8345414: Google CAInterop test failures

[gnu-andrew]

This fixes failing Google cacert tests. It should leave us with just two failing (digicerttlsrsarootg5, quovadisrootca2g3), which we can fix or exclude separately. The backport applies cleanly from 11u after the paths are shuffled.

Testing shows that the tests now pass:

Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsigne46
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsigneccrootcar4
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsignr46
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsignrootcar6
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#godaddyrootg2ca
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootcar1
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootcar2
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootecccar3
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#gtsrootecccar4

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8345414 needs maintainer approval

Issue

• JDK-8345414: Google CAInterop test failures (Bug - P3 - Approved)

Reviewers

• Severin Gehwolf (@jerboaa - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/673/head:pull/673
$ git checkout pull/673

Update a local copy of the PR:
$ git checkout pull/673
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/673/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 673

View PR using the GUI difftool:
$ git pr show -t 673

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/673.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back andrew! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@gnu-andrew This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8345414: Google CAInterop test failures

Reviewed-by: sgehwolf

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 01: Full - Incremental (7250aa0b)
• 00: Full (3ed2386f)

[jerboaa]

Looks good. Only two more test failures in jdk/security_infra group (which is for another patch):

security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3

[jerboaa]

Linux additional build failure should go away if you merge master. The tier1 failure on Linux x86 (32 bit is intermittent).

[openjdk]

⚠️ @gnu-andrew This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

[jerboaa]

Looks good. Only two more test failures in jdk/security_infra group (which is for another patch):

security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3

Those two seem to be caused by the revocation certificate site not serving a revoked cert. See:
https://www.quovadisglobal.com/download-roots-crl/ and
https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates

Both https://digicert-tls-rsa4096-root-g5-revoked.chain-demos.digicert.com and https://quovadis-root-ca-2-g3-revoked.chain-demos.digicert.com don't properly work (in my browser as well).

[gnu-andrew]

Linux additional build failure should go away if you merge master. The tier1 failure on Linux x86 (32 bit is intermittent).

Done. It hadn't yet been pushed when I posted this.

[gnu-andrew]

Looks good. Only two more test failures in jdk/security_infra group (which is for another patch):

security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5 
security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3

Those two seem to be caused by the revocation certificate site not serving a revoked cert. See: https://www.quovadisglobal.com/download-roots-crl/ and https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates

Both https://digicert-tls-rsa4096-root-g5-revoked.chain-demos.digicert.com and https://quovadis-root-ca-2-g3-revoked.chain-demos.digicert.com don't properly work (in my browser as well).

Thanks for looking at these.

Yes, I see a failure page in Firefox at first for those URLs, and then clicking 'Try Again' takes me to a page I'm apparently not meant to see.

What I can't understand is why these pass in 11u. I don't see any relevant differences in the tests, which suggests it might be class library differences we might not want to alter. I'm tending towards filing bugs for these and excluding them, so we can have a clean run again at last. Let me know your thoughts.

[gnu-andrew]

/approval request Fix for the CAcert test which cause a number of failing cases to now pass. No real risk - test only and test cases were already failing - and has been reviewed by Severin Gehwolf.

[openjdk]

@gnu-andrew
8345414: The approval request has been created successfully.

[jerboaa]

What I can't understand is why these pass in 11u. I don't see any relevant differences in the tests, which suggests it might be class library differences we might not want to alter. I'm tending towards filing bugs for these and excluding them, so we can have a clean run again at last. Let me know your thoughts.

They don't fail in 11u since those tests (jdk/security_infra) only run in 8u as part of the tier 1 CI. Feel free to file bugs and we can do exclusions for them (and then un-exclude once the underlying issue is fixed).

[jerboaa]

What I can't understand is why these pass in 11u. I don't see any relevant differences in the tests, which suggests it might be class library differences we might not want to alter. I'm tending towards filing bugs for these and excluding them, so we can have a clean run again at last. Let me know your thoughts.

They don't fail in 11u since those tests (jdk/security_infra) only run in 8u as part of the tier 1 CI.

Besides, JDK 11u has https://bugs.openjdk.org/browse/JDK-8334441 (mark them manual).

[jerboaa]

What I can't understand is why these pass in 11u. I don't see any relevant differences in the tests, which suggests it might be class library differences we might not want to alter. I'm tending towards filing bugs for these and excluding them, so we can have a clean run again at last. Let me know your thoughts.

They don't fail in 11u since those tests (jdk/security_infra) only run in 8u as part of the tier 1 CI.

Besides, JDK 11u has https://bugs.openjdk.org/browse/JDK-8334441 (mark them manual).

Just ran them manually on latest 11u and they also fail there.

[jerboaa]

It appears the relevant tests no longer fail. Seems an intermittent issue.

Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3

[jerboaa]

Either way, please integrate @gnu-andrew.

[gnu-andrew]

What I can't understand is why these pass in 11u. I don't see any relevant differences in the tests, which suggests it might be class library differences we might not want to alter. I'm tending towards filing bugs for these and excluding them, so we can have a clean run again at last. Let me know your thoughts.

They don't fail in 11u since those tests (jdk/security_infra) only run in 8u as part of the tier 1 CI. Feel free to file bugs and we can do exclusions for them (and then un-exclude once the underlying issue is fixed).

Yes, I'm aware that they are manual but I thought they passed when I ran them all on 11u. Checking my logs again, it seems they don't. I guess I was just thinking of the diff on the 11u PR.

Anyway, this is a better situation because it means it is a general issue with the test and not something specific to 8u.

[gnu-andrew]

It appears the relevant tests no longer fail. Seems an intermittent issue.

Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5
Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#quovadisrootca2g3

Ok, they did fail for me back when I did the 11u PR too.

[gnu-andrew]

/integrate

[openjdk]

Going to push as commit 1b94cbf.

[openjdk]

@gnu-andrew Pushed as commit 1b94cbf.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.