Bug 1964848

PR to work-around build failures ready, not yet merged:
https://gitlab.com/redhat/centos-stream/rpms/postgresql/-/merge_requests/1

test init                         ... ok           17 ms
test md5                          ... ok           14 ms
test sha1                         ... ok           13 ms
test hmac-md5                     ... ok           12 ms
test hmac-sha1                    ... ok           12 ms
test blowfish                     ... FAILED       12 ms
test rijndael                     ... FAILED       12 ms
test sha2                         ... ok           13 ms
test des                          ... FAILED       12 ms
test 3des                         ... FAILED       12 ms
test cast5                        ... FAILED       11 ms
test crypt-des                    ... ok           16 ms
test crypt-md5                    ... ok           20 ms
test crypt-blowfish               ... ok           52 ms
test crypt-xdes                   ... ok           18 ms
test pgp-armor                    ... ok           15 ms
test pgp-decrypt                  ... FAILED       32 ms
test pgp-encrypt                  ... ok          529 ms
test pgp-compression              ... ok           36 ms
test pgp-pubkey-decrypt           ... FAILED       33 ms
test pgp-pubkey-encrypt           ... ok           29 ms
test pgp-info                     ... ok           13 ms

These are the tests failing at this point.

Most common error reported by the server is: "ERROR:  encrypt error: Cipher cannot be initialized ?"

upstream thread begins at https://www.postgresql.org/message-id/FEF81714-D479-4512-839B-C769D2605F8A%40yesql.se

message about the upstream waiting for OpenSSL being in beta:
https://www.postgresql.org/message-id/F4341C2C-BBAA-48D2-94A7-5B5CC3FB0C5F%40yesql.se
https://www.postgresql.org/message-id/A47E7675-E506-44EB-857B-60E1FF193FA6%40yesql.se

(In reply to Honza Horak from comment #10)
> test blowfish                     ... FAILED       12 ms

For a smaller reproducer for this test specifically, it's enough to use this:

  EVP_EncryptInit_ex(ctx, EVP_bf_cbc(), ...

This works with openssl 1.1.1 and not with openssl 3.0.0. I'm asking more whether this is expected and what to expect during build generally in https://issues.redhat.com/browse/CRYPTO-4398

(In reply to Honza Horak from comment #10)
> test pgp-decrypt                  ... FAILED       32 ms
> test pgp-pubkey-decrypt           ... FAILED       33 ms

These failures are both related to missing blowfish as well, as the result diff is:

--- /home/cloud-user/rpmbuild/BUILD/postgresql-13.2/contrib/pgcrypto/expected/pgp-pubkey-decrypt.out	2021-02-08 16:54:11.000000000 -0500
+++ /home/cloud-user/rpmbuild/BUILD/postgresql-13.2/contrib/pgcrypto/results/pgp-pubkey-decrypt.out	2021-06-17 13:46:37.897984632 -0400
@@ -595,11 +595,7 @@
 
 select pgp_pub_decrypt(dearmor(data), dearmor(seckey))
 from keytbl, encdata where keytbl.id=2 and encdata.id=2;
- pgp_pub_decrypt 
------------------
- Secret msg
-(1 row)
-
+ERROR:  Wrong key or corrupt data
 select pgp_pub_decrypt(dearmor(data), dearmor(seckey))
 from keytbl, encdata where keytbl.id=3 and encdata.id=3;
  pgp_pub_decrypt 

and the test SQL is:
https://github.com/postgres/postgres/blob/1dc75515/contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql#L511
(see the comment "-- elg2048 / blowfish")

A PR that disables tests that fails currently:
https://gitlab.com/redhat/centos-stream/rpms/postgresql/-/merge_requests/7

However, the pgp tests are disabled entirely, despite they should work if the keys used some more modern encryption. So, it should be possible to change the testing files to make the pgp tests work again, it just needs some more investigation.

Moving ITM now as this will likely not be done in upcoming week.

And switching back to ASSIGNED to signal clearly that it is still not done yet.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: postgresql), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2384