Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Test failures on CTL parsing

Open
  • Is something wrong?
#257 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
rust
Domain
cryptography

Research direction

Start by running the listed x509::pkcs7::authenticode and x509::pkcs7::ctl::tests::create_ctl tests and inspect the FailedToParseCtl error for the Microsoft serialized trust list. Review the interim test disabling in #256 and compare the current CTL data with the parser's expectations. Done means the CTL parses successfully and the affected tests can be re-enabled and pass.

Written by the indexing model from the issue text.

Description

The following tests started failing:

x509::pkcs7::authenticode::test::full_validation_authenticode_signature_with_well_known_ca
x509::pkcs7::authenticode::test::full_validation_self_signed_authenticode_signature
x509::pkcs7::authenticode::test::full_validation_self_signed_authenticode_signature_with_only_leaf_certificate
x509::pkcs7::authenticode::test::full_validation_self_signed_authenticode_signature_with_root_and_leaf_certificate
x509::pkcs7::authenticode::test::self_signed_authenticode_signature_validation_against_ctl
x509::pkcs7::authenticode::test::self_signed_authenticode_signature_validation_against_ctl_with_excluded_ca_certificate
x509::pkcs7::authenticode::test::self_signed_authenticode_signature_validation_against_ctl_with_excluded_not_existing_ca_certificate
x509::pkcs7::ctl::tests::create_ctl

In all cases, the error is

panicked at 'called Result::unwrap() on an Err value: FailedToParseCtl(Cert(Asn1Deserialization { element: "pkcs7 certificate", source: InvalidData }))',

No commit in picky-rs can explain the regression; it's likely that something changed In Microsoft's serialized trust list. Although it's possible, I doubt the file is broken (it's used by Windows Update to update Windows' root certificates). Something in the current file is causing picky to choke.

As an interim measure, the tests were disabled in #256.

Dominant language
Rust
Stars
70
Forks
43
Avg merge
2d 12h
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Devolutions/picky-rs

All issues in Devolutions/picky-rs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.