ECDSA_Sign test was recently added in https://crrev.com/c/1401975 as a part of ECC keys support in chaps. After that several more related CLs have landed, and more are still pending.

In the failed test VerifyFinal for CKM_ECDSA_SHA1 returns CKR_SIGNATURE_LEN_RANGE.

Meng-Huan, please take a look.

I cannot find any CL that is likely to have broken that unit test.  Also what would be so special about nami?  I am calling it a flake.

CHUMP | ec | gwendal | 1423597
CHUMP | kernel | mak.chopra | 1423689
CHUMP | kernel | c_mkenna | 1420245
CHUMP | overlay-octopus-private | teravest | 801141
tast-tests | gbiv | 1413873 | fails:15 | platform: disable the mlock tast on some platforms
platform2 | zentaro | 1357730 | fails:4 | oobe_config: Add secomp filters
chromiumos-overlay | gwink | 1398513 | fails:0(4) | policy_utils: Add package policy_utils to dev/test build for all boards
adhd | paulhsia | 1314277 | fails:3 | CRAS: cras_server_socket module for CrasServerSocket
hdctools | dlaurie | 1409756 | fails:3 | sarien: Fix servo power state control
tast | gbiv | 1415684 | fails:3 | local_test_runner: add the transparent_hugepage feature
adhd | paulhsia | 1341709 | fails:2 | CRAS: audio_socket module for audio message
autotest | lgoodby | 1407928 | fails:2 | sysinfo: Add fifos to unit test
chromiumos-overlay | lakshmana | 1409851 | fails:2 | Import quipper from github.
chromite | dhanyaganesh | 1410159 | fails:1(2) | TriageRelevantChanges: Use buildstore instead of cidb handle
autotest | ayatane | 1395761 | fails:1 | autotest: Remove unused function run_special_task_actions
autotest | fshao | 1410772 | fails:1 | platform_KernelVersionByBoard: kukui on 4.19
autotest | gwendal | 1417090 | fails:1 | hardware_StorageQualBase : Add 4k 1qd random read/write test
autotest | kalin | 1419242 | fails:1 | Add input playback tests to touch suite only.
autotest-cheets | kcwu | *796237 | fails:1 | cheets_GTS: add control file to run single test.
board-overlays | hidehiko | 1414530 | fails:1 | Reland "Update ebuild files for platform/arc-camera -> platform2/camera migra...
board-overlays | manojgupta | 1422539 | fails:1 | amd64-generic: Drop gbm use from mesa.
chromite | dburger | 1422257 | fails:1 | Remove weave from SiteParams
coreboot | pgeorgi | 1418803 | fails:1 | UPSTREAM: src/mainboard/google/sarien: query recovery mode from Cr50
coreboot | pgeorgi | 1418804 | fails:1 | UPSTREAM: soc/intel/icelake: Fix AG3E programming in PMC
coreboot | pgeorgi | 1418805 | fails:1 | UPSTREAM: soc/intel/cannonlake: Change in SaGv options
coreboot | pgeorgi | 1418806 | fails:1 | UPSTREAM: mb/google/hatch: Configure miscellaneous features
coreboot | pgeorgi | 1418807 | fails:1 | UPSTREAM: lib/libgcc.c: Fix shift warnings
coreboot | pgeorgi | 1418808 | fails:1 | UPSTREAM: tss/tcg-2.0: remove unnecessary break from marshaling code
coreboot | pgeorgi | 1418809 | fails:1 | UPSTREAM: console/init: Print log level in coreboot banner
coreboot | pgeorgi | 1418810 | fails:1 | UPSTREAM: cpu/intel/car: Remove unneeded white space
coreboot | pgeorgi | 1418811 | fails:1 | UPSTREAM: soc/intel/cannonlake: drop extra newline
coreboot | pgeorgi | 1418812 | fails:1 | UPSTREAM: superio/nsc: fix IO masks
coreboot | pgeorgi | 1418813 | fails:1 | UPSTREAM: vendorcode/{amd,cavium,intel}: Remove trailing whitespace
coreboot | pgeorgi | 1418814 | fails:1 | UPSTREAM: sb/intel/i82801gx: Implement PCIe coalescing
coreboot | pgeorgi | 1418815 | fails:1 | UPSTREAM: mb/kontron/986lcd-m: Implement disabling ethernet NIC in ramstage
coreboot | pgeorgi | 1418816 | fails:1 | UPSTREAM: mb/lenovo/x220: Add x1 as a variant
ec | caveh | 1407245 | fails:1 | atlas: only apply internal EC_WP_L pullup when needed
ec | gwendal | 1412641 | fails:1 | ec_commands: Fix errors spotted by kernel checkpatch
ec | yllin | 1416074 | fails:1 | kukui: Fix adc read crashes EC.
kernel | shirish.s-AT-amd.com | 1415243 | fails:1 | FROMGIT/BACKPORT: x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0...
kernel | shirish.s-AT-amd.com | 1415244 | fails:1 | FROMGIT/BACKPORT: x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk
platform2 | baileyberro | 1413494 | fails:1 | oobe_config: Use correct logging levels in FinishRestore
