Skip to content

Comments

[1.1.1][github-ci] Enable krb5 external tests#16339

Closed
romen wants to merge 12 commits intoopenssl:OpenSSL_1_1_1-stablefrom
romen:issues/1.1.1/fix_incomplete_github_ci_p/ext_krb5
Closed

[1.1.1][github-ci] Enable krb5 external tests#16339
romen wants to merge 12 commits intoopenssl:OpenSSL_1_1_1-stablefrom
romen:issues/1.1.1/fix_incomplete_github_ci_p/ext_krb5

Conversation

@romen
Copy link
Member

@romen romen commented Aug 17, 2021

This is based on #16252 and will need to be rebased once that is merged.

Tasks

  • Enable the tests again
  • Fix the failure

romen added 12 commits August 14, 2021 15:01
This commit does not include the daily run-checker workflow.
The daily run-checker is scheduled to start at 6:42, instead of the
start of the hour.

The official GitHub documentation remarks the following regarding
scheduled workflows:

> Note: The schedule event can be delayed during periods of high loads
> of GitHub Actions workflow runs. High load times include the start of
> every hour. To decrease the chance of delay, schedule your workflow to
> run at a different time of the hour.

42, obviously, has been picked because it is the answer to the ultimate
question of life, the universe, and everything.
This commit temporarily disables cross-compiling tests for sparcv9, due
to failures to be investigated in a dedicated PR.
This commit temporarily disables krb5 external tests,
due to failures to be investigated in a dedicated PR.
This commit temporarily disables pyca external tests,
due to failures to be investigated in a dedicated PR.
This commit temporarily disables tests for no-tls1_3,
due to failures to be investigated in a dedicated PR.
In 1.1.1 currently we do not support running multiple tests in parallel,
and the `--debug -O1` msan build required more than 3h to run the tests.

This commit temporarily disables this build configuration.
This commit temporarily disables the ubsan build,
due to failures to be investigated in a dedicated PR.
@romen romen added branch: 1.1.1 Applies to OpenSSL_1_1_1-stable branch (EOL) triaged: bug The issue/pr is/fixes a bug labels Aug 17, 2021
@romen romen requested a review from mattcaswell August 17, 2021 10:02
@romen romen self-assigned this Aug 17, 2021
@romen romen mentioned this pull request Aug 17, 2021
16 tasks
@romen romen changed the title [1.1.1][github-ci] Disable krb5 external tests [1.1.1][github-ci] Enable krb5 external tests Aug 17, 2021
@romen
Copy link
Member Author

romen commented Aug 17, 2021

@kaduk can you help with this?

@kaduk
Copy link
Contributor

kaduk commented Aug 17, 2021

Yes, I will take a look. I might have a couple days' latency, though.

@romen
Copy link
Member Author

romen commented Aug 17, 2021

Yes, I will take a look. I might have a couple days' latency, though.

Thanks!

@kaduk
Copy link
Contributor

kaduk commented Aug 24, 2021

Reporting on what I found so far before I get sucked into other things this week:

It seems that (part of) the krb5 test suite is using pyopenssl to be the "other side" of the end-to-end test, which involves having pyopenssl load up the certificates in https://github.com/krb5/krb5/tree/krb5-1.19.1-final/src/tests/dejagnu/proxy-certs , which involves the system openssl (which I assume pyopenssl is backending to) getting a crack at them via SSL_CTX_use_certificate_chain_file() or thereabouts, and the corresponding ssl_security_cert() call fails with SSL_R_CA_MD_TOO_WEAK.

They seem to all be 2048-bit RSA with SHA256, though, so I'm not sure what part would be making the system openssl unhappy.

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 61 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 92 days ago

@paulidale
Copy link
Contributor

What needs to happen here?

@kaduk
Copy link
Contributor

kaduk commented Nov 25, 2021

My sketch of a plan was to drop some /usr/bin/openssl invocations in the CI job to see what the system openssl thinks of the certificates in question; I just haven't had a chance to get back to this with the other things I have going on. Someone else is welcome to step in as well, of course :)

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 61 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 92 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 123 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 154 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 185 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 216 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 247 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 278 days ago

@t8m
Copy link
Member

t8m commented Aug 31, 2022

@romen will you rebase this?

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 61 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 92 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 123 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 154 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 185 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 216 days ago

@openssl-machine
Copy link
Collaborator

This PR is in a state where it requires action by @openssl/committers but the last update was 247 days ago

@tom-cosgrove-arm
Copy link
Contributor

Is this PR still wanted? Several conflicts, and marked as draft...

@t8m
Copy link
Member

t8m commented May 9, 2023

Closing.

@t8m t8m closed this May 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

branch: 1.1.1 Applies to OpenSSL_1_1_1-stable branch (EOL) triaged: bug The issue/pr is/fixes a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants