bug#34426: xmlsec has test failures

[Maxim Cournoyer]

Hello Björn,

Björn Höfling <address@hidden> writes:

> On Mon, 11 Feb 2019 06:57:57 +0100
> Björn Höfling <address@hidden> wrote:
>
>> commit: 50a93adc05b611836e740c4b55571890f4c6770a
>> 
>> Package xmlsec has test failures:
>
> I bisected this error and found out:
>
> It is introduced by updating gnutls from 3.5.18 to 3.6.5 on commit
>
> commit 06f5bc4e12a78883c6f4a543711311bd66e6832b
> Author: Marius Bakke <address@hidden>
> Date:   Mon Dec 10 02:38:32 2018 +0100
>
>     gnu: GnuTLS: Update to 3.6.5.
>
> Later on commit:
>
> a46dcdfa3d9002eface76ef9f83e5d34c1ecbfb0
>
> in core-updates GnuTLS it updated to 3.6.6. But here xmlsec still
> has test failures.

Good debugging! This should help us identify what change in GnuTLS might
have broke xmlsec between those versions.

It seems the test suite failures are caused by a single problem:

--8<---------------cut here---------------start------------->8---
Key data "x509" found
 /tmp/guix-build-xmlsec-1.2.27.drv-0/xmlsec1-1.2.27/apps/xmlsec1 verify  
--crypto gnutls --crypto-config /tmp/xmlsec-crypto-config --trusted-der 
/tmp/guix-build-xmlsec-1.2.27.drv-0/xmlsec1-1.2.27/tests/keys/cacert.der 
--untrusted-der /tmp/
guix-build-xmlsec-1.2.27.drv-0/xmlsec1-1.2.27/tests/keys/ca2cert.der  
--untrusted-der 
/tmp/guix-build-xmlsec-1.2.27.drv-0/xmlsec1-1.2.27/tests/keys/rsacert.der 
--enabled-key-data x509 /tmp/guix-build-xmlsec-1.2.27.drv-0/xmlsec1-1.2.27/test
s/aleksey-xmldsig-01/x509data-sn-test.xml
func=xmlSecGnuTLSX509StoreVerify:file=x509vfy.c:line=354:obj=unknown:subj=unknown:error=71:certificate
 verification failed:gnutls_x509_crt_list_verify: verification failed: 
status=258u
--8<---------------cut here---------------end--------------->8---

> Has anyone an idea why these tests fail and how to fix it?

I haven't investigated more at this time, but will have too, as it
breaks my Gnucash setup.

Maxim