From a7a0d7687de1cae23ffd9e039037c82037e4b97a Mon Sep 17 00:00:00 2001
From: Michal Nowak <mnowak@isc.org>
Date: Thu, 21 May 2026 06:32:23 +0200
Subject: [PATCH 1/2] Add Debian "trixie" (386)

(cherry picked from commit b076c43b1c8bb9b32f5c4d049acfa0b859f4c3eb)
---
 .gitlab-ci.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5e42957f0d..49fb9e6b35 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -211,6 +211,10 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-trixie-amd64cross32"
   <<: *linux_amd64
 
+.debian-trixie-386: &debian_trixie_386_image
+  image: "$CI_REGISTRY_IMAGE:debian-trixie-386"
+  <<: *linux_amd64
+
 .debian-sid-amd64: &debian_sid_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
   <<: *linux_amd64
@@ -1308,6 +1312,33 @@ gcc:trixie:amd64cross32:
   <<: *debian_trixie_amd64cross32_image
   <<: *build_job
 
+# Jobs for regular GCC builds on Debian 13 "trixie" (386)
+
+gcc:trixie:386:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_trixie_386_image
+  <<: *build_job
+
+system:gcc:trixie:386:
+  <<: *debian_trixie_386_image
+  <<: *system_test_job
+  <<: *extra_system_tests_triggering_rules
+  needs:
+    - job: gcc:trixie:386
+      artifacts: true
+
+unit:gcc:trixie:386:
+  <<: *debian_trixie_386_image
+  <<: *unit_test_job
+  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:trixie:386
+      artifacts: true
+
+
 # Jobs for regular GCC builds on Debian "sid" (amd64)
 # Also tests configration option: --without-lmdb.
 

From 3584c03e3f9569907dcf1ae5b2f2521298bcc2a1 Mon Sep 17 00:00:00 2001
From: Michal Nowak <mnowak@isc.org>
Date: Thu, 21 May 2026 07:31:15 +0000
Subject: [PATCH 2/2] Tolerate dnspython post-2038 timestamp overflow on 32-bit

dnspython's RRSIG.to_text() converts the signature inception/expiration
fields by calling time.gmtime(), which on 32-bit platforms raises
OverflowError for values past 2038-01-19 (INT32_MAX). Several DNSSEC
test fixtures use far-future expirations: the precomputed RRSIGs in
the dnssec test's rsasha1.example.db.in zone expire in 2093, ans4 of
the chain test hardcodes 2090, and ans10 of the dnssec test uses
2**32-1 (year 2106). Whenever a response carrying such an RRSIG is
formatted with str()/to_text() the overflow propagates out and either
fails the test (when triggered in isctest.query's debug logging) or
kills the asyncserver-based ans* server (when triggered in its
response logger), which in turn cascades into "Failed to stop
servers" teardown errors and SERVFAIL responses for subsequent tests.

Wrap the to_text() calls in isctest/query.py and the str(response)
call in asyncserver's _log_response() with try/except OverflowError,
falling back to a placeholder message. The conversions are only used
for debug logging, so losing the human-readable form there does not
affect what the tests actually validate.

Assisted-by: Claude:claude-opus-4-7

(cherry picked from commit 968ccdeeda3f258d00b01064bbfd84d612079a11)
---
 bin/tests/system/isctest/asyncserver.py |  6 +++++-
 bin/tests/system/isctest/query.py       | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/bin/tests/system/isctest/asyncserver.py b/bin/tests/system/isctest/asyncserver.py
index 080c08c380..5942129474 100644
--- a/bin/tests/system/isctest/asyncserver.py
+++ b/bin/tests/system/isctest/asyncserver.py
@@ -1321,8 +1321,12 @@ class AsyncDnsServer(AsyncServer):
                 qctx.socket,
                 qctx.protocol.name,
             )
+            try:
+                response_text = str(response)
+            except OverflowError:
+                response_text = "<response not representable as text>"
             logging.debug(
-                "\n".join([f"[OUT] {l}" for l in [""] + str(response).splitlines()])
+                "\n".join([f"[OUT] {l}" for l in [""] + response_text.splitlines()])
             )
             return
 
diff --git a/bin/tests/system/isctest/query.py b/bin/tests/system/isctest/query.py
index 4f4e0a7c45..14a8027be6 100644
--- a/bin/tests/system/isctest/query.py
+++ b/bin/tests/system/isctest/query.py
@@ -38,6 +38,17 @@ def generic_query(
     log_response: bool = True,
 ) -> Any:
 
+    def _safe_to_text(msg: dns.message.Message) -> str:
+        """
+        Convert a DNS message to text, tolerating dnspython's failure to render
+        RRSIG inception/expiration timestamps that overflow the platform's
+        time_t (e.g. post-2038 values on 32-bit systems).
+        """
+        try:
+            return msg.to_text()
+        except OverflowError:
+            return "<message not representable as text>"
+
     def log_querymsg(exception: Exception | None = None) -> None:
         """
         Helper for logging query message. Call this *after* query_func() has
@@ -48,7 +59,7 @@ def generic_query(
         nonlocal log_query
         if log_query:
             isctest.log.debug(
-                f"isc.query.{query_func.__name__}(): query\n{message.to_text()}"
+                f"isc.query.{query_func.__name__}(): query\n{_safe_to_text(message)}"
             )
             log_query = False  # only log query once
 
@@ -79,7 +90,7 @@ def generic_query(
         if res:
             if log_response:
                 isctest.log.debug(
-                    f"isc.query.{query_func.__name__}(): response\n{res.to_text()}"
+                    f"isc.query.{query_func.__name__}(): response\n{_safe_to_text(res)}"
                 )
             if res.rcode() == expected_rcode or expected_rcode is None:
                 return res