Bug 1477676 - trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place
Summary: trust anchor complains about invalid attribute and fails when a new certifica...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: p11-kit
Version: 25
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Daiki Ueno
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-08-02 15:33 UTC by Mike Gahagan
Modified: 2017-08-29 20:24 UTC (History)
5 users (show)

Fixed In Version: p11-kit-0.23.8-1.fc25
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-29 20:24:52 UTC
Type: Bug


Attachments (Terms of Use)

Description Mike Gahagan 2017-08-02 15:33:54 UTC
Description of problem:

trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place

Version-Release number of selected component (if applicable):
p11-kit-0.23.2-4.fc25.x86_64

How reproducible:
always

Steps to Reproduce:
[root@localhost trust-anchor-complains-about-invalid-attribute-and]# cd /tmp
[root@localhost tmp]# /etc/pki/tls/certs/make-dummy-cert mycert-tmp.pem
[root@localhost tmp]# openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem
[root@localhost tmp]# trust anchor --store mycert.pem
p11-kit: the CKA_TRUSTED attribute is not valid for the object
p11-kit: couldn't create object: Certain fields have invalid values

Actual results:
p11-kit: the CKA_TRUSTED attribute is not valid for the object
p11-kit: couldn't create object: Certain fields have invalid values

Expected results:
Certificate is created and stored

Additional info:
This bug was in RHEL 7 and fixed in 7.4. F26's p11-kit-0.23.5-3.fc26 does not have this issue so it appears we just need to update the F25 package. Bug was found during the recent effort to port RHEL tests in Beaker to Fedora upstream testing.

Comment 1 Mike Gahagan 2017-08-02 15:37:02 UTC
Automated test for this bug is here:
https://upstreamfirst.fedorainfracloud.org/p11-kit

Note that this is a temporary repo and may be moved in the future.

Comment 2 Daiki Ueno 2017-08-14 08:55:55 UTC
This is probably bug 1158926, but I was hesitating to update p11-kit in F25 to a newer upstream release, because it also brings in new features as well as bug fixes.

If this bug is particularly important, I can backport the fix.

Comment 3 Mike Gahagan 2017-08-14 15:25:46 UTC
Hi,

This is indeed the same as bug 1158926 (RHEL bug references were removed from the name of the test due to upstream porting guidelines). I don't know of any implications aside from the test failing.

Comment 4 Daiki Ueno 2017-08-15 14:38:13 UTC
Considering that there shouldn't be any backward incompatible change, I am going to update p11-kit to 0.23.8.

Comment 5 Fedora Update System 2017-08-15 14:55:19 UTC
p11-kit-0.23.8-1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9

Comment 6 Fedora Update System 2017-08-15 22:21:49 UTC
p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9

Comment 7 Fedora Update System 2017-08-29 20:24:52 UTC
p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.