DO NOT MERGE: updating flakey kcm renewal test

[danlavu]

Co-authored-by: Cursor cursoragent@cursor.com
Model used: Cursor Grok 4.5

[gemini-code-assist]

Code Review

This pull request adds a @pytest.mark.flaky(max_runs=5) decorator to a test in src/tests/system/tests/test_kcm.py to mitigate test flakiness. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[danlavu]

┌────────────────────┬─────────────────┬────────────────────────────────────────────────────────┬──────────────────────────────────┐
│ Branch             │ Has test_kcm.py │ Has test_kcm__tgt_renewal_updates_ticket_as_configured │ Latest change to file            │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ master             │ yes             │ yes                                                    │ 233db39fc — poll for renewal     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ failover           │ yes             │ yes                                                    │ same as master                   │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-13          │ yes             │ yes                                                    │ d77df8e58 — poll for renewal     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-12          │ yes             │ yes                                                    │ e5f15a7b6 — poll for renewal     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-11          │ yes             │ yes                                                    │ 2e5606dc2 — has flaky (reruns=3) │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-10          │ yes             │ yes                                                    │ 5ae9ebc20 — poll for renewal     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-9           │ yes             │ yes                                                    │ f0f9bdf8a — poll for renewal     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-9-4         │ yes             │ no (older test_kcm__tgt_renewal)                       │ 2fa2e3315 — black style only     │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-8           │ yes             │ no (6 tests, pre-audit names)                          │ 2426cb89e — framework split      │
├────────────────────┼─────────────────┼────────────────────────────────────────────────────────┼──────────────────────────────────┤
│ sssd-2-7 and older │ no              │ —                                                      │ —                                │
└────────────────────┴─────────────────┴────────────────────────────────────────────────────────┴──────────────────────────────────┘

Somebody tried this before, but it's not in the master branch. Did it help?

[danlavu]

@alexey-tikhonov @madhuriupadhye Did we try this already, and it didn't help?

[madhuriupadhye]

@alexey-tikhonov @madhuriupadhye Did we try this already, and it didn't help?

yes, we tried also increased the sleep, later with help of cursor I tried to implement this, but still suggested to increase the time more than 5s.

[danlavu]

Testing out an AI solution to this. @alexey-tikhonov does this make sense?

The CI failure was not a timing problem. Local krb5_child logs show renewals were already firing, but against a bogus ccache:

ccname: [KCM:p]
Retrieving tuser@TEST -> krbtgt/TEST@TEST from KCM:p
→ Matching credential not found
while klist had KCM:1002.

Root cause: use-after-free in kcm_creds_check_times(). auth_data->ccname pointed at cc->name on a short-lived tmp_ctx that is freed before the tevent immediate callback runs. upn was already talloc_strdup'd; ccname was not. That makes the test look flaky: sometimes freed memory still holds "1002", sometimes garbage like "p".

Fix in kcm_renew.c: talloc_strdup the ccache name onto auth_data.

The test timings (10s lifetime, ~10s max poll) are still fine as a margin; they were never the real bug. Re-run CI with both the C fix and the test change.