From 6b5852e39f22bc66627f869934341166325a410c Mon Sep 17 00:00:00 2001
From: rusticorn <mail@rusticorn.com>
Date: Thu, 9 Jul 2026 10:03:13 +0200
Subject: [PATCH 1/2] run tests on linux arm ci pipeline

---
 .github/workflows/ci.yml | 18 ++++++++++++++++++
 Makefile                 |  5 +++++
 2 files changed, 23 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eaf4b34458..301d6c88a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -180,6 +180,14 @@ jobs:
       - name: Override rust toolchain
         run: rustup override set ${{ matrix.rust }}
 
+      - uses: taiki-e/install-action@nextest
+
+      # qemu runs the cross-compiled aarch64 test binaries; the aarch64 cross
+      # runtime provides the sysroot qemu loads guest libs from; gpgsm is needed
+      # by the x509 signing e2e test (ssh-keygen/gpg/openssl are preinstalled).
+      - name: Install emulation and signing tools
+        run: sudo apt-get update && sudo apt-get install -y qemu-user-static libc6-arm64-cross libgcc-s1-arm64-cross gpgsm
+
       - name: Setup ARM toolchain
         run: |
           rustup target add aarch64-unknown-linux-gnu
@@ -201,6 +209,16 @@ jobs:
       - name: Build Debug
         run: |
           make build-linux-arm-debug
+
+      # Run the suite for aarch64 under emulation. qemu emulates the aarch64
+      # test binary (loading its libs from the cross sysroot via -L) while
+      # passing native x86 child processes (git, gpg, ssh-keygen, ...) straight
+      # through to the host, so the signing e2e tests exercise the real tools.
+      - name: Run tests (aarch64, emulated)
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER: qemu-aarch64-static -L /usr/aarch64-linux-gnu
+        run: make test-linux-arm
+
       - name: Build Release
         run: |
           make build-linux-arm-release
diff --git a/Makefile b/Makefile
index 939c8118ef..e9e83343fa 100644
--- a/Makefile
+++ b/Makefile
@@ -61,6 +61,11 @@ build-linux-musl-release:
 test-linux-musl:
 	cargo nextest run --workspace --target=x86_64-unknown-linux-musl
 
+# aarch64 test binaries are cross-compiled, so CI runs them under qemu via a
+# CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER (see .github/workflows/ci.yml).
+test-linux-arm:
+	cargo nextest run --workspace --target=aarch64-unknown-linux-gnu
+
 release-linux-arm: build-linux-arm-release
 	mkdir -p release
 

From 6669be009289f242a4c05ea8963192277b3334b7 Mon Sep 17 00:00:00 2001
From: rusticorn <mail@rusticorn.com>
Date: Thu, 9 Jul 2026 10:12:12 +0200
Subject: [PATCH 2/2] exclude a test

---
 Makefile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e9e83343fa..c45bcba3f0 100644
--- a/Makefile
+++ b/Makefile
@@ -63,8 +63,11 @@ test-linux-musl:
 
 # aarch64 test binaries are cross-compiled, so CI runs them under qemu via a
 # CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER (see .github/workflows/ci.yml).
+# Exclude test_hook_with_missing_shebang: it needs the kernel's ENOEXEC (so
+# gitui retries the hook via `sh`), which qemu-user doesn't emulate — the exec
+# just exits 127. It passes on real aarch64 hardware.
 test-linux-arm:
-	cargo nextest run --workspace --target=aarch64-unknown-linux-gnu
+	cargo nextest run --workspace --target=aarch64-unknown-linux-gnu -E 'not test(test_hook_with_missing_shebang)'
 
 release-linux-arm: build-linux-arm-release
 	mkdir -p release