Bug 1477676

Summary:	trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place
Product:	[Fedora] Fedora	Reporter:	Mike Gahagan <mgahagan>
Component:	p11-kit	Assignee:	Daiki Ueno <dueno>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	25	CC:	dueno, kengert, mpreisle, stefw, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	p11-kit-0.23.8-1.fc25	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-29 20:24:52 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mike Gahagan 2017-08-02 15:33:54 UTC

Description of problem:

trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place

Version-Release number of selected component (if applicable):
p11-kit-0.23.2-4.fc25.x86_64

How reproducible:
always

Steps to Reproduce:
[root@localhost trust-anchor-complains-about-invalid-attribute-and]# cd /tmp
[root@localhost tmp]# /etc/pki/tls/certs/make-dummy-cert mycert-tmp.pem
[root@localhost tmp]# openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem
[root@localhost tmp]# trust anchor --store mycert.pem
p11-kit: the CKA_TRUSTED attribute is not valid for the object
p11-kit: couldn't create object: Certain fields have invalid values

Actual results:
p11-kit: the CKA_TRUSTED attribute is not valid for the object
p11-kit: couldn't create object: Certain fields have invalid values

Expected results:
Certificate is created and stored

Additional info:
This bug was in RHEL 7 and fixed in 7.4. F26's p11-kit-0.23.5-3.fc26 does not have this issue so it appears we just need to update the F25 package. Bug was found during the recent effort to port RHEL tests in Beaker to Fedora upstream testing.

Comment 1 Mike Gahagan 2017-08-02 15:37:02 UTC

Automated test for this bug is here:
https://upstreamfirst.fedorainfracloud.org/p11-kit

Note that this is a temporary repo and may be moved in the future.

Comment 2 Daiki Ueno 2017-08-14 08:55:55 UTC

This is probably bug 1158926, but I was hesitating to update p11-kit in F25 to a newer upstream release, because it also brings in new features as well as bug fixes.

If this bug is particularly important, I can backport the fix.

Comment 3 Mike Gahagan 2017-08-14 15:25:46 UTC

Hi,

This is indeed the same as bug 1158926 (RHEL bug references were removed from the name of the test due to upstream porting guidelines). I don't know of any implications aside from the test failing.

Comment 4 Daiki Ueno 2017-08-15 14:38:13 UTC

Considering that there shouldn't be any backward incompatible change, I am going to update p11-kit to 0.23.8.

Comment 5 Fedora Update System 2017-08-15 14:55:19 UTC

p11-kit-0.23.8-1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9

Comment 6 Fedora Update System 2017-08-15 22:21:49 UTC

p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9

Comment 7 Fedora Update System 2017-08-29 20:24:52 UTC

p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.