[Pkg-openssl-devel] Bug#907215: python3.6: FTBFS with openssl as tests needs update for new version of openssl

[Paul Gevers]

Source: python3.6
Version: 3.6.6-2
Severity: serious
Tags: ftbfs
X-Debbugs-CC: debian-ci at lists.debian.org, openssl at packages.debian.org
User: debian-ci at lists.debian.org
Usertags: needs-update
Control: affects -1 src:openssl
Control: block 907015 by -1

Dear maintainers,

With a recent upload of openssl the autopkgtest of python3.6 started to
fail in testing. I copied the some of the output below.

Also the latest run on reproducible builds failed (it timed out, but
lots of errors before it did).

Currently this regression is contributing to the delay of the migration
of openssl to testing [1]. Of course, openssl shouldn't just break your
autopkgtest (or even worse, your package), but it seems to me that the
change in openssl was intended and your package needs to update to the
new situation. If needed, please change the bug's severity.

If this is a real problem in your package (and not only in your
autopkgtest), the right binary package(s) from openssl should really add
a versioned Breaks on the unfixed version of (one of your) package(s),
hence I added a blocking relation on the openssl bug that tracks that.
Note: the Breaks is nice even if the issue is only in the autopkgtest as
it helps the migration software to figure out the right versions to
combine in the tests.

A quote from the openssl maintainer about the openssl update:
"
This is probably the result of the default openssl.cfg now having:
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT at SECLEVEL=2

Where the SECLEVEL 2 requires a 112 / 2048 bit security level.
"

More information about this bug and the reason for filing it can be found on
https://wiki.debian.org/ContinuousIntegration/RegressionEmailInformation

Paul

[1] https://qa.debian.org/excuses.php?package=openssl

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/python3.6.html

https://ci.debian.net/data/autopkgtest/testing/amd64/p/python3.6/874866/log.gz

======================================================================
ERROR: test_session_handling (test.test_ssl.ThreadedTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python3.6/test/test_ssl.py", line 3579, in
test_session_handling
    s.connect((HOST, server.port))
  File "/usr/lib/python3.6/ssl.py", line 1100, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.6/ssl.py", line 1091, in _real_connect
    self.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 1068, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 689, in do_handshake
    self._sslobj.do_handshake()
ConnectionResetError: [Errno 104] Connection reset by peer

======================================================================
FAIL: test_options (test.test_ssl.ContextTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python3.6/test/test_ssl.py", line 908, in test_options
    self.assertEqual(default, ctx.options)
AssertionError: <Opti[26
chars]CIPHER_SERVER_PREFERENCE|OP_NO_COMPRESSION: 2185363540> !=
<Opti[26 chars]CIPHER_SERVER_PREFERENCE|1048576|OP_NO_COMPRESSION:
2186412116>

======================================================================
FAIL: test_default_ciphers (test.test_ssl.ThreadedTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python3.6/test/test_ssl.py", line 3088, in
test_default_ciphers
    s.connect((HOST, server.port))
AssertionError: OSError not raised

======================================================================
FAIL: test_default_ecdh_curve (test.test_ssl.ThreadedTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python3.6/test/test_ssl.py", line 3142, in
test_default_ecdh_curve
    self.assertIn("ECDH", s.cipher()[0])
AssertionError: 'ECDH' not found in 'TLS_AES_256_GCM_SHA384'

======================================================================
FAIL: test_shared_ciphers (test.test_ssl.ThreadedTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python3.6/test/test_ssl.py", line 3460, in
test_shared_ciphers
    self.fail(name)
AssertionError: TLS_AES_256_GCM_SHA384

----------------------------------------------------------------------
Ran 125 tests in 1.763s

FAILED (failures=4, errors=8, skipped=8)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-openssl-devel/attachments/20180824/a8e88e8f/attachment.sig>