Multiple test-failures on FreeBSD-14

[UnitedMarsupials]

Freshly built against on FreeBSD-14/amd64, using the stock OpenSSL-3.0.16, I get the following test-failures:

• BadSSL-1.10 dh composite FAILED
• BadSSL-1.17 dh1024 FAILED
• BadSSL-1.33 no sct FAILED
• tlsIO-9.1 testing spurious (0 byte read) events FAILED

The failures are the same regardless of whether TCL-8.6 or 9.0 is used. Attaching test-logs. Please, advise.

test-8.6.log
test-9.0.log

P.S. I'd also like to point out, that hardcoding a port-number -- such as the 8831 -- to use on localhost is not safe: there could be spurious test-failures because that port could be used by something else. The port should be determined dynamically during the test's runtime.

[bohagan1]

Those failures aren't an issue. Since you are using an older version of OpenSSL, it has looser requirements for what is allowed. For 1.33, the BadSSL server has an old certificate. They will fix it at some point. The TclTLS-9.1 failure is a known issue due to fixing the I/O stalling issues. So you're good.

Most of the test cases are very old, so one of these days I'll get around to updating them.

[UnitedMarsupials]

Those failures aren't an issue.

Respectfully, they are an issue -- the failures prevent automatic testing post-build. If the tests are old, they should be removed -- or, at least, disabled. If they depend on the OpenSSL version, they should be made conditional.

But it should be possible -- for any software capable of testing itself -- to invoke the tests automatically to verify, that the just-built binaries are valid...

[bohagan1]

They aren't old tests, I just don't control the BadSSL website and when they decide to renew their certificates nor OpenSSL and what/when they obsolete certain functions. Let me see what I can do.

[bohagan1]

All test failures should be corrected now. It was a clean test for me on 14.1. Didn't have a chance to try with 14.3 or 15.0 yet. Let me know if you still see any test failures. Thanks.

[UnitedMarsupials]

All test failures should be corrected now. It was a clean test for me on 14.1.

Awesome. I'll try refreshing the port this weekend and report :) Is it fair to say, this GitHub repository now is the source of TCLTLS, not the earlier one? Or do you consider yours to be a fork?

Thank you!

[bohagan1]

They are kept in sync. The core.tcl-lang.org site is the official version.

[UnitedMarsupials]

I see, that source file is now named tcltls-2.0-src.tar.gz, which is a departure from the traditional naming scheme (which had no -src suffix). Also, inside the tarball is the directory named tcltls-20260121024900-5d3e3c3bf8/ -- rather than the expected tcltls-2.0/.

I dealt with both issues, ran ./configure with --with-openssl-dir=/usr --enable-ssl-fastpath --disable-rpath --with-tcl8 --exec-prefix=/opt --with-tcl=/opt/lib/tcl9.0 --with-tclinclude=/opt/include/tcl9.0 --prefix=/opt:

checking TEA configuration... ok (TEA 3.13)
configure: configuring tls 2.0
checking system version... FreeBSD-14.3-STABLE
checking for Tcl configuration... found /opt/lib/tcl9.0/tclConfig.sh
checking for gcc... cc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether cc accepts -g... yes
checking for cc option to enable C11 features... none needed
checking for existence of /opt/lib/tcl9.0/tclConfig.sh... loading
...

The subsequent build succeeded, but created only one library -- with 9.0 stubs:

--- libtls2.0.so ---
rm -f libtls2.0.so
cc -O2 -pipe -march=sandybridge  -fstack-protector-strong -fno-strict-aliasing  -pipe  -O2 -fomit-frame-pointer -DNDEBUG -Wall -fPIC  -shared -Wl,--export-dynamic  -o libtls2.0.so tls.o tlsBIO.o tlsIO.o tlsX509.o -L/usr/lib -lssl -lcrypto -L/opt/lib -ltclstub9.0
: libtls2.0.so

Unfortunately, the testing fails, because it attempts to load a differently-named library:

