Re: [security-dev 01725]: Re: Please review new regression test for java.net.* API

2010-03-22 Thread Andrew John Hughes
On 22 March 2010 15:41, Sean Mullan wrote: > Andrew John Hughes wrote: >> >> On 18 March 2010 21:12, Christopher Hegarty -Sun Microsystems Ireland >> wrote: >>> >>> Andrew John Hughes wrote: On 18 March 2010 20:56, Christopher Hegarty -Sun Microsystems Ireland wrote: > > B

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 21:12, Christopher Hegarty -Sun Microsystems Ireland wrote: > Andrew John Hughes wrote: >> >> On 18 March 2010 20:56, Christopher Hegarty -Sun Microsystems Ireland >> wrote: >>> >>> Brad, Pavel, Andrew, >>> >>> I'm also not comfortable with this test, but what bothers me more tha

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Christopher Hegarty -Sun Microsystems Ireland
Andrew John Hughes wrote: On 18 March 2010 20:56, Christopher Hegarty -Sun Microsystems Ireland wrote: Brad, Pavel, Andrew, I'm also not comfortable with this test, but what bothers me more than the reliance on an external server is the reliance on cacerts. While cacerts (or equivalent) is not

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 20:56, Christopher Hegarty -Sun Microsystems Ireland wrote: > Brad, Pavel, Andrew, > > I'm also not comfortable with this test, but what bothers me more than the > reliance on an external server is the reliance on cacerts. While cacerts (or > equivalent) is not part of OpenJDK I d

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Christopher Hegarty -Sun Microsystems Ireland
Brad, Pavel, Andrew, I'm also not comfortable with this test, but what bothers me more than the reliance on an external server is the reliance on cacerts. While cacerts (or equivalent) is not part of OpenJDK I don't think it makes sense adding a test to OpenJDK that has a reliance on it. For

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 18:40, Brad Wetmore wrote: > > I have a couple important tasks to finish ASAP, so if there is more > discussion, I'll have to jump in sometime next week, but wanted to add > one thing before anything was done: > > Pavel wrote: >> And we can use other URL if verisign.com is problem

Re: [security-dev 01698]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Brad Wetmore
I have a couple important tasks to finish ASAP, so if there is more discussion, I'll have to jump in sometime next week, but wanted to add one thing before anything was done: Pavel wrote: > And we can use other URL if verisign.com is problematic. We've tried to limit the reliance on servers outs

Re: [security-dev 01702]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 15:13, Sean Mullan wrote: > Andrew John Hughes wrote: > >> This has been posted about before; OpenJDK currently can't bootstrap >> itself because it doesn't have a working cacerts store (the JAXP URL >> uses https). >> >> I don't know how to solve this; we can certainly have the c

Re: [security-dev 01703]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 15:07, Christopher Hegarty -Sun Microsystems Ireland wrote: > > > Sean Mullan wrote: >> >> >>> >>> Security folk: >>>  Do we currently have any tests with a dependency on cacerts? >> >> yes, but they would be in the closed tests. > > So we have your own non public tests for t

Re: [security-dev 01701]: Re: Please review new regression test for java.net.* API

2010-03-18 Thread Christopher Hegarty -Sun Microsystems Ireland
Sean Mullan wrote: Security folk: Do we currently have any tests with a dependency on cacerts? yes, but they would be in the closed tests. So we have your own non public tests for this. Maybe RedHat should take a similar approach then. -Chris. --Sean

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 14:57, Christopher Hegarty -Sun Microsystems Ireland wrote: > Pavel Tisnovsky wrote: >> >> Christopher Hegarty -Sun Microsystems Ireland wrote: >>> >>> Alan Bateman wrote: Pavel Tisnovsky wrote: > > Hi, > > please review new regression test for java.net.*

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Christopher Hegarty -Sun Microsystems Ireland
Pavel Tisnovsky wrote: Christopher Hegarty -Sun Microsystems Ireland wrote: Alan Bateman wrote: Pavel Tisnovsky wrote: Hi, please review new regression test for java.net.* API. This test check if the cacerts keytool database is configured properly and SSL is really working. The test should

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Pavel Tisnovsky
Christopher Hegarty -Sun Microsystems Ireland wrote: Alan Bateman wrote: Pavel Tisnovsky wrote: Hi, please review new regression test for java.net.* API. This test check if the cacerts keytool database is configured properly and SSL is really working. The test should not fail if SSL is worki

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Alan Bateman
Christopher Hegarty -Sun Microsystems Ireland wrote: : Alan is correct there are already tests for SSL/Https in javax.net, but I believe these use self signed certs, no dependency on cacerts. OK, in that case adding a new test make sense. The test/java/net tree is probably not the best place t

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 14:28, Christopher Hegarty -Sun Microsystems Ireland wrote: > Alan Bateman wrote: >> >> Pavel Tisnovsky wrote: >>> >>> Hi, >>> >>> please review new regression test for java.net.* API. This test check if >>> the cacerts keytool database is configured properly and SSL is really >>>

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Christopher Hegarty -Sun Microsystems Ireland
Alan Bateman wrote: Pavel Tisnovsky wrote: Hi, please review new regression test for java.net.* API. This test check if the cacerts keytool database is configured properly and SSL is really working. The test should not fail if SSL is working (in other case it simply throws IOException). Webr

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Andrew John Hughes
On 18 March 2010 13:56, Alan Bateman wrote: > Pavel Tisnovsky wrote: >> >> Hi, >> >> please review new regression test for java.net.* API. This test check if >> the cacerts keytool database is configured properly and SSL is really >> working. The test should not fail if SSL is working (in other ca

Re: Please review new regression test for java.net.* API

2010-03-18 Thread Alan Bateman
Pavel Tisnovsky wrote: Hi, please review new regression test for java.net.* API. This test check if the cacerts keytool database is configured properly and SSL is really working. The test should not fail if SSL is working (in other case it simply throws IOException). Webrev si available at h