As part of ticket https://pagure.io/freeipa/issue/7593, I refactored replication.wait_for_entry() to support attribute values and a clearer error handling path. After the refactoring, some tests started to fail, because an entry wasn't replicated in a timely fashion. It turned out that the tests have been broken for a while, but replication.wait_for_entry() failed to report it.

Simplified code:

timeout = int(time.time()) + 60
entry = None
while int(time.time()) < timeout:
    try:
        entry = fails()
    except Exception:
        pass
    time.sleep(1)

if entry is None and int(time.time()) > timeout:
    raise NotFound()
elif entry:
    return "ok"

In the false negative test, the loop spent 60.45 seconds. Since int(60.45) == 60 and 60 < 60 is false, the loop terminates with entry still None. But since 60 > 60 is also false, the function never raised NotFound() unless the current time was rounded up. For small timesouts around 60 seconds and a fast LDAP server, this never happened.

See @ftweedal long comment on https://github.com/freeipa/freeipa/pull/2051#issuecomment-399301323