From Fedora Project Wiki

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 9: Line 9:
| fedora_mailing_list = test
| fedora_mailing_list = test
}}
}}
{{admon/warning | In construction | This Test Day page is still in construction. It shall be ready for the Test Day - when this message is removed :) .}}


{{admon/note | Can't make the date? | If you come to this page before or after the test day is completed, your testing is still valuable, and you can use the information on this page to test, file any bugs you find at [http://bugzilla.redhat.com Bugzilla], and add your results to the results section. If this page is more than a month old when you arrive here, please check the [[QA/Test_Days|current schedule]] and see if a similar but more recent Test Day is planned or has already happened.}}
{{admon/note | Can't make the date? | If you come to this page before or after the test day is completed, your testing is still valuable, and you can use the information on this page to test, file any bugs you find at [http://bugzilla.redhat.com Bugzilla], and add your results to the results section. If this page is more than a month old when you arrive here, please check the [[QA/Test_Days|current schedule]] and see if a similar but more recent Test Day is planned or has already happened.}}
Line 14: Line 16:
== What to test? ==
== What to test? ==


Today's instalment of Fedora Test Day will focus on testing the [[Features/SharedSystemCertificates|Shared System Certificates]] feature. The goal is to make NSS, GnuTLS, OpenSSL and Java share a default source for retrieving system certificate anchors and black list information.  
Today's instalment of Fedora Test Day will focus on testing the [[SharedSystemCertificates|Shared System Certificates]] feature. The goal is to make NSS, GnuTLS, OpenSSL and Java share a default source for retrieving system certificate anchors and black list information.  


The work done in Fedora 19 is an initial step of a comprehensive solution. But none the less it makes the installation of anchors and blacklists standardized across the various crypto libraries. Currently an ''update-ca-trust'' step is required, but in the future we hope to make this unnecessary.
The work done in Fedora 19 is an initial step of a comprehensive solution. But none the less it makes the installation of anchors and blacklists standardized across the various crypto libraries. Currently an 'extract' step is required, but in the future we hope to make this unnecessary.


== Who's available ==
== Who's available ==


The following cast of characters will be available testing, workarounds, bug fixes, and general discussion ...
The following cast of characters will be available testing, workarounds, bug fixes, and general discussion ...
* Development - [[User:Stefw|Stef Walter]] (stefw), [[User:KaiEngert|Kai Engert]] (kaie)
* Development - [[User:StefWalter|Stef Walter]] (stefw), [[User:KaiEngert|Key Engert]] (kaie)
* Quality Assurance - [[User:JiriJaburek|Jiri Jaburek]] (jjaburek), [[User:AlesMarecek|Ales Marecek]] (alich)
* Quality Assurance - [[User:JiriJaburek|Jiri Jaburek]] (jjaburek), [[User:AlesMarecek|Ales Marecek]] (alich)


== Prerequisite for Test Day ==  
== Prerequisite for Test Day ==  


=== '''Update your machine''' ===
To test this feature you need an updated Fedora 19 system, with at least the following software:


If you're running Fedora 19, make sure you have these packages updated:
* p11-kit 0.17.4 (or later)
* p11-kit 0.17.4 (or later)
* p11-kit-trust 0.17.4 (or later)
* p11-kit-trust 0.17.4 (or later)
* ca-certficates 2012.87-10.0 (or later)
* ca-certficates 2012.87-9 (or later)
* nss 3.14.3-10 (or later)
* nss 3.14.3-10 (or later)


This feature is not testable on Fedora 18 or Rawhide at the current time.
Some of the software used to test this feature in the test cases below:
 
See the detailed [[Test_Day:2013-03-28_Shared_System_Certificates/Prerequisites|prerequisites page]] to get yourself setup for the test cases below.
 
=== '''Live image''' ===
 
Optionally, you may download a non-destructive Fedora 19 live image for your architecture. General tips on using a live image are available at [[FedoraLiveCD]].