platform2 | lgcheng | 1418991 | fails:1 | sepolicy: label usb device correctly for non nyc build.
virtual-usb-printer | valleau | 1413292 | fails:0(1) | virtual-usb-printer: Adding ability to write received files
autotest | xixuan | 1418989 | autotest: Rename duplicated test names in suite:chrome-informational.
chromite | nmasti | 1413672 | group_baseline: set uid and gid to be identical
chromite | dburger | 1422258 | Remove deprecated KAYLE from site params
chromite | saklein | 1422547 | build api: Simplify BuildTarget proto
chromiumos-overlay | chadversary | 1315771 | dev-lang/python-3.6.5: Add 3.6 alongside 3.4
chromiumos-overlay | manojgupta | 1413780 | lld: CherryPick r351186.
chromiumos-overlay | hidehiko | 1414511 | camera: Reland "camera: Migrate platform/arc-camera into platform2/camera."
chromiumos-overlay | paulhsia | 1421297 | dev-rust: Add ebuilds for byteorder and related crates
chromiumos-overlay | paulhsia | 1421299 | dev-rust: Add ebuilds for protobuf and related crates
chromiumos-overlay | paulhsia | 1421300 | dev-rust: Add ebuilds for protoc-rust and related crates
chromiumos-overlay | paulhsia | 1421301 | dev-rust: Add ebuilds for pkg-config and related crates
chromiumos-overlay | paulhsia | 1421302 | dev-rust: Add ebuilds for num_cpus crates
chromiumos-overlay | allenwebb | 1421859 | chromeos: Add elt-patches to packages.provided for new libtool.eclass
chromiumos-overlay | ahassani | 1422537 | eclass: Remove traces of mario from appid.eclass
chromiumos-overlay | manojgupta | 1422538 | virglrenderer: Switch to minibgm for fuzzer builds.
chromiumos-overlay | sonnysasaka | 1422637 | bluetooth: Install newblued upstart script
crosutils | bingxue | 1419293 | Mask out /usr/include/tensorflow for image
crosvm | jkwang | 1320429 | sys_util: refactor pollcontext to decouple events from epoll fd.
ec | allenwebb | 1418250 | Revert "Remove fuzzer test runs from buildall."
ec | dzigterman | 1419123 | LSM6: Follow ODR change procedure from application notes
ec | jettrink | 1422057 | cleanup/ish: update copyright header to style
ec | aaboagye | 1422460 | nocturne: Check IRQ and HPD in DPStatus message.
ec | dzigterman | 1423123 | LSM6: Throw out junk data after ODR changes
gdisp | jintao | *801391 | Beautify proto string printout in gdisp-perf
kernel | dianders | 1330711 | CHROMIUM: scripts: Account for clang in the kernel config scripts
kernel | dianders | 1330712 | CHROMIUM: config: Normalize (clang vs gcc)
kernel | thgarnie | 1379655 | BACKPORT: FROMLIST: audit: add container id
kernel | cujomalainey | 1410622 | UPSTREAM: ASoC: vc4_hdmi: replace codec to component
kernel | cujomalainey | 1410623 | UPSTREAM: ASoC: wm8903: replace codec to component
kernel | cujomalainey | 1410624 | UPSTREAM: ASoC: wm8960: replace codec to component
kernel | cujomalainey | 1410625 | UPSTREAM: ASoC: sirf-audio: replace codec to component
kernel | cujomalainey | 1410626 | UPSTREAM: ASoC: pcm3168a: replace codec to component
kernel | cujomalainey | 1410627 | UPSTREAM: ASoC: wm8510: replace codec to component
kernel | cujomalainey | 1410628 | UPSTREAM: ASoC: cs4270: replace codec to component
kernel | cujomalainey | 1410629 | UPSTREAM: ASoC: wm8978: replace codec to component
kernel | cujomalainey | 1410630 | UPSTREAM: ASoC: mc13783: replace codec to component
kernel | cujomalainey | 1410631 | UPSTEAM: ASoC: wm8955: replace codec to component
kernel | cujomalainey | 1410632 | UPSTREAM: ASoC: wm8900: replace codec to component
kernel | cujomalainey | 1410633 | UPSTREAM: ASoC: cx20442: replace codec to component
kernel | cujomalainey | 1410634 | UPSTREAM: ASoC: rt5631: replace codec to component
kernel | cujomalainey | 1410635 | UPSTREAM: ASoC: cs42l42: replace codec to component
kernel | cujomalainey | 1410636 | UPSTREAM: ASoC: rt5616: replace codec to component
kernel | cujomalainey | 1410637 | UPSTREAM: ASoC: cs42l73: replace codec to component
kernel | cujomalainey | 1410638 | UPSTREAM: ASoC: wm8974: replace codec to component
kernel | cujomalainey | 1410639 | UPSTREAM: ASoC: msm8916-wcd-digital: replace codec to component
kernel | cujomalainey | 1410640 | UPSTREAM: ASoC: ad73311: replace codec to component
kernel | cujomalainey | 1410641 | UPSTREAM: ASoC: wm8750: replace codec to component
