Repository navigation
Multiple tests fail due to expired certificates if system date is set further than year 2037ish #107562
Description
To test the readiness of Yocto stack for Y2038 we run qemu virtual machines with RTC set to some day in 2040. This causes many of python's tests to fail on both 32 bit and 64 bit systems: the reason is that test certificate expiry dates are set to 2037 or so by Lib/test/make_ssl_certs.py:
startdate = "20180829142316Z"
enddate = "20371028142316Z"
I would propose to set the expiry date to far enough in the future that it won't have to be tweaked in our lifetimes: this way real Y2038 issues in python (or in things it depends on) can be exposed and fixed (it's well possible there are none, but that needs confirmation too).
Failures seen:
6 tests failed:
test_asyncio test_httplib test_imaplib test_poplib test_ssl
test_urllib2_localnet
If there's agreement on this, I can prepare the patch.
Activity
[-]Y2038: tests are failing due to expired certificates if system date is set further than year 2037ish[/-][+]Multiple tests fail due to expired certificates if system date is set further than year 2037ish[/+]Eclips4 commentedon Aug 2, 2023
Looks like a duplicate ofRelated: #101732kanavin commentedon Aug 2, 2023
It's related, but not a duplicate. This ticket is about tests failing if system date is set to 2040 because certificates have expired, and suggests re-setting the expiry date directly in python upstream.
That ticket #101732 is about what happens when system date is set to 2040 and certificates have been re-generated with expiry date further in the future (the ticket specifically mentions doing that in reproducibility instructions). In that case, other issues, e.g. in ssl module are uncovered.
pythongh-107562: Update test certificates to expire far in the future
gh-107562: make_ssl_certs.py: produce test certificates that expire f…
gh-107562: Update test certificates to expire far in the future (GH-1…
encukou commentedon Oct 9, 2024
Merged to main. Thanks for the patch, and for your patience!
kanavin commentedon Oct 9, 2024
Thanks for support! But they still need to be regenerated and committed?
kanavin commentedon Oct 9, 2024
Ah NVM I see it already happened just a moment ago in #125104 . No idea why github wouldn't send me notifications as this ticket was made by me.
pythongh-107562: make_ssl_certs.py: produce test certificates that ex…