go1.18: [Tracker] go1.18 breaks CSR validation (fix pending in go1.18.1)

[MadhavJivrajani]

Which jobs are failing?

https://testgrid.k8s.io/sig-release-master-blocking#integration-master

Which tests are failing?

https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/108905/pull-kubernetes-integration/1506459579091783680
an instance of a failure, the tests here are the ones failing

Since when has it been failing?

My guess is since #108870 was merged

Testgrid link

https://testgrid.k8s.io/sig-release-master-blocking#integration-master

Reason for failure (if possible)

https://tip.golang.org/doc/go1.18#sha1

Anything else we need to know?

No response

Relevant SIG(s)

/sig testing

[MadhavJivrajani]

/priority critical-urgent
/cc @dims @aojea

[nikhita]

https://tip.golang.org/doc/go1.18#sha1

The failures for https://testgrid.k8s.io/sig-release-master-blocking#integration-master look like they are related to this.

Example below:

x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)

[MadhavJivrajani]

/assign

[aojea]

So, presubmits jobs didn't catch these things?

[MadhavJivrajani]

A temporary fix, quick fix would be setting the env variable as suggested:

GODEBUG=x509sha1=1

Continuing to look
/sig auth
(for visibility)

[MadhavJivrajani]

So, presubmits jobs didn't catch these things?

yeah, I'm wondering this too

[aojea]

it seems golang has to do a minor release golang/go#41682 (comment), they are being too strict and sha1 in signatures seems to be allowed

https://go-review.googlesource.com/c/go/+/394294/3/src/crypto/x509/x509.go