Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(libcurl): set path to ca-certificates at build time for libcurl #871

Merged
merged 1 commit into from
Feb 9, 2023
Merged

fix(libcurl): set path to ca-certificates at build time for libcurl #871

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cmake/modules/curl.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ else()
--without-libpsl
--without-nghttp2
--without-libssh2
--with-ca-path=/etc/ssl/certs/
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@poiana This option only fixes the problem for distros that use the certificate directory format where each root CA gets its own entry in the /etc/ssl/certs directory.

RHEL-based distros do not use those. They instead put them at /etc/ssl/certs/ca-bundle.crt (ubuntu actually instead uses /etc/ssl/certs/ca-certificates.crt, so there is no single file that is common across both).

That said, I think that if you specify both:

--with-ca-bundle=/etc/ssl/certs/ca-bundle.crt
--with-ca-path=/etc/ssl/certs

then it should work on both ubuntu and rhel-based distros.

There is also a chance that if you simply install the ca-certificates package in the build environment and build the bundled openssl pointing at the correct ssl dir for the build environment that you can omit this setting here, and it will use defaults that work on any distro at runtime, but I'm not sure about that.

Also, this parameter is not supposed to have a trailing /. If you look in strace, that results in paths with a double / in them like:

[pid 3558894] newfstatat(AT_FDCWD, "/etc/ssl/certs//52efdea2.0", 0xffffb33d7b30, 0) = -1 ENOENT (No such file or directory)

--disable-threaded-resolver
--without-brotli
--without-zstd
Expand Down