8384815: SelectOneKeyOutOfMany and PreferredKey fail after expired test certificate

[sendaoYan]

Hi all,

This is backport PR to make test generate certificates during test run which avoid the fixed certificate expired cause test fails.
There are two changes make this PR backported uncleanly.

1. jdk11u lack of JDK-8325766 cause javac report can not find setOneHourValidity. I add setOneHourValidity() manully.
2. Class CertificateBuilder locate in different package in jdk17u and jdk11u. So I adopt the @libary and import package name for CertificateBuilder.
3. CertificateBuilder.setPublicKey() return void in jdk11u, so split the chaind calls for new CertificateBuilder()
4. jdk11u do not support Arrays.stream().toList(), so I use Arrays.stream.anyMatch() instead.

Change has been verified locally by run the releated on linux-x64. Test-fix only, no risk.

---

• I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8384815 needs maintainer approval

Error

 ⚠️ OCA signatory status must be verified

Issue

• JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after expired test certificate (Bug - P2)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk11u-dev.git pull/3203/head:pull/3203
$ git checkout pull/3203

Update a local copy of the PR:
$ git checkout pull/3203
$ git pull https://git.openjdk.org/jdk11u-dev.git pull/3203/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 3203

View PR using the GUI difftool:
$ git pr show -t 3203

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk11u-dev/pull/3203.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back syan! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 01: Full - Incremental (2a2aec76)
• 00: Full (8e12a844)

[vieiro]

@sendaoYan Good to see this backported! I was about to backport it. I've added some hints that may prove useful.

[vieiro]

Maybe:

 * @library ../../../../java/security/testlibrary/
 * @library /test/lib
 * @build jdk.test.lib.Utils
 *        CertificateBuilder

Is a better approach? (we're using it elsewhere in JDK11, e.g.

jdk11u-dev/test/jdk/sun/security/ssl/CertPathRestrictions/TLSRestrictions.java

Line 57 in 39194d9

* @library /test/lib

)

[sendaoYan]

I have split the '@library' as two lines. But I do not add '@build jdk.test.lib.Utils', seems these two tests do not need build this class jdk.test.lib.Utils.

[gnu-andrew]

1. I think JDK-8325766 should be backported first rather than just cherry-picking setOneHourValidity. This solves the same issue for other pre-generated certificates. This should be a separate PR this one can depend on.
2. Rather than working around the bad return values for CertificateBuilder, I would cherry-pick the CertificateBuilder.java changes in JDK-8179502 as an additional commit on this PR. The whole thing is an enhancement with CSR not suitable for backport, but the CertificateBuilder.java changes are largely unrelated and fix it to actually work to the Builder pattern as the name suggests.
3. I'm not sure why you need to add @run main lines here. Isn't that the default? I don't see them in the 17u patch. Did the tests fail without this?

[sendaoYan]

3. I'm not sure why you need to add @run main lines here. Isn't that the default? I don't see them in the 17u patch. Did the tests fail without this?

I add the '@build CertificateBuilder' line for both tests, because CertificateBuilder.java located different directories in jdk17u and jdk11u. In jdk11u jtreg will not build CertificateBuilder.java by default, So I add this line.

And if I add ''@build CertificateBuilder' but not suffix @run main line , jtreg will report error like "TEST RESULT: Error. No action after @build'.

I will try to cherry-pick JDK-8179502 and JDK-8325766 first.

Thanks for the suggestions.

[gnu-andrew]

I will try to cherry-pick JDK-8179502 and JDK-8325766 first.

8325766 should be a separate PR. It is too complicated to be combined with this change.

[sendaoYan]

8325766 should be a separate PR. It is too complicated to be combined with this change.

Okey, thanks for the advices. I do create a new PR later.

[gnu-andrew]

8325766 should be a separate PR. It is too complicated to be combined with this change.

Okey, thanks for the advices. I do create a new PR later.

I've created #3222 for backporting 8325766. It was quite involved and also required the 8179502 changes that this one needs. Assuming this is integrated, it should simplify this backport considerably.