Re: BUG #19815: 004_sni.pl fails deterministically with OpenSSL 1.1.1 (tests 75 and 86)

> On 31 Oct 2026, at 01:28, Michael Paquier <michael(at)paquier(dot)xyz> wrote:
>
> On Fri, Oct 30, 2026 at 12:47:17PM -0700, Jacob Champion wrote:
>> 1.1.1o apparently fixes the mapping behavior, which is why I didn't
>> see it locally... It's easy enough to add an alternative expected
>> message to the tests, but why aren't our RHEL 8 buildfarm machines
>> complaining?
>
> Perhaps they're already patched or reflect some specific RHEL
> behavior. If the diff of output can be fixed by upgrading OpenSSL,
> I'd suggest to upgrade OpenSSL on the buildfarm host, not touch
> Postgres to adapt to it, especially as everybody should be out of
> 1.1.1 these days.

I've built and tested old versions of OpenSSL to confirm the behaviour, and
1.1.1n and newer does indeed pass the tests. OpenSSL 1.1.1n is 4 years old,
and 1.1.1 is 3 years out of support, so I too don't see a compelling reason to
carry an alternative output file which risk masking other bugs, or patch libpq,
when the real solution is to upgrade OpenSSL.

If we suddenly get RHEL8 machines running the SSL tests, with ancient OpenSSL
versions, in the buildfarm we might have to revisit.

--
Daniel Gustafsson