rustls / rustls/rustls-platform-verifier

Test failures on `main` - suspected Windows verifier weirdness

Open
#117 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug O-Windows
Dominant language
Rust
Stars
158
Forks
60
Avg merge
5d 10h
Merged PRs (30d)
3

Description

Noticed CI is failing the Windows latest job:

---- tests::verification_mock::tests::stapled_revoked_dns stdout ----
thread 'tests::verification_mock::tests::stapled_revoked_dns' panicked at rustls-platform-verifier\src\tests\mod.rs:51:9:
assertion `left == right` failed
  left: Ok(())
 right: Err(InvalidCertificate(Revoked))
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- tests::verification_mock::tests::stapled_revoked_ipv4 stdout ----
thread 'tests::verification_mock::tests::stapled_revoked_ipv4' panicked at rustls-platform-verifier\src\tests\mod.rs:51:9:
assertion `left == right` failed
  left: Ok(())
 right: Err(InvalidCertificate(Revoked))

---- tests::verification_mock::tests::stapled_revoked_ipv6 stdout ----
thread 'tests::verification_mock::tests::stapled_revoked_ipv6' panicked at rustls-platform-verifier\src\tests\mod.rs:51:9:
assertion `left == right` failed
  left: Ok(())
 right: Err(InvalidCertificate(Revoked))


failures:
    tests::verification_mock::tests::stapled_revoked_dns
    tests::verification_mock::tests::stapled_revoked_ipv4
    tests::verification_mock::tests::stapled_revoked_ipv6

And the Android task:

07-30 18:14:51.040  3199  3229 I rustls_platform_verif..: verifying Err(InvalidCertificate(UnknownIssuer))
07-30 18:14:51.042  3199  3229 W rustls_platform_verif..: certificate was not trusted: java.
org.rustls.platformverifier.CertificateVerifierTests > runMockTestSuite[test(AVD) - 9] FAILED 
	org.junit.ComparisonFailure: A test failed. Check the logs above for Rust panics. expected:<[success]> but was:<[test failed!]>
	at org.junit.Assert.assertEquals(Assert.java:115)
security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I won't have time to look into this right away, so filing for a rainy day.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with rustls-platform-verifier/src/tests/mod.rs:51 and the failing stapled_revoked_dns, stapled_revoked_ipv4, and stapled_revoked_ipv6 tests. Compare the Windows latest and Android task logs, then investigate why revocation and trust-anchor checks differ on those platforms. Done means the affected CI tests pass with the expected certificate-verification errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.