jdk_security1 FAILED in Test_openjdk8_hs_extended.openjdk (all platforms)

[smlambert]

2 testcases in jdk_security1 fail as follows:

java/security/cert/CertPathBuilder/targetConstraints/BuildEEBasicConstraints.java

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
	at CertUtils.build(CertUtils.java:232)
	at BuildEEBasicConstraints.main(BuildEEBasicConstraints.java:77)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)
	at java.lang.Thread.run(Thread.java:750)

java/security/cert/pkix/policyChanges/TestPolicy.java

java.security.cert.CertPathValidatorException: validity check failed
	at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
	at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:220)
	at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140)
	at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79)
	at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292)
	at TestPolicy.main(TestPolicy.java:102)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)
	at java.lang.Thread.run(Thread.java:750)
Caused by: java.security.cert.CertificateExpiredException: NotAfter: Mon Nov 07 11:57:03 GMT 2022
	at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:277)
	at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:677)
	at sun.security.provider.certpath.BasicChecker.verifyValidity(BasicChecker.java:190)
	at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144)
	at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)

Test Info
Test Name: jdk_security1_0
Test Duration: 3 min 10 sec
Machine: test-docker-ubuntu2204-ppc64le-1
TRSS link for the test output: https://trss.adoptium.net/output/test?id=63c21fffed0b30773ba35f48

Build Info
Build Name: Test_openjdk8_hs_extended.openjdk_ppc64le_linux_testList_1
Jenkins Build start time: Jan 13 2023, 06:19 pm
Jenkins Build URL: https://ci.adoptopenjdk.net/job/Test_openjdk8_hs_extended.openjdk_ppc64le_linux_testList_1/86/
TRSS link for the build: https://trss.adoptium.net/allTestsInfo?buildId=63c21f23ed0b30773ba35d15

Java Version
openjdk version "1.8.0_362"
OpenJDK Runtime Environment (Temurin)(build 1.8.0_362-b06)
OpenJDK 64-Bit Server VM (Temurin)(build 25.362-b06, mixed mode)

This test has been failed 11 times since Nov 12 2022, 07:37 am
Java Version when the issue first seen
openjdk version "1.8.0_362"
OpenJDK Runtime Environment (Temurin)(build 1.8.0_362-b02)
OpenJDK 64-Bit Server VM (Temurin)(build 25.362-b02, mixed mode)
Jenkins Build URL: https://ci.adoptopenjdk.net/job/Test_openjdk8_hs_extended.openjdk_ppc64le_linux_testList_1/75/

The test failed on machine test-docker-ubuntu2204-ppc64le-1 1 times
The test failed on machine test-docker-debian11-ppc64le-1 1 times
The test failed on machine test-osuosl-ubuntu1604-ppc64le-1 6 times
The test failed on machine test-osuosl-ubuntu1604-ppc64le-2 1 times
The test failed on machine test-osuosl-ubuntu1804-ppc64le-1 1 times
The test failed on machine test-osuosl-ubuntu1804-ppc64le-2 1 times

Rerun in Grinder

[smlambert]

Also seen on x64_linux (details #4245 (comment)), appears from deep history to have begun failing between Nov 5 and Nov 12 runs, then consistently failing in all subsequent runs.

[smlambert]

BuildEEBasicConstraints.java is https://bugs.openjdk.org/browse/JDK-8296485 - which shows as backported to 8 via https://bugs.openjdk.org/browse/JDK-8297058 on Nov 15 - need to verify if that testcase fix is actually in our jdk8u mirror.

openjdk/jdk8u-dev#188 is the change and it is not inhttps://github.com/adoptium/jdk8u/blob/jdk8u362-beforereleastest-ga/jdk/test/java/security/cert/CertPathBuilder/targetConstraints/BuildEEBasicConstraints.java

[smlambert]

TestPolicy.java failure is https://bugs.openjdk.org/browse/JDK-8296480

[smlambert]

Need to exclude via the upstream bug URLs in the absence of backported fixes.

[sxa]

There are some failures in security/infra/java/security/CertpathValidator/certification but not the oneslisted in the descripttion of this issue - perhaps the originals have been excluded but more need to be now?

They seem to be TEST FAILED: couldn't determine EE certificate status:

• https://ci.adoptium.net/job/Test_openjdk8_hs_extended.openjdk_aarch64_linux_testList_2/44/testReport/security_infra_java_security_cert_CertPathValidator_certification_DigicertCSRootG5/java/DigicertCSRootG5/
• https://ci.adoptium.net/job/Test_openjdk8_hs_extended.openjdk_aarch64_linux_testList_2/44/testReport/security_infra_java_security_cert_CertPathValidator_certification_EmSignRootG2CA/java/EmSignRootG2CA/
• https://ci.adoptium.net/job/Test_openjdk8_hs_extended.openjdk_aarch64_linux_testList_1/44/testReport/security_infra_java_security_cert_CertPathValidator_certification_DigicertCSRootG5/java/DigicertCSRootG5/
• https://ci.adoptium.net/job/Test_openjdk8_hs_extended.openjdk_aarch64_linux_testList_1/44/testReport/security_infra_java_security_cert_CertPathValidator_certification_EmSignRootG2CA/java/EmSignRootG2CA/

[smlambert]

BuildEEBasicConstraints and TestPolicy fix is now in our mirror, so closing.