bug#68474: [Guix-Past]: openssl@1.0.2u does not pass tests

bug#68474: [Guix-Past]: openssl@1.0.2u does not pass tests

[Jean-Pierre De Jesus Diaz via Bug reports for GNU Guix]

[-- Attachment #1: Type: text/plain, Size: 1054 bytes --]

The package at the guix-past channel does not pass the tests at
`tests/cms-test.pl'
file.  It fails with the following error:

From the build log:

...
CMS consistency test
/gnu/store/lj75fc25zx2y9pqvfp95la84rdhlj4f8-perl-5.36.0/bin/perl cms-test.pl
CMS => PKCS#7 compatibility tests
signed content DER format, RSA key: verify error
```

And the from the error file that the test writes:

$ cat /tmp/guix-build-openssl-1.0.2u.drv-0/openssl-1.0.2u/test/cms.err
Verification failure
140737353281920:error:21075075:PKCS7 routines:PKCS7_verify:certificate
verify error:pk7_smime.c:335:Verify error:certificate has expired

My guix description is:

Generation 74    Jan 15 2024 12:28:39    (current)
  guix 162d6a2
    repository URL: https://git.savannah.gnu.org/git/guix.git
    branch: master
    commit: 162d6a2fdd6af13272967c77347a54934ecb45e6
  guix-past 0e8c1ea
    repository URL: https://gitlab.inria.fr/guix-hpc/guix-past
    branch: master
    commit: 0e8c1eae3efd34ab291fc6a4b69b767683488bb9

--
Jean-Pierre De Jesus DIAZ
Foundation Devices, Inc.

[-- Attachment #2: spxpvzpamzndlggz8xd4d79vis312d-openssl-1.0.2u.drv.gz --]
[-- Type: application/gzip, Size: 78626 bytes --]

bug#68474: [Guix-Past]: openssl@1.0.2u does not pass tests

[Ludovic Courtès]

Hi,

Jean-Pierre De Jesus Diaz <jean@foundationdevices.com> skribis:

> And the from the error file that the test writes:
>
> $ cat /tmp/guix-build-openssl-1.0.2u.drv-0/openssl-1.0.2u/test/cms.err
> Verification failure
> 140737353281920:error:21075075:PKCS7 routines:PKCS7_verify:certificate
> verify error:pk7_smime.c:335:Verify error:certificate has expired

This is a typically “time trap”.  Options are: use libfaketime to run
“make check”, change the certificates so they don’t expire, or skip
those tests.

Would you like to give it a try?

Thanks,
Ludo’.

bug#68474: [Guix-Past]: openssl@1.0.2u does not pass tests

[Jean-Pierre De Jesus Diaz via Bug reports for GNU Guix]

Hi,

On Tue, Jan 30, 2024 at 5:29 PM Ludovic Courtès
<ludovic.courtes@inria.fr> wrote:
>
> Hi,
>
> Jean-Pierre De Jesus Diaz <jean@foundationdevices.com> skribis:
>
> > And the from the error file that the test writes:
> >
> > $ cat /tmp/guix-build-openssl-1.0.2u.drv-0/openssl-1.0.2u/test/cms.err
> > Verification failure
> > 140737353281920:error:21075075:PKCS7 routines:PKCS7_verify:certificate
> > verify error:pk7_smime.c:335:Verify error:certificate has expired
>
> This is a typically “time trap”.  Options are: use libfaketime to run
> “make check”, change the certificates so they don’t expire, or skip
> those tests.
>
> Would you like to give it a try?
>
> Thanks,
> Ludo’.

I'll give it a try to use libfaketime to keep tests enabled.

Thanks,

-- 
Jean-Pierre De Jesus DIAZ
Foundation Devices, Inc.

bug#68474: [PATCH] tls: Fix openssl-1.0 check phase.

[Jean-Pierre De Jesus DIAZ via Bug reports for GNU Guix]

From: Jean-Pierre De Jesus DIAZ <me@jeandudey.tech>

* modules/past/packages/tls.scm (openssl-1.0): Fix a time bomb in
cms-test.pl due to expired certificates.
---
 modules/past/packages/tls.scm | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/modules/past/packages/tls.scm b/modules/past/packages/tls.scm
index cbc9834..a494e1c 100644
--- a/modules/past/packages/tls.scm
+++ b/modules/past/packages/tls.scm
@@ -140,6 +140,20 @@
                        ,@(if (%current-target-system)
                              '((getenv "CONFIGURE_TARGET_ARCH"))
                              '())))))
+         (add-before 'check 'patch-util/shlib_wrap.sh
+           (lambda* (#:key tests? native-inputs inputs #:allow-other-keys)
+             (when tests?
+               (let ((lib (search-input-file (or native-inputs inputs)
+                                             "lib/faketime/libfaketime.so.1"))
+                     (release-date "2019-12-20 13:25:43"))
+                 ;; Invoking "faketime make ..." does not work as this script
+                 ;; sets its own LD_PRELOAD variable, so re-export it with
+                 ;; libfaketime and set the fake time.
+                 (substitute* "util/shlib_wrap.sh"
+                   (("cmd=\"\\$1\\$\\{EXE_EXT\\}\"" all)
+                    (string-append "export LD_PRELOAD=" lib ":$LD_PRELOAD\n"
+                                   "export FAKETIME=\"" release-date "\"\n"
+                                   all)))))))
          (add-after 'install 'move-static-libraries
            (lambda* (#:key outputs #:allow-other-keys)
              ;; Move static libraries to the "static" output.
@@ -175,7 +189,7 @@
                (delete-file-recursively (string-append out "/share/openssl-"
                                                        ,version "/misc"))
                #t))))))
-    (native-inputs (list (S "perl")))
+    (native-inputs (list (S "libfaketime") (S "perl")))
     (native-search-paths
      (list (search-path-specification
             (variable "SSL_CERT_DIR")

base-commit: d60a388678098e6de60ca1a65806903b5739da29
-- 
2.41.0

bug#68474: [PATCH] tls: Fix openssl-1.0 check phase.

[Ludovic Courtès]

Hello,

Jean-Pierre De Jesus DIAZ <jean@foundationdevices.com> skribis:

> From: Jean-Pierre De Jesus DIAZ <me@jeandudey.tech>
>
> * modules/past/packages/tls.scm (openssl-1.0): Fix a time bomb in
> cms-test.pl due to expired certificates.

Perfect.  Pushed, thanks!

Ludo’.