8308592: Framework for CA interoperability testing

[gnu-andrew]

Hi all,

This pull request contains a backport of commit da57d2a1 from the openjdk/jdk repository.

The commit being backported was authored by Rajan Halade on 19 Sep 2023 and was reviewed by Sean Mullan.

It reworks the certificate tests to use test portals rather than having to maintain copies of the certificates in the OpenJDK repository and so should reduce the maintenance cost of these tests going forward. The fix has already been backported to 21u and Oracle-17u.

The backport was clean and tests passed successfully:

Test Path: test/jdk/security/infra/java/security/cert/CertPathValidator/certification
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#actalisauthenticationrootca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca2
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca4
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#buypassclass2ca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#buypassclass3ca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#certignarootca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#comodoeccca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#comodorsaca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#entrustrootcaec1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#entrustrootcag4
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsigneccrootcar4
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsignrootcar6
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#godaddyrootg2ca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootcar1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootcar2
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootecccar3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootecccar4
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#letsencryptisrgx1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#microsoftecc2017
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#microsoftrsa2017
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca1g3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca3g3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#sslrooteccca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#sslrootevrsaca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#sslrootrsaca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#starfieldrootg2ca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#twcaglobalrootca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#usertrusteccca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#usertrustrsaca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CertignaCA.java
Passed: security/infra/java/security/cert/CertPathValidator/certification/DTrustCA.java
Passed: security/infra/java/security/cert/CertPathValidator/certification/HaricaCA.java
Passed: security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java
Test results: passed: 37

Thanks!

---

Progress

• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8308592 needs maintainer approval

Issue

• JDK-8308592: Framework for CA interoperability testing (Enhancement - P3 - Approved)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk17u-dev.git pull/1805/head:pull/1805
$ git checkout pull/1805

Update a local copy of the PR:
$ git checkout pull/1805
$ git pull https://git.openjdk.org/jdk17u-dev.git pull/1805/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 1805

View PR using the GUI difftool:
$ git pr show -t 1805

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk17u-dev/pull/1805.diff

Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back andrew! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[openjdk]

⚠️ @gnu-andrew This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

[gnu-andrew]

/approval request This change reworks the certificate tests to use test portals rather than having to maintain copies of the certificates in the OpenJDK repository and so should reduce the maintenance cost of these tests going forward. The fix has already been backported to 21u and Oracle-17u. The backport was clean and tests passed successfully

[openjdk]

@gnu-andrew The approval request has been created successfully.

[mlbridge]

Webrevs

• 00: Full (c01fc278)

[GoeLin]

/approve yes

[openjdk]

@GoeLin
8308592: The approval request has been approved.

[openjdk]

@gnu-andrew This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8308592: Framework for CA interoperability testing

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 18 new commits pushed to the master branch:

• e7fc89d: 8313322: RISC-V: implement MD5 intrinsic
• 64be3f0: 8313792: Verify 4th party information in src/jdk.internal.le/share/legal/jline.md
• b382b09: 8316206: Test StretchedFontTest.java fails for Baekmuk font
• 80c8ce7: 8304174: Remove delays from httpserver tests
• 1b5139b: 8298735: Some tools/jpackage/windows/* tests fails with jtreg test timeout
• cdbce9c: 8249826: 5 javax/net/ssl/SSLEngine tests use @ignore w/o bug-id
• 23457a6: 8297798: Timeout with DTLSOverDatagram test template
• 94c154e: 8292261: adjust timeouts in JLI GetObjectSizeIntrinsicsTest.java
• c345ffa: 8288961: jpackage: test MSI installation fix
• 6bdd611: 8286475: Drop --enable-preview from instanceof pattern matching related tests
• ... and 8 more: https://git.openjdk.org/jdk17u-dev/compare/52962e4a4fccfbb67ad0ebef7ac0039351029707...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[gnu-andrew]

Thanks @GoeLin
/integrate

[openjdk]

Going to push as commit cb535e2.
Since your change was applied there have been 26 commits pushed to the master branch:

• 9fce30a: 8298867: Basics.java fails with SSL handshake exception
• 1ce8f3e: 8293156: Dcmd VM.classloaders fails to print the full hierarchy
• 7e58a42: 8283670: gtest os.release_multi_mappings_vm is still racy
• 9404b2b: 8314121: test tools/jpackage/share/RuntimePackageTest.java#id0 fails on RHEL8
• 486a468: 8307732: build-test-lib is broken
• 0ce7d86: 8289745: JfrStructCopyFailed uses heap words instead of bytes for object sizes
• 4ecf818: 8276054: JMH benchmarks for Fences
• 8961594: 8300997: Add curl support to createJMHBundle.sh
• e7fc89d: 8313322: RISC-V: implement MD5 intrinsic
• 64be3f0: 8313792: Verify 4th party information in src/jdk.internal.le/share/legal/jline.md
• ... and 16 more: https://git.openjdk.org/jdk17u-dev/compare/52962e4a4fccfbb67ad0ebef7ac0039351029707...master

Your commit was automatically rebased without conflicts.

[openjdk]

@gnu-andrew Pushed as commit cb535e2.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.