adoptium / adoptium/infrastructure

dev.functional test ssl-tests_0 fails on Alpine test nodes

Open
#4,301 0 comments 0 reactions 0 assignees View on GitHub
testFail
Dominant language
Python
Stars
96
Forks
106
Avg merge
1d 23h
Merged PRs (30d)
13

Description

Please set the title to indicate the test name and machine name where known.

To make it easy for the infrastructure team to repeat and diagnose, please
answer the following questions:

- Test suite/name (e.g, BUILD_LIST, TARGET, CUSTOM_TARGET): ssl-tests_0 (dev.functional)
- Recent `Test_` link to ci.adoptium.net that shows the failure: https://ci.adoptium.net/job/Test_openjdk8_hs_dev.functional_x86-64_alpine-linux/46/
- Specific error text (if applicable):
```
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_GCM_SHA384
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_GCM_SHA256
IGNORED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_CBC_SHA256
IGNORED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_CBC_SHA256
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_CBC_SHA
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_CBC_SHA
```

And, later in the test:
```
stderr: *** Fatal error: The encryption algorithm is not supported.
```

Full test output

[ssl-tests-gnutls-client.jtr.txt](https://github.com/user-attachments/files/26400113/ssl-tests-gnutls-client.jtr.txt)

- **Hyperlink** to re-run in Grinder: [Grinder link](https://ci.adoptium.net/job/Grinder/parambuild/?SDK_RESOURCE=upstream&TARGET=testList+TESTLIST=ssl-tests_0&BASE_DOCKER_REGISTRY_CREDENTIAL_ID=&TEST_FLAG=&UPSTREAM_TEST_JOB_NAME=&DOCKER_REQUIRED=false&ACTIVE_NODE_TIMEOUT=5&VENDOR_TEST_DIRS=&EXTRA_DOCKER_ARGS=&TKG_OWNER_BRANCH=adoptium%3Amaster&OPENJ9_SYSTEMTEST_OWNER_BRANCH=eclipse%3Amaster&PLATFORM=x86-64_alpine-linux&GENERATE_JOBS=true&KEEP_REPORTDIR=true&PERSONAL_BUILD=false&DOCKER_REGISTRY_DIR=&RERUN_ITERATIONS=0&ADOPTOPENJDK_REPO=https%3A%2F%2Fgithub.com%2Fadoptium%2Faqa-tests.git&SETUP_JCK_RUN=false&DOCKER_REGISTRY_URL_CREDENTIAL_ID=&LABEL=&EXTRA_OPTIONS=&CUSTOMIZED_SDK_URL=&BUILD_IDENTIFIER=&JENKINS_KEY=&ADOPTOPENJDK_BRANCH=master&LIGHT_WEIGHT_CHECKOUT=false&USE_JRE=false&ARTIFACTORY_SERVER=&KEEP_WORKSPACE=false&USER_CREDENTIALS_ID=&JDK_VERSION=8&DOCKER_REGISTRY_URL=&ITERATIONS=1&VENDOR_TEST_REPOS=&JDK_REPO=https%3A%2F%2Fgithub.com%2Fadoptium%2Falpine-jdk8u&JCK_GIT_BRANCH=master&OPENJ9_BRANCH=master&OPENJ9_SHA=&JCK_GIT_REPO=&VENDOR_TEST_BRANCHES=&UPSTREAM_JOB_NAME=build-scripts%2Fjobs%2Fjdk8u%2Fjdk8u-alpine-linux-x64-temurin&OPENJ9_REPO=https%3A%2F%2Fgithub.com%2Feclipse-openj9%2Fopenj9.git&CLOUD_PROVIDER=&CUSTOM_TARGET=&VENDOR_TEST_SHAS=&JDK_BRANCH=jdk8u492-b04_adopt&LABEL_ADDITION=&ARTIFACTORY_REPO=&ARTIFACTORY_ROOT_DIR=&UPSTREAM_TEST_JOB_NUMBER=&DOCKERIMAGE_TAG=&TEST_TIME=120&JDK_IMPL=hotspot&SSH_AGENT_CREDENTIAL=&AUTO_DETECT=true&SLACK_CHANNEL=aqavit-bot&DYNAMIC_COMPILE=true&RELATED_NODES=&ADOPTOPENJDK_SYSTEMTEST_OWNER_BRANCH=adoptium%3Amaster&APPLICATION_OPTIONS=&CUSTOMIZED_SDK_URL_CREDENTIAL_ID=eclipse_temurin_bot_email_and_token&ARCHIVE_TEST_RESULTS=false&NUM_MACHINES=&OPENJDK_SHA=&TRSS_URL=&RERUN_FAILURE=false&USE_TESTENV_PROPERTIES=false&BUILD_LIST=functional&ADDITIONAL_ARTIFACTS_REQUIRED=&UPSTREAM_JOB_NUMBER=514&STF_OWNER_BRANCH=adoptium%3Amaster&TIME_LIMIT=25&JVM_OPTIONS=&PARALLEL=None)
- Any existing issues covering this:
- https://github.com/rh-openjdk/ssl-tests/issues/39
- This issue does not appear to be reproducible in their Alpine podman containers.
- Machine(s) this test works on: The unit test that fails does not run on non-Alpine x64 Linux, but the openssl-client cipher testing unit test does test the affected ciphers, and passes for both Alpine and non-alpine.
- Machine(s) this test fails on: [test-docker-alpine320-x64-1](https://ci.adoptium.net/computer/test-docker-alpine320-x64-1), [test-docker-alpine320-x64-4](https://ci.adoptium.net/computer/test%2Ddocker%2Dalpine320%2Dx64%2D4/)

Any other details:

This issue may be rendered irrelevant once the TLS_RSA_* ciphers have been excluded upstream for jdk8.

Currently, the exclusion bug is [here](https://bugs.openjdk.org/browse/JDK-8245545), and the exclusion blocker fix is [here](https://github.com/openjdk/jdk8u-dev/pull/763).

Contributor guide

Open the contributing guide

Research direction

Start by rerunning ssl-tests_0 from the linked Grinder job on test-docker-alpine320-x64-1 or -4, then inspect the attached ssl-tests-gnutls-client.jtr.txt output. Compare the failure with ssl-tests issue 39 and the referenced JDK-8245545 and jdk8u-dev pull request. Done means the failure is resolved or confirmed irrelevant after the TLS_RSA_* exclusion, with the result documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java, linux
Domain
infrastructure, security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.