===>  Testing for tcltls-2.0
TCL_LIBRARY=`echo /opt/include/tcl9.0/library` LD_LIBRARY_PATH="/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8:/opt/lib/tcl9.0:"  PATH="/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8:/opt/lib/tcl9.0:/usr/bin:/opt/libexec/ccache:/n/home/ports/devel/tcltls/work/.bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/opt/sbin:/opt/bin:/home/mi/bin"  TCLLIBPATH="/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8" /opt/bin/tclsh9.0 `echo ./tests/all.tcl`   -load "package ifneeded tls 2.0  [list load libtls2.0.so [string totitle tls]];  source ./library/tls.tcl"
couldn't load file "/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8/libtcl9tls2.0.so": Cannot open "/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8/libtcl9tls2.0.so"
    while executing
"load [file join $dir libtcl9tls2.0.so] [string totitle tls]"
    (lambda term "{dir} {
        # Load library
        load [file join $dir libtcl9tls2.0...." line 3)
    invoked from within
"apply {{dir} {
        # Load library
        load [file join $dir libtcl9tls2.0.so] [string totitle tls]

        # Source init file
        set initScript [file join $dir tls.t..."
    ("package ifneeded tls 2.0" script)
    invoked from within
"package require tls"
    (file "/n/home/ports/devel/tcltls/work/tcltls-20260121024900-5d3e3c3bf8/tests/common.tcl" line 5)
    invoked from within
"source -encoding utf-8 [file join $path common.tcl]"
    invoked from within
"if {[file exists [file join $path common.tcl]]} {
    source -encoding utf-8 [file join $path common.tcl]
}"
    (file "./tests/all.tcl" line 25)

Looking inside the pkgIndex.tcl, I see, that two different libraries are expected to be present -- and loaded depending on the version of the executing tclsh. But only one is built -- regardless of whether I use --with-tcl8 with ./configure.

[bohagan1]

I added the "-src" suffix like TCL uses to better distinguish from the windows compiled file. I can put it back that's an issue. I used the fossil snapshot to create the file so it would have the right info for the build info, but missed removing the extra directory path. Sorry about that.

The configure/build process will only build one version at a time. Since you used the --with-tcl8 option, only that version will be built (libtls2.0.so). You need to do a 'make clean', then run configure again without that option to build the TCL 9 version (libtcl9tls2.0.so). You must do the make clean and rerun the configure script for it to work. Without that you'll still get the TCL 8 version.

[UnitedMarsupials]

Sorry about that.

No problem -- one can argue for both sides of this particular decision tree. My problem -- as much as it is -- was the inconsistency with the previous releases. Pick whichever approach you prefer -- as long as you stick with it :)

The configure/build process will only build one version at a time. Since you used the --with-tcl8 option, only that version will be built (libtls2.0.so).

If only a single version of the library is built anyway, why have the --with-tcl8 at all? I thought, the TCL-version is discerned from the tclConfig.sh -- and that, by adding --with-tcl8, I request a second flavor of the library.

So, there is no way to build two versions in one go, is there? If so, I'll need to split the port into two "flavors"...

But, at any rate, whether I use the --with-tcl8 or not, I get libtls2.0.so -- and the tests fail, because they are looking for libtcl9tls2.0.so. I imagine, pkgIndex.tcl will fail too...

For example, with flags of --with-openssl-dir=/usr --enable-ssl-fastpath --disable-rpath --without-tcl8 --exec-prefix=/opt --with-tcl=/opt/lib/tcl9.0 --with-tclinclude=/opt/include/tcl9.0 --prefix=/opt, I still get the libtls2.0.so, not the libtcl9tls2.0.so.

[UnitedMarsupials]

It looks like the --without-tcl8 is the culprit -- it causes the library name to be libtls2.0.so, even when building against TCL-9.x...

Back to testing, I'm happy to report, the tests against both TCL-8.6 and 9.0 pass now:

Tests ended at Sun Feb 01 19:55:17 EST 2026
all.tcl:        Total   186 Passed 120 Skipped 66 Failed 0
Sourced 5 Test Files.
Number of tests skipped for each constraint:
        17      OpenSSL1.1.1
        14      OpenSSL3.2
        12      doTestsWithRemoteServer
        3       mac
        3       ssl2
        3       ssl3
        1       testthread
        2       unexplainedFailure
        1       unix !mac
        2       unix !mac OpenSSL3.2
        7       win
        1       win !OpenSSL1.1.1

[bohagan1]

Thanks for the report. Good to hear it works now. I don't use the --without-tcl8 option, so good to hear that works for you too. You'll have to ask on the TCL Core Distro list why the --with-tcl8 and --without-tcl8 options work the way they do. It's all part of the TEA build scripts.