fix(core-net): cast uint32_t grace_us for %u format specifier

.gitignore

@@ -65,3 +65,4 @@ doc
 /bb1/
 /bb3/
 /bin/
+/scratch

.sai.json

@@ -10,6 +10,13 @@
                                 "cd build && SAI_CPACK=\"-G RPM\" ${cpack}"
                         ]
 		},
+		"rocky9-ca/aarch64-a72a55-rk3588/clang": {
+			"default": false,
+                        "build": [
+                                "mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
+                                "cd build && scan-build -o ./scan-results make -j$SAI_PARALLEL"
+                        ]
+		},
 		"netbsd-OSX-bigsur/x86_64-intel-i3/llvm": {
                         "build": [
 				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib MACOSX_DEPLOYMENT_TARGET=15.7 cmake .. -DCMAKE_MAKE_PROGRAM=/usr/bin/make -DLWS_GNUTLS_INCLUDE_DIRS=/usr/local/include -DLWS_GNUTLS_LIBRARIES=/usr/local/lib/libgnutls.dylib ${cmake}",
@@ -58,14 +65,14 @@
                                 "cd build && SAI_CPACK=\"-G DEB\" ${cpack}"
 			]
 		},
-                "netbsd/aarch64BE-bcm2837-a53/gcc": {
-                        "default": false,
-                        "build": [
-				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
-                                "cd build && make -j$SAI_PARALLEL && rm -rf ../destdir && make -j$SAI_PARALLEL DESTDIR=../destdir install",
-				"cd build && LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib /usr/pkg/bin/ctest -j$SAI_PARALLEL --output-on-failure --repeat until-pass:3"
-			]
-                },
+#                "netbsd/aarch64BE-bcm2837-a53/gcc": {
+#                        "default": false,
+#                        "build": [
+#				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
+#                                "cd build && make -j$SAI_PARALLEL && rm -rf ../destdir && make -j$SAI_PARALLEL DESTDIR=../destdir install",
+#				"cd build && LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib /usr/pkg/bin/ctest -j$SAI_PARALLEL --output-on-failure --repeat until-pass:3"
+#			]
+#                },
 		"freebsd/aarch64/llvm": {
                         "default": false,
                         "build": [
@@ -98,21 +105,21 @@
 				"cd ebuild/${cpack} ; . /opt/esp/esp-idf/export.sh ; rm -rf build ; idf.py set-target esp32 && cp partitions.csv sdkconfig.h build && cp -rp sdkconfig.old sdkconfig && cp sdkconfig build && idf.py ${cmake} build size size-components size-files",
 				". /opt/esp/esp-idf/export.sh && pwd && cd ebuild/${cpack}/build && /usr/local/bin/sai-device ${cpack} ESPPORT=0 ctest --output-on-failure"
 			]
-		},
-		"coverity/x86_64/gcc": {
-			"default": false,
-                        "build": [
-				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
-                                "cd build && export PATH=\"/opt/cov-analysis-linux64-2024.12.1/bin:$PATH\" && cov-build --dir cov-int make -j$SAI_PARALLEL",
-                                "cd build && SAI_CPACK=\"-G RPM\" ${cpack}"
-			]
-		}
+		}#,
+#		"coverity/x86_64/gcc": {
+#			"default": false,
+#                        "build": [
+#				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
+#                                "cd build && export PATH=\"/opt/cov-analysis-linux64-2024.12.1/bin:$PATH\" && cov-build --dir cov-int make -j$SAI_PARALLEL",
+#                                "cd build && SAI_CPACK=\"-G RPM\" ${cpack}"
+#			]
+#		}
 	},
 
 	"configurations": {
 		"default": {
 			"cmake":	"",
-			"platforms":	"w11/x86_64-amd/msvc-schannel,netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"w11/x86_64-amd/msvc-schannel,freebsd/aarch64/llvm"
 		},
 		"default-noh3": {
 			"cmake":	"-DLWS_WITH_HTTP3=0",
@@ -127,7 +134,7 @@
 		},
 		"default-dht": {
 			"cmake":	"-DLWS_WITH_DHT=1",
-			"platforms":	"w11/x86_64-amd/msvc,netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"w11/x86_64-amd/msvc,freebsd/aarch64/llvm"
 		},
 		"fault-injection": {
 			"cmake":	"-DLWS_WITH_SYS_FAULT_INJECTION=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_CBOR=1"
@@ -165,9 +172,13 @@
 			"cmake":	"-DLWS_ROLE_QUIC=1 -DLWS_WITH_WOLFSSL=1 -DLWS_WOLFSSL_INCLUDE_DIRS=/usr/local/include -DLWS_WOLFSSL_LIBRARIES=/usr/local/lib/libwolfssl.so -DLWS_WITH_MINIMAL_EXAMPLES=0",
 			"platforms":	"none, rocky9/aarch64-a72a55-rk3588/gcc"
 		},
+                "openhitls": {
+                        "cmake":        "-DLWS_WITH_OPENHITLS=1 -DOPENHITLS_INCLUDE_DIRS=/opt/openhitls/include -DOPENHITLS_LIBRARIES='/opt/openhitls/build/libhitls_tls.so;/opt/openhitls/build/libhitls_pki.so;/opt/openhitls/build/libhitls_crypto.so;/opt/openhitls/build/libhitls_bsl.so;/opt/openhitls/build/libhitls_auth.so'",
+			"platforms":	"none, rocky9/aarch64-a72a55-rk3588/gcc"
+		},
 		"default-noexamples": {
 			"cmake":	"-DLWS_WITH_MINIMAL_EXAMPLES=0",
-			"platforms":	"netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"freebsd/aarch64/llvm"
 		},
 		"tls-sess-off": {
 			"cmake":	"-DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_TLS_SESSIONS=0"
@@ -194,7 +205,7 @@
 
 		"secure-streams-off": {
 			"cmake":	"-DLWS_WITH_SECURE_STREAMS=0 -DLWS_WITH_MINIMAL_EXAMPLES=1",
-			"platforms":	"w11/x86_64-amd/msvc,netbsd/aarch64BE-bcm2837-a53/gcc"
+			"platforms":	"w11/x86_64-amd/msvc"
 		},
 		"secure-streams-proxy": {
 			"cmake":	"-DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_SECURE_STREAMS_PROXY_API=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 "
@@ -204,6 +215,7 @@
 		},
 		"distro_recommended": { # minimal examples also needed for ctest
 			"cmake":	"-DLWS_WITH_DISTRO_RECOMMENDED=1 -DLWS_WITH_MINIMAL_EXAMPLES=1",
+			"platforms":	"rocky9-ca/aarch64-a72a55-rk3588/clang",
 			"cpack":	"cpack $SAI_CPACK",
 			"artifacts":	"build/*.rpm, build/*.deb, build/*.zip"
 		},
@@ -286,16 +298,17 @@
 		},
 		"threadpool": {
 			"cmake":	"-DLWS_WITH_THREADPOOL=1 -DLWS_WITH_MINIMAL_EXAMPLES=1"
-		},
+		}
+		#,
 
 		# only applies to the coverity builder, and on pushes to "coverity" branch
 
-		"coverity": {
-			"cmake":	"-DLWS_WITHOUT_EXTENSIONS=0 -DLWS_WITH_CGI=1 -DLWS_IPV6=1 -DLWS_WITH_HTTP_PROXY=1 -DLWS_WITH_RANGES=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_CBOR=1 -DLWS_WITH_JOSE=1 -DLWS_WITH_COSE=1 -DLWS_WITH_SYS_DHCP_CLIENT=1 -DLWS_WITH_FTS=1 -DLWS_WITH_STRUCT_SQLITE3=1 -DLWS_ROLE_DBUS=1 -DLWS_WITH_SYS_ASYNC_DNS=1 -DLWS_WITH_SYS_ASYNC_DNS_DNSSEC=1 -DLWS_WITH_WEBRTC=1 -DLWS_WITH_DHT=1 -DLWS_WITH_ASYNC_QUEUE=1  -DLWS_WITH_SYS_FAULT_INJECTION=1 -DLWS_WITH_TLS_JIT_TRUST=1 -DLWS_ROLE_MQTT=1 -DLWS_ROLE_RAW_PROXY=1 -DLWS_WITH_EVENT_LIBS=1 -DLWS_WITH_LIBUV=1 -DLWS_WITH_STRUCT_JSON=1 -DLWS_WITH_LWS_DSH=1 -DLWS_WITH_SECURE_STREAMS_PROXY_API=1 -DLWS_WITH_AUTHORITATIVE_DNS=1 -DLWS_WITH_DHT=1 -DLWS_WITH_DHT_BACKEND=1 -DLWS_WITH_PLUGINS=1 -DLWS_WITH_QUIC=1 -DLWS_WITH_HTTP3=1",
-			"platforms":	"none, coverity/x86_64/gcc",
-			"cpack":	"export STAMP=`git log -1 --pretty=format:%h` && rm -f libwebsockets.tar.xz && tar cJvf libwebsockets.tar.xz cov-int && script -e -q -c \"cat /etc/coverity/secrets.sh | lws-minimal-http-client-post-form --h1 https://scan.coverity.com:443/builds?project=warmcat%2Flibwebsockets --form file=@libwebsockets.tar.xz --form version=${STAMP} --form 'description=lws qa'\" /dev/null",
-			"branches":	"coverity"
-		}
+#		"coverity": {
+#			"cmake":	"-DLWS_WITHOUT_EXTENSIONS=0 -DLWS_WITH_CGI=1 -DLWS_IPV6=1 -DLWS_WITH_HTTP_PROXY=1 -DLWS_WITH_RANGES=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_CBOR=1 -DLWS_WITH_JOSE=1 -DLWS_WITH_COSE=1 -DLWS_WITH_SYS_DHCP_CLIENT=1 -DLWS_WITH_FTS=1 -DLWS_WITH_STRUCT_SQLITE3=1 -DLWS_ROLE_DBUS=1 -DLWS_WITH_SYS_ASYNC_DNS=1 -DLWS_WITH_SYS_ASYNC_DNS_DNSSEC=1 -DLWS_WITH_WEBRTC=1 -DLWS_WITH_DHT=1 -DLWS_WITH_ASYNC_QUEUE=1  -DLWS_WITH_SYS_FAULT_INJECTION=1 -DLWS_WITH_TLS_JIT_TRUST=1 -DLWS_ROLE_MQTT=1 -DLWS_ROLE_RAW_PROXY=1 -DLWS_WITH_EVENT_LIBS=1 -DLWS_WITH_LIBUV=1 -DLWS_WITH_STRUCT_JSON=1 -DLWS_WITH_LWS_DSH=1 -DLWS_WITH_SECURE_STREAMS_PROXY_API=1 -DLWS_WITH_AUTHORITATIVE_DNS=1 -DLWS_WITH_DHT=1 -DLWS_WITH_DHT_BACKEND=1 -DLWS_WITH_PLUGINS=1 -DLWS_WITH_QUIC=1 -DLWS_WITH_HTTP3=1",
+#			"platforms":	"none, coverity/x86_64/gcc",
+#			"cpack":	"export STAMP=`git log -1 --pretty=format:%h` && rm -f libwebsockets.tar.xz && tar cJvf libwebsockets.tar.xz cov-int && script -e -q -c \"cat /etc/coverity/secrets.sh | lws-minimal-http-client-post-form --h1 https://scan.coverity.com:443/builds?project=warmcat%2Flibwebsockets --form file=@libwebsockets.tar.xz --form version=${STAMP} --form 'description=lws qa'\" /dev/null",
+#			"branches":	"coverity"
+#		}
 #		,
 		# awkward, we also want to test mbedtls, but coverity blocks on SSL build needing manual intervention
 #		"coverity-mbedtls": {

AGENTS.md

@@ -2,26 +2,45 @@
 
 ## Overview
 
-Please make high quality, not lazy, implementation decisions, because the code will have to be
-maintained for a long time.  And everybody, LLM or person, is able to work better if we keep
-the code clean and to a high standard to start with.
+Please err on the side of high quality, not lazy, implementation decisions, because the code
+will have to be maintained for a long time.  And everybody, LLM or person, is able to work
+better if we keep the code clean and to a high standard to start with.
 
