test, so we tend to err on the side of more test coverage.
-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.