certsync activate phase hangs on buildslaves

[jmroot (Joshua Root)]

Example with the shortest log: ​https://build.macports.org/builders/buildports-snowleopard-x86_64/builds/19502

This means that nothing that depends on certsync, even indirectly, can be built.

[landonf (Landon Fuller)]

This would be locking up when executing SecItemExport; is there anything odd that the build server does to the execution environment?

[jmroot (Joshua Root)]

Well, it is a headless environment, which some other ports have problems with. Not sure if there's anything else unusual.

[cooljeanius (Eric Gallager)]

Cc Me!

[landonf (Landon Fuller)]

Replying to jmr@…:

Well, it is a headless environment, which some other ports have problems with. Not sure if there's anything else unusual.

It should work just fine headless; I admit I'm at a loss as to how to debug this without local system access. For it to fail at that point, the process would have to have blocked on one of the following:

• SecKeychainItemExport() or SecItemExport(), or
• -[NSData writeToFile:options:error]

Neither /should/ ever block, but the Sec* functions do speak to the keychain server.

The output file is written to ${prefix}/etc/openssl/cert.pem, but I assume that wouldn't be a problem on a build slave, and if it was, I don't know why it would simply block in the file write.

@wsiegrist, would it be possible to get a spinlock dump or backtrace on one of these blocked processes?

[danielluke (Daniel J. Luke)]

It might be generically useful if a recipe for setting up a VM that looks just like a buildslave were available too (so individual committers could set up something to debug things like this).

[landonf (Landon Fuller)]

certsync seems to be (magically) not hanging on the Mavericks buildbot, and I haven't gotten reports of it hanging for other releases. Perhaps we can revisit the use of certsync in subversion et al?

[danielluke (Daniel J. Luke)]

If it's still failing on any of the buildbots, we can't use it as the default dependency because it will cause those build(s) to fail. So, if it's still failing on the 10.8 buildbot, we can't use it without loosing 10.8 builds.

[landonf (Landon Fuller)]

I honestly have no idea how to tell if it's failing on any of the buildbots. The only reason I knew for certain it was working on the 10.9 buildbot is that someone did a forced full rebuild of all ports to generate packages.

[danielluke (Daniel J. Luke)]

You can force a build to test (and/or just check to see if there's a package available if it's distributable).

[landonf (Landon Fuller)]

Set the license properly and ... bingo: ​http://packages.macports.org/certsync/

[danielluke (Daniel J. Luke)]

Excellent!

[neverpanic (Clemens Lang)]

This no longer seems to be a problem.