Lower the security level during the python regression tests to allow for small keys - #2
Lower the security level during the python regression tests to allow for small keys#2vxgmichel wants to merge 1 commit into
Conversation
| # ====================================================== | ||
|
|
||
| %changelog | ||
| * For the next release, include the following entry: |
There was a problem hiding this comment.
Not sure this is parsable anyway rpmlint will complain.
AFAIK we add -WIP to version for not to be released change, is this documented anywhere?
cc: @ydirson
There was a problem hiding this comment.
…for small keys With the update to openssl 3.5, the `test_ssl` and `test_poplib` tests started to hang indefinitely. This is due to the threaded servers in those modules no longer answering requests due to the keys in the test certificates being too small. As a workaround, we allow 1024-bit test certificates specifically for the python tests. This is done by creating a temporary configuration to lower the security level, i.e. setting `SECLEVEL` to 0. Note that this does not fix all the tests in those two test modules: some tests were already failing before but the status of the python test runs are ignored. Signed-off-by: Vincent Michel <vincent.michel@vates.tech>
61ef593 to
362d163
Compare
There was a problem hiding this comment.
Yes, you need a work item to link this RPM, either associated with the update of another RPM (in this case, OpenSSL) or by creating a new card.
However, we must link the RPM update to a card in Plane.
As for the release target, it will be "next+1" for the time being. It is to be released at the same time as the associated OpenSSL update.
I updated the PR description to mention XCPNG-3273 (the openssl 3.5 update). I also updated the plane card with information about this PR and xcp-ng-rpms/python3#2 |
|
|
||
| # Changes since the last build, to fold into the next changelog entry: | ||
| # - Lower the security level during the python regression tests to allow for small keys | ||
| %changelog |
There was a problem hiding this comment.
nitpicking: I would add comments after the %changelog keyword
There was a problem hiding this comment.
I followed the recommendation in the PR by @stormi :
https://github.com/xcp-ng/xcp-ng-org/pull/520/changes#diff-6555197921b2f3a7a66b464efc32886c32e65a174d98dee859a33a555ffe2f53R740
Maybe leave a comment there?
5 participants
Main information
Work Item Reference
XCPNG-3273
Related changes (optional)
xcp-ng-rpms/openssl#7
xcp-ng-rpms/openssl#8
xcp-ng-rpms/openssl#9
Context & Motivation
The update to openssl 3.5 caused some of the tests in
test_sslandtest_poplibto hang. This is due to the threaded servers in those modules no longer answering requests due to the keys in the test certificates being too small. As a workaround, we allow 1024-bit test certificates specifically for the python tests. This is done by creating a temporary configuration to lower the security level, i.e. settingSECLEVELto 0. Note that this does not fix all the tests in those two test modules: some tests were already failing before but the status of the python test runs are ignored.Release Target
I propose that we don't release this change. It will simply be included in the next change that bumps the release for this package.
Release Notes and Documentation
Explain the change to users
Nothing to explain, we're just fixing a build.
Attention points
Those patches might get outdated when new versions of python will be imported.
Documentation update needed
Nothing to document, we're just fixing the build.
Testing and regression avoidance
What tests have you performed?
I made sure that the build succeeds with
xcp-ng-vmichel1enabled, which containsopenssl-3.5.5-1.3~xcpng3273.1.xcpng8.3.A scratch build should also be done one xcp-ng-rpms/openssl#9 is merged.
What manual tests should be performed after the build, and by whom?
No manual tests required, we're just fixing the build
What's covered by the xcp-ng-tests test suite?
N/A
What tests have been or will be added to CI for this change? If none, explain why.
None, we're just fixing the build
Xen Orchestra Impact
Does this affect existing features in Xen Orchestra, or add new features that could be useful?