[Bug]: Test failures (revoke_test.go:1097: '-1' and '0' are not equal)

[plaimbock]

Steps to Reproduce

I built certificates 0.28.4 on https://copr.fedorainfracloud.org with both the fedora-42-x86_64 and fedora-43-x86_64 chroots enabled. The Fedora 42 build was fine but the Fedora 43 build fails in the tests. Fedora 43 has golang 1.25.1. Build command (within the spec file):

BUILD_DATE="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" '+%Y-%m-%d %H:%M UTC')"
GO_ENVS="CGO_ENABLED=1" go build \
  -trimpath \
  -buildmode=pie \
  -mod=readonly \
  -modcacherw \
  -ldflags "-linkmode external -extldflags \"${LDFLAGS}\" -X \"main.Version=0.28.4\" -X \"main.BuildTime=${BUILD_DATE}\"" \
  -o bin/step-ca ./cmd/...

The build log is available here:
https://download.copr.fedorainfracloud.org/results/patrickl/dev/fedora-43-x86_64/09669585-step-ca/builder-live.log.gz

FAIL snippets below:

Output:
...
=== RUN TestHandler_RevokeCert/ok/using-account-key
revoke_test.go:1097: '-1' and '0' are not equal
--- FAIL: TestHandler_RevokeCert (0.00s)
--- PASS: TestHandler_RevokeCert/fail/no-payload (0.00s)
--- PASS: TestHandler_RevokeCert/fail/prov.AuthorizeRevoke (0.00s)
--- PASS: TestHandler_RevokeCert/fail/ca.Revoke (0.00s)
--- PASS: TestHandler_RevokeCert/fail/no-account (0.00s)
--- PASS: TestHandler_RevokeCert/fail/nil-account (0.00s)
--- PASS: TestHandler_RevokeCert/fail/account-not-authorized (0.00s)
--- PASS: TestHandler_RevokeCert/fail/unauthorized-certificate-key (0.00s)
--- PASS: TestHandler_RevokeCert/fail/certificate-revoked-check-fails (0.00s)
--- PASS: TestHandler_RevokeCert/fail/certificate-already-revoked (0.00s)
--- FAIL: TestHandler_RevokeCert/ok/using-certificate-key (0.00s)
--- PASS: TestHandler_RevokeCert/fail/no-jws (0.00s)
--- PASS: TestHandler_RevokeCert/fail/nil-jws (0.00s)
--- PASS: TestHandler_RevokeCert/fail/no-provisioner (0.00s)
--- PASS: TestHandler_RevokeCert/fail/unmarshal-payload (0.00s)
--- PASS: TestHandler_RevokeCert/fail/wrong-certificate-encoding (0.00s)
--- PASS: TestHandler_RevokeCert/fail/no-certificate-encoded (0.00s)
--- PASS: TestHandler_RevokeCert/fail/account-not-valid (0.00s)
--- PASS: TestHandler_RevokeCert/fail/ca.Revoke-already-revoked (0.00s)
--- PASS: TestHandler_RevokeCert/fail/nil-provisioner (0.00s)
--- PASS: TestHandler_RevokeCert/fail/nil-payload (0.00s)
--- PASS: TestHandler_RevokeCert/fail/db.GetCertificateBySerial (0.00s)
--- PASS: TestHandler_RevokeCert/fail/different-certificate-contents (0.00s)
--- PASS: TestHandler_RevokeCert/fail/invalid-reasoncode (0.00s)
--- FAIL: TestHandler_RevokeCert/ok/using-account-key (0.00s)
...
--- PASS: TestWireIntegration (0.01s)
FAIL
...
FAIL github.com/smallstep/certificates/acme/api 0.091s
=== RUN TestDB_getDBAccount
...

Your Environment

• OS - Fedora 43 x86_64
• step-ca Version - 0.28.4

Expected Behavior

All tests PASS.

Actual Behavior

Some tests FAIL(ed)

Additional Context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[plaimbock]

Buildlog here:
builder-live.log.gz

[hslatman]

Hey @plaimbock, thank you for opening the issue.

The error seems to originate from https://github.com/smallstep/assert/blob/master/assert.go#L114, when called from https://github.com/smallstep/certificates/blob/master/acme/api/revoke_test.go#L1097 for the two "OK" test cases. It's interesting to see the values to be evaluated to -1 and 0, while a string slice gets passed to it, especially since it only happens on Fedora 43. That same assert.Equals is called in many more places with string slices, and those pass. I know that there are packages for some of our libraries on some Linux distributions, so maybe something's acting up there. It doesn't seem to occur on macOS with 1.25.1, and in our CI with 1.25.2 it also seems to pass as expected.

[plaimbock]

Hey @hslatman Thank you for your feedback. Since you mentioned golang 1.25.2 I did another build on Fedora 43 of 0.28.4 with golang-1.25.2. I don't see the "'-1' and '0' are not equal" message anymore so that's great. But I still see a number of FAILs.

The full aarch64 build log is here:
https://download.copr.fedorainfracloud.org/results/patrickl/step-ca/fedora-43-aarch64/09688379-step-ca/builder-live.log.gz

The full x86_64 buildl log is here:
https://download.copr.fedorainfracloud.org/results/patrickl/step-ca/fedora-43-x86_64/09688379-step-ca/builder-live.log.gz

[hslatman]

Interesting. It's the same test cases that are failing.