Let expect_fail clear on refs that carry the fix via a fixed_on marker

Author: aidangarske

.github/examples-manifest.yml

@@ -877,14 +877,11 @@ examples:
           <<: *stapling
           client: [./ocsp-client, --tls13]
         expect: "Client: TLS handshake success"
-        # A wolfSSL bug, not an example bug, reproduced locally: the RFC 8446
-        # 4.4.2 check in tls.c searches only ssl->extensions, but
-        # wolfSSL_CTX_UseOCSPStapling leaves status_request on ctx->extensions,
-        # so the server's staple is killed with unsupported_extension (-429).
-        # wolfSSL's own TLSX_CheckUnsupportedExtension does that ctx fallback;
-        # this call site does not. Fix filed as wolfSSL/wolfssl#10936; drop this
-        # expect_fail when it merges.
+        # wolfSSL bug (not the example): a CTX-set status_request is dropped from
+        # the TLS1.3 Certificate msg (-429). Fixed on master by wolfSSL/wolfssl#10936,
+        # still in v5.9.2-stable; drop expect_fail + fixed_on once a stable tag has it.
         expect_fail: "wolfSSL drops a CTX-set status_request in the TLS1.3 Certificate msg (-429)"
+        fixed_on: [master]
 
   - id: custom-io-file-client
     path: custom-io-callbacks/file-client

.github/scripts/run_example.py

@@ -617,7 +617,7 @@ def attempt_step(step, cwd, env):
     return label, ok, detail, log
 
 
-def run_entry(entry, expect_sha, results):
+def run_entry(entry, expect_sha, results, wolfssl_ref):
     eid = entry["id"]
     cwd = REPO / entry["path"]
     env = dict(os.environ)
@@ -692,6 +692,11 @@ def run_entry(entry, expect_sha, results):
             detail = f"{n} runs ok" if ok else f"flaked on run {run_no}/{n}: {detail}"
 
         xfail = step.get("expect_fail")
+        # A fix lands in master before it ships in a stable tag, so the same bug is
+        # known-fail on stable yet fixed on master; fixed_on lists the refs that
+        # carry the fix and must therefore pass normally.
+        if xfail and wolfssl_ref in (step.get("fixed_on") or []):
+            xfail = None
         if xfail and not ok:
             status, detail = "xfail", f"known: {xfail}"
             ok = True
@@ -793,7 +798,7 @@ def main():
     results = []
     ok = True
     for entry in entries:
-        ok = run_entry(entry, expect_sha, results) and ok
+        ok = run_entry(entry, expect_sha, results, args.wolfssl_ref) and ok
 
     for r in results:
         r["ref"] = args.wolfssl_ref