Skip to content

fix(nbd): regenerate TLS test certificates at build time #17142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
WithEnoughCoffee wants to merge 1 commit into from
Closed

fix(nbd): regenerate TLS test certificates at build time #17142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions base/comps/nbd/nbd.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1 @@
[components.nbd]

[[components.nbd.overlays]]
description = "Mark tls and tlshuge tests as expected failures — shipped test certificates expired on 2026-04-17 (10-year certs generated 2016-04-19). Fixed upstream in nbd 3.27.0 (commit 58b356b) but not backported to 3.25."
type = "spec-search-replace"
section = "%check"
regex = 'make check'
replacement = 'make check XFAIL_TESTS="tls tlshuge"'
22 changes: 21 additions & 1 deletion specs/n/nbd/nbd.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ BuildRequires: make
BuildRequires: gcc
BuildRequires: glib2-devel >= 2.26
BuildRequires: gnutls-devel
BuildRequires: gnutls-utils
BuildRequires: zlib-devel
BuildRequires: libnl3-devel
BuildRequires: bison
Expand Down Expand Up @@ -58,9 +59,28 @@ install -pDm644 %{S:1} %{buildroot}%{_unitdir}/nbd-server.service
install -pDm644 %{S:2} %{buildroot}%{_sysconfdir}/sysconfig/nbd-server

%check
# Regenerate TLS test certificates at build time so they are always valid.
# The shipped certs (generated 2016) expired on 2026-04-17.
# See tests/run/certs/README.md for the upstream procedure.
pushd tests/run/certs
certtool --generate-privkey --outfile ca-key.pem 2>/dev/null
certtool --generate-self-signed --load-privkey ca-key.pem \
--template ca.info --outfile ca-cert.pem 2>/dev/null
certtool --generate-privkey --outfile server-key.pem 2>/dev/null
certtool --generate-certificate --load-ca-certificate ca-cert.pem \
--load-ca-privkey ca-key.pem --load-privkey server-key.pem \
--template server.info --outfile server-cert.pem 2>/dev/null
certtool --generate-privkey --outfile client-key.pem 2>/dev/null
certtool --generate-certificate --load-ca-certificate ca-cert.pem \
--load-ca-privkey ca-key.pem --load-privkey client-key.pem \
--template client.info --outfile client-cert.pem 2>/dev/null
certtool --generate-privkey --outfile selfsigned-key.pem 2>/dev/null
certtool --generate-self-signed --load-privkey selfsigned-key.pem \
--template ca.info --outfile selfsigned-cert.pem 2>/dev/null
Comment on lines +66 to +79
popd
Comment on lines +65 to +80
Comment on lines +65 to +80
# wait longer for nbd-server to fully start,
# one second may not be enough on Fedora building infra
DELAY=10 make check XFAIL_TESTS="tls tlshuge"
DELAY=10 make check

%post
%systemd_post nbd-server.service
Expand Down
Loading