Retest the fixed bugs of #9 with the GUI VMs (batch 6) #25

New issue

Open

opened 2026-11-10 16:12:03 +00:00 by asxpi · 0 comments

asxpi commented

2026-11-10 16:12:03 +00:00

Member

Versions (at 2026-11-10; step 1 below updates them)

	version
anotherim-js	0.8.0 (`a9d303a2`, libtacky v1.2.7); develop has 3 more (XEP-0245 `/me` drawn as an action, b187c257 citing this repo's batch 3; the undecryptable line)
libtacky	v1.2.7 (`49b4c635`, 2026-11-10); develop has 5 more commits toward 1.2.8 (room invites, `65a31465`)
servers / peers	unchanged since the original runs: Prosody 13.0.7, ejabberd 26.09, anotherim-server `master@b9e675dd`; Gajim 2.6.0, Dino 0.5.1, Kaidan 0.16.0, anotherim-web (same build as the app)

Upstream check before batch 6 (2026-11-10 ~19:00 UTC): libtacky develop 65a31465 (v1.2.7-5), latest release v1.2.7; anotherim-js develop b8a7b85e (v0.8.0 + 6: XEP-0245 /me as an action, the undecryptable line, an Android notice key), which pins libtacky v1.2.7. Built b8a7b85e with XML_LOG=1: another-im-tauri-0.8.0-develop-b8a7b85e-xmllog-x86_64.AppImage (sha256 223feb9e…de9901) and its web build; batch 6 tests that.

Plan (batch 6, after batch 5)

Steps, in order:

Check upstream again (libtacky develop and releases, anotherim-js develop and releases, comments on #1, #9, #24 and here) for fixes newer than batch 5's.
If anotherim-js has anything newer than 0.8.0, build it (XML_LOG=1 AppImage and the web build, as for rc9 and 0.8.0) and test that; else test 0.8.0 (a9d303a2, built 2026-11-10).
Re-run the VM runs behind every #9 item fixed by then (the main table's "Fixed upstream" column, the "Also fixed" table, UI gaps fixed upstream such as XEP-0245 /me), with the same peers, plus a regression run next to each.

All #9 bugs

Every item of #9's bug table (rc9 / v1.2.3, 20 found after batch 4), with #9's status and the upstream fix as of 2026-11-10 ~17:00 UTC (libtacky develop 65a31465, anotherim-js develop b8a7b85e; no newer). Retest yes = fixed upstream (fully or partly); the rest stay listed, not run. Result: ⏳ pending, then ✅ fixed / 🟡 partly / ❌ still there, with the run.

