Merge remote-tracking branch 'origin/master' into glopes/sidecar-comm

Author: cataphract

.claude/ci/appsec-gradle-integration.md

@@ -8,9 +8,8 @@ file.
 
 | CI Job | Image | What it does |
 |--------|-------|-------------|
-| `appsec integration tests: [{target}]` | `docker:29.4.0-noble` | Gradle integration tests with C++ helper (release/zts variants) |
-| `appsec integration tests (helper-rust): [{target}]` | same | Same tests with Rust helper (`-PuseHelperRust`); includes `debug` variant |
-| `appsec integration tests (ssi): [{target}]` | same | SSI mode (PHP 8.3 only) |
+| `appsec integration tests: [{target}]` | `docker:29.4.0-noble` | Gradle integration tests with Rust helper by default (release/zts/musl variants) |
+| `appsec integration tests (ssi): [{target}]` | same | SSI mode (PHP 8.3 only), Rust helper by default |
 | `helper-rust build and test` | same | `cargo fmt --check` + build + unit tests |
 | `helper-rust code coverage` | same | Unit test coverage via `cargo-llvm-cov` |
 | `helper-rust integration coverage` | same | Integration coverage collection (not needed locally) |
@@ -60,18 +59,17 @@ The `--tests` filter accepts:
 - Class only: `"*Apache2FpmTests*"` or `"com.datadog.appsec.php.integration.Apache2FpmTests"`
 - Wildcard: `"*FpmTests*"`
 
-### With helper-rust (instead of C++ helper)
+### Rust helper (default)
 
 ```bash
-./gradlew test8.3-debug -PuseHelperRust --info \
+./gradlew test8.3-debug --info \
     --tests "com.datadog.appsec.php.integration.Apache2FpmTests.Pool environment"
 ```
 
-This builds the Rust helper via the `buildHelperRust` task (musl build, works on both glibc and musl targets) and stores the binary in the `php-helper-rust` Docker volume.
-
-### C++ helper (default)
-
-Omit `-PuseHelperRust` and `-PhelperBinary`. The C++ helper is built via the `buildAppsec-*` task.
+This builds the Rust helper via the `buildHelperRust` task (musl build,
+works on both glibc and musl targets), stores the binary in the
+`php-helper-rust` Docker volume, and mounts it as
+`/helper-rust/libddappsec-helper.so`.
 
 ## Image Tags
 
@@ -135,7 +133,8 @@ Start a test container without running tests (for manual debugging):
 ./gradlew runMain8.3-release -PtestClass=com.datadog.appsec.php.integration.Apache2FpmTests
 ```
 
-The `-PtestClass` property is required (the task is not created without it). Add `-PuseHelperRust` or `-PhelperBinary=...` as needed.
+The `-PtestClass` property is required (the task is not created without
+it). Add `-PhelperBinary=...` to bind-mount an explicit helper binary.
 
 SSI variant:
 
@@ -158,22 +157,18 @@ build/test-logs/com.datadog.appsec.php.integration.Apache2FpmTests-8.3-debug/
 ├── access.log
 ├── appsec.log         # PHP extension appsec log
 ├── error.log          # Apache error log
-├── helper.log         # Helper process log (C++ or Rust)
+├── helper.log         # Rust helper process log
 ├── php_error.log
 ├── php_fpm_error.log
 └── sidecar.log
 ```
 
-To distinguish which helper ran, check `helper.log`:
-- Rust: starts with `[INFO] AppSec helper starting`
-- C++: starts with `[info]` lines like `Started listening on abstract socket`
-
 ## Musl/Alpine Target
 
 The `test8.5-release-musl` target uses an Alpine-based nginx+fpm image. Tests tagged with `@Tag("musl")` are included; untagged tests are excluded.
 
 ```bash
-./gradlew test8.5-release-musl -PuseHelperRust --info
+./gradlew test8.5-release-musl --info
 ```
 
 The `buildHelperRust` task already produces a musl-linked binary (built on Alpine with `cargo +nightly`, using LLVM libunwind). The `patchelf --remove-needed libc.musl-*` step makes it load on both musl and glibc systems.
@@ -183,7 +178,6 @@ The `buildHelperRust` task already produces a musl-linked binary (built on Alpin
 | CI Job | Gradle Command |
 |---|---|
 | `appsec integration tests: [test8.3-release]` | `./gradlew test8.3-release` |
-| `appsec integration tests (helper-rust): [test8.3-debug]` | `./gradlew test8.3-debug -PuseHelperRust` |
 | `appsec integration tests (ssi): [test8.3-release-ssi]` | `./gradlew test8.3-release-ssi` |
 | `helper-rust build and test` | `./gradlew testHelperRust` |
 | `helper-rust code coverage` | `./gradlew coverageHelperRust` |
@@ -199,7 +193,7 @@ Gradle uses named Docker volumes for build artifacts and caches. Key volumes:
 |---|---|
 | `php-helper-rust` | `libddappsec-helper.so` (Rust helper binary) |
 | `php-tracer-{v}-{var}` | Built `ddtrace.so` |
-| `php-appsec-{v}-{var}` | Built `ddappsec.so` + C++ helper |
+| `php-appsec-{v}-{var}` | Built `ddappsec.so` |
 | `php-tracer-cargo-cache` | Cargo registry cache |
 | `php-tracer-cargo-cache-git` | Cargo git cache |
 | `php-appsec-boost-cache` | Boost build cache |

.claude/ci/appsec-native-tests.md

@@ -11,7 +11,6 @@ file.
 | `test appsec extension: [{ver}, {arch}, debug]` | `datadog/dd-trace-ci:php-{ver}_bookworm-6` | Builds appsec PHP extension + runs phpunit `.phpt` tests |
 | `test appsec extension: [{ver}, {arch}, debug-zts]` | same | ZTS variant |
 | `test appsec extension: [{ver}, {arch}, debug-zts-asan]` | same | ASAN variant (PHP 7.4+) |
-| `test appsec helper asan` | `datadog/dd-trace-ci:bookworm-6` | Builds C++ helper with ASAN, runs gtest suite |
 | `appsec lint` | `datadog/dd-trace-ci:php-8.3_bookworm-6` | clang-format + clang-tidy |
 | `appsec code coverage` | `datadog/dd-trace-ci:php-8.3_bookworm-6` | Coverage instrumented build (not needed locally) |
 
@@ -143,77 +142,6 @@ reuse it. To force a full rebuild:
 docker volume rm php-appsec-8.3-debug php-tracer-8.3-debug
 ```
 
-## Helper tests (C++ ASAN)
-
-The C++ helper tests use the `bookworm-6` image (no PHP needed). The
-binary is a gtest executable. With `--overlayfs --root`, all writes
-(including `appsec/build-helper`) persist in the Docker volume
-automatically — no manual bind mount needed.
-
-### Full suite
-
-```bash
-.claude/ci/dockerh --cache appsec-helper --overlayfs --root \
-  datadog/dd-trace-ci:bookworm-6 -- bash -c '
-set -e
-apt-get update -qq && apt-get install -y -qq \
-  libc++-17-dev libc++abi-17-dev > /dev/null 2>&1
-# Required: libddwaf submodule dir may trigger git's safe.directory check.
-git config --global --add safe.directory \
-  /project/dd-trace-php/appsec/third_party/libddwaf
-mkdir -p appsec/build-helper
-cd appsec/build-helper
-cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_BUILD_EXTENSION=OFF \
-  -DDD_APPSEC_ENABLE_COVERAGE=OFF -DDD_APPSEC_TESTING=ON \
-  -DCMAKE_CXX_FLAGS="-stdlib=libc++ -fsanitize=address -fsanitize=leak -DASAN_BUILD" \
-  -DCMAKE_C_FLAGS="-fsanitize=address -fsanitize=leak -DASAN_BUILD" \
-  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address -fsanitize=leak" \
-  -DCMAKE_MODULE_LINKER_FLAGS="-fsanitize=address -fsanitize=leak"
-make -j$(nproc) ddappsec_helper_test
-cd /project/dd-trace-php
-./appsec/build-helper/tests/helper/ddappsec_helper_test
-'
-```
-
-`clang-tidy-17` is not needed here — omitting it saves ~5–8 seconds of
-apt time. CI installs it via a shared `before_script` template.
-
-CI also passes `-DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache` and
-`-DCLANG_TIDY=/usr/bin/run-clang-tidy-17` to cmake. The first only
-affects where the Boost cache lands (not a correctness issue locally).
-The second means CI silently runs clang-tidy checks during the helper
-build that are skipped locally.
-
-### Single test
-
-Once built, the pre-built binary can be re-run without rebuilding, but
-the `libc++` runtime must still be installed (container rootfs is not
-persisted by `--overlayfs`):
-
-```bash
-.claude/ci/dockerh --cache appsec-helper --overlayfs --root \
-  datadog/dd-trace-ci:bookworm-6 -- bash -c '
-apt-get update -qq && apt-get install -y -qq libc++1-17 libc++abi1-17 > /dev/null 2>&1
-./appsec/build-helper/tests/helper/ddappsec_helper_test \
-  --gtest_filter="WafTest.TraceAttributesAreSent"
-'
-```
-
-The filter supports wildcards: `--gtest_filter="WafTest.*"` runs all
-tests in the `WafTest` suite. Use `--gtest_list_tests` to see available
-tests.
-
-### Without ASAN
-
-For a faster non-ASAN build (useful when debugging test logic rather than
-memory issues), drop the sanitizer flags:
-
-```bash
-cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_BUILD_EXTENSION=OFF \
-  -DDD_APPSEC_TESTING=ON \
-  -DCMAKE_CXX_FLAGS="-stdlib=libc++" -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++"
-```
-
 ## Appsec lint
 
 This can easily run locally:

.claude/ci/building-locally.md

@@ -28,13 +28,7 @@ Before any build, ensure the relevant submodules are initialised
 # Tracer extension (ddtrace.so) — needs libdatadog
 git submodule update --init libdatadog
 
-# Appsec extension or helper — needs these additionally
-git submodule update --init \
-  appsec/third_party/libddwaf \
-  appsec/third_party/msgpack-c \
-  appsec/third_party/cpp-base64
-
-# Appsec helper rust — needs libddwaf-rust
+# Appsec extension/helper — needs libddwaf-rust
 git submodule update --init --recursive \
   appsec/third_party/libddwaf-rust
 ```
@@ -181,15 +175,14 @@ make -j$(nproc) xtest
 For ASAN, add `-DENABLE_ASAN=ON` to cmake. See
 [appsec-native-tests.md](appsec-native-tests.md) for full details.
 
