Update

vendor/tailscale.com/util/syspolicy/internal/internal.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/go-json-experiment/json/jsontext"
 	"tailscale.com/types/lazy"
+	"tailscale.com/util/testenv"
 	"tailscale.com/version"
 )
 
@@ -25,22 +26,10 @@ func OS() string {
 	return OSForTesting.Get(version.OS)
 }
 
-// TB is a subset of testing.TB that we use to set up test helpers.
-// It's defined here to avoid pulling in the testing package.
-type TB interface {
-	Helper()
-	Cleanup(func())
-	Logf(format string, args ...any)
-	Error(args ...any)
-	Errorf(format string, args ...any)
-	Fatal(args ...any)
-	Fatalf(format string, args ...any)
-}
-
 // EqualJSONForTest compares the JSON in j1 and j2 for semantic equality.
 // It returns "", "", true if j1 and j2 are equal. Otherwise, it returns
 // indented versions of j1 and j2 and false.
-func EqualJSONForTest(tb TB, j1, j2 jsontext.Value) (s1, s2 string, equal bool) {
+func EqualJSONForTest(tb testenv.TB, j1, j2 jsontext.Value) (s1, s2 string, equal bool) {
 	tb.Helper()
 	j1 = j1.Clone()
 	j2 = j2.Clone()

vendor/tailscale.com/util/syspolicy/internal/loggerx/logger.go

@@ -10,7 +10,7 @@ import (
 
 	"tailscale.com/types/lazy"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/syspolicy/internal"
+	"tailscale.com/util/testenv"
 )
 
 const (
@@ -58,7 +58,7 @@ func verbosef(format string, args ...any) {
 
 // SetForTest sets the specified printf and verbosef functions for the duration
 // of tb and its subtests.
-func SetForTest(tb internal.TB, printf, verbosef logger.Logf) {
+func SetForTest(tb testenv.TB, printf, verbosef logger.Logf) {
 	lazyPrintf.SetForTest(tb, printf, nil)
 	lazyVerbosef.SetForTest(tb, verbosef, nil)
 }

vendor/tailscale.com/util/syspolicy/internal/metrics/metrics.go

@@ -17,6 +17,7 @@ import (
 	"tailscale.com/util/slicesx"
 	"tailscale.com/util/syspolicy/internal"
 	"tailscale.com/util/syspolicy/internal/loggerx"
+	"tailscale.com/util/syspolicy/pkey"
 	"tailscale.com/util/syspolicy/setting"
 	"tailscale.com/util/testenv"
 )
@@ -209,7 +210,7 @@ func scopeMetrics(origin *setting.Origin) *policyScopeMetrics {
 
 var (
 	settingMetricsMu  sync.RWMutex
-	settingMetricsMap map[setting.Key]*settingMetrics
+	settingMetricsMap map[pkey.Key]*settingMetrics
 )
 
 func settingMetricsFor(setting *setting.Definition) *settingMetrics {
@@ -259,7 +260,7 @@ var addMetricTestHook, setMetricTestHook syncs.AtomicValue[metricFn]
 
 // SetHooksForTest sets the specified addMetric and setMetric functions
 // as the metric functions for the duration of tb and all its subtests.
-func SetHooksForTest(tb internal.TB, addMetric, setMetric metricFn) {
+func SetHooksForTest(tb testenv.TB, addMetric, setMetric metricFn) {
 	oldAddMetric := addMetricTestHook.Swap(addMetric)
 	oldSetMetric := setMetricTestHook.Swap(setMetric)
 	tb.Cleanup(func() {
@@ -283,8 +284,8 @@ func SetHooksForTest(tb internal.TB, addMetric, setMetric metricFn) {
 	lazyUserMetrics.SetForTest(tb, newScopeMetrics(setting.UserSetting), nil)
 }
 
-func newSettingMetric(key setting.Key, scope setting.Scope, suffix string, typ clientmetric.Type) metric {
-	name := strings.ReplaceAll(string(key), string(setting.KeyPathSeparator), "_")
+func newSettingMetric(key pkey.Key, scope setting.Scope, suffix string, typ clientmetric.Type) metric {
+	name := strings.ReplaceAll(string(key), string(pkey.KeyPathSeparator), "_")
 	name = strings.ReplaceAll(name, ".", "_") // dots are not allowed in metric names
 	return newMetric([]string{name, metricScopeName(scope), suffix}, typ)
 }

vendor/tailscale.com/util/syspolicy/internal/metrics/test_handler.go

@@ -9,6 +9,7 @@ import (
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/set"
 	"tailscale.com/util/syspolicy/internal"
+	"tailscale.com/util/testenv"
 )
 
 // TestState represents a metric name and its expected value.
@@ -19,13 +20,13 @@ type TestState struct {
 
 // TestHandler facilitates testing of the code that uses metrics.
 type TestHandler struct {
-	t internal.TB
+	t testenv.TB
 
 	m map[string]int64
 }
 
 // NewTestHandler returns a new TestHandler.
-func NewTestHandler(t internal.TB) *TestHandler {
+func NewTestHandler(t testenv.TB) *TestHandler {
 	return &TestHandler{t, make(map[string]int64)}
 }