{|
* firefox
! Architecture !! SHA256SUM
* gnutls-utils
|-  
* nss-tools
| [http://kparal.fedorapeople.org/testdays/2013-03-28/testday-20130328-x86_64.iso x86_64] || 389311d2a62789a15601ffc181b15dd6c8d610c90cafd49d01c26cf923b6a3f6
* openssl
|-
* java-1.7.0-openjdk-devel
| [http://kparal.fedorapeople.org/testdays/2013-03-28/testday-20130328-i686.iso i686] || d41ec49ca6c43122ebb5b4bb9c7e1b86bdc85b82aa9a72aaa57c09c0d5c2f76b
* epiphany
|}
* wget


You can also use [http://dl.fedoraproject.org/pub/alt/stage/19-Alpha-TC2/Live/ Fedora 19 Alpha TC2] images, if you already have them.
TODO: There will be a live image available for testing, which contains all of the above software.


See the detailed [[Test_Day:2013-03-28_Shared_System_Certificates/Prerequisites|prerequisites page]] to get yourself setup for the test cases below.
All of the above is available on an updated Fedora 19 nightly. Unfortunately the nightlies have been somewhat unstable as of late.  


== How to test? ==
== How to test? ==


You can use the test cases below, or you can explore the feature further. At a high level the following are being tested
xxxxxxxxxxxxxxxx TODO xxxxxxxxxxxxxxxxxx


* '''p11-kit-trust''' provides a replacement for the NSS ''libnssckbi.so'' module. The ''libnssckbi.so'' used to provide built in certificate trust anchors and blacklists, and now the ''p11-kit-trust.so'' module does this. So we'll be testing that NSS applications (like Firefox) continue to work as expected.
High level details on how a contributor can get involved. This can include (but not limited to):


* '''ca-certificates''' extracts files ready for ''p11-kit-trust.so'' to use. We'll be testing that these files are installed correctly to be picked up.
* Areas to target with exploratory testing
* A list of pre-defined test cases to execute
* How to report back results


* '''ca-certificates''' provides an ''update-ca-trust'' script which uses '''p11-kit''' to extract certificate anchor information from ''p11-kit-trust.so'' for crypto libraries (gnutls, openssl, java) that cannot yet read directly from ''p11-kit-trust.so'' on the fly. We'll test this extract process, and make sure that applications using these crypto libraries continue to work as expected.
Here's another common chunk (again, replace XX as above):


* There is now a standard method for adding a certificate anchor. We'll test that this works, and is picked up by all the applications.
=== '''Update your machine''' ===


The test cases below explore the above actions and more. You of course are free to go out of bounds and provide additional testing and feedback. Below is some documentation you may find useful as you do:
If you're running Fedora XX, make sure you have all the current updates for it installed, using the update manager. If you want to try Rawhide, see the instructions on the [[Releases/Rawhide|Rawhide]] page on the various ways in which you can install or update to Rawhide. Or:


* http://p11-glue.freedesktop.org/doc/p11-kit/trust.html
=== '''Live image''' ===
* http://p11-glue.freedesktop.org/trust-module.html


For each bug you find report a bug on [https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora Red Hat Bugzilla] under the Fedora product, and the relevant component.
Optionally, you may download a non-destructive Rawhide live image for your architecture. Tips on using a live image are available at [[FedoraLiveCD]]. Live images can be found [http://alt.fedoraproject.org/pub/alt/nightly-composes/desktop/ here].


== Test Cases ==
== Test Cases ==


These are in a recommended order, although you may skip around. Each test case notes its prerequisites and setup.
Provide a list of test areas or test cases that you'd like contributors to execute. For other examples, see [[:Category:Test_Cases]].
 
<!-- If you change the order here, update the numbers in the table below -->
# [[QA:Testcase_Certificate_Trust:Untrusted_Certificate|Reject untrusted certificates]]
# [[QA:Testcase_Certificate_Trust:System_Trust|Validate system trusted certificates]]
# [[QA:Testcase_Certificate_Trust:Configure_Anchor|Configure a new certificate authority anchor]]
# [[QA:Testcase_Certificate_Trust:Deconfigure_Anchor|Remove a configured certificate authority anchor]]
# [[QA:Testcase_Certificate_Trust:Blacklist_Root|Blacklist a root certificate authority]]
# [[QA:Testcase_Certificate_Trust:Blacklist_Intermediate|Blacklist an intermediate certificate authority]]
# [[QA:Testcase_Certificate_Trust:Edit_Trust_In_Firefox|Edit trust in Firefox]]
# [[QA:Testcase_Certificate_Trust:Upgrade_Bundle|Upgrade to Fedora 19 with a modified CA bundle]]
 
== Tips and Known Issues ==
Please check the [[Features/SharedSystemCertificates:TipsAndKnownIssues|tips and known issues]] to see if a problem is already known, and which has helpful information for triaging issues.


