#58650 OpenSSL 1.1.1n test failures due to expired certificates (time bomb)

Message #32 received at 58650@debbugs.gnu.org (full text, mbox, reply):

Received: (at 58650) by debbugs.gnu.org; 27 Feb 2023 04:04:05 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sun Feb 26 23:04:05 2023
Received: from localhost ([127.0.0.1]:45571 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1pWUk9-0003BX-1f
	for submit@debbugs.gnu.org; Sun, 26 Feb 2023 23:04:05 -0500
Received: from mail-qt1-f174.google.com ([209.85.160.174]:42974)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@gmail.com>)
 id 1pWUk5-0003At-72; Sun, 26 Feb 2023 23:04:03 -0500
Received: by mail-qt1-f174.google.com with SMTP id ay9so5361297qtb.9;
 Sun, 26 Feb 2023 20:04:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=mime-version:user-agent:message-id:in-reply-to:date:references
 :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=YwLkWlTYwbYtJeJ/WhyW+ldpeI8W/GOsp3sPDgpcGyQ=;
 b=ODwEPD/t7T9xYrnLoJbPKMx7eAjp4ywNSupMOIW2kG4neT1H804IjRQBTEH376N8l6
 85PraOomjDnOOd1MtzLeviWkyqAfp7gW83deDe3nUSAMjN97wROAUuFkysSceAcSB7M4
 XwAj6hTvc1lnfY89r7Jk/+y3Q/soaKIFt/EAlHNGDLOmuRBmLJGc0k9HaFELXkf6bWeB
 sQ/MpomEJ1SbSNb3xhzlXU9fEWuqIUGLYRdYTAbOR2N3mY2CynHBZOa1uBtF7+ln8fzJ
 H1Mt0bkLGnSJ5m+WRJ8uRMAEqAp51m+DMt0QllX3LxaI4dM+bW24lQFuN0BcPMQoU/+n
 sDkw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=mime-version:user-agent:message-id:in-reply-to:date:references
 :subject:cc:to:from:x-gm-message-state:from:to:cc:subject:date
 :message-id:reply-to;
 bh=YwLkWlTYwbYtJeJ/WhyW+ldpeI8W/GOsp3sPDgpcGyQ=;
 b=qM11DC+GMSgtURaVS3kzAqREzt3nnSXirpvUjQ2s5Af9O7uicG0M9XkZsjHDPagOu9
 vIDNQeiw9d6ZyCVIiCmYfu7wEpEiQVv4+RGtAyK7xDke2+zr5zv1+1qSc2h2MiFJ6BkI
 udj4wf7JiNHwzfAMu7K91NHMZKhkttFaj/vxSjkPafKea5n46sMApJZhpT5spal4wGwp
 KW6W7sSAK50Nwy5edEXsuG+K6tZ4Vt7S8NNT+bO67Q5kET0L2Jkns5o5MVM71nloe9Qx
 si5R97tSaGZ/kmzGKhL4pDnQPyxOp4GI1ywBQJdlpSCJBuneHEFY3nXa5sK6mENlUxXU
 lhcw==
X-Gm-Message-State: AO0yUKVnrECSAuQLDg01F6UBVPEdOE0x7SengjUtxinWbOt3Owjcvkfi
 s2W3FcEB/Pm6T0L/5MHFgv4=
X-Google-Smtp-Source: AK7set/OV1b+40GpghV5HaGadPUzNr7C2Y8Y7Dh1ML5q7+KYotdsSsJZGptkuLWoEPp8H22JkEtnlQ==
X-Received: by 2002:ac8:5d8c:0:b0:3bf:cb70:8a4f with SMTP id
 d12-20020ac85d8c000000b003bfcb708a4fmr10115561qtx.41.1677470635466; 
 Sun, 26 Feb 2023 20:03:55 -0800 (PST)
Received: from hurd (dsl-156-86.b2b2c.ca. [66.158.156.86])
 by smtp.gmail.com with ESMTPSA id
 a23-20020ac87217000000b003b62e8b77e7sm3914711qtp.68.2023.02.26.20.03.54
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sun, 26 Feb 2023 20:03:55 -0800 (PST)
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 56137@debbugs.gnu.org
Subject: Re: bug#58650: OpenSSL 1.1.1n test failures due to expired
 certificates (time bomb)
References: <87r13h3tqr.fsf@gnu.org>
 <20230226052906.784-1-maxim.cournoyer@gmail.com>
Date: Sun, 26 Feb 2023 23:03:53 -0500
In-Reply-To: <20230226052906.784-1-maxim.cournoyer@gmail.com> (Maxim
 Cournoyer's message of "Sun, 26 Feb 2023 00:29:04 -0500")
Message-ID: <871qmbdaae.fsf_-_@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 58650
Cc: sjors@sprovoost.nl, ludo@gnu.org, 58650@debbugs.gnu.org,
 maximedevos@telenet.be, zimon.toutoune@gmail.com
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi,

I also tried with libfaketime, which seemed more complete and easy to
setup globally via environment variables:

--8<---------------cut here---------------start------------->8---
modified   gnu/packages/tls.scm
@@ -491,11 +491,47 @@ (define (target->openssl-target target)
                (error "unsupported openssl target architecture")))))
         (string-append kernel "-" arch))))
 
