Current outage due to SSL certification issue

[Geod24]

Hi everyone,
As you might have noticed, the CI is currently completely broken due to some SSL issues.

What's happening

On some systems, downloading https://dlang.org/install.sh fails:

$ curl https://dlang.org/install.sh
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

On some systems, it succeeds.

Why it's happening

My understanding is that the current configuration of dlang.org is incorrect, inasmuch as it does not server the intermediate certificate(s), but only its own certificate (and an extra certificate for a co-hosted website). This is backed by the error message (unable to verify first certificate) and SSLLabs: https://www.ssllabs.com/ssltest/analyze.html?d=dlang.org

How to fix it

The server needs to send the full path to the root certificate. Alternatively, tools might be able to work around it by downloading the missing intermediate certificate (I'll explore this in setup-dlang).

When will it be fixed

We don't know yet, as only one person can fix this, but ASAP.

[Geod24]

The Github action has been hotfixed, but the problem persists with other CIs: https://github.com/dlang-community/setup-dlang/releases/tag/v1.0.4

[ibuclaw]

Thanks! Maybe we should have a few more accounts on the downloads server to give us some redundancy of people available to act when these sorts of things happen?

[Geod24]

I think it would be good, I'll bring it up at the next foundation meeting.

[Geod24]

Everything should be back to normal now, thanks to Jan.

[p0nce]

Still getting this on Travis CI, I wonder what to do?

[PetarKirov]

I think the problem is with Travis CI's curl, as this works for me:

CURL_USER_AGENT="Travis-CI $(curl --version | head -n 1)"
curl -fsSL -A "$CURL_USER_AGENT" --connect-timeout 5 --speed-time 30 --speed-limit 1024 "https://dlang.org/install.sh" -O

[PetarKirov]

@p0nce the work around would be to manually run the steps in this script in order to download the install.sh script in before_install:
https://github.com/travis-ci/travis-build/blob/5f10098154313ca99ed72dbf75c7bdf670708f2b/lib/travis/build/script/d.rb

If that doesn't work, you could try asking the TravisCI team here: https://travis-ci.community/ as essentially d.rb is their responsibility, even though our community contributed it.

[p0nce]

Looking for a fix not a workaround. Travis still gives free credits for open-source and is one of the only free CI to have arm64

[PetarKirov]

Looking for a fix not a workaround.

Agreed, but based on the available information I still think the issue is with TravisCI, so I'm not sure what we can do to fix it, other than suggest you find a way to download dlang.org/install.sh manually or use pre-built docker images.

Travis still gives free credits for open-source and is one of the only free CI to have arm64

cirrus-ci also supports Linux arm64 (and also FreeBSD) and provides free credits for open-source.

[PetarKirov]

I ran into the Travis CI SSL issue recently myself. From what I can see, I still think that the problem is on their side, as of several jobs in the same build some pass without issues and some fail:

• https://app.travis-ci.com/github/symmetryinvestments/influx-d/jobs/548517525
• https://app.travis-ci.com/github/symmetryinvestments/influx-d/jobs/548517529

[p0nce]

The .travis.yml file:

language: d

before_install:
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo apt-get update -y ; fi
  - if [[ "$TRAVIS_OS_NAME" == "linux" && "$TRAVIS_CPU_ARCH" == "amd64" ]]; then sudo apt-get install -y gcc-multilib ; fi

arch:
  - amd64
  - arm64

os:
  - linux

d:
 - ldc-1.26.0
 - ldc-1.24.0
 - dmd-beta
 - dmd-2.097.0
 - dmd-2.094.2

matrix:
  allow_failures:
   - d: dmd-beta      # DMD on arm64 not supported
     arch: arm64
   - d: dmd-2.097.0
     arch: arm64
   - d: dmd-2.094.2
     arch: arm64

# Note: run 64-bit tests if (arch == amd64) || (compiler is LDC)
# Note: run 32-bit tests on Linux x86 only
# Note: need '' escaping because of fricking YAML
script:
  - 'if [[ "${DC: -4}" == "ldc2" || "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test --compiler=${DC} ; fi'
  - 'if [[ "${DC: -4}" == "ldc2" || "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-release --compiler=${DC} ; fi'
  - 'if [[ "${DC: -4}" == "ldc2" || "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-inst --compiler=${DC} ; fi'
  - 'if [[ "${DC: -4}" == "ldc2" || "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-release-inst --compiler=${DC} ; fi'
  - if [[ "$TRAVIS_OS_NAME" == "linux" && "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test --compiler=${DC} -a x86 ; fi
  - if [[ "$TRAVIS_OS_NAME" == "linux" && "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-release --compiler=${DC} -a x86 ; fi
  - if [[ "$TRAVIS_OS_NAME" == "linux" && "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-inst --compiler=${DC} -a x86 ; fi
  - if [[ "$TRAVIS_OS_NAME" == "linux" && "$TRAVIS_CPU_ARCH" == "amd64" ]]; then dub test -b unittest-release-inst --compiler=${DC} -a x86 ; fi