== Test Results ==
== Test Results ==


If you have problems with any of the tests, report a bug to [https://bugzilla.redhat.com Bugzilla] usually for the component [https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&version=19&component=ca-certificates ca-certificates], or [https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&version=19&component=p11-kit p11-kit]. If you are unsure about exactly how to file the report or what other information to include, just ask on IRC and we will help you.
Construct a table or list to allow testers to post results. Each column should be a test case or configuration, and each row should consist of test results. Include some instructions on how to report bugs, and any special instructions. Here's an example, from a Palimpsest test day:


Once you have completed the tests, add your results to the Results table below, following the example results from the first line as a template. The first column should be your name with a link to your User page in the Wiki if you have one. For each test case, use the [[Template:result|result template]] to enter your result, as shown in the example result line.
If you have problems with any of the tests, report a bug to [https://bugzilla.redhat.com Bugzilla] usually for the component [https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&version=13&component=udisks udisks], or [https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&version=13&component=gnome-disk-utility gnome-disk-utility] for bugs in the Palimpsest graphical front end itself. If you are unsure about exactly how to file the report or what other information to include, just ask on IRC and we will help you. Once you have completed the tests, add your results to the Results table below, following the example results from the first line as a template. The first column should be your name with a link to your User page in the Wiki if you have one. For each test case, use the [[Template:result|result template]] to enter your result, as shown in the example result line.


{|
{|
! User
! User
! [[QA:Testcase_Certificate_Trust:Untrusted_Certificate|1. untrusted]]
! [[QA:Testcase_sample_1|Sample test 1]]
! [[QA:Testcase_Certificate_Trust:System_Trust|2. systrust]]
! [[QA:Testcase_sample_2|Sample test 2]]
! [[QA:Testcase_Certificate_Trust:Configure_Anchor|3. configure]]
! [[QA:Testcase_sample_3|Sample test 3]]
! [[QA:Testcase_Certificate_Trust:Deconfigure_Anchor|4. deconfig]]
! [[QA:Testcase_sample_4|Sample test 4]]
! [[QA:Testcase_Certificate_Trust:Blacklist_Root|5. badroot]]
! [[QA:Testcase_Certificate_Trust:Blacklist_Intermediate|6. badinter]]
! [[QA:Testcase_Certificate_Trust:Edit_Trust_In_Firefox|7. editfire]]
! [[QA:Testcase_Certificate_Trust:Upgrade_Bundle|8. upgrade]]
! References
! References
|-
|-
| [[User:Stefw|Stef Walter]]
| [[User:SampleUser|Sample User]]
| {{result|pass}}
| {{result|none}}  
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|warn||928750}}
| {{result|pass}}
| <references/>
|-
| [[User:alich|alich]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|warn||928914}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|fail}} <ref>Cannot update F18 Live VM.</ref>
| <references/>
|-
| [[User:fholec|fholec]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| <references/>
|-
|-
| [[User:omoris|omoris]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}} <ref>The same issue as Stef has already reported above.</ref>
| {{result|fail}} <ref>Cannot update F18 Live VM (bus error), not related to TD topic.</ref>
| <references/>
|-
|-
| [[User:mvadkert|Miroslav Vadkerti]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}  <ref>p11-kit: shouldn't be reached at sys_C_Logout {{bz|928750}}</ref>
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|warn}} <ref>Test pass, but also encountered {{bz|54321}}</ref>
| {{result|fail}} <ref>{{bz|12345}}</ref>
| <references/>
| <references/>
|-
|-
|-
| [[User:jjaburek|Jiri Jaburek]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|fail}}  <ref>Conflicting files on update, 'upgrade' or --skip-broken didn't help.</ref>
| <references/>
|-
|-
| [[User:dspurek|David Spurek]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|none}}
| <references/>
|-
|-
| [[User:exo|Tomas Meszaros]]
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| {{result|pass}}
| <references/>
|}
|}


  [[Category:Fedora 19 Test Days]]
[[Category:Test Days]]
[[Category:QA Templates]]
Please note that all contributions to Fedora Project Wiki are considered to be released under the Attribution-Share Alike 4.0 International (see Fedora Project Wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please solve the following task below and enter the answer in the box (more info):

Cancel Editing help (opens in new window)