Re: [ANNOUNCE] Git v2.34.0-rc2

On Tue, Nov 09, 2021 at 04:59:29PM -0800, Junio C Hamano wrote:

I'm seeing some test breakage from the release candidates here. On my Debian unstable system, everything passed a few days ago. But after upgrading openssh-client from 1:8.4p1-5 to 1:8.7p1-1 (which hit unstable on Saturday), all of the GPGSSH bits seem to break:

  Test Summary Report
  -------------------
  t5534-push-signed.sh                             (Wstat: 256 Tests: 13 Failed: 2)
    Failed tests:  8, 12
    Non-zero exit status: 1
  t6200-fmt-merge-msg.sh                           (Wstat: 256 Tests: 31 Failed: 2)
    Failed tests:  7-8
    Non-zero exit status: 1
  t7031-verify-tag-signed-ssh.sh                   (Wstat: 256 Tests: 8 Failed: 5)
    Failed tests:  2, 4-7
    Non-zero exit status: 1
  t7528-signed-commit-ssh.sh                       (Wstat: 256 Tests: 23 Failed: 10)
    Failed tests:  2-5, 7, 9, 12-13, 17, 19
    Non-zero exit status: 1

This doesn't have anything to do with -rc2 in particular. The breakage bisects to f265f2d630 (ssh signing: tests for logs, tags & push certs, 2021-09-10), and is triggered by the system openssh upgrade.

It's hard to tell what's going on, as we seem to just be getting bad results from ssh-keygen. Here's the first failing test in t7031 (with GIT_TRACE and -x):

  [...]
  + git verify-tag initial
  trace: built-in: git verify-tag initial
  trace: run_command: ssh-keygen -Y find-principals -f '/home/peff/compile/git/t/trash directory.t7031-verify-tag-signed-ssh/gpghome/ssh.all_valid.allowedSignersFile' -s /tmp/.git_vtag_tmpSxXLIv
  trace: run_command: ssh-keygen -Y check-novalidate -n git -s /tmp/.git_vtag_tmpSxXLIv
  + exit 1
  error: last command exited with $?=1
  not ok 2 - verify and show ssh signatures

Likewise, this segfault (!) from t7528 is scary:

  [...]
  + git verify-commit initial
  trace: built-in: git verify-commit initial
  trace: run_command: ssh-keygen -Y find-principals -f '/home/peff/compile/git/t/trash directory.t7528-signed-commit-ssh/gpghome/ssh.all_valid.allowedSignersFile' -s /tmp/.git_vtag_tmpCOAwhp
  error: ssh-keygen died of signal 11
  trace: run_command: ssh-keygen -Y check-novalidate -n git -s /tmp/.git_vtag_tmpCOAwhp
  Good "git" signature with ED25519 key SHA256:E+1Xptv1zGa2fWFjSL36Tl2m2NVxcyJVzhfQTnU+yWc
  + exit 1
  error: last command exited with $?=1
  not ok 2 - verify and show signatures

So it may not be a bug we need to fix in Git. But shipping v2.34 with lots of test failures may cause some headaches. Maybe we need to tighten up the GPGSSH prereq checks to block broken versions?

-Peff