kernel | cujomalainey | 1410642 | UPSTREAM: ASoC: wm8400: replace codec to component
kernel | cujomalainey | 1410643 | UPSTREAM: ASoC: wm5100: replace codec to component
kernel | cujomalainey | 1410644 | UPSTREAM: ASoC: sta32x: replace codec to component
kernel | cujomalainey | 1410645 | FIXUP: ASoC: sta32x: set ->component pointer in private struct
kernel | cujomalainey | 1410646 | UPSTREAM: ASoC: cs42l51: replace codec to component
kernel | cujomalainey | 1410647 | UPSTREAM: ASoC: es7134: replace codec to component
kernel | cujomalainey | 1410648 | UPSTREAM: ASoC: ak5386: replace codec to component
kernel | cujomalainey | 1410649 | UPSTREAM: ASoC: ssm2518: replace codec to component
kernel | cujomalainey | 1410650 | UPSTREAM: ASoC: stac9766: replace codec to component
kernel | cujomalainey | 1410651 | UPSTREAM: ASoC: wm8524: replace codec to component
kernel | cujomalainey | 1410652 | UPSTREAM: ASoC: cs4271: replace codec to component
kernel | cujomalainey | 1410653 | UPSTREAM: ASoC: uda134x: replace codec to component
kernel | cujomalainey | 1410654 | UPSTREAM: ASoC: wm8731: replace codec to component
kernel | cujomalainey | 1410655 | UPSTREAM: ASoC: wm8904: replace codec to component
kernel | cujomalainey | 1410656 | UPSTREAM: ASoC: tlv320aic3x: replace codec to component
kernel | cujomalainey | 1410657 | UPSTREAM: ASoC: pcm5102a: replace codec to component
kernel | cujomalainey | 1410658 | UPSTREAM: ASoC: 88pm860x: replace codec to component
kernel | cujomalainey | 1410659 | UPSTREAM: ASoC: wm8961: replace codec to component
kernel | cujomalainey | 1410660 | UPSTREAM: ASoC: cs35l34: replace codec to component
kernel | cujomalainey | 1410661 | UPSTREAM: ASoC: wm8727: replace codec to component
kernel | cujomalainey | 1410662 | UPSTREAM: ASoC: wm8728: replace codec to component
kernel | cujomalainey | 1410663 | UPSTREAM: ASoC: wm8985: replace codec to component
kernel | cujomalainey | 1410664 | UPSTREAM: ASoC: alc5623: replace codec to component
kernel | groeck | 1416554 | CHROMIUM: Merge 'v4.19.16' into chromeos-4.19
kernel | groeck | 1416561 | CHROMIUM: Merge 'v4.14.94' into chromeos-4.14
kernel | groeck | 1416562 | CHROMIUM: Merge 'v4.4.171' into chromeos-4.4
kernel | dianders | 1422486 | BACKPORT: FROMLIST: arm64: dts: sdm845: Add gpu and gmu device nodes
kernel | dianders | 1422487 | FIXUP: FROMLIST: arm64: dts: sdm845: Add gpu and gmu device nodes (address-ce...
kernel | dianders | 1422488 | FROMLIST: arm64: dts: sdm845: Add interconnect for GPU
kernel | dianders | 1422864 | CHROMIUM: config: Normalize (KCOV, CC_HAS_SANCOV_TRACE_PC)
kernel | dianders | 1423121 | FROMLIST: drm/msm/a6xx: Add support for an interconnect path
kernel | dianders | 1423122 | FROMLIST: dt-bindings: drm/msm/a6xx: Document interconnect properties for GPU
manifest-internal | derekgr | *778390 | Revert "Adds chromeos/third_party/chromeos-amt-tvpresence private package."
manifest-internal | jflat | *798436 | samus-kernelnext-private: Added firmware to groups
overlay-sarien-private | tbegin | *800748 | sarien: remove cros-workon from chromeos-config-bsp-sarien-private
platform2 | pmoy | 1390713 | diagnostics: add a way of returning directories.
platform2 | baileyberro | 1407449 | oobe_config: Add OobeRestore metrics logging
platform2 | pmoy | 1409724 | diagnostics: add support for reading from sysfs to libtelem.
platform2 | jimmyxgong | 1413999 | smbprovider: Add missing proto verifications to RemountOptionsProto
platform2 | hidehiko | 1414255 | camera: Update platform2 related paths.
platform2 | yusukes | 1418255 | init: Delete 'rm -rf /var/log/arc-...' lines
platform2 | jkardatzke | 1418977 | vm_tools: Remove unneeded VM ip, subnet, netmask from cicerone
platform2 | cmtm | 1423403 | init: backout journald until M73 branch point
project-jetstream-private | nmasti | *790773 | jetstream: set uid value to be identical to gid
suite_scheduler | sontis | 1422277 | Add grunt board to platform test suites.
tast-tests | yuhsuan | 1420417 | audio.ALSAConformance: Not finish until UI selects active nodes
toolchain-utils | cmtice | 1412836 | toolchain-utils: Update scripts for testing Go compiler.
toolchain-utils | cmtice | 1422317 | toolchain-utils: Remove 'link' board from our tests.