-## Appsec Helpers
+## Appsec Helper
 
-The tarball needs two helper binaries in `appsec_$(uname -m)/`:
-`libddappsec-helper.so` (C++) and `libddappsec-helper-rust.so`
-(Rust), plus `appsec/recommended.json`.
+The tarball needs the Rust helper binary in `appsec_$(uname -m)/` as
+`libddappsec-helper.so`, plus `appsec/recommended.json`.
 
 ### Rust helper
 
-Image is on Docker Hub. Output: `appsec_$(uname -m)/libddappsec-helper-rust.so`.
+Image is on Docker Hub. Output: `appsec_$(uname -m)/libddappsec-helper.so`.
 
 ```bash
 git submodule update --init --recursive \
@@ -202,27 +195,6 @@ git submodule update --init --recursive \
     -- bash .gitlab/build-appsec-helper-rust.sh
 ```
 
-### C++ helper
-
-The CI image (`nginx_musl_toolchain`) lives at
-`registry.ddbuild.io/images/mirror/b1o7r7e0/nginx_musl_toolchain`
-(not on Docker Hub). Transfer it via
-`docker save ... | ssh HOST docker load` if needed. Output:
-`appsec_$(uname -m)/libddappsec-helper.so` + `recommended.json`.
-
-```bash
-git submodule update --init \
-  appsec/third_party/libddwaf \
-  appsec/third_party/msgpack-c \
-  appsec/third_party/cpp-base64
-
-.claude/ci/dockerh --cache compile-appsec-helper-cpp --overlayfs \
-    registry.ddbuild.io/images/mirror/b1o7r7e0/nginx_musl_toolchain \
-    -e CI_COMMIT_SHA=$(git rev-parse HEAD) \
-    -e CI_COMMIT_BRANCH=$(git rev-parse --abbrev-ref HEAD) \
-    -- bash .gitlab/build-appsec-helper.sh
-```
-
 ## Profiler Extension
 
 ### For correctness tests (bookworm)
@@ -313,8 +285,7 @@ compiled `.so` files:
 - `extensions_$(uname -m)/` — ddtrace extensions
   (`ddtrace-{API}[-zts|-debug|-debug-zts].so`)
 - `appsec_$(uname -m)/` — appsec extensions (`ddappsec-{API}[-zts].so`) +
-  helpers (`libddappsec-helper.so` and `libddappsec-helper-rust.so`) +
-  `recommended.json`
+  Rust helper (`libddappsec-helper.so`) + `recommended.json`
 - `datadog-profiling/{triplet}/lib/php/{API}/` — profiler
   extensions