tomcat7 ftbfs in trusty and vivid (test failures)

[Matthias Klose]

tomcat7 ftbfs in vivd (test failures)

seen in a test rebuild
https://launchpad.net/ubuntu/+archive/test-rebuild-20150202/+build/6847125

[Serge Hallyn (serge-hallyn)]

Interestingly it fails on a debian jessie build machine as well.

[Matthias Klose (doko)]

this fails on trusty as well, seen in a test rebuild of trusty-security, and confirmed with a clean trusty chroot.

[Oleg Strikov (strikov-deactivatedaccount)]

It seems that this bug consists of many partially independent bugs.
I found at least two:

(1)
openjdk in vivid has SSLv3 disable but tests try to use it and get 'protocol is disabled or cipher suites are inappropriate'
as a warkaround you may enable sslv3 back by commenting the following line in /etc/java-7-openjdk/security/java.security:
# jdk.tls.disabledAlgorithms=SSLv3

(2)
another issue is that certificates inside the package expired which leads to SSL errors here and there
for example:

$ head test/org/apache/tomcat/util/net/localhost-cert.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4099 (0x1003)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, CN=ca-test.tomcat.apache.org
        Validity
            Not Before: Feb 28 05:28:42 2013 GMT
            Not After : Feb 28 05:28:42 2015 GMT
        Subject: C=US, CN=localhost

Note Feb 28 2015

[Oleg Strikov (strikov-deactivatedaccount)]

They have updated certs in trunk:
http://mail-archives.apache.org/mod_mbox/tomcat-dev/201502.mbox/%<email address hidden>%3E
We may just pick them up.

[Oleg Strikov (strikov-deactivatedaccount)]

Some part of bugs disappear when I put updated certs (with expiration date in 2017) from here:
https://github.com/apache/tomcat/test/org/apache/tomcat/util/net/{localhost-cert.pem, localhost-copy1.jks, localhost.jks, localhost-key.pem}

[Matthias Klose (doko)]

so can we disable the sslv3 tests then? the alternative would be to keep sslv3 enabled in openjdk-7

[Joshua Powers (powersj)]

Trusty is building correctly:
https://launchpad.net/ubuntu/+source/tomcat7/7.0.52-1ubuntu0.10