Repository navigation
Conversation
The CA interaction test connected to www.nodejs.org without sending a TLS server name. The endpoint returned its default nodejs.org certificate, which did not cover www.nodejs.org, so hostname verification failed before the test could check the supplied CA behavior. Send www.nodejs.org as the server name while preserving the hostname, certificate verification and all CA assertions. Apply the correction in the runtime image and include the patched test in its syntax checks. Assisted-by: Codex
adfbecd to
54930a2
Compare
EtiennePerot
left a comment
EtiennePerot
left a comment
There was a problem hiding this comment.
Please exclude the test instead. We shouldn't rely on external connectivity to websites during tests. I know we have plenty of tests that do today, but as soon as one shows any sign of flaking, it should get the boot instead of a dedicated patch we have to carry.
That's a fair point. Just to point out though: this patch has already landed upstream. |
|
Closing this PR because The SNI correction has merged upstream in nodejs/node#66835. The independent Node upgrade remains preserved; its redundant copy of this patch can be removed without re-enabling the excluded test. Posted by Codex on behalf of @tamird. |
The Node.js CA interaction test connects to www.nodejs.org without
sending a TLS server name. The endpoint can return its default nodejs.org
certificate, which does not cover www.nodejs.org, so hostname verification
fails before the test checks the supplied CA behavior.
Apply the correction proposed in nodejs/node#66835 to the
runtime image. Send www.nodejs.org as the server name while preserving the
hostname, certificate verification, and all CA assertions. Include the
patched test in the existing image syntax checks.
The fresh source image and complete declared gVisor Node.js runtime profile
passed in both filesystem modes: 160 runtime shards and 7,898 inner tests.
This qualification used the source-image integration branch and retains
the profile's existing exclusions. The earlier focused affected-partition
run also passed. Upstream Node metadata checks have passed; these gVisor
results do not establish a full upstream Node source-suite result.
Assisted by OpenAI Codex.