Bug 1893562

Summary: Review Request: golang-github-muesli-crunchy - Finds common flaws in passwords
Product: [Fedora] Fedora Reporter: Fabian Affolter <mail>
Component: Package ReviewAssignee: Olivier Lemasle <o.lemasle>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: o.lemasle, package-review
Target Milestone: ---Flags: o.lemasle: fedora-review+
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-30 01:38:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Fabian Affolter 2020-11-01 20:30:24 UTC
Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec
SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-1.fc33.src.rpm

Project URL: https://github.com/muesli/crunchy

Description:
Finds common flaws in passwords. Like cracklib, but written in Go.

Koji scratch build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=54717570

rpmlint output:
$ rpmlint golang-github-muesli-crunchy-0.4.0-1.fc33.src.rpm 
golang-github-muesli-crunchy.src: W: spelling-error %description -l en_US cracklib -> crack lib, crack-lib, crackling
golang-github-muesli-crunchy.src: W: no-%build-section
1 packages and 0 specfiles checked; 0 errors, 2 warnings.

$ rpmlint golang-github-muesli-crunchy-devel-0.4.0-1.fc33.noarch.rpm 
golang-github-muesli-crunchy-devel.noarch: W: spelling-error %description -l en_US cracklib -> crack lib, crack-lib, crackling
golang-github-muesli-crunchy-devel.noarch: W: hidden-file-or-dir /usr/share/gocode/src/github.com/muesli/crunchy/.goipath
1 packages and 0 specfiles checked; 0 errors, 2 warnings.

Fedora Account System Username: fab

Comment 1 Olivier Lemasle 2020-11-02 14:06:22 UTC
Tests fail in mock.
Actually, I do not understand why tests were not executed in your Koji scratch build... I also launched a scratch build (https://koji.fedoraproject.org/koji/taskinfo?taskID=54771110); tests were executed and failed.

- Test TestRatePassword fail because /usr/share/dict is empty in mock. I suppose this package should depend on package "words", it it expects a dictionary.
- Test TestCheckHIBP fail because there's no Internet access in mock. This tests should be disabled.

Test failure messages:

--- FAIL: TestRatePassword (0.00s)
    crunchy_test.go:97: Expected rating 0 for password 'password', got 20
    crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'password', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'intoxicate', got 22
    crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'intoxicate', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'p@ssw0rd', got 42
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'p@ssw0rd', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '!pass@word?', got 64
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '!pass@word?', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'drowssap', got 20
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'drowssap', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '?drow@ssap!', got 64
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '?drow@ssap!', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5f4dcc3b5aa765d61d8327deb882cf99', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5f4dcc3b5aa765d61d8327deb882cf99', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got <nil>
--- FAIL: TestCheckHIBP (0.00s)
    crunchy_test.go:117: Expected Password has been found inside haveibeenpwned.com database for password 'Qwertyuiop', got Get "https://api.pwnedpasswords.com/range/21052": dial tcp: lookup api.pwnedpasswords.com: Temporary failure in name resolution

Comment 2 Olivier Lemasle 2020-11-02 14:11:56 UTC
Reading that paragraph in README:

> Your system dictionaries from /usr/share/dict will be indexed. If no dictionaries were found,
> crunchy only relies on the regular sanity checks (ErrEmpty, ErrTooShort, ErrTooFewChars and
> ErrTooSystematic). On Ubuntu it is recommended to install the wordlists distributed with
> cracklib-runtime, on macOS you can install cracklib-words from brew. You could also install
> various other language dictionaries or wordlists, e.g. from skullsecurity.org.

I think this package should have:
# For tests (if %check)
BuildRequires: words
# Weak dependency only
Recommends: words

Comment 3 Fabian Affolter 2020-12-19 16:13:59 UTC
Thanks for your input.

Koji scratch build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=57803588

%changelog
* Fri Dec 18 2020 Fabian Affolter <mail> - 0.4.0-2
- Update requirements (#1893562)

Updated files:
Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec
SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm

Comment 4 Olivier Lemasle 2020-12-19 18:38:40 UTC
The spec is OK but the SRPM is missing (https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm gives error 404)

Comment 6 Olivier Lemasle 2020-12-21 10:38:53 UTC
- Spec & changelog ok
- License ok
- Guidelines ok
- rpmlint ok
- builds in mock
- latest version packaged

Package accepted

Comment 7 Fabian Affolter 2020-12-21 17:38:03 UTC
Thanks a lot for the review.

Comment 8 Gwyn Ciesla 2020-12-21 17:46:57 UTC
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/golang-github-muesli-crunchy

Comment 9 Fedora Update System 2020-12-21 22:29:59 UTC
FEDORA-2020-2c9bef21fd has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd

Comment 10 Fedora Update System 2020-12-22 02:19:06 UTC
FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2020-2c9bef21fd \*`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2020-12-30 01:38:15 UTC
FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.