'command1' autopkgtest fails due to expired test certs

[Dan Streetman]

[impact]

autopkgtest 'command1' fails:

# bootstrap.test.lua
[ ta ] keyfile 'ok1.keys': doesn't exist, bootstrapping
ok 1 - fake server certificate is detected
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/ok1.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_attr_extra_attr.keys': doesn't exist, bootstrapping
ok 2 - bogus TA XML with an extra attribute
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_attr_extra_attr.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_attr_validfrom_invalid.keys': doesn't exist, bootstrapping
ok 3 - bogus TA XML with invalid validFrom value
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_attr_validfrom_invalid.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_attr_validfrom_missing.keys': doesn't exist, bootstrapping
ok 4 - bogus TA XML without mandatory validFrom attribute
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_attr_validfrom_missing.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_elem_extra.keys': doesn't exist, bootstrapping
ok 5 - bogus TA XML with an extra element
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_elem_extra.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_elem_missing.keys': doesn't exist, bootstrapping
ok 6 - bogus TA XML without mandatory element
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_elem_missing.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'err_multi_ta.keys': doesn't exist, bootstrapping
ok 7 - bogus TA XML with multiple TAs
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/err_multi_ta.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'unsupp_nonroot.keys': doesn't exist, bootstrapping
ok 8 - unsupported TA XML for non-root zone
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/unsupp_nonroot.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'unsupp_xml_v11.keys': doesn't exist, bootstrapping
ok 9 - unsupported TA XML with XML v1.1
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/unsupp_xml_v11.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile 'ok0_badtimes.keys': doesn't exist, bootstrapping
ok 10 - TA XML with no valid keys
# Got this error: "/usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/ok0_badtimes.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec"
[ ta ] keyfile '@/tmp/autopkgtest.UnFhsC/build.Co6/src/tests/config/test.cfg:23 /usr/lib/knot-resolver/trust_anchors.lua:503: [ ta ] fetch of "https://localhost:8080/ok1_expired1.xml" failed: certificate verify failed
[ ta ] Failed to bootstrap root trust anchors; see:
       https://knot-resolver.readthedocs.io/en/latest/daemon.html#enabling-dnssec
ok1_expired1.keys': doesn't exist, bootstrapping
Expected return code '0' got '2'.
make: *** [tests/config/test_config.mk:22: daemon/lua/trust_anchors.test/bootstrap.test.lua] Error 1

[scope]

This is fixed upstream with commit
https://gitlab.labs.nic.cz/knot/knot-resolver/commit/ae4808ab2329bdf190dcfd80b198ce0791a9b4f7

This is needed in Eoan and Focal, which use the test certs that expired.

Bionic and earlier do not contain the expired test certs and do not need this patch (in addition, the Bionic autopkgtests have never worked)

[test case]

check autopkgtest output, e.g.:
https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-eoan/eoan/amd64/k/knot-resolver/20200204_001858_d45dd@/log.gz

[regression potential]

continued autopkgtest failures and/or incorrect failures or incorrect passes

[other info]

this was hacked around in Focal by using 'datefudge' to fake the date during the testcase run; this reverts that hack since it's not needed with the proper fix.

[Launchpad Janitor (janitor)]

This bug was fixed in the package knot-resolver - 3.2.1-3ubuntu2

---------------
knot-resolver (3.2.1-3ubuntu2) focal; urgency=medium

  * d/p/lp1861924-daemon-trust_anchors.test-Turn-off-expiration-date-i.patch:
    - update test certs that had expired (LP: #1861924)
  * d/t/control:
    - remove datefudge hack since above fixes this properly

 -- Dan Streetman <email address hidden> Tue, 04 Feb 2020 15:33:45 -0500

[Steve Langasek (vorlon)]

Hello Dan, or anyone else affected,

Accepted knot-resolver into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knot-resolver/3.2.1-3ubuntu0.19.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted knot-resolver (3.2.1-3ubuntu0.19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

knot-resolver/3.2.1-3ubuntu0.19.10.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#knot-resolver

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Dan Streetman (ddstreet)]

autopkgtests now pass on amd64 and ppc64el. The package is not built for arm64 or s390x so tests fail there of course due to badpkg. The test fails on armhf due to a different error, bug 1862448. The test fails on i386 due to some additional error; I opened bug 1862449 for that but haven't investigated.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted knot-resolver (3.2.1-3ubuntu0.19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

knot-resolver/3.2.1-3ubuntu0.19.10.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#knot-resolver

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package knot-resolver - 3.2.1-3ubuntu0.19.10.1

---------------
knot-resolver (3.2.1-3ubuntu0.19.10.1) eoan; urgency=medium

  * d/p/lp1861924-daemon-trust_anchors.test-Turn-off-expiration-date-i.patch:
    - update test certs that had expired (LP: #1861924)

 -- Dan Streetman <email address hidden> Tue, 04 Feb 2020 16:25:22 -0500

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for knot-resolver has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.