Author: Andy Green <andy@warmcat.com>
Date: Sun Oct 04 20:02:39 2026 +0100

sai: c-oracle: build C with tls, which the digest retry transcripts need

Since C's 28c43133e, api-test-sansio's case 49, an h1 and a ws client
retrying a digest challenge, only exists with a tls library, since the
client's digest hashes with its genhash.  c-oracle built C with
LWS_WITH_SSL=OFF, so it recorded neither h1-client-digest-retry.json nor
ws-client-digest-retry.json, and failed as if C had removed them: C's
transcripts are unchanged since bd9c8170.

Build with openssl, C's default, and without h3, which would want gnutls
as well and records nothing.  The option is given as ON, not dropped,
since the build dir is kept between jobs and its cache says OFF.  At C
1328f31 the job records the 59 transcripts npro holds.

The failure said C's transcripts moved; say instead that either C moved
them or the build lacks an option they need.  The builder needs
openssl-devel, as docs/sai.md now says.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019kg5Eemy68ZaqDBcUJQG6J


diff --git a/docs/sai.md b/docs/sai.md
index 14ac114..5af949b 100644
--- a/docs/sai.md
+++ b/docs/sai.md
@@ -101,7 +101,7 @@ cargo +nightly miri setup --target i686-unknown-linux-gnu
 and, as root, for the C build `c-oracle` does:
 
 ```sh
-dnf install git cmake make gcc zlib-devel
+dnf install git cmake make gcc zlib-devel openssl-devel
 ```
 
 Miri builds a standard library for each target it interprets.
diff --git a/scripts/sai.sh b/scripts/sai.sh
index 40e4ecb..ec873bd 100755
--- a/scripts/sai.sh
+++ b/scripts/sai.sh
@@ -96,7 +96,9 @@ miri)
 oracle)
 	# A C lws checkout of main-dev kept between jobs, built with what
 	# every transcript needs: fault injection for the seeded random,
-	# extensions and zlib for the permessage-deflate ones
+	# extensions and zlib for the permessage-deflate ones, and a tls
+	# library, whose genhash the digest auth ones need.  The tls is
+	# openssl, the default; h3 would need gnutls too, and records nothing.
 	c="${LWS_ORACLE:-$HOME/lws-oracle}"
 	require_cmd git "dnf install git"
 	require_cmd cmake "dnf install cmake"
@@ -104,6 +106,8 @@ oracle)
 	require_cmd cc "dnf install gcc"
 	require_run "zlib headers" "dnf install zlib-devel" \
 		sh -c 'echo "#include <zlib.h>" | cc -E - >/dev/null'
+	require_run "openssl headers" "dnf install openssl-devel" \
+		sh -c 'echo "#include <openssl/ssl.h>" | cc -E - >/dev/null'
 	require_done
 	if [ ! -d "$c/.git" ]; then
 		git clone --depth 50 -b main-dev \
@@ -114,7 +118,8 @@ oracle)
 	echo "== C lws $(git -C "$c" log -1 --format='%h %s')"
 
 	cmake -S "$c" -B "$c/build-oracle" -DCMAKE_BUILD_TYPE=DEBUG \
-		-DLWS_WITH_SSL=OFF -DLWS_WITH_MINIMAL_EXAMPLES=ON \
+		-DLWS_WITH_SSL=ON -DLWS_WITH_HTTP3=OFF \
+		-DLWS_WITH_MINIMAL_EXAMPLES=ON \
 		-DLWS_WITH_SYS_FAULT_INJECTION=ON -DLWS_WITHOUT_EXTENSIONS=OFF \
 		-DLWS_WITH_ZLIB=ON
 	cmake --build "$c/build-oracle" --target lws-api-test-sansio -j "$jobs"
@@ -129,8 +134,9 @@ oracle)
 		echo "== the transcripts match C $(git -C "$c" log -1 --format=%h)"
 		exit 0
 	fi
-	echo "C's transcripts moved since $(cut -c1-12 "$ours/C-COMMIT"):"
-	echo "sync them with scripts/sync-c-oracle.sh and say why in the commit"
+	echo "C's transcripts differ from those of $(cut -c1-12 "$ours/C-COMMIT"):"
+	echo "if C changed them, sync them with scripts/sync-c-oracle.sh and say"
+	echo "why in the commit; if C did not, this build lacks an option they need"
 	exit 1
 	;;