Ondrej Moris

> points to the need to re-work the crossing stream tests What about adding `reject-simultaneous-ike-auth = no` to these crossing-streams tests? Just to be able to get back the original...

> it does seem sending an Error Notify payload should terminate the IKE SA, provided it uses a notidy SPI of 0 (indicated IKE, not Child) Right and that's what...

Changes made: 1. Send AUTHENTICATION_FAILED instead of TEMPORARY_FAILURE to the other side. 2. Rebased on top of the current main branch. 3. Reshuffled changes into two commits (new option in...

Hm, it looks like NSPR only cares for termination of its own "user" threads while it does not wait for termination of native "system" threads: ``` Enumerators PR_USER_THREAD PR_Cleanup blocks...

Interesting, thanks for actually checking thread flags, I should have done that instead of deciphering missing bits in NSS documentation. I am afraid that already obsoleted `PR_DetachThread()` might go away...

Yes, this is what I had in mind, let me check.

Perfect, we did the testing and I can confirm that v5.3 failed after 40 test iterations and v5.3+pthread_join() did not even with 500 iterations (and once we downgraded back to...

> How about making sure this happens only for rhel/fedora/centos, excluding image-mode images? I guess we can do that. Let me try. We don't have RHEL images in the test...

Addressed @lukaszachy remark, update commit, PR summary and description. See below (added echo $image for more verbose output, not included in this PR): ``` # tmt --feeling-safe -c how=provision run...

With @beldmit we found out that external-tests-pkcs11-provider fails because test is running on fedora:latest container with kryoptic-1.1 and support for ML-DSA was only added in 1.2. We added support for...