heimdal ftbfs in disco

[Matthias Klose]

https://launchpadlibrarian.net/417925401/buildlog_ubuntu-disco-amd64.heimdal_7.5.0+dfsg-2.1_BUILDING.txt.gz

=============================================
   Heimdal 7.5.0: lib/hx509/test-suite.log
=============================================

# TOTAL: 16
# PASS: 15
# SKIP: 0
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: test_chain
================

cert -> root
cert -> root
cert -> root
sub-cert -> root
sub-cert -> sub-ca -> root
sub-cert -> sub-ca
sub-cert -> sub-ca -> root
sub-cert -> sub-ca -> root
sub-cert -> sub-ca -> root
max depth 2 (ok)
max depth 1 (fail)
ocsp non-ca responder
ocsp ca responder
ocsp no-ca responder, missing cert
ocsp no-ca responder, missing cert, in pool
ocsp no-ca responder, keyHash
ocsp revoked cert
ocsp print reply resp1-ocsp-no-cert
ocsp print reply resp1-ca
ocsp print reply resp1-keyhash
ocsp print reply resp2
ocsp verify exists
ocsp verify not exists
ocsp verify revoked
crl non-revoked cert
FAIL test_chain (exit status: 1)

============================================================================
Testsuite summary for Heimdal 7.5.0
============================================================================
# TOTAL: 16
# PASS: 15
# SKIP: 0
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0
============================================================================
See lib/hx509/test-suite.log
Please report to https://github.com/heimdal/heimdal/issues

[Matthias Klose (doko)]

same test failure in cosmic:
https://launchpadlibrarian.net/418305085/buildlog_ubuntu-cosmic-amd64.heimdal_7.5.0+dfsg-2_BUILDING.txt.gz

[Seth Arnold (seth-arnold)]

Hmm, also ugly:

test-normalize.c: In function ‘main’:
test-normalize.c:159:49: warning: ‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
      snprintf(longname, sizeof(longname), "%s/%s", srcdir, filename);
                                                 ^
In file included from /usr/include/stdio.h:867,
                 from test-normalize.c:37:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:67:10: note: ‘__builtin___snprintf_chk’ output 2 or more bytes (assuming 257) into a destination of size 256
   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        __bos (__s), __fmt, __va_arg_pack ());
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Leonidas S. Barbosa (leosilvab)]

hi there,

I was attempting to update a security issue on heimdal and had these issues with tests (maybe also related)

FAIL test_ca (exit status: 1)

FAIL: test_chain
================

cert -> root
FAIL test_chain (exit status: 1)

FAIL: test_cms
==============

not testing ECDSA since hcrypto doesnt support ECDSA
create signed data
verify signed data
hxtool: hx509_cms_verify_signed: Failed to find certificate with id CE776EDE0BF421F878C01A7CC3B966EC4C3D4A23
FAIL test_cms (exit status: 1)

============================================================================
Testsuite summary for Heimdal 7.5.0
============================================================================
# TOTAL: 16
# PASS: 13
# SKIP: 0
# XFAIL: 0
# FAIL: 3
# XPASS: 0
# ERROR: 0
============================================================================
See lib/hx509/test-suite.log
Please report to https://github.com/heimdal/heimdal/issues
============================================================================

From upstream, it seems there is a probably fix, but the issue is still open and it seems not to work for 32 Oses - see here: https://github.com/heimdal/heimdal/issues/533

If anyone has any clue how to fix this FTBFS it would be appreciate :) - tks!

[Andreas Hasenack (ahasenack)]

The upstream issue links to a commit that fixes it:
https://github.com/quanah/heimdal/commit/e3cd069e5c40b455541508b81ffeb0563e882aed

The above commit, as I understand it, is the result of running some script to regenerate the certificates used in the test suite, and then the results were committed. For deb packages, it's a bit of a challenge because it includes binary changes, which can't be represented in a debian/patch/<file>.patch

This comment has a hint about the 32bit issue: https://github.com/heimdal/heimdal/issues/533#issuecomment-477264834

Personally I would prefer to have the test certificates regenerated prior to each test run. That would also handle the 32bit issue, as long as certs expire "soon" (like, on the month of the test run for example).

[Andreas Hasenack (ahasenack)]

Disco is EOL, and the package builds fine in current devel release. Closing the bug.