Hi, I cannot fetch dist tarballs from github on a newly installed Gentoo-prefix instance: >>> Emerging (1 of 1) sci-biology/bowtie-2.4.2::science >>> Downloading 'http://distfiles.gentoo.org/distfiles/c8/bowtie-2.4.2.tar.gz' --2021-03-17 15:03:08-- http://distfiles.gentoo.org/distfiles/c8/bowtie-2.4.2.tar.gz Resolving distfiles.gentoo.org... 185.246.208.17 Connecting to distfiles.gentoo.org|185.246.208.17|:80... connected. HTTP request sent, awaiting response... 404 Not Found 2021-03-17 15:03:09 ERROR 404: Not Found. >>> Downloading 'https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz' --2021-03-17 15:03:09-- https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz Resolving github.com... 140.82.121.3 Connecting to github.com|140.82.121.3|:443... connected. ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US’: Unable to locally verify the issuer's authority. To connect to github.com insecurely, use `--no-check-certificate'. !!! Couldn't download 'bowtie-2.4.2.tar.gz'. Aborting. * Fetch failed for 'sci-biology/bowtie-2.4.2', Log file: * '/bar/portage/sci-biology/bowtie-2.4.2/temp/build.log' This is somewhat similar to bug #770451 Could emerge automagically re-issue the command with --no-check-certificate to ignore the certificate? What's the point to check them? We anyway have checksums in the manifest file, right? $ lddtree ~/gentoo/usr/bin/wget wget => /foo/gentoo/usr/bin/wget (interpreter => /foo/gentoo/lib64/ld-linux-x86-64.so.2) libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 libpthread.so.0 => /lib64/libpthread.so.0 ld-linux-x86-64.so.2 => /foo/gentoo/lib64/ld-linux-x86-64.so.2 libssl.so.1.1 => not found libcrypto.so.1.1 => not found libz.so.1 => /lib64/libz.so.1 libc.so.6 => /lib64/libc.so.6 $ $ emerge -pv wget These are the packages that would be merged, in order: Calculating dependencies... done! [ebuild R ] net-misc/wget-1.21.1::gentoo USE="nls pcre (ssl) zlib -cookie_check -debug -gnutls -idn -ipv6 (-libressl) -metalink -ntlm -static -test -uuid" 0 KiB Total: 1 package (1 reinstall), Size of downloads: 0 KiB $ emerge --info Portage 3.0.17 (python 3.8.8-final-0, default/linux/amd64/17.1/no-multilib/prefix/kernel-3.2+, gcc-10.2.0, glibc-2.32-r8, 3.10.0-1160.15.2.el7.x86_64 x86_64) ================================================================= System uname: Linux-3.10.0-1160.15.2.el7.x86_64-x86_64-Intel-R-_Xeon-R-_Gold_6254_CPU_@_3.10GHz-with-glibc2.2.5 KiB Mem: 10563841808 total,1243219532 free KiB Swap: 4194300 total, 3895952 free Timestamp of repository gentoo: Wed, 17 Mar 2021 01:00:01 +0000 Head commit of repository gentoo: 7f45254f083ec6d66c62d554198d449ea52e3420 sh bash 5.1_p4 ld GNU ld (Gentoo 2.35.2 p1) 2.35.2 app-shells/bash: 5.1_p4::gentoo dev-java/java-config: 2.3.1::gentoo dev-lang/perl: 5.32.1::gentoo dev-lang/python: 3.8.8::gentoo, 3.9.2::gentoo dev-util/cmake: 3.19.7::gentoo sys-apps/baselayout: 2.7-r1::gentoo sys-apps/sandbox: 2.21::gentoo sys-devel/autoconf: 2.71::gentoo sys-devel/automake: 1.16.3-r1::gentoo sys-devel/binutils: 2.35.2::gentoo sys-devel/gcc: 9.3.0-r2::gentoo, 10.2.0-r5::gentoo sys-devel/gcc-config: 2.4::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.11::gentoo (virtual/os-headers) sys-libs/glibc: 2.32-r8::gentoo Repositories: gentoo location: /bar/gentoo/var/db/repos/gentoo sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-metamanifest: no sync-rsync-extra-opts: sync-rsync-verify-max-age: 24 sync-rsync-verify-jobs: 1 science location: /bar/gentoo/var/lib/layman/science masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="@FREE Intel-SDP intel-ucode fasta meme mRNAmarkup ApE modeller gmap abyss swiss-prot Aladdin AVASYS pyvcf Non-profit-OSL-3.0 estscan blat staden CeCILL-1.1 phrap STRIDE cctbx-2.0 bh-luxi ARIADNE unRAR trf freedist free-noncomm genscan no-source-code BSD MIT BSD-2 unicode Subversion" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /foo/gentoo/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /foo/gentoo/etc/env.d /foo/gentoo/etc/gentoo-release" CXXFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" DISTDIR="/foo/gentoo/var/cache/distfiles" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles force-prefix ipc-sandbox merge-sync multilib-strict network-sandbox news nostrip parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans