adoptium / adoptium/infrastructure
dev.functional test ssl-tests_0 fails on Alpine test nodes
- Dominant language
- Python
- Stars
- 96
- Forks
- 106
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
Please set the title to indicate the test name and machine name where known.
To make it easy for the infrastructure team to repeat and diagnose, please
answer the following questions:
- Test suite/name (e.g, BUILD_LIST, TARGET, CUSTOM_TARGET): ssl-tests_0 (dev.functional)
- Recent `Test_` link to ci.adoptium.net that shows the failure: https://ci.adoptium.net/job/Test_openjdk8_hs_dev.functional_x86-64_alpine-linux/46/
- Specific error text (if applicable):
```
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_GCM_SHA384
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_GCM_SHA256
IGNORED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_CBC_SHA256
IGNORED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_CBC_SHA256
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_256_CBC_SHA
FAILED: SunJSSE/TLSv1.2: TLSv1.2 + TLS_RSA_WITH_AES_128_CBC_SHA
```
And, later in the test:
```
stderr: *** Fatal error: The encryption algorithm is not supported.
```
Full test output
[ssl-tests-gnutls-client.jtr.txt](https://github.com/user-attachments/files/26400113/ssl-tests-gnutls-client.jtr.txt)
- **Hyperlink** to re-run in Grinder: [Grinder link](https://ci.adoptium.net/job/Grinder/parambuild/?SDK_RESOURCE=upstream&TARGET=testList+TESTLIST=ssl-tests_0&BASE_DOCKER_REGISTRY_CREDENTIAL_ID=&TEST_FLAG=&UPSTREAM_TEST_JOB_NAME=&DOCKER_REQUIRED=false&ACTIVE_NODE_TIMEOUT=5&VENDOR_TEST_DIRS=&EXTRA_DOCKER_ARGS=&TKG_OWNER_BRANCH=adoptium%3Amaster&OPENJ9_SYSTEMTEST_OWNER_BRANCH=eclipse%3Amaster&PLATFORM=x86-64_alpine-linux&GENERATE_JOBS=true&KEEP_REPORTDIR=true&PERSONAL_BUILD=false&DOCKER_REGISTRY_DIR=&RERUN_ITERATIONS=0&ADOPTOPENJDK_REPO=https%3A%2F%2Fgithub.com%2Fadoptium%2Faqa-tests.git&SETUP_JCK_RUN=false&DOCKER_REGISTRY_URL_CREDENTIAL_ID=&LABEL=&EXTRA_OPTIONS=&CUSTOMIZED_SDK_URL=&BUILD_IDENTIFIER=&JENKINS_KEY=&ADOPTOPENJDK_BRANCH=master&LIGHT_WEIGHT_CHECKOUT=false&USE_JRE=false&ARTIFACTORY_SERVER=&KEEP_WORKSPACE=false&USER_CREDENTIALS_ID=&JDK_VERSION=8&DOCKER_REGISTRY_URL=&ITERATIONS=1&VENDOR_TEST_REPOS=&JDK_REPO=https%3A%2F%2Fgithub.com%2Fadoptium%2Falpine-jdk8u&JCK_GIT_BRANCH=master&OPENJ9_BRANCH=master&OPENJ9_SHA=&JCK_GIT_REPO=&VENDOR_TEST_BRANCHES=&UPSTREAM_JOB_NAME=build-scripts%2Fjobs%2Fjdk8u%2Fjdk8u-alpine-linux-x64-temurin&OPENJ9_REPO=https%3A%2F%2Fgithub.com%2Feclipse-openj9%2Fopenj9.git&CLOUD_PROVIDER=&CUSTOM_TARGET=&VENDOR_TEST_SHAS=&JDK_BRANCH=jdk8u492-b04_adopt&LABEL_ADDITION=&ARTIFACTORY_REPO=&ARTIFACTORY_ROOT_DIR=&UPSTREAM_TEST_JOB_NUMBER=&DOCKERIMAGE_TAG=&TEST_TIME=120&JDK_IMPL=hotspot&SSH_AGENT_CREDENTIAL=&AUTO_DETECT=true&SLACK_CHANNEL=aqavit-bot&DYNAMIC_COMPILE=true&RELATED_NODES=&ADOPTOPENJDK_SYSTEMTEST_OWNER_BRANCH=adoptium%3Amaster&APPLICATION_OPTIONS=&CUSTOMIZED_SDK_URL_CREDENTIAL_ID=eclipse_temurin_bot_email_and_token&ARCHIVE_TEST_RESULTS=false&NUM_MACHINES=&OPENJDK_SHA=&TRSS_URL=&RERUN_FAILURE=false&USE_TESTENV_PROPERTIES=false&BUILD_LIST=functional&ADDITIONAL_ARTIFACTS_REQUIRED=&UPSTREAM_JOB_NUMBER=514&STF_OWNER_BRANCH=adoptium%3Amaster&TIME_LIMIT=25&JVM_OPTIONS=&PARALLEL=None)
- Any existing issues covering this:
- https://github.com/rh-openjdk/ssl-tests/issues/39
- This issue does not appear to be reproducible in their Alpine podman containers.
- Machine(s) this test works on: The unit test that fails does not run on non-Alpine x64 Linux, but the openssl-client cipher testing unit test does test the affected ciphers, and passes for both Alpine and non-alpine.
- Machine(s) this test fails on: [test-docker-alpine320-x64-1](https://ci.adoptium.net/computer/test-docker-alpine320-x64-1), [test-docker-alpine320-x64-4](https://ci.adoptium.net/computer/test%2Ddocker%2Dalpine320%2Dx64%2D4/)
Any other details:
This issue may be rendered irrelevant once the TLS_RSA_* ciphers have been excluded upstream for jdk8.
Currently, the exclusion bug is [here](https://bugs.openjdk.org/browse/JDK-8245545), and the exclusion blocker fix is [here](https://github.com/openjdk/jdk8u-dev/pull/763).
Contributor guide
Research direction
Start by rerunning ssl-tests_0 from the linked Grinder job on test-docker-alpine320-x64-1 or -4, then inspect the attached ssl-tests-gnutls-client.jtr.txt output. Compare the failure with ssl-tests issue 39 and the referenced JDK-8245545 and jdk8u-dev pull request. Done means the failure is resolved or confirmed irrelevant after the TLS_RSA_* exclusion, with the result documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java, linux
- Domain
- infrastructure, security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100