Use Mozilla's CA certificate store for libgit2 SSL certificates when compiling on SUSE SLES 11. #23807
Conversation
deps/libgit2.mk
Outdated
| CURL_LOCATION=$(shell which curl 2>/dev/null) | ||
| WGET_LOCATION=$(shell which wget 2>/dev/null) | ||
| ifeq ($(shell [ -x $(CURL_LOCATION) ] && $(CURL_LOCATION) -V >/dev/null && echo exists),exists) | ||
| $(shell curl --cacert $(OPENSSL_DIR)/certs/GlobalSign_Root_CA.pem -O https://curl.haxx.se/ca/cacert.pem && \ |
There was a problem hiding this comment.
will this file change over time?
|
@tkelman The GlobalSign Root CA certificate was added April 7, 2016 in recommended update openssl-certs-2.7-0.6.1. According to The |
|
Is there a versioned url we could download from and checksum verify so it's reproducible? |
|
@tkelman The This fingerprint can be checked with: There does not seem to be a checksum to verify |
deps/libgit2.mk
Outdated
| @@ -70,10 +70,14 @@ CURL_LOCATION=$(shell which curl 2>/dev/null) | |||
| WGET_LOCATION=$(shell which wget 2>/dev/null) | |||
| ifeq ($(shell [ -x $(CURL_LOCATION) ] && $(CURL_LOCATION) -V >/dev/null && echo exists),exists) | |||
| $(shell curl --cacert $(OPENSSL_DIR)/certs/GlobalSign_Root_CA.pem -O https://curl.haxx.se/ca/cacert.pem && \ | |||
| curl --cacert $(OPENSSL_DIR)/certs/GlobalSign_Root_CA.pem -O https://curl.haxx.se/ca/cacert.pem.sha256 && \ | |||
There was a problem hiding this comment.
better than nothing, but downloading the checksum from the same site doesn't help with repeatability of the build - is there a versioned source of these?
|
@tkelman The Mozilla SSL certificate store does not seem to have versions (see certdata.txt). However, the cacert.pem page provided by the official curl project website hosts older cacert.pem revisions by date (2017-09-20, 2017-06-07, etc). All revisions of cacert.pem document the date of the converted certdata.txt on the 4th commented line. This does not mean root CA certificates aren't added or revoked. For example, CNNIC was added to the list of distrusted root CA certificates (see https://arstechnica.com/information-technology/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/) in 2015. Perhaps you would like the sha256 checksums of the previous cacert.pem revisions? |
|
@tkelman The recent commits changes the requirement of the latest cacert.pem to cacert-2017-09-20.pem. This file will not change and could be considered a version by date. |
|
@mikhail-j this is pretty cool. I will take a closer look over the next couple of days because I want to see if this can instead just be used on all platforms; it seems a shame to have such a nicely put together downloading process used only on one platform when it could benefit them all and hopefully dodge the mess of Makefile rules that search for that file on various systems. |
|
@staticfloat I agree that this CA certificate store provided by Mozilla and the curl project website should be usable on all platforms. I would prefer downloading the Mozilla SSL certificate store with an encrypted connection in addition to SHA256 checksum verification. As you mentioned, SSL certificates are stored differently on different Linux operating systems. This can be a problem if we require a SSL/TLS v1.2 connection to download the certificates from the authenticated server. However, downloading CA certificates without SSL/TLS would be a last resort. |
|
The following commits have been moved to a different branch susecacerts. I will open a new pull request with an up-to-date branch. |
Currently, both v0.6.0 and a neutral build on SUSE SLES 11 SP4 does not fail to compile. However, the compiled binaries fail to execute successfully and prints
ErrorException("error initializing LibGit2 module")(#18693).I've tried setting the
SSL_CERT_DIRenvironmental variable when running thejuliabinary, but the binaries continue to print the same errors.By default, the SUSE SLES 11 SP4
openssl-certspackage does not provide CA certificates in a bundle.This pull request fixes the lack of a CA certificate bundle on SUSE SLES 11 (#18936 #19556) by packaging the CA certificates bundle from the official curl project website (CA certificates extracted from Mozilla).
On a separate note, running
make teston julia v0.6.0 in SUSE SLES 11 SP4 encounters an error withlibgit2:I fixed this issue by renaming the
openssl(openssl v0.9.8j) toopenssl0and symbolically linkingopenssltoopenssl1(openssl v1.0.1g).