Bug 1893562
| Summary: | Review Request: golang-github-muesli-crunchy - Finds common flaws in passwords | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Fabian Affolter <mail> |
| Component: | Package Review | Assignee: | Olivier Lemasle <o.lemasle> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | o.lemasle, package-review |
| Target Milestone: | --- | Flags: | o.lemasle:
fedora-review+
|
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-30 01:38:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Fabian Affolter
2020-11-01 20:30:24 UTC
Tests fail in mock. Actually, I do not understand why tests were not executed in your Koji scratch build... I also launched a scratch build (https://koji.fedoraproject.org/koji/taskinfo?taskID=54771110); tests were executed and failed. - Test TestRatePassword fail because /usr/share/dict is empty in mock. I suppose this package should depend on package "words", it it expects a dictionary. - Test TestCheckHIBP fail because there's no Internet access in mock. This tests should be disabled. Test failure messages: --- FAIL: TestRatePassword (0.00s) crunchy_test.go:97: Expected rating 0 for password 'password', got 20 crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'password', got <nil> crunchy_test.go:97: Expected rating 0 for password 'intoxicate', got 22 crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'intoxicate', got <nil> crunchy_test.go:97: Expected rating 0 for password 'p@ssw0rd', got 42 crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'p@ssw0rd', got <nil> crunchy_test.go:97: Expected rating 0 for password '!pass@word?', got 64 crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '!pass@word?', got <nil> crunchy_test.go:97: Expected rating 0 for password 'drowssap', got 20 crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'drowssap', got <nil> crunchy_test.go:97: Expected rating 0 for password '?drow@ssap!', got 64 crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '?drow@ssap!', got <nil> crunchy_test.go:97: Expected rating 0 for password '5f4dcc3b5aa765d61d8327deb882cf99', got 100 crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5f4dcc3b5aa765d61d8327deb882cf99', got <nil> crunchy_test.go:97: Expected rating 0 for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got 100 crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got <nil> crunchy_test.go:97: Expected rating 0 for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got 100 crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got <nil> crunchy_test.go:97: Expected rating 0 for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got 100 crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got <nil> --- FAIL: TestCheckHIBP (0.00s) crunchy_test.go:117: Expected Password has been found inside haveibeenpwned.com database for password 'Qwertyuiop', got Get "https://api.pwnedpasswords.com/range/21052": dial tcp: lookup api.pwnedpasswords.com: Temporary failure in name resolution Reading that paragraph in README:
> Your system dictionaries from /usr/share/dict will be indexed. If no dictionaries were found,
> crunchy only relies on the regular sanity checks (ErrEmpty, ErrTooShort, ErrTooFewChars and
> ErrTooSystematic). On Ubuntu it is recommended to install the wordlists distributed with
> cracklib-runtime, on macOS you can install cracklib-words from brew. You could also install
> various other language dictionaries or wordlists, e.g. from skullsecurity.org.
I think this package should have:
# For tests (if %check)
BuildRequires: words
# Weak dependency only
Recommends: words
Thanks for your input. Koji scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=57803588 %changelog * Fri Dec 18 2020 Fabian Affolter <mail> - 0.4.0-2 - Update requirements (#1893562) Updated files: Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm The spec is OK but the SRPM is missing (https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm gives error 404) Again, sorry. Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm - Spec & changelog ok - License ok - Guidelines ok - rpmlint ok - builds in mock - latest version packaged Package accepted Thanks a lot for the review. (fedscm-admin): The Pagure repository was created at https://src.fedoraproject.org/rpms/golang-github-muesli-crunchy FEDORA-2020-2c9bef21fd has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2020-2c9bef21fd \*` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report. |