I also can't find any relative CLs. My current theory:
It's a flaky test - it depends on the key generated by GenerateECCKeyPair(), which gives a random keypair.
And the reason is the following:

When we create the signature in ECCSign, we do
  const string& signature = ConvertFromBIGNUM(sig->r) + ConvertFromBIGNUM(sig->s);
ConvertFromBIGNUM() is basically BN_bn2bin(). BN_bn2bin creates BN_num_bytes() of data, which iiuc can be less than max length (if the most significant byte is zero). So, the resulting length can be less than max and can be an odd value.
As the result, in ECCVerify we get an error here:
  // Parse signature back to ECDSA_SIG
  int sign_size = signature.size();
  if (sign_size % 2 != 0) {
    return CKR_SIGNATURE_LEN_RANGE;
  } 

So, to always get max length we need something similar to what, for example, RsaPrivateExponent() does in third_party/tpm2/CpriRSA.c:
   fill = key->publicKey->size - BN_num_bytes(bnD);
   BN_bn2bin(bnD, &key->privateKey->buffer[fill]);
   memset(key->privateKey->buffer, 0, fill);

Needs to be double-checked, of course :) And fixed, if so. 

I confirmed that sometimes we will get unexpected length of bignum because OpenSSL doesn't padding the generated values (but TPM does). This will actually cause the test fail.

A fix CL is ready: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/1423980

It looks it is not very often. I ran hundred times of these functions before (with OpenSSL command checking) and didn't happen. I ran more today and verify the CL after 500 times run.

BTW, there is also random in ECCSign() since the DSA algorithm will use some random value.