Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 598591 - [gnome-overlay] certificate issues of downloads from download.gnome.org
Summary: [gnome-overlay] certificate issues of downloads from download.gnome.org
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Linux Gnome Desktop Team
URL: https://bugzilla.gnome.org/show_bug.c...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-30 18:22 UTC by Harris Landgarten
Modified: 2016-11-30 11:51 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Harris Landgarten 2016-10-30 18:22:45 UTC
testing of gnome-3,22 packages is being effected by certificate issues. Here is an example using wget directly:

wget  https://download.gnome.org/sources/libgnome-games-support/1.2/libgnome-games-support-1.2.1.tar.xz
--2016-10-30 14:18:45--  https://download.gnome.org/sources/libgnome-games-support/1.2/libgnome-games-support-1.2.1.tar.xz
Resolving download.gnome.org... 209.132.180.168, 209.132.180.180
Connecting to download.gnome.org|209.132.180.168|:443... connected.
ERROR: cannot verify download.gnome.org's certificate, issued by ‘CN=StartCom Class 2 Primary Intermediate Server CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL’:
  Unable to locally verify the issuer's authority.
To connect to download.gnome.org insecurely, use `--no-check-certificate'.

There is also issues with 9999 packages and git failures.
Comment 1 Jura 2016-10-31 08:34:39 UTC
>>> Emerging (1 of 1) app-editors/gedit-3.22.0::my-gnome
>>> Downloading 'http://distfiles.gentoo.org/distfiles/gedit-3.22.0.tar.xz'
--2016-10-31 11:33:04--  http://distfiles.gentoo.org/distfiles/gedit-3.22.0.tar.xz
Resolving distfiles.gentoo.org... 156.56.247.195, 64.50.236.52, 137.226.34.46, ...
Connecting to distfiles.gentoo.org|156.56.247.195|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2016-10-31 11:33:05 ERROR 404: Not Found.

>>> Downloading 'http://download.gnome.org/sources/gedit/3.22/gedit-3.22.0.tar.xz'
--2016-10-31 11:33:05--  http://download.gnome.org/sources/gedit/3.22/gedit-3.22.0.tar.xz
Resolving download.gnome.org... 209.132.180.168, 209.132.180.180
Connecting to download.gnome.org|209.132.180.168|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://download.gnome.org/sources/gedit/3.22/gedit-3.22.0.tar.xz [following]
--2016-10-31 11:33:05--  https://download.gnome.org/sources/gedit/3.22/gedit-3.22.0.tar.xz
Connecting to download.gnome.org|209.132.180.168|:443... connected.
ERROR: cannot verify download.gnome.org's certificate, issued by ‘CN=StartCom Class 2 Primary Intermediate Server CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL’:
  Unable to locally verify the issuer's authority.
To connect to download.gnome.org insecurely, use `--no-check-certificate'.
!!! Couldn't download 'gedit-3.22.0.tar.xz'. Aborting.
 * Fetch failed for 'app-editors/gedit-3.22.0', Log file:
 *  '/var/tmp/portage/app-editors/gedit-3.22.0/temp/build.log'

>>> Failed to emerge app-editors/gedit-3.22.0, Log file:

>>>  '/var/tmp/portage/app-editors/gedit-3.22.0/temp/build.log'

 * Messages for package app-editors/gedit-3.22.0:

 * Fetch failed for 'app-editors/gedit-3.22.0', Log file:
 *  '/var/tmp/portage/app-editors/gedit-3.22.0/temp/build.log'
Comment 2 Jura 2016-11-02 08:22:52 UTC
Temporary solution:

FETCHCOMMAND="/usr/bin/wget --no-check-certificate -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\"" 
RESUMECOMMAND="/usr/bin/wget -c --no-check-certificate -O \"\${DISTDIR}/\${FILE}\" \"\${URI}\""

in /etc/portage/make.conf
Comment 3 Gilles Dartiguelongue (RETIRED) gentoo-dev 2016-11-02 23:50:52 UTC
Gnome SSL certificates were issued by a CA that is considered untrustworthy and was removed from ca-certificates package by default. If you wish to reinstall it, you can use the USE=insecure_certs for now, hopefully Gnome will change their certificates soon.
Comment 4 Pacho Ramos gentoo-dev 2016-11-30 11:51:26 UTC
it seems this was fixed in upstream side