Gentoo has stabilized LLVM 22 and bindgen needs some updates to support it; samael 0.0.20 updates bindgen to support this.
Unfortunately naively updating to either 0.0.20 or 0.0.21 causes integration test failures:
$ TMPDIR=/tmp/omicron chrt -i 0 cargo t --no-fail-fast -E 'package(omicron-nexus)' -j 8 -- integration_tests::saml
info: experimental features enabled: setup-scripts, benchmarks
Finished `test` profile [unoptimized + debuginfo] target(s) in 0.78s
Finished `test` profile [unoptimized + debuginfo] target(s) in 0.36s
Running `target/debug/crdb-seed`
Jun 30 14:01:32.550 INFO Using existing CRDB seed tarball: `/tmp/omicron/crdb-base-iliana/c3b7c01f2493b97eda0295f026efab0028f50f05960a99f96b507dcfec8612fa.tar`
SETUP PASS [ 0.416s] crdb-seed: cargo run -p crdb-seed --profile test
FAIL [ 0.026s] omicron-nexus::test_all integration_tests::saml::test_accept_saml_response_only_assertion_signed
stdout ───
running 1 test
test integration_tests::saml::test_accept_saml_response_only_assertion_signed ... FAILED
failures:
failures:
integration_tests::saml::test_accept_saml_response_only_assertion_signed
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.00s
stderr ───
thread 'integration_tests::saml::test_accept_saml_response_only_assertion_signed' (200780) panicked at nexus/tests/integration_tests/saml.rs:928:10:
called `Result::unwrap()` on an `Err` value: HttpError { status_code: 400, error_code: None, external_message: "assertion is missing signature!", internal_message: "assertion is missing signature!", headers: None }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
PASS [ 0.028s] omicron-nexus::test_all integration_tests::saml::test_correct_saml_response_with_group_attributes_wrong_attribute_name
PASS [ 0.029s] omicron-nexus::test_all integration_tests::saml::test_correct_saml_response_with_group_attributes
PASS [ 0.030s] omicron-nexus::test_all integration_tests::saml::test_correct_saml_response
PASS [ 0.031s] omicron-nexus::test_all integration_tests::saml::test_correct_saml_response_ecdsa_sha256
FAIL [ 0.030s] omicron-nexus::test_all integration_tests::saml::test_handle_saml_response_with_xml_comment
stdout ───
running 1 test
test integration_tests::saml::test_handle_saml_response_with_xml_comment ... FAILED
failures:
failures:
integration_tests::saml::test_handle_saml_response_with_xml_comment
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.01s
stderr ───
thread 'integration_tests::saml::test_handle_saml_response_with_xml_comment' (200828) panicked at nexus/tests/integration_tests/saml.rs:1033:16:
expected validation to succeed: HttpError { status_code: 400, error_code: None, external_message: "could not extract SAMLResponse assertion! SAML Response and all assertions must be signed", internal_message: "could not extract SAMLResponse assertion! SAML Response and all assertions must be signed", headers: None }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
PASS [ 9.683s] omicron-nexus::test_all integration_tests::saml::test_create_a_saml_idp_invalid_descriptor_truncated
PASS [ 0.035s] omicron-nexus::test_all integration_tests::saml::test_reject_saml_response_signed_with_other_key
PASS [ 0.024s] omicron-nexus::test_all integration_tests::saml::test_reject_unsigned_saml_response
PASS [ 9.989s] omicron-nexus::test_all integration_tests::saml::test_create_a_saml_idp_metadata_no_keys
PASS [ 10.030s] omicron-nexus::test_all integration_tests::saml::test_create_a_saml_idp_invalid_descriptor_no_redirect_binding
PASS [ 10.159s] omicron-nexus::test_all integration_tests::saml::test_create_a_saml_idp_metadata_only_encryption_keys
PASS [ 10.224s] omicron-nexus::test_all integration_tests::saml::test_create_a_saml_idp
PASS [ 10.326s] omicron-nexus::test_all integration_tests::saml::test_create_a_hidden_silo_saml_idp
PASS [ 10.548s] omicron-nexus::test_all integration_tests::saml::test_post_saml_response_with_relay_state
PASS [ 10.952s] omicron-nexus::test_all integration_tests::saml::test_post_saml_response
PASS [ 7.401s] omicron-nexus::test_all integration_tests::saml::test_saml_idp_reject_keypair
PASS [ 7.912s] omicron-nexus::test_all integration_tests::saml::test_saml_idp_metadata_url_404
PASS [ 7.674s] omicron-nexus::test_all integration_tests::saml::test_saml_idp_rsa_keypair_ok
PASS [ 7.929s] omicron-nexus::test_all integration_tests::saml::test_saml_idp_metadata_url_invalid
────────────
Summary [ 18.369s] 20 tests run: 18 passed, 2 failed, 860 skipped
FAIL [ 0.026s] omicron-nexus::test_all integration_tests::saml::test_accept_saml_response_only_assertion_signed
FAIL [ 0.030s] omicron-nexus::test_all integration_tests::saml::test_handle_saml_response_with_xml_comment
error: test run failed
0.0.19...0.0.201: njaremko/samael@9d11d73...02ee0dd (problem likely introduced in this range)
0.0.20...0.0.21: njaremko/samael@02ee0dd...5b187c1
Gentoo has stabilized LLVM 22 and bindgen needs some updates to support it; samael 0.0.20 updates bindgen to support this.
Unfortunately naively updating to either 0.0.20 or 0.0.21 causes integration test failures:
0.0.19...0.0.201: njaremko/samael@9d11d73...02ee0dd (problem likely introduced in this range)
0.0.20...0.0.21: njaremko/samael@02ee0dd...5b187c1
Footnotes
maybe,i checked the diff and they are not relevant to the rust code ↩.cargo_vcs_info.jsonin the crate says 0.0.20 was published with a dirty tree