unprivileged" FFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j100" PKGDIR="/foo/gentoo/var/cache/binpkgs" PORTAGE_CONFIGROOT="/foo/gentoo/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/baz" USE="acl amd64 asm avx avx2 berkdb boost bzip2 cli crypt dri emboss fortran gdbm gmp iconv icu java jpeg jpg lapack libglvnd libtirpc mariadb mmx ncurses nfs nls nptl nptlonly objc openmp openssl pbs pcre pcre16 pdf perl png prefix readline sctp seccomp server session split-usr sqlite sse sse2 sse3 sse4_1 sse4_2 ssl sslv3 ssse3 svg tcl tcpd threads tiff tk truetype unicode vim-syntax xml zlib" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_8" PYTHON_TARGETS="python3_8" RUBY_TARGETS="ruby26" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
(In reply to Martin Mokrejš from comment #0) > Hi, > I cannot fetch dist tarballs from github on a newly installed > Gentoo-prefix instance: > > >>> Emerging (1 of 1) sci-biology/bowtie-2.4.2::science > >>> Downloading 'http://distfiles.gentoo.org/distfiles/c8/bowtie-2.4.2.tar.gz' > --2021-03-17 15:03:08-- > http://distfiles.gentoo.org/distfiles/c8/bowtie-2.4.2.tar.gz > Resolving distfiles.gentoo.org... 185.246.208.17 > Connecting to distfiles.gentoo.org|185.246.208.17|:80... connected. > HTTP request sent, awaiting response... 404 Not Found > 2021-03-17 15:03:09 ERROR 404: Not Found. > > >>> Downloading 'https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz' > --2021-03-17 15:03:09-- > https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz > Resolving github.com... 140.82.121.3 > Connecting to github.com|140.82.121.3|:443... connected. > ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert TLS > Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US’: > Unable to locally verify the issuer's authority. > To connect to github.com insecurely, use `--no-check-certificate'. > !!! Couldn't download 'bowtie-2.4.2.tar.gz'. Aborting. > * Fetch failed for 'sci-biology/bowtie-2.4.2', Log file: > * '/bar/portage/sci-biology/bowtie-2.4.2/temp/build.log' > > > This is somewhat similar to bug #770451 > > Could emerge automagically re-issue the command with > --no-check-certificate to ignore the certificate? What's the point to check > them? We anyway have checksums in the manifest file, right? So emerge doesn't actually know the command its running right, fetching is controlled by FETCHCOMMAND in make.conf; so if emerge just randomly added '--no-check-certificate' it would break people using non-wget fetchcommands (e.g. for curl its '--insecure'.) Placing all this logic in emerge to 'make things work' seems a little messy. You should debug why the certificates are failing; Spanky listed some instructions on this in the other bug (770451) that you linked. Or you can simply turn off secure fetching for this distfile. TLS here serves less as secure mechanism (agreed we have manifests for that) but is a privacy boost as most of the bytes between you and the origin are encrypted w/TLS. I'd expect most distfiles protected by TLS, not fewer, as time goes on. -A > > > $ lddtree ~/gentoo/usr/bin/wget > wget => /foo/gentoo/usr/bin/wget (interpreter => > /foo/gentoo/lib64/ld-linux-x86-64.so.2) > libpcre2-8.so.0 => /lib64/libpcre2-8.so.0 > libpthread.so.0 => /lib64/libpthread.so.0 > ld-linux-x86-64.so.2 => /foo/gentoo/lib64/ld-linux-x86-64.so.2 > libssl.so.1.1 => not found > libcrypto.so.1.1 => not found > libz.so.1 => /lib64/libz.so.1 > libc.so.6 => /lib64/libc.so.6 > $ > > $ emerge -pv wget > > These are the packages that would be merged, in order: > > Calculating dependencies... done! > [ebuild R ] net-misc/wget-1.21.1::gentoo USE="nls pcre (ssl) zlib > -cookie_check -debug -gnutls -idn -ipv6 (-libressl) -metalink -ntlm -static > -test -uuid" 0 KiB > > Total: 1 package (1 reinstall), Size of downloads: 0 KiB > > > $ emerge --info > Portage 3.0.17 (python 3.8.8-final-0, > default/linux/amd64/17.1/no-multilib/prefix/kernel-3.2+, gcc-10.2.0, > glibc-2.32-r8, 3.10.0-1160.15.2.el7.x86_64 x86_64) > ================================================================= > System uname: > Linux-3.10.0-1160.15.2.el7.x86_64-x86_64-Intel-R-_Xeon-R-_Gold_6254_CPU_@_3. > 10GHz-with-glibc2.2.5 > KiB Mem: 10563841808 total,1243219532 free > KiB Swap: 4194300 total, 3895952 free > Timestamp of repository gentoo: Wed, 17 Mar 2021 01:00:01 +0000 > Head commit of repository gentoo: 7f45254f083ec6d66c62d554198d449ea52e3420 > sh bash 5.1_p4 > ld GNU ld (Gentoo 2.35.2 p1) 2.35.2 > app-shells/bash: 5.1_p4::gentoo > dev-java/java-config: 2.3.1::gentoo > dev-lang/perl: 5.32.1::gentoo > dev-lang/python: 3.8.8::gentoo, 3.9.2::gentoo > dev-util/cmake: 3.19.7::gentoo > sys-apps/baselayout: 2.7-r1::gentoo > sys-apps/sandbox: 2.21::gentoo > sys-devel/autoconf: 2.71::gentoo > sys-devel/automake: 1.16.3-r1::gentoo > sys-devel/binutils: 2.35.2::gentoo > sys-devel/gcc: 9.3.0-r2::gentoo, 10.2.0-r5::gentoo > sys-devel/gcc-config: 2.4::gentoo > sys-devel/libtool: 2.4.6-r6::gentoo > sys-devel/make: 4.3::gentoo > sys-kernel/linux-headers: 5.11::gentoo (virtual/os-headers) > sys-libs/glibc: 2.32-r8::gentoo > Repositories: > > gentoo > location: /bar/gentoo/var/db/repos/gentoo > sync-type: rsync > sync-uri: rsync://rsync.gentoo.org/gentoo-portage > priority: -1000 > sync-rsync-verify-metamanifest: no > sync-rsync-extra-opts: > sync-rsync-verify-max-age: 24 > sync-rsync-verify-jobs: 1 > > science > location: /bar/gentoo/var/lib/layman/science > masters: gentoo > priority: 50 > > ACCEPT_KEYWORDS="amd64 ~amd64" > ACCEPT_LICENSE="@FREE Intel-SDP intel-ucode fasta meme mRNAmarkup ApE > modeller gmap abyss swiss-prot Aladdin AVASYS pyvcf Non-profit-OSL-3.0 > estscan blat staden CeCILL-1.1 phrap STRIDE cctbx-2.0 bh-luxi ARIADNE unRAR > trf freedist free-noncomm genscan no-source-code BSD MIT BSD-2 unicode > Subversion" > CBUILD="x86_64-pc-linux-gnu" > CFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" > CHOST="x86_64-pc-linux-gnu" > CONFIG_PROTECT="/etc /foo/gentoo/etc /usr/share/gnupg/qualified.txt" > CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d > /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/sandbox.d > /etc/terminfo /foo/gentoo/etc/env.d /foo/gentoo/etc/gentoo-release" > CXXFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" > DISTDIR="/foo/gentoo/var/cache/distfiles" > ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB > PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY > XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" > FCFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" > FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs > config-protect-if-modified distlocks ebuild-locks fixlafiles force-prefix > ipc-sandbox merge-sync multilib-strict network-sandbox news nostrip > parallel-fetch pid-sandbox preserve-libs protect-owned > qa-unresolved-soname-deps sfperms splitdebug strict unknown-features-warn > unmerge-logs unmerge-orphans unprivileged" > FFLAGS="-O2 -pipe -mtune=native -ftree-vectorize" > GENTOO_MIRRORS="http://distfiles.gentoo.org" > LANG="en_US.UTF-8" > LDFLAGS="-Wl,-O1 -Wl,--as-needed" > MAKEOPTS="-j100" > PKGDIR="/foo/gentoo/var/cache/binpkgs" > PORTAGE_CONFIGROOT="/foo/gentoo/" > PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times > --omit-dir-times --compress --force --whole-file --delete --stats > --human-readable --timeout=180 --exclude=/distfiles --exclude=/local > --exclude=/packages --exclude=/.git" > PORTAGE_TMPDIR="/baz" > USE="acl amd64 asm avx avx2 berkdb boost bzip2 cli crypt dri emboss fortran > gdbm gmp iconv icu java jpeg jpg lapack libglvnd libtirpc mariadb mmx > ncurses nfs nls nptl nptlonly objc openmp openssl pbs pcre pcre16 pdf perl > png prefix readline sctp seccomp server session split-usr sqlite sse sse2 > sse3 sse4_1 sse4_2 ssl sslv3 ssse3 svg tcl tcpd threads tiff tk truetype > unicode vim-syntax xml zlib" ABI_X86="64" ADA_TARGET="gnat_2018" > ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x > ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 > trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core > authz_core socache_shmcb unixd actions alias auth_basic authn_alias > authn_anon authn_dbm authn_default authn_file authz_dbm authz_default > authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid > dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache > filter headers include info log_config logio mem_cache mime mime_magic > negotiation rewrite setenvif speling status unique_id userdir usertrack > vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df > interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse > sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 > garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom > oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 > timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput" KERNEL="linux" > LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb > ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" > LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" > OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" > POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_8" > PYTHON_TARGETS="python3_8" RUBY_TARGETS="ruby26" USERLAND="GNU" > VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" > XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p > iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark > ipmark dhcpmac delude chaos account" > Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, > LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, > PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Yeah, I don't see why emerge should work around the broken TLS certificate chain you have on this system.
(In reply to Martin Mokrejš from comment #0) > >>> Downloading 'https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz' > --2021-03-17 15:03:09-- > https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz > Resolving github.com... 140.82.121.3 > Connecting to github.com|140.82.121.3|:443... connected. > ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert TLS > Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US’: > Unable to locally verify the issuer's authority. > To connect to github.com insecurely, use `--no-check-certificate'. > !!! Couldn't download 'bowtie-2.4.2.tar.gz'. Aborting. > * Fetch failed for 'sci-biology/bowtie-2.4.2', Log file: > * '/bar/portage/sci-biology/bowtie-2.4.2/temp/build.log' > > > This is somewhat similar to bug #770451 > > Could emerge automagically re-issue the command with > --no-check-certificate to ignore the certificate? What's the point to check > them? We anyway have checksums in the manifest file, right? Are you sure that you don't want to enable --no-check-certificate unconditionally? We certainly can't do this by default, but you are welcome to do it if desired. I realize that this sort of "fail open" behavior could be desired, but I imagine that it is much more typical to enable --no-check-certificate unconditionally.
Hi, thank you for the answers. So, truly said, I have no time and interest to fix the whole world. I do not want to study all tricks about the certificates either. And to answer question of Zac, well, I will gladly disable the checks unconditionally but I haven't realized yet how to do it. Probably bash$ FETCHCOMMAND="wget --no-check-certificate" emerge $package I think in general portage should do the decision on it own. If it cannot fetch a certidficate one way it try another. and the error message in an ideal world should explain the user straight what he/she might do. Even for me this is another blocker and I have to find a workaround and learn how something is supposed to work. I know the amount of work fo poratge developers is just growing continually but felt this is something what users should not face. Could emerge re-try with another download host (supposedly try with another Ip given by the resolver), try http instead of https, or downgrade to ftp? I do not care as a user, the manifests are enough for me. And if the message should be hey, we found a misconfigured host in the cloud which has maybe an expired certificate ... I am not the one going to email github about this, I have no time.
I am almost certain that your system is misconfigured or has an out of date CA certificate bundle installed. This is not an issue most users will encounter if they are regularly updating their system. Portage isn't responsible for verifying the certificates when fetching files. It does not make sense to have Portage jump through hoops to work around a broken CA bundle. While I understand you may be frustrated by an error message you find cryptic, Portage is not the place to address this.
I guess the underlying issue is wget somehow not being able to verify the certs, wheras it should. Do you have app-misc/ca-certificates installed?
I thought I misread the message about a broken certificate on my side. I have no idea, this is a brand new, 1-day old Gentoo-Prefix installation. Is some of the packages providing certificates serving me outdated certificate?
qlist -Iv ca-certificates
BTW, make.conf.5 manpage is not clear enough to me how the FETCHCOMMAND line should look like. I have only app-misc/ca-certificates-20210119.3.62 installed, what else is needed?
I suspect this is some issue with the Prefix install. Re-assigning to them.
do you have $EPREFIX/etc/ssl/certs/ca-certificates.crt does running update-ca-certificates help? You can simply test by running % wget "https://raw.githubusercontent.com/barbieri/barbieri-playground/master/openwrt/wifi-disconnect-low-signal/README.md" -O - (or any other random file from github)
strace for the command $ strace wget https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz --2021-03-17 18:50:57-- https://github.com/BenLangmead/bowtie2/archive/v2.4.2.tar.gz Resolving github.com... 140.82.121.3 Connecting to github.com|140.82.121.3|:443... connected. ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1,O=DigiCert Inc,C=US’: Unable to locally verify the issuer's authority. To connect to github.com insecurely, use `--no-check-certificate'. reveals it looks for $prefix/etc/ssl/certs/ebc232bc.0 which is missing. Indeed, the directory is containing just total 321 -rw-r--r-- 1 mmokrejs meta 0 Mar 17 10:51 .keep_dev-libs_openssl-0 drwxr-xr-x 5 mmokrejs meta 4096 Mar 17 10:53 .. drwxr-xr-x 2 mmokrejs meta 4096 Mar 17 11:01 java -rw-r--r-- 1 mmokrejs meta 200313 Mar 17 11:18 ca-certificates.crt drwxr-xr-x 3 mmokrejs meta 65536 Mar 17 11:18 . $ So I went to reinstall it: >>> Emerging (1 of 1) app-misc/ca-certificates-20210119.3.62::gentoo * ca-certificates_20210119.tar.xz BLAKE2B SHA512 size ;-) ... [ ok ] * nss-3.62.tar.gz BLAKE2B SHA512 size ;-) ... [ ok ] >>> Unpacking source... >>> Unpacking ca-certificates_20210119.tar.xz to /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work >>> Unpacking nss-3.62.tar.gz to /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work >>> Source unpacked in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work >>> Preparing source in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work ... * Applying ca-certificates-20150426-root.patch ... [ ok ] >>> Source prepared. >>> Configuring source in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work ... >>> Source configured. >>> Compiling source in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work ... * Using python3.8 to build make -j100 -C /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work/ca-certificates-20210119/mozilla make: Entering directory '/scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work/ca-certificates-20210119/mozilla' python3 certdata2pem.py Ignoring certificate "Verisign Class 1 Public Primary Certification Authority - G3". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "Verisign Class 2 Public Primary Certification Authority - G3". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "Certum Root CA". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "Camerfirma Chambers of Commerce Root". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "Camerfirma Global Chambersign Root". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "SwissSign Platinum CA - G2". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "OISTE WISeKey Global Root GA CA". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Certificate "Explicitly Distrust DigiNotar Root CA" blacklisted, ignoring. Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" blacklisted, ignoring. Certificate "MITM subCA 1 issued by Trustwave" blacklisted, ignoring. Certificate "MITM subCA 2 issued by Trustwave" blacklisted, ignoring. Certificate "TURKTRUST Mis-issued Intermediate CA 1" blacklisted, ignoring. Certificate "TURKTRUST Mis-issued Intermediate CA 2" blacklisted, ignoring. Ignoring certificate "Symantec Class 1 Public Primary Certification Authority - G6". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "Symantec Class 2 Public Primary Certification Authority - G6". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR Ignoring certificate "D-TRUST Root CA 3 2013". SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR make: Leaving directory '/scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work/ca-certificates-20210119/mozilla' Updating certificates in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work/image/storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs... 129 added, 0 removed; done. Running hooks in /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/work/image/storage/brno3-cerit/home/mmokrejs/gentoo/etc/ca-certificates/update.d... done. >>> Source compiled. >>> Test phase [not enabled]: app-misc/ca-certificates-20210119.3.62 >>> Install app-misc/ca-certificates-20210119.3.62 into /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/image >>> Completed installing app-misc/ca-certificates-20210119.3.62 into /scratch.ssd/mmokrejs/job_2285717.cerit-pbs.cerit-sc.cz/portage/app-misc/ca-certificates-20210119.3.62/image * Final size of build directory: 200896 KiB (196.1 MiB) * Final size of installed tree: 1372 KiB ( 1.3 MiB) >>> Installing (1 of 1) app-misc/ca-certificates-20210119.3.62::gentoo * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/c01cdfa2.