Skip to content

test: add regression tests for issue #118 (error queue pollution)#926

Merged
boorad merged 1 commit into
mainfrom
test/issue-118-regression
Feb 15, 2026
Merged

test: add regression tests for issue #118 (error queue pollution)#926
boorad merged 1 commit into
mainfrom
test/issue-118-regression

Conversation

@boorad
Copy link
Copy Markdown
Collaborator

@boorad boorad commented Feb 15, 2026

Summary

Adds regression tests for #118sign() failing with "Failed to read private key" after calling other crypto operations due to OpenSSL error queue pollution.

Analysis: Why #118 Is Resolved

The original bug was caused by OpenSSL error queue pollution. OpenSSL maintains a per-thread error queue — when crypto operations like pbkdf2Sync() run, they can leave stale errors in the queue. If sign() then parses a private key without first clearing that queue, the stale errors cause EVP_PKEY parsing to fail with "Failed to read private key", even though the key is perfectly valid.

Since #118 was filed, the entire native layer has been rewritten. The fix is defensive ERR_clear_error() calls before every key parsing operation in KeyObjectData.cpp:

  • Line 38 — before TryParsePrivateKey() (PEM private key path)
  • Line 138 — before TryParsePrivateKey() in GetPublicOrPrivateKey() (PKCS8/SEC1/PKCS1 fallback)
  • Line 161 — before the second TryParsePrivateKey() attempt (PEM auto-detect path)
  • Line 239 — before TryParsePrivateKey() in GetPrivateKey() (DER private key path)

Additionally, the utility helper getOpenSSLError() now drains and clears the error queue after retrieving an error message, preventing residual pollution.

This directly addresses the root cause: no matter what crypto operations ran before sign(), the error queue is always clean when key parsing begins.

Changes

  • New test file example/src/tests/keys/sign_verify_error_queue.ts with 7 regression tests:
    • sign after pbkdf2Sync (repeated)
    • sign after createHash (repeated)
    • sign after createHmac (repeated)
    • sign after AES cipher/decipher (repeated)
    • sign after mixed crypto operations (repeated)
    • Ed25519 sign after mixed crypto operations
    • ECDSA sign after mixed crypto operations
  • Each test runs 10 iterations to catch intermittent error queue pollution
  • Registered test file in useTestsList.ts

Testing

Run the keys.sign/verify test suite in the example app. All 7 new tests should pass.

Closes #118

Add sign/verify tests that deliberately dirty the OpenSSL error queue
with pbkdf2, hash, hmac, and cipher operations before signing. Covers
RSA, Ed25519, and ECDSA key types with 10 iterations each to catch
intermittent failures.
@boorad boorad self-assigned this Feb 15, 2026
@github-actions
Copy link
Copy Markdown
Contributor

🤖 End-to-End Test Results - Android

Status: ✅ Passed
Platform: Android
Run: 22030039432

📸 Final Test Screenshot

Maestro Test Results - android

Screenshot automatically captured from End-to-End tests and will expire in 30 days


This comment is automatically updated on each test run.

@github-actions
Copy link
Copy Markdown
Contributor

🤖 End-to-End Test Results - iOS

Status: ✅ Passed
Platform: iOS
Run: 22030039436

📸 Final Test Screenshot

Maestro Test Results - ios

Screenshot automatically captured from End-to-End tests and will expire in 30 days


This comment is automatically updated on each test run.

@boorad boorad merged commit 5ec93b3 into main Feb 15, 2026
6 checks passed
@boorad boorad deleted the test/issue-118-regression branch February 15, 2026 05:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error: Failed to read private key

1 participant