#	Bug	Severity	Status in #9	Fixed upstream	Retest	Result
S14	OMEMO 2: aim's retraction goes out in the clear; Kaidan shows the fallback	security/privacy	open, reproduced batch 0 + 1	1.2.4 95e7007d (bare `<retract id/>` kept beside by default, `retract_hint`)	yes	⏳
S15	OMEMO: reactions, receipts, markers in the clear; file metadata whenever a 0.3 envelope goes out	security/privacy	open; file part re-recorded batch 1	no: sealed only once servers advertise `urn:tacky:push:sealed-signals:0` (none yet)	no	–
C35	MUC: no instant-room configuration after creating a room	correctness	open, reproduced batch 2, batch 3 also for a room anotherim-web made (Prosody unlocks after 5 min, deletes the room when empty)	–	no	–
C36	Calls: a session-accept without `<rtcp-mux/>` is rejected (Kaidan)	correctness	open, reproduced batch 2 on all three	1.2.4 ebd5f227, 4b5e279f, 7d76eab7	yes	⏳
C38	OMEMO 2 with Kaidan: "can't be read" count grows	correctness	not reproduced by restarts; rose around each XEP-0424 run, unexplained	–	no	–
C39	~~Calls: aim's outgoing video never shown~~	–	withdrawn (harness, #16)	–	no	–
C40	XEP-0448: aes-256-cbc-pkcs7 shares (Kaidan's) not decrypted; URL-named card, Download keeps the ciphertext	correctness	open (Kaidan's IV off-spec too)	1.2.5 c5f1e50e	yes	⏳
C41	XEP-0448: aim's sent picture has no esfs source (aesgcm:// + SIMS only)	correctness	open	1.2.5 9f6ac320: the stored record was a clear rebuild, not the wire; recheck which one our evidence shows	yes	⏳
C42	`urn:tacky:omemo-trust:0`: a contact key's change is published only for Undecided → Verified	correctness	refined batch 2	1.2.5 8a83649a	yes	⏳
C43	XEP-0482: aim's `<accept/>`/`<reject/>`/`<left/>` withheld in an OMEMO room when a member has no OMEMO device	correctness	new, batch 2, batch 3 prosody too	partly, 1.2.6 ad62fa11: answers to a clear invite go clear; to a sealed one still withheld	yes	⏳
C44	Muji group call: anotherim-web hears nothing from aim (opus arrives, level 0)	correctness	new, batch 2, side not traced; batch 3 prosody too	–	no	–
C45	MUC: membership and ban sent with the occupant's full JID; Prosody refuses them silently	correctness	new, batch 2 (was a candidate)	1.2.6 606eee7f	yes	⏳
C46	Mediated room invite: a second 1:1-looking chat of the room's JID; on Prosody no invitation card	correctness	new, batch 2 (was a candidate)	1.2.6 3569c3fa, bcad614e, 3bb27017, 8ff28739 (also: ejabberd's room password in the invite body hidden)	yes	⏳
C47	XEP-0054: aim writes its profile only as vCard4 (XEP-0292); Kaidan (vcard-temp only) reads an empty card	correctness	new, batch 4	–	no	–
C48	XEP-0191: the OMEMO device-list fetch that failed while blocked is never retried after the unblock; the next message fails "no devices"	correctness	new, batch 4 (seen as web, same libtacky)	–	no	–
M26	No desktop notification while aim's window has focus	minor	open (may be intended)	–	no	–
M27	"View XML" shows OMEMO 2 messages with the 0.3 EME namespace	minor	open, cause in libtacky	1.2.4 94769ce0	yes	⏳
M28	anotherim-web shows no desktop notification	minor	open (harness Chromium only)	–	no	–
M29	XEP-0425: a moderated message shows as "Message retracted", without moderator or reason	minor	new, batch 2 (was a candidate)	library side, 1.2.6 67894a54 (`moderated_by`, `retract_reason`); anotherim-js must show them	yes	⏳
M30	XEP-0084: aim keeps a contact's avatar after the contact deletes its metadata node	minor	new, batch 4	–	no	–
M31	XEP-0172: after an empty `<nick/>` anotherim-web's Contact info keeps the old nick	minor (anotherim-js UI)	new, batch 4	–	no	–
P1	Kaidan: "Checksum does not match" on aim's OMEMO 2 upload	peer (Kaidan)	proven Kaidan's, report upstream	–	no	–
P2	~~Prosody test server hands out no STUN/TURN~~	server config	fixed by #13	–	no	–
P3	Dino intermittently sends no audio in calls	peer (Dino)	reproduced batch 2, first time on prosody (2 of 3 runs), report upstream	–	no	–
P4	Dino 0.5.1 rejects aim's JET cipher `aes-128-gcm-nopadding:0`	peer (Dino; XEP-0396 contradicts itself)	recorded batch 1	1.2.5 04e6935d (worked around: Dino's cipher spelling sent, both read)	yes	⏳
P5	Dino 0.5.1 rejects aim's IBB transport-replace after losing the tie-break	peer (Dino)	recorded batch 1	–	no	–
P6	ejabberd test server: proxy65 announces 127.0.0.2	server config	recorded batch 1, not fixed	–	no	–

Also fixed, mentioned elsewhere in #9 (not in its bug table):

Item	Fixed in	Retest	Result
Hang-up after answering Dino's XEP-0353 call: no session-terminate reaches Dino (230335)	libtacky 1.2.7 781b33ce: the terminate is written before the media is closed	yes	⏳
anotherim-js#95: destroyed-room view not shown in rc9 (225948)	libtacky 1.2.7 c9421614: cause in libtacky, the room's state stayed `joined` after `<destroy/>`	yes	⏳
anotherim-web answers aim's checksum `session-info` with `unknown-session` after a Jingle file transfer (180200)	libtacky 1.2.5 39d2ff82: no `<checksum/>` after the last byte (it raced the receiver's terminate)	yes	⏳
Dino shows a download button instead of aim's picture, `cid:` thumbnail unsupported (184517)	libtacky 1.2.5 c9dfdb6f: the share also carries the thumbnail as a `data:` URI (≤16 KiB), sealed when encrypted	yes	⏳
C34 (#1): a destroyed room recreated empty after a restart	libtacky 1.2.2 1aed459c	no (confirmed)	✅
C30 (#1): aim's decline doesn't reach the inviter	before rc9 (#1) –	no (confirmed)	✅
P2: Prosody test server hands out no STUN/TURN	interop #13 (coturn + `mod_turn_external`) –	no (confirmed)	✅

Not implemented in aim (UI gaps in #9; retest where upstream added it):

Item	Upstream	Retest	Result
XEP-0245 `/me` drawn raw	anotherim-js develop b187c257 (after 0.8.0)	yes, if the batch 6 build has it	⏳
urn:tacky:pep-expiry:0 time limit	–	no	–
XEP-0249 sending	–	no	–
XEP-0486 setting a room avatar	–	no	–
XEP-0425 moderating	–	no	–
XEP-0272/0482 starting a group call	–	no	–

Results

Filled in when batch 6 is merged.

