<div dir="ltr"><div>FTBFS due to failing tests:<br>FAIL: keystoneclient.tests.unit.test_cms.CMSTest.test_cms_verify<br>FAIL: keystoneclient.tests.unit.test_cms.CMSTest.test_cms_verify_token_no_files<br><br></div><div>Both tests fail because: Command 'openssl' returned non-zero exit status 1<br><br></div><div>I think its OpenSSL >= 1.1 bug, which returns wrong exit code (1 insted of 2) if input file not exists.<br></div><div><br>I prepared quilt patch and going to upload new release of python-keystoneclient.<br><br>====<br>Description: Workaround for FTBFS with OpenSSL >= 1.1.0<br> OpenSSL1.1 returns exit code 1 if certfile or CAfile not exists.<br> This is possibly OpenSSL bug<br> <a href="https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES">https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES</a><br>Author: Ondřej Kobližek <<a href="mailto:koblizeko@gmail.com">koblizeko@gmail.com</a>><br>Forwarded: <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844928">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844928</a><br><br>--- a/keystoneclient/common/cms.py<br>+++ b/keystoneclient/common/cms.py<br>@@ -42,9 +42,10 @@<br> <br> <br> # The openssl cms command exits with these status codes.<br>-# See <a href="https://www.openssl.org/docs/apps/cms.html#EXIT_CODES">https://www.openssl.org/docs/apps/cms.html#EXIT_CODES</a><br>+# See <a href="https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES">https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES</a><br> class OpensslCmsExitStatus(object):<br>     SUCCESS = 0<br>+    COMMAND_OPTIONS_PARSING_ERROR = 1<br>     INPUT_FILE_READ_ERROR = 2<br>     CREATE_CMS_READ_MIME_ERROR = 3<br> <br>@@ -180,21 +181,28 @@<br>     # Do not log errors, as some happen in the positive thread<br>     # instead, catch them in the calling code and log them there.<br> <br>-    # When invoke the openssl with not exist file, return code 2<br>-    # and error msg will be returned.<br>+    # When invoke the openssl >= 1.1.0 with not exist file, return code should<br>+    # be 2 instead of 1 and error msg will be returned.<br>     # You can get more from<br>-    # <a href="http://www.openssl.org/docs/apps/cms.html#EXIT_CODES">http://www.openssl.org/docs/apps/cms.html#EXIT_CODES</a><br>+    # <a href="https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES">https://www.openssl.org/docs/man1.1.0/apps/cms.html#EXIT-CODES</a><br>     #<br>     # $ openssl cms -verify -certfile not_exist_file -CAfile<br>     #       not_exist_file -inform PEM -nosmimecap -nodetach<br>     #       -nocerts -noattr<br>-    # Error opening certificate file not_exist_file<br>+    # cms: Cannot open input file not_exist_file, No such file or directory<br>     #<br>     if retcode == OpensslCmsExitStatus.INPUT_FILE_READ_ERROR:<br>         if err.startswith('Error reading S/MIME message'):<br>             raise exceptions.CMSError(err)<br>         else:<br>             raise exceptions.CertificateConfigError(err)<br>+    # workaround for OpenSSL >= 1.1.0,<br>+    # should return OpensslCmsExitStatus.INPUT_FILE_READ_ERROR<br>+    if retcode == OpensslCmsExitStatus.COMMAND_OPTIONS_PARSING_ERROR:<br>+        if err.startswith('cms: Cannot open input file'):<br>+            raise exceptions.CertificateConfigError(err)<br>+        else:<br>+            raise subprocess.CalledProcessError(retcode, 'openssl', output=err)<br>     elif retcode != OpensslCmsExitStatus.SUCCESS:<br>         raise subprocess.CalledProcessError(retcode, 'openssl', output=err)<br>     return output<br>====<br></div></div>