Jira (PUP-10689) Assess SSL provider spec after upgrade to openssl 1.1.1h

Gabriel Nagy (Jira) Wed, 07 Oct 2020 06:23:38 -0700

Title: Message Title

Gabriel Nagy created an issue

Issue Type:	Bug
Assignee:	Unassigned
Created:	2020/10/07 6:22 AM
Priority:	Normal
Reporter:	Gabriel Nagy

After upgrading to openssl 1.1.1h, the following rspec failure can be seen:

$ bundle exec rspec ./spec/unit/ssl/ssl_provider_spec.rb

Run options: exclude {:broken=>true, :benchmark=>true}

.......................................F................................

Failures:

  1) Puppet::SSL::SSLProvider when creating an ssl context with client certs raises if root cert signature is invalid

     Failure/Error:

       expect {

         subject.create_context(**config.merge(cacerts: global_cacerts))

       }.to raise_error(Puppet::SSL::CertVerifyError,

                        "Invalid signature for certificate 'CN=Test CA'")

       expected Puppet::SSL::CertVerifyError with "Invalid signature for certificate 'CN=Test CA'" but nothing was raised

     # ./spec/unit/ssl/ssl_provider_spec.rb:278:in `block (3 levels) in <top (required)>'

     # ./spec/spec_helper.rb:180:in `block (2 levels) in <top (required)>'

     # /home/gabi/.rvm/gems/ruby-2.6.3/gems/webmock-3.9.1/lib/webmock/rspec.rb:37:in `block (2 levels) in <top (required)>'

Finished in 0.51384 seconds (files took 1.09 seconds to load)

72 examples, 1 failure

Failed examples:

rspec ./spec/unit/ssl/ssl_provider_spec.rb:274 # Puppet::SSL::SSLProvider when creating an ssl context with client certs raises if root cert signature is invalid

We traced this to https://github.com/openssl/openssl/commit/42bb51e59308b3ebc5cc1c35ff4822fba6b52d79, notably the changing of X509_V_FLAG_CHECK_SS_SIGNATURE to no longer check signature of the root CA. Downgrading openssl to 1.1.1g causes the test to pass again.

This currently impacts GitHub Actions Windows runners, as ruby 2.7.2 there comes with openssl 1.1.1h.

Add Comment

This message was sent by Atlassian Jira

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.374199.1602076955000.50487.1602076980035%40Atlassian.JIRA.

Jira (PUP-10689) Assess SSL provider spec after upgrade to openssl 1.1.1h

Reply via email to