Retest of the bugs marked fixed in #9 with the GUI VMs (batch 6), and a check that the fixes broke nothing nearby. Results go here; #9 keeps its original evidence and gets a link back once a row is confirmed. The #1 retest (batch 5, headless) is #24. ## Versions (at 2026-11-10; step 1 below updates them) | | version | |---|---| | anotherim-js | **0.8.0** (`a9d303a2`, libtacky v1.2.7); develop has 3 more (XEP-0245 `/me` drawn as an action, b187c257 citing this repo's batch 3; the undecryptable line) | | libtacky | **v1.2.7** (`49b4c635`, 2026-11-10); develop has 5 more commits toward 1.2.8 (room invites, `65a31465`) | | servers / peers | unchanged since the original runs: Prosody 13.0.7, ejabberd 26.09, anotherim-server `master@b9e675dd`; Gajim 2.6.0, Dino 0.5.1, Kaidan 0.16.0, anotherim-web (same build as the app) | **Upstream check before batch 6 (2026-11-10 ~19:00 UTC):** libtacky develop `65a31465` (v1.2.7-5), latest release v1.2.7; anotherim-js develop `b8a7b85e` (v0.8.0 + 6: XEP-0245 `/me` as an action, the undecryptable line, an Android notice key), which pins libtacky **v1.2.7**. Built `b8a7b85e` with XML_LOG=1: `another-im-tauri-0.8.0-develop-b8a7b85e-xmllog-x86_64.AppImage` (sha256 `223feb9e…de9901`) and its web build; batch 6 tests that. ## Plan (batch 6, after batch 5) Steps, in order: 1. Check upstream again (libtacky develop and releases, anotherim-js develop and releases, comments on #1, #9, #24 and here) for fixes newer than batch 5's. 2. If anotherim-js has anything newer than 0.8.0, build it (XML_LOG=1 AppImage and the web build, as for rc9 and 0.8.0) and test that; else test 0.8.0 (`a9d303a2`, built 2026-11-10). 3. Re-run the VM runs behind every #9 item fixed by then (the main table's "Fixed upstream" column, the "Also fixed" table, UI gaps fixed upstream such as XEP-0245 `/me`), with the same peers, plus a regression run next to each. ## All #9 bugs Every item of #9's bug table (rc9 / v1.2.3, 20 found after batch 4), with #9's status and the upstream fix as of 2026-11-10 ~17:00 UTC (libtacky develop `65a31465`, anotherim-js develop `b8a7b85e`; no newer). **Retest** yes = fixed upstream (fully or partly); the rest stay listed, not run. Result: ⏳ pending, then ✅ fixed / 🟡 partly / ❌ still there, with the run. | # | Bug | Severity | Status in #9 | Fixed upstream | Retest | Result | |---|---|---|---|---|---|---| | S14 | OMEMO 2: aim's retraction goes out in the clear; Kaidan shows the fallback | security/privacy | open, reproduced batch 0 + 1 | 1.2.4 [95e7007d](https://dev.another.im/another-im/libtacky/commit/95e7007d) (bare `<retract id/>` kept beside by default, `retract_hint`) | yes | ⏳ | | S15 | OMEMO: reactions, receipts, markers in the clear; file metadata whenever a 0.3 envelope goes out | security/privacy | open; file part re-recorded batch 1 | no: sealed only once servers advertise `urn:tacky:push:sealed-signals:0` (none yet) | no | – | | C35 | MUC: no instant-room configuration after creating a room | correctness | open, **reproduced batch 2**, batch 3 also for a room anotherim-web made (Prosody unlocks after 5 min, deletes the room when empty) | – | no | – | | C36 | Calls: a session-accept without `<rtcp-mux/>` is rejected (Kaidan) | correctness | open, **reproduced batch 2 on all three** | 1.2.4 [ebd5f227](https://dev.another.im/another-im/libtacky/commit/ebd5f227), [4b5e279f](https://dev.another.im/another-im/libtacky/commit/4b5e279f), [7d76eab7](https://dev.another.im/another-im/libtacky/commit/7d76eab7) | yes | ⏳ | | C38 | OMEMO 2 with Kaidan: "can't be read" count grows | correctness | not reproduced by restarts; rose around each XEP-0424 run, unexplained | – | no | – | | C39 | ~~Calls: aim's outgoing video never shown~~ | – | withdrawn (harness, #16) | – | no | – | | C40 | XEP-0448: aes-256-cbc-pkcs7 shares (Kaidan's) not decrypted; URL-named card, Download keeps the ciphertext | correctness | open (Kaidan's IV off-spec too) | 1.2.5 [c5f1e50e](https://dev.another.im/another-im/libtacky/commit/c5f1e50e) | yes | ⏳ | | C41 | XEP-0448: aim's sent picture has no esfs source (aesgcm:// + SIMS only) | correctness | open | 1.2.5 [9f6ac320](https://dev.another.im/another-im/libtacky/commit/9f6ac320): the *stored record* was a clear rebuild, not the wire; recheck which one our evidence shows | yes | ⏳ | | C42 | `urn:tacky:omemo-trust:0`: a contact key's change is published only for Undecided → Verified | correctness | **refined batch 2** | 1.2.5 [8a83649a](https://dev.another.im/another-im/libtacky/commit/8a83649a) | yes | ⏳ | | C43 | XEP-0482: aim's `<accept/>`/`<reject/>`/`<left/>` withheld in an OMEMO room when a member has no OMEMO device | correctness | **new, batch 2**, batch 3 prosody too | partly, 1.2.6 [ad62fa11](https://dev.another.im/another-im/libtacky/commit/ad62fa11): answers to a clear invite go clear; to a sealed one still withheld | yes | ⏳ | | C44 | Muji group call: anotherim-web hears nothing from aim (opus arrives, level 0) | correctness | **new, batch 2**, side not traced; batch 3 prosody too | – | no | – | | C45 | MUC: membership and ban sent with the occupant's full JID; Prosody refuses them silently | correctness | **new, batch 2** (was a candidate) | 1.2.6 [606eee7f](https://dev.another.im/another-im/libtacky/commit/606eee7f) | yes | ⏳ | | C46 | Mediated room invite: a second 1:1-looking chat of the room's JID; on Prosody no invitation card | correctness | **new, batch 2** (was a candidate) | 1.2.6 [3569c3fa](https://dev.another.im/another-im/libtacky/commit/3569c3fa), [bcad614e](https://dev.another.im/another-im/libtacky/commit/bcad614e), [3bb27017](https://dev.another.im/another-im/libtacky/commit/3bb27017), [8ff28739](https://dev.another.im/another-im/libtacky/commit/8ff28739) (also: ejabberd's room password in the invite body hidden) | yes | ⏳ | | C47 | XEP-0054: aim writes its profile only as vCard4 (XEP-0292); Kaidan (vcard-temp only) reads an empty card | correctness | **new, batch 4** | – | no | – | | C48 | XEP-0191: the OMEMO device-list fetch that failed while blocked is never retried after the unblock; the next message fails "no devices" | correctness | **new, batch 4** (seen as web, same libtacky) | – | no | – | | M26 | No desktop notification while aim's window has focus | minor | open (may be intended) | – | no | – | | M27 | "View XML" shows OMEMO 2 messages with the 0.3 EME namespace | minor | open, cause in libtacky | 1.2.4 [94769ce0](https://dev.another.im/another-im/libtacky/commit/94769ce0) | yes | ⏳ | | M28 | anotherim-web shows no desktop notification | minor | open (harness Chromium only) | – | no | – | | M29 | XEP-0425: a moderated message shows as "Message retracted", without moderator or reason | minor | **new, batch 2** (was a candidate) | library side, 1.2.6 [67894a54](https://dev.another.im/another-im/libtacky/commit/67894a54) (`moderated_by`, `retract_reason`); anotherim-js must show them | yes | ⏳ | | M30 | XEP-0084: aim keeps a contact's avatar after the contact deletes its metadata node | minor | **new, batch 4** | – | no | – | | M31 | XEP-0172: after an empty `<nick/>` anotherim-web's Contact info keeps the old nick | minor (anotherim-js UI) | **new, batch 4** | – | no | – | | P1 | Kaidan: "Checksum does not match" on aim's OMEMO 2 upload | peer (Kaidan) | proven Kaidan's, report upstream | – | no | – | | P2 | ~~Prosody test server hands out no STUN/TURN~~ | server config | fixed by #13 | – | no | – | | P3 | Dino intermittently