Bug 1893562 - Review Request: golang-github-muesli-crunchy - Finds common flaws in passwords
Summary: Review Request: golang-github-muesli-crunchy - Finds common flaws in passwords
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Olivier Lemasle
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-11-01 20:30 UTC by Fabian Affolter
Modified: 2020-12-30 01:38 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-12-30 01:38:15 UTC
Type: Bug
Embargoed:
o.lemasle: fedora-review+


Attachments (Terms of Use)

Description Fabian Affolter 2020-11-01 20:30:24 UTC
Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec
SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-1.fc33.src.rpm

Project URL: https://github.com/muesli/crunchy

Description:
Finds common flaws in passwords. Like cracklib, but written in Go.

Koji scratch build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=54717570

rpmlint output:
$ rpmlint golang-github-muesli-crunchy-0.4.0-1.fc33.src.rpm 
golang-github-muesli-crunchy.src: W: spelling-error %description -l en_US cracklib -> crack lib, crack-lib, crackling
golang-github-muesli-crunchy.src: W: no-%build-section
1 packages and 0 specfiles checked; 0 errors, 2 warnings.

$ rpmlint golang-github-muesli-crunchy-devel-0.4.0-1.fc33.noarch.rpm 
golang-github-muesli-crunchy-devel.noarch: W: spelling-error %description -l en_US cracklib -> crack lib, crack-lib, crackling
golang-github-muesli-crunchy-devel.noarch: W: hidden-file-or-dir /usr/share/gocode/src/github.com/muesli/crunchy/.goipath
1 packages and 0 specfiles checked; 0 errors, 2 warnings.

Fedora Account System Username: fab

Comment 1 Olivier Lemasle 2020-11-02 14:06:22 UTC
Tests fail in mock.
Actually, I do not understand why tests were not executed in your Koji scratch build... I also launched a scratch build (https://koji.fedoraproject.org/koji/taskinfo?taskID=54771110); tests were executed and failed.

- Test TestRatePassword fail because /usr/share/dict is empty in mock. I suppose this package should depend on package "words", it it expects a dictionary.
- Test TestCheckHIBP fail because there's no Internet access in mock. This tests should be disabled.

Test failure messages:

--- FAIL: TestRatePassword (0.00s)
    crunchy_test.go:97: Expected rating 0 for password 'password', got 20
    crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'password', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'intoxicate', got 22
    crunchy_test.go:100: Expected Password is too common / from a dictionary for password 'intoxicate', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'p@ssw0rd', got 42
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'p@ssw0rd', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '!pass@word?', got 64
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '!pass@word?', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'drowssap', got 20
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password 'drowssap', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '?drow@ssap!', got 64
    crunchy_test.go:100: Expected Password is mangled, but too common / from a dictionary for password '?drow@ssap!', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5f4dcc3b5aa765d61d8327deb882cf99', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5f4dcc3b5aa765d61d8327deb882cf99', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8', got <nil>
    crunchy_test.go:97: Expected rating 0 for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8', got <nil>
    crunchy_test.go:97: Expected rating 0 for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got 100
    crunchy_test.go:100: Expected Password is hashed, but too common / from a dictionary for password 'b109f3bbbc244eb82441917ed06d618b9008dd09b3befd1b5e07394c706a8bb980b1d7785e5976ec049b46df5f1326af5a2ea6d103fd07c95385ffab0cacbc86', got <nil>
--- FAIL: TestCheckHIBP (0.00s)
    crunchy_test.go:117: Expected Password has been found inside haveibeenpwned.com database for password 'Qwertyuiop', got Get "https://api.pwnedpasswords.com/range/21052": dial tcp: lookup api.pwnedpasswords.com: Temporary failure in name resolution

Comment 2 Olivier Lemasle 2020-11-02 14:11:56 UTC
Reading that paragraph in README:

> Your system dictionaries from /usr/share/dict will be indexed. If no dictionaries were found,
> crunchy only relies on the regular sanity checks (ErrEmpty, ErrTooShort, ErrTooFewChars and
> ErrTooSystematic). On Ubuntu it is recommended to install the wordlists distributed with
> cracklib-runtime, on macOS you can install cracklib-words from brew. You could also install
> various other language dictionaries or wordlists, e.g. from skullsecurity.org.

I think this package should have:
# For tests (if %check)
BuildRequires: words
# Weak dependency only
Recommends: words

Comment 3 Fabian Affolter 2020-12-19 16:13:59 UTC
Thanks for your input.

Koji scratch build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=57803588

%changelog
* Fri Dec 18 2020 Fabian Affolter <mail> - 0.4.0-2
- Update requirements (#1893562)

Updated files:
Spec URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy.spec
SRPM URL: https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm

Comment 4 Olivier Lemasle 2020-12-19 18:38:40 UTC
The spec is OK but the SRPM is missing (https://fab.fedorapeople.org/packages/SRPMS/golang-github-muesli-crunchy-0.4.0-2.fc33.src.rpm gives error 404)

Comment 6 Olivier Lemasle 2020-12-21 10:38:53 UTC
- Spec & changelog ok
- License ok
- Guidelines ok
- rpmlint ok
- builds in mock
- latest version packaged

Package accepted

Comment 7 Fabian Affolter 2020-12-21 17:38:03 UTC
Thanks a lot for the review.

Comment 8 Gwyn Ciesla 2020-12-21 17:46:57 UTC
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/golang-github-muesli-crunchy

Comment 9 Fedora Update System 2020-12-21 22:29:59 UTC
FEDORA-2020-2c9bef21fd has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd

Comment 10 Fedora Update System 2020-12-22 02:19:06 UTC
FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2020-2c9bef21fd \*`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-2c9bef21fd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2020-12-30 01:38:15 UTC
FEDORA-2020-2c9bef21fd has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.