The nightly test test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_revocation is failing with pki packages taken from the copr repo @pki/master.
Seen in PR 3834 with the following logs and report:
self = <ipatests.test_integration.test_ipahealthcheck.TestIpaHealthCheck object at 0x7f0177370ef0> def test_ipa_healthcheck_revocation(self): """ Ensure that healthcheck reports when IPA certs are revoked. """ error_msg = ( "Certificate tracked by {key} is revoked {revocation_reason}" ) error_msg_0_4 = ( "Certificate is revoked, unspecified" ) result = self.master.run_command( ["getcert", "list", "-f", paths.HTTPD_CERT_FILE] ) request_id = get_certmonger_fs_id(result.stdout_text) # Revoke the web cert certfile = self.master.get_file_contents(paths.HTTPD_CERT_FILE) cert = x509.load_certificate_list(certfile) serial = cert[0].serial_number > self.master.run_command(["ipa", "cert-revoke", str(serial)]) test_integration/test_ipahealthcheck.py:923: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <ipatests.pytest_ipa.integration.host.Host master.ipa.test (master)> argv = ['ipa', 'cert-revoke', '9'], set_env = True, stdin_text = None log_stdout = True, raiseonerr = True, cwd = None, bg = False, encoding = 'utf-8' ok_returncode = 0 def run_command(self, argv, set_env=True, stdin_text=None, log_stdout=True, raiseonerr=True, cwd=None, bg=False, encoding='utf-8', ok_returncode=0): """Wrapper around run_command to log stderr on raiseonerr=True :param ok_returncode: return code considered to be correct, you can pass an integer or sequence of integers """ result = super().run_command( argv, set_env=set_env, stdin_text=stdin_text, log_stdout=log_stdout, raiseonerr=False, cwd=cwd, bg=bg, encoding=encoding ) # in FIPS mode SSH may print noise to stderr, remove the string # "FIPS mode initialized" + optional newline. result.stderr_bytes = FIPS_NOISE_RE.sub(b'', result.stderr_bytes) try: result_ok = result.returncode in ok_returncode except TypeError: result_ok = result.returncode == ok_returncode if not result_ok and raiseonerr: result.log.error('stderr: %s', result.stderr_text) > raise subprocess.CalledProcessError( result.returncode, argv, result.stdout_text, result.stderr_text ) E subprocess.CalledProcessError: Command '['ipa', 'cert-revoke', '9']' returned non-zero exit status 1. pytest_ipa/integration/host.py:202: CalledProcessError ----------------------------- Captured stderr call ----------------------------- ipa: ERROR: stderr: ipa: ERROR: Request failed with status 404: Non-2xx response from CA REST API: 404.
The call to ipa cert-revoke is failing. Internally, the code tries to find which PKI version is installed using a call to PKI endpoint /pki/rest/info (https://pagure.io/freeipa/blob/5d3c6b761b9d59ce6640d1141848eb66585795f7/f/ipaserver/plugins/dogtag.py#_1165-1173) but this endpoint has been removed with the pki commit https://github.com/dogtagpki/pki/commit/74e5f89343d55c6a555dc65d4591a02fb70675c8 Move current REST APIs to v1 package .
ipa cert-revoke
The endpoint is now available in pki/v1/info.
IPA should be able to handle the exception and fallback to the other endpoint.
Metadata Update from @frenaud: - Issue tagged with: test-failure
Fixed with commit https://github.com/dogtagpki/pki/commit/cd070b882e47bdb92cc17ce01f81bd4f97e80efb that adds a rewriterule from pki/rest/info to pki/v1/info
Green run in PR#3947: details
Metadata Update from @frenaud: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)