crypto/x509: TestSystemVerify/EKULeafValid fails on LUCI

[heschi]

The test is failing on 1.20 and master:

=== RUN   TestSystemVerify/EKULeafValid
    verify_test.go:525: Got 2 matches instead of 1 for expected chain [CORPORATIVO FICTICIO ACTIVO EAEko Herri Administrazioen CA - CA AAPP Vascas (2) IZENPE S.A.]
    verify_test.go:528: 	 matched /IZENPE/Ziurtagiri korporatiboa-Certificado corporativo,Condiciones de uso en www.izenpe.com nola erabili jakiteko/CORPORATIVO FICTICIO ACTIVO -> ES/IZENPE S.A./AZZ Ziurtagiri publikoa - Certificado publico SCA/EAEko Herri Administrazioen CA - CA AAPP Vascas (2) -> ES/IZENPE S.A.//Izenpe.com
    verify_test.go:528: 	 matched /IZENPE/Ziurtagiri korporatiboa-Certificado corporativo,Condiciones de uso en www.izenpe.com nola erabili jakiteko/CORPORATIVO FICTICIO ACTIVO -> ES/IZENPE S.A./AZZ Ziurtagiri publikoa - Certificado publico SCA/EAEko Herri Administrazioen CA - CA AAPP Vascas (2) -> ES/IZENPE S.A.//Izenpe.com
--- FAIL: TestSystemVerify/EKULeafValid (0.00s)

https://ci.chromium.org/ui/p/golang/builders/ci/gotip-windows-amd64/b8777650789528565057/test-results

cc @golang/security @rolandshoemaker

[rolandshoemaker]

I assume Izenpe re-issued one of their roots, resulting in a pair of valid chains, instead of just one.

We can probably bandaid this, but it's an inherent problem with how TestSystemVerify works. Once #52108 lands we'll be able to just remove these semi-broken tests entirely.

[heschi]

I'd appreciate a bandaid :(

[rolandshoemaker]

I will bandaid :)

[gopherbot]

Change https://go.dev/cl/505035 mentions this issue: crypto/x509: tolerate multiple matching chains in testVerify

[heschi]

@gopherbot please backport to 1.20.

[gopherbot]

Backport issue(s) opened: #60947 (for 1.20).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/505275 mentions this issue: [release-branch.go1.20] crypto/x509: tolerate multiple matching chains in testVerify