rustls / rustls/rustls-platform-verifier

Proposal: Allow Android real-world tests to pass CI even when expired

Open
#183 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

discussion good first issue O-Android
Dominant language
Rust
Stars
158
Forks
60
Avg merge
5d 10h
Merged PRs (30d)
3

Description

We run into the case time and time again where CI starts failing after a period of inactivity in the repository. The root cause of this is our real-world test cases: they include certificates from real CAs, which therefore have real (usually ~90 day) expiry periods.

Most of our testing infrastructure for the various platforms is robust enough to handle this by faking all of the associated timestamps used in the trust evaluation so that little-to-nothing bitrots. Android is the odd one out here, for reasons documented in https://github.com/rustls/rustls-platform-verifier/issues/59.

I would like to propose, until time can be made to redo/improve the Android verifier implementation, that we allow real-world tests that fail to be marked as passing and instead add a warning to the GitHub action output:

  1. The code is compiled for #[cfg(target_os = "android")]
  2. The expected test case result is not ::Expired.
  3. The actual test case result is ::Expired.

To implement this all I believe we would need is some Android-specific error handling logic in the real world result handling. It would simply println! a warning string in the format GHA expects.

No changes to the Android verifier Kotlin should be required, as we already check the timestamp for obviously revoked certs before running any of the platform-provided X.509 chain verification (which is where the spurious errors come from). This means that when we explicitly pass in a timestamp that's too old for a certificate, we will still get the expected failure result.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in rustls-platform-verifier/src/tests/verification_real_world/mod.rs around the real-world result handling described in the issue. Check the Android-specific path for cases where the expected result is not ::Expired but the actual result is ::Expired, then verify that the GitHub Actions warning is emitted without changing other platforms or expected expiration failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, rust
Domain
security, testing
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.