From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thomas Munro <thomas.munro@gmail.com>
cc: Andrew Dunstan <andrew@dunslane.net>,
        PostgreSQL-development <pgsql-hackers@postgresql.org>,
        Jacob Champion <jacob.champion@enterprisedb.com>
Subject: Re: disabled SSL log_like tests
In-reply-to: 
 <CA+hUKG+fLqyweHqFSBcErueUVT0vDuSNWui-ySz3+d_APmq7dw@mail.gmail.com>
References: <984fca80-85a8-4c6f-a5cc-bb860950b435@dunslane.net>
 <2199758.1744901785@sss.pgh.pa.us>
 <1ce11d3f-624c-4003-a032-1b10cc138305@dunslane.net>
 <2814408.1745005558@sss.pgh.pa.us> <2859105.1745015195@sss.pgh.pa.us>
 <1120735.1745350422@sss.pgh.pa.us>
 <CA+hUKG+fLqyweHqFSBcErueUVT0vDuSNWui-ySz3+d_APmq7dw@mail.gmail.com>
Comments: In-reply-to Thomas Munro <thomas.munro@gmail.com>
	message dated "Tue, 06 May 2025 07:39:09 +1200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3058989.1746485124.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 05 May 2025 18:45:24 -0400
Message-ID: <3058990.1746485124@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3058990.1746485124%40sss.pgh.pa.us>
Precedence: bulk

Thomas Munro <thomas.munro@gmail.com> writes:
> If you run the not-yet-enabled-by-default OpenBSD CI task on master,
> ssl/001_ssltests fails in "intermediate client certificate is
> untrusted", recently uncommented by commit e0f373ee.

Yeah, I see that too.  But I also see three failures in 002_scram.pl,
which presumably were there before e0f373ee.  (Tested on OpenBSD 7.6
and 7.7.)  The buildfarm's OpenBSD animals haven't caught this
because they don't run this test suite :-(.  Yes they build with
--with-openssl, but one of them lacks --enable-tap-tests and the
other two aren't filling PG_TEST_EXTRA.

The SCRAM failures are a bit discouraging ...

[18:16:33.259](0.565s) not ok 26 - SCRAM with SSL and channel_binding=3Dre=
quire, server certificate uses 'rsassaPss'
[18:16:33.261](0.002s) =

[18:16:33.261](0.000s) #   Failed test 'SCRAM with SSL and channel_binding=
=3Drequire, server certificate uses 'rsassaPss''
#   at t/002_scram.pl line 161.
[18:16:33.262](0.001s) #          got: '2'
#     expected: '0'
[18:16:33.264](0.002s) not ok 27 - SCRAM with SSL and channel_binding=3Dre=
quire, server certificate uses 'rsassaPss': no stderr
[18:16:33.265](0.001s) =

[18:16:33.265](0.000s) #   Failed test 'SCRAM with SSL and channel_binding=
=3Drequire, server certificate uses 'rsassaPss': no stderr'
#   at t/002_scram.pl line 161.
[18:16:33.266](0.001s) #          got: 'psql: error: connection to server =
at "127.0.0.1", port 10442 failed: SSL error: sslv3 alert handshake failur=
e'
#     expected: ''
[18:16:33.268](0.002s) not ok 28 - SCRAM with SSL and channel_binding=3Dre=
quire, server certificate uses 'rsassaPss': log matches
[18:16:33.269](0.001s) =

[18:16:33.269](0.000s) #   Failed test 'SCRAM with SSL and channel_binding=
=3Drequire, server certificate uses 'rsassaPss': log matches'
#   at /home/tgl/pgsql/src/test/ssl/../../../src/test/perl/PostgreSQL/Test=
/Cluster.pm line 2607.
[18:16:33.270](0.001s) #                   '2025-05-05 18:16:33.222 EDT [7=
1478] [unknown] LOG:  connection received: host=3Dlocalhost port=3D42632
# 2025-05-05 18:16:33.244 EDT [71478] [unknown] LOG:  could not accept SSL=
 connection: missing rsa certificate
# '
#     doesn't match '(?^:connection authenticated: identity=3D"ssltestuser=
" method=3Dscram-sha-256)'

			regards, tom lane