 Even if your instructions don't include specific admonishment about quality, it is always
 necessary.
 
 Our work should follow the existing usage of apis in the project as much as possible.
 
+## Interacting
+
+We will be working on the same sources, do not build into ./build since I will be using it; make
+your own ./build-agy or whatever.
+
+While the idea is you should modify and test sources towards some goal, please do NOT modify the
+git state unless directly asked.
+
+Often although we are working on the same sources, they are being tested on devices you don't have
+access to.  So you must ask for access to data state on those remote machines; looking at the local
+machine you are running on for config or data state directly is of zero use in those circumstances.
+
+If you are unable to complete something the user expects from the interaction with you, you
+must clearly explain to the user which parts are incomplete and need further work.
+
 ## Coding
 
-We avoid things like `scanf` for carefully parsing with code, eg with `lws_tokenize` or similar.
+We are very concerned about security, architecturally and in the code.  We avoid using:
 
-We avoid `FILE *` and use apis like open(), read().
+ - things like `scanf` for carefully parsing with code, eg with `lws_tokenize` or similar.
 
-We avoid casual linked-lists and use `lws_dll2_t`.
+ - `FILE *` and use apis like open(), read().
 
-We consider using lwsac instead of discrete allocations, if the pattern of allocations will benefit from it.
+ - casual linked-lists and use `lws_dll2_t`.
 
-We consider using lws_struct to convert between sqlite storage <-> structs <-> JSON
+We consider using:
+
+ - lwsac instead of discrete allocations, if the pattern of allocations will benefit from it.
+
+ - lws_struct to convert between sqlite storage <-> structs <-> JSON
 
 ## Appropriate locality
 
@@ -31,10 +50,14 @@ makes sense it's possible.
 
 ## Security
 
-Please bear in mind what parts of the system are secrets and look after the security of them.
+Please bear in mind:
 
-In particular, all web pieces are made available on the internet with a strict CSP.  That means
-** no inline styles or scripts ** .  You can find the web pieces (JS, HTML, css) in ./assets/
+ - which parts of the system are secrets, and look after the security of them.
+ - all external data is untrusted and should be assumed to be part of an attack until
+   we have validated it to be within a range and type we expect and can safely consume.
+
+ - all web pieces are served with a strict CSP.  That means ** no inline styles or scripts ** .
+   You can usually find the web pieces (JS, HTML, css) in ./assets/
 
 ## Build testing
 
@@ -48,3 +71,6 @@ commands for the platform.
 minimal-examples-lowlevel/http-client/minimal-http-client-post/CMakeLists.txt shows how to use the fixtures
 stuff to magic peers into being while being sensitive to parallel CI using `$ENV{SAI_INSTANCE_IDX}` to make
 unique ports.
+
+In the case you can build and run ctest meaningfully, please do confirm the build passes before completing
+work on your goal.

CMakeLists-implied-options.txt

@@ -357,6 +357,10 @@ if (LWS_PLAT_FREERTOS)
  set(LWS_HAVE_GETIFADDRS 1)
  set(LWS_WITH_CUSTOM_HEADERS 0)
  set(LWS_WITH_STUB 0)
+ # FreeRTOS can't fork/exec; STUB defaults ON and implies SPAWN above before
+ # this point disables it, leaving SPAWN (and its siginfo_t typedef) on. Force
+ # it off here - there's no spawn support on FreeRTOS anyway.
+ set(LWS_WITH_SPAWN 0)
 endif()
 
 if (LWS_WITHOUT_TESTAPPS)