+;;; A minimal version of libfaketime that should remain private.  Its only
+;;; purpose is to avoid introducing a cycle with openssl due to libfaketime's
+;;; git-fetch origin, which pulls git (which requires openssl).
+(define libfaketime-minimal
+  (package
+    (name "libfaketime")
+    (version "0.9.10")
+    (home-page "https://github.com/wolfcw/libfaketime")
+    (source (origin
+              (method url-fetch)
+              ;; XXX: We cheat and use a dynamically generated archive GitHub
+              ;; link here, since we can't fetch from git.
+              (uri (string-append  "https://github.com/wolfcw/" name
+                                   "/archive/refs/tags/v" version ".tar.gz"))
+              (sha256
+               (base32
+                "0zwlwxpya3scayf8b3ans6pp82k8k42bk5wfqvcm02kmkhxx76kj"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags #~(list "all")
+      #:tests? #f
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'configure
+            (lambda* (#:key outputs #:allow-other-keys)
+              (setenv "CC" #$(cc-for-target))
+              (setenv "PREFIX" #$output))))))
+    (synopsis "Fake the system time for single applications")
+    (description
+     "The libfaketime library allows users to modify the system time that an
+application \"sees\".  It is meant to be loaded using the dynamic linker's
+@code{LD_PRELOAD} environment variable.  The @command{faketime} command
+provides a simple way to achieve this.")
+    (license license:gpl2)))
+
 (define-public openssl-1.1
   ;; Note to maintainers: when updating this package, make sure to update the
   ;; RELEASE-DATE variable below.  It is used by datefudge to avoid time bombs
   ;; in the test suite.
-  (let ((release-date "2021-08-24 00:00"))
+  (let ((release-date "@2021-08-24 00:00:00"))
     (package
       (name "openssl")
       (version "1.1.1l")
@@ -517,7 +553,7 @@ (define-public openssl-1.1
       (outputs '("out"
                  "doc"      ;6.8 MiB of man3 pages and full HTML documentation
                  "static")) ;6.4 MiB of .a files
-      (native-inputs (list datefudge perl))
+      (native-inputs (list libfaketime-minimal perl))
       (arguments
        (list
         #:modules '((guix build gnu-build-system)
@@ -537,6 +573,15 @@ (define-public openssl-1.1
         #:disallowed-references (list (canonical-package perl))
         #:phases
         #~(modify-phases %standard-phases
+            (add-before 'unpack 'setup-libfaketime
+              (lambda* (#:key native-inputs inputs #:allow-other-keys)
+                (let ((libfaketime.so.1 (search-input-file
+                                         (or native-inputs inputs)
+                                         "lib/faketime/libfaketime.so.1")))
+                  (setenv "LD_PRELOAD" libfaketime.so.1)
+                  (setenv "NO_FAKE_STAT" "1")
+                  (setenv "FAKETIME_DONT_RESET" "1")
+                  (setenv "FAKETIME" #$release-date))))
             #$@(if (%current-target-system)
                    #~((add-before 'configure 'set-cross-compile

--8<---------------cut here---------------end--------------->8---

But I still get the same error:

--8<---------------cut here---------------start------------->8---
../../util/shlib_wrap.sh /gnu/store/hy6abswwv4d89zp464fw52z65fkzr7h5-perl-5.34.0/bin/perl -I ../../util/perl ../generate_ssl_tests.pl ../ssl-tests/12-ct.conf.in > 12-ct.conf.30543.tmp => 0
    ok 1 - Getting output from generate_ssl_tests.pl.
    ok 2 - Comparing generated sources.
        # Subtest: ../ssl_test
        1..1
            # Subtest: test_handshake
            1..6
            ok 1 - iteration 1
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:33
            # [2] compared to [0]
            # INFO:  @ test/ssl_test.c:34
            # ExpectedResult mismatch: expected Success, got ClientFail.
            # 140450700142400:error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired:ssl/record/rec_layer_s3.c:1543:SSL alert number 45
            not ok 2 - iteration 2
            ok 3 - iteration 3
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:33
            # [2] compared to [0]
            # INFO:  @ test/ssl_test.c:34
            # ExpectedResult mismatch: expected Success, got ClientFail.
            # 140450700142400:error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired:ssl/record/rec_layer_s3.c:1543:SSL alert number 45
            not ok 4 - iteration 4
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:33
            # [4] compared to [0]
            # INFO:  @ test/ssl_test.c:34
            # ExpectedResult mismatch: expected Success, got FirstHandshakeFailed.
            # 140450700142400:error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired:ssl/record/rec_layer_s3.c:1543:SSL alert number 45
            not ok 5 - iteration 5
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:33
            # [4] compared to [0]
            # INFO:  @ test/ssl_test.c:34
            # ExpectedResult mismatch: expected Success, got FirstHandshakeFailed.
            # 140450700142400:error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired:ssl/record/rec_layer_s3.c:1543:SSL alert number 45
            not ok 6 - iteration 6
        not ok 1 - test_handshake
../../util/shlib_wrap.sh ../ssl_test 12-ct.conf.30543.tmp => 1
    not ok 3 - running ssl_test 12-ct.conf

    #   Failed test 'running ssl_test 12-ct.conf'
    #   at ../test/recipes/80-test_ssl_new.t line 148.
    # Looks like you failed 1 test of 3.
not ok 12 - Test configuration 12-ct.conf

#   Failed test 'Test configuration 12-ct.conf'
#   at
#   /tmp/guix-build-openssl-1.1.1l.drv-0/openssl-1.1.1l/test/../util/perl/OpenSSL/Test.pm
#   line 1212.
--8<---------------cut here---------------end--------------->8---

When attempting to build with

--8<---------------cut here---------------start------------->8---
./pre-inst-env guix build --no-grafts -e '(@@ (gnu packages tls) openssl-1.1)'
--8<---------------cut here---------------end--------------->8---

Upstream seems to have moved to give very large expiry dates on their
test certs (100 years), so perhaps we can simply remove this test and
hope the problem doesn't come back to haunt us...

-- 
Thanks,
Maxim

Send a report that this bug log contains spam.