sends no audio in calls | peer (Dino) | **reproduced batch 2, first time on prosody** (2 of 3 runs), report upstream | – | no | – | | P4 | Dino 0.5.1 rejects aim's JET cipher `aes-128-gcm-nopadding:0` | peer (Dino; XEP-0396 contradicts itself) | recorded batch 1 | 1.2.5 [04e6935d](https://dev.another.im/another-im/libtacky/commit/04e6935d) (worked around: Dino's cipher spelling sent, both read) | yes | ⏳ | | P5 | Dino 0.5.1 rejects aim's IBB transport-replace after losing the tie-break | peer (Dino) | recorded batch 1 | – | no | – | | P6 | ejabberd test server: proxy65 announces 127.0.0.2 | server config | recorded batch 1, not fixed | – | no | – | **Also fixed, mentioned elsewhere in #9** (not in its bug table): | Item | Fixed in | Retest | Result | |---|---|---|---| | Hang-up after answering Dino's XEP-0353 call: no session-terminate reaches Dino ([230335](https://dev.another.im/another-im/interop/src/branch/main/runs/20261109-230335-XEP-0353-aim-vs-dino+web-as-aim-prosody/EVIDENCE.md)) | libtacky 1.2.7 [781b33ce](https://dev.another.im/another-im/libtacky/commit/781b33ce): the terminate is written before the media is closed | yes | ⏳ | | anotherim-js#95: destroyed-room view not shown in rc9 ([225948](https://dev.another.im/another-im/interop/src/branch/main/runs/20261109-225948-XEP-0045-aim-vs-gajim-anotherim-server/EVIDENCE.md)) | libtacky 1.2.7 [c9421614](https://dev.another.im/another-im/libtacky/commit/c9421614): cause in libtacky, the room's state stayed `joined` after `<destroy/>` | yes | ⏳ | | anotherim-web answers aim's checksum `session-info` with `unknown-session` after a Jingle file transfer ([180200](https://dev.another.im/another-im/interop/src/branch/main/runs/20261109-180200-XEP-0234-aim-vs-web-prosody/EVIDENCE.md)) | libtacky 1.2.5 [39d2ff82](https://dev.another.im/another-im/libtacky/commit/39d2ff82): no `<checksum/>` after the last byte (it raced the receiver's terminate) | yes | ⏳ | | Dino shows a download button instead of aim's picture, `cid:` thumbnail unsupported ([184517](https://dev.another.im/another-im/interop/src/branch/main/runs/20261109-184517-XEP-0447-aim-vs-dino-ejabberd/EVIDENCE.md)) | libtacky 1.2.5 [c9dfdb6f](https://dev.another.im/another-im/libtacky/commit/c9dfdb6f): the share also carries the thumbnail as a `data:` URI (≤16 KiB), sealed when encrypted | yes | ⏳ | | C34 (#1): a destroyed room recreated empty after a restart | libtacky 1.2.2 [1aed459c](https://dev.another.im/another-im/libtacky/commit/1aed459c) | no (confirmed) | ✅ | | C30 (#1): aim's decline doesn't reach the inviter | before rc9 (#1) – | no (confirmed) | ✅ | | P2: Prosody test server hands out no STUN/TURN | interop #13 (coturn + `mod_turn_external`) – | no (confirmed) | ✅ | **Not implemented in aim** (UI gaps in #9; retest where upstream added it): | Item | Upstream | Retest | Result | |---|---|---|---| | XEP-0245 `/me` drawn raw | anotherim-js develop [b187c257](https://dev.another.im/another-im/anotherim-js/commit/b187c257) (after 0.8.0) | yes, if the batch 6 build has it | ⏳ | | urn:tacky:pep-expiry:0 time limit | – | no | – | | XEP-0249 sending | – | no | – | | XEP-0486 setting a room avatar | – | no | – | | XEP-0425 moderating | – | no | – | | XEP-0272/0482 starting a group call | – | no | – | ## Results Filled in when batch 6 is merged.

asxpi referenced this issue

2026-11-10 16:12:11 +00:00

Retest the fixed bugs of #1 on libtacky develop (batch 5) #24

asxpi referenced this issue

2026-11-10 21:01:11 +00:00

Batch 7: cover the untested features, code coverage, hostile-server fuzzing #29

asxpi referenced this issue

2026-11-10 22:08:05 +00:00

Batch 7 harness: headless calls, libtacky against libtacky, also/scenario, shared fake server #30