Fix test suite results with system CrackLib

* Patch the upstream test suite to change the expected results for a few
  passwords that are rejected by the embedded CrackLib but accepted by
  the system CrackLib (which the Debian package is built with).

diff --git a/debian/changelog b/debian/changelog
index f82087d3b4a4e9c567d66a2c692387a476b05e4e..1829222124834793f865b0a0ff42658a37a09442 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,9 @@ krb5-strength (3.1-1) UNRELEASED; urgency=medium
     - Configuration instructions are now provided in installed man pages,
       including a new krb5-strength man page, to make them more accessible
       after installation.
+  * Patch the upstream test suite to change the expected results for a few
+    passwords that are rejected by the embedded CrackLib but accepted by
+    the system CrackLib (which the Debian package is built with).
   * Re-enable treating test suite failures as package build failures now
     that bug #724570 in CrackLib was fixed in Debian.
   * Switch to the DEP-14 branch layout and update debian/gbp.conf and

diff --git a/debian/patches/0001-Change-CrackLib-tests-for-system-CrackLib.patch b/debian/patches/0001-Change-CrackLib-tests-for-system-CrackLib.patch
new file mode 100644 (file)
index 0000000..6df3039
--- /dev/null
+++ b/debian/patches/0001-Change-CrackLib-tests-for-system-CrackLib.patch
@@ -0,0 +1,66 @@
+From: Russ Allbery <eagle@eyrie.org>
+Date: Sun, 25 Dec 2016 11:50:14 -0800
+Subject: Change CrackLib tests for system CrackLib
+
+The upstream test suite contains a few tests that fail with the
+normal system CrackLib rules.  Modify them to expect passes so
+that we can run the full test suite during the build.
+
+Also remove CrackLib when testing character classes, since it
+rejects the passwords used for minimum_different testing as too
+simplistic.
+---
+ tests/data/passwords/cracklib.json |  8 ++------
+ tests/plugin/mit-t.c               | 12 ++++++------
+ 2 files changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/tests/data/passwords/cracklib.json b/tests/data/passwords/cracklib.json
+index 037a70f..b69e700 100644
+--- a/tests/data/passwords/cracklib.json
++++ b/tests/data/passwords/cracklib.json
+@@ -22,9 +22,7 @@
+     {
+         "name": "in dictionary (repeated)",
+         "principal": "test@EXAMPLE.ORG",
+-        "password": "stanfordstanford",
+-        "code": "KADM5_PASS_Q_GENERIC",
+-        "error": "it is based on a (duplicated) dictionary word"
++        "password": "stanfordstanford"
+     },
+     {
+         "name": "in dictionary (reversed)",
+@@ -36,9 +34,7 @@
+     {
+         "name": "seven characters",
+         "principal": "test@EXAMPLE.ORG",
+-        "password": "dfareas",
+-        "code": "KADM5_PASS_Q_GENERIC",
+-        "error": "it is too short"
++        "password": "dfareas"
+     },
+     {
+         "name": "four characters",
+diff --git a/tests/plugin/mit-t.c b/tests/plugin/mit-t.c
+index 7eba594..4406e38 100644
+--- a/tests/plugin/mit-t.c
++++ b/tests/plugin/mit-t.c
+@@ -272,13 +272,13 @@ main(void)
+     vtable->close(ctx, data);
+ 
+     /* Add simple character class configuration to krb5.conf. */
+-    setup_argv[5] = (char *) "minimum_different";
+-    setup_argv[6] = (char *) "8";
+-    setup_argv[7] = (char *) "require_ascii_printable";
++    setup_argv[3] = (char *) "minimum_different";
++    setup_argv[4] = (char *) "8";
++    setup_argv[5] = (char *) "require_ascii_printable";
++    setup_argv[6] = (char *) "true";
++    setup_argv[7] = (char *) "require_non_letter";
+     setup_argv[8] = (char *) "true";
+-    setup_argv[9] = (char *) "require_non_letter";
+-    setup_argv[10] = (char *) "true";
+-    setup_argv[11] = NULL;
++    setup_argv[9] = NULL;
+     run_setup((const char **) setup_argv);
+ 
+     /* Obtain a new Kerberos context with that krb5.conf file. */

diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644 (file)
index 0000000..ec5913b
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+0001-Change-CrackLib-tests-for-system-CrackLib.patch

diff --git a/debian/rules b/debian/rules
index 142523e8e7110c00c2f1ad1c4da57d742606d2b9..f00fa05146c8143576b672b920b0ea063318e3b0 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -7,6 +7,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
        dh $@
 
 override_dh_auto_configure:
+       ./bootstrap
        dh_auto_configure -- --enable-reduced-depends --with-cracklib
 
 override_dh_auto_install: