Red Hat Bugzilla – Bug 1144188
TPS tests: RPM rebuild failure due to wildcard imports
Last modified: 2015-07-22 02:55:26 EDT
During the TPS testing of the 'pki-core' component for the RHEL 6.6 errata, a failure occurred when the TPS rebuild test failed with the following error: com/netscape/ca/CAService.java:642: error: reference to Extension is ambiguous, both interface java.security.cert.Extension in java.security.cert and class netscape.security.x509.Extension in netscape.security.x509 match Extension ext = (Extension) e.nextElement(); ^ com/netscape/ca/CAService.java:642: error: reference to Extension is ambiguous, both interface java.security.cert.Extension in java.security.cert and class netscape.security.x509.Extension in netscape.security.x509 match Extension ext = (Extension) e.nextElement(); This was due to the use of "wildcards" in the import statements of the source code contained in the RHEL 6 maintenance branch (a problem that has been alleviated in newer versions of the product): . . . import netscape.security.x509.*; import netscape.security.util.BigInt; import netscape.security.util.*; import java.security.cert.*; . . . For the purposes of RHEL 6.7, we should apply the following minimal fix so that the TPS tests will succeed: diff --git a/base/ca/src/com/netscape/ca/CAService.java b/base/ca/src/com/netscape/ca/CAService.java index a63391d..43bb3dd 100644 --- a/base/ca/src/com/netscape/ca/CAService.java +++ b/base/ca/src/com/netscape/ca/CAService.java @@ -639,7 +639,7 @@ public class CAService implements ICAService, IService { Enumeration e = exts.getElements(); while (e.hasMoreElements()) { - Extension ext = (Extension) e.nextElement(); + netscape.security.x509.Extension ext = (netscape.security.x509.Extension) e.nextElement(); if (ext.getExtensionId().toString().equals(PKIXExtensions.BasicConstraints_Id.toString())) { bc_ext = (BasicConstraintsExtension) ext;
The issue is stated as follows: com/netscape/ca/CAService.java:642: error: reference to Extension is ambiguous, both interface java.security.cert.Extension in java.security.cert and class netscape.security.x509.Extension in netscape.security.x509 match Extension ext = (Extension) e.nextElement(); This never used to be a problem before because java.security.cert.Extension was only introduced in Java 7. This also won't be a problem unless java.security.cert.Extension is found in the classpath before netscape.security.x509.Extension. If it is though, and ext is instantiated as a netscape.security.x509.Extension, then some subsequent calls - like ext.getExtensionId() will fail. Now, this code is in a function called issueX509Cert() - which sounds like its pretty important. In fact, I suspect its executed whenever we issue a cert. Thats a double edged sword -- we know that we have not had any issues - so its likely that the classpath is set up correctly. On the other hand, do we want to rely on this for such an important bit of code? Remember that classpath issues are notoriously difficult to debug. Incidentally, on looking at this code, I think that Matt's initial solution needs to be tweaked a bit, so that the Enumeration is also typed -- ie. Enumeration e = exts.getElements(); should become Enumeration<netscape.security.x509.Extension> e = exts.getElements();
Proposing this as a 0day for RHEL 6.6.z based off of the description in comment#2. The fix for this can be prepared quickly, as it's trivial.
Created attachment 941624 [details] pki-core-9.0.3-bz1144188.patch Although we attempted to follow the Z-Stream procedures for a 0-day errata located at https://home.corp.redhat.com/wiki/working-z-streams, we were informed by release-engineering that if we checked this patch into the rhel-6.6 dist-git branch, that rhel-6.7 would be cloned from the rhel-6.6 branch (thus picking up this patch).
Created attachment 941632 [details] pki-core.spec Although we attempted to follow the Z-Stream procedures for a 0-day errata located at https://home.corp.redhat.com/wiki/working-z-streams, we were informed by release-engineering that if we checked this spec file into the rhel-6.6 dist-git branch, that rhel-6.7 would be cloned from the rhel-6.6 branch (thus picking up this spec file).
TPS tests of RHEL 6.7 pki-core errata for build pki-core-9.0.3-40.el6 passed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1347.html