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/VeriSign_Universal_Root_Certification_Authority.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/5a4d6896.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/Staat_der_Nederlanden_Root_CA_-_G3.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/e18bfb83.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/QuoVadis_Root_CA_3_G3.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/02265526.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/Entrust_Root_Certification_Authority_-_G2.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/fc5a8f99.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/3e44d2f7.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/TrustCor_RootCert_CA-2.pem which does not exist. * QA Notice: Symbolic link /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/b727005e.0 points to /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/AffirmTrust_Premium.pem which does not exist. ... * Removing the following broken symlinks: * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_SSL.com_EV_Root_Certification_Authority_ECC.pem -> ../../../../../../../../storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_32888f65.0 -> Hellenic_Academic_and_Research_Institutions_RootCA_2015.pem * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_UCA_Extended_Validation_Root.pem -> ../../../../../../../../storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_4304c5e5.0 -> Network_Solutions_Certificate_Authority.pem * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_QuoVadis_Root_CA.pem -> ../../../../../../../../storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA.crt * /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/._cfg0000_D-TRUST_Root_Class_3_CA_2_2009.pem -> ../../../../../../../../storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009. ... $ ls -latr /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/ total 321 -rw-r--r-- 1 mmokrejs meta 0 Mar 17 10:51 .keep_dev-libs_openssl-0 drwxr-xr-x 5 mmokrejs meta 4096 Mar 17 10:53 .. drwxr-xr-x 2 mmokrejs meta 4096 Mar 17 11:01 java -rw-r--r-- 1 mmokrejs meta 200313 Mar 17 18:54 ca-certificates.crt drwxr-xr-x 3 mmokrejs meta 65536 Mar 17 18:54 . $ Nevertheless, if I could get the "--no-check-certificate" appended to the wget command if would be helpful.
$ cat $EPREFIX/etc/ssl/certs/ca-certificates.crt cat: /etc/ssl/certs/ca-certificates.crt: No such file or directory $ update-ca-certificates Updating certificates in /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs... 129 added, 0 removed; done. Running hooks in /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ca-certificates/update.d... done. $ $ ls -latr /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/ | head total 450 -rw-r--r-- 1 mmokrejs meta 0 Mar 17 10:51 .keep_dev-libs_openssl-0 drwxr-xr-x 5 mmokrejs meta 4096 Mar 17 10:53 .. lrwxrwxrwx 1 mmokrejs meta 89 Mar 17 19:00 ACCVRAIZ1.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt lrwxrwxrwx 1 mmokrejs meta 96 Mar 17 19:00 AC_RAIZ_FNMT-RCM.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt lrwxrwxrwx 1 mmokrejs meta 110 Mar 17 19:00 Actalis_Authentication_Root_CA.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt lrwxrwxrwx 1 mmokrejs meta 102 Mar 17 19:00 AffirmTrust_Commercial.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt lrwxrwxrwx 1 mmokrejs meta 102 Mar 17 19:00 AffirmTrust_Networking.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt lrwxrwxrwx 1 mmokrejs meta 99 Mar 17 19:00 AffirmTrust_Premium.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt lrwxrwxrwx 1 mmokrejs meta 103 Mar 17 19:00 AffirmTrust_Premium_ECC.pem -> /storage/brno3-cerit/home/mmokrejs/gentoo/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt $ echo $EPREFIX $ echo $PREFIX $ ls -latr $HOME/gentoo/etc/ssl/certs/ca-certificates.crt -rw-r--r-- 1 mmokrejs meta 200313 Mar 17 19:00 /storage/brno3-cerit/home/mmokrejs/gentoo/etc/ssl/certs/ca-certificates.crt $ So, my $PREFIX and $EPREFIX are the cause?
So, my problem is gone after the update-ca-certificates exec. Thank you for the tip. Fabian.
check $EPREFIX/usr/share/portage/config/make.globals to see the default FETCHCOMMAND, you could amend it. Seems your problem lies in ca-certificates not installing any certs. % qlist ca-certificates | wc -l 395 lrwxr-xr-x 1 fabian staff 51 Mar 17 19:49 /Users/fabian/Gentoo-11.0i/etc/ssl/certs/c01cdfa2.0 -> VeriSign_Universal_Root_Certification_Authority.pem
update-ca-certificates should be run as part of pkg_compile, so this is weird. But it appears to be the root cause of your problem here.
(In reply to Fabian Groffen from comment #15) > check $EPREFIX/usr/share/portage/config/make.globals to see the default > FETCHCOMMAND, you could amend it. Excellent, if this was mentioned in the make.conf manpage I would manage to copy&paste the line with the addition I needed. > Seems your problem lies in ca-certificates not installing any certs. > > % qlist ca-certificates | wc -l > 395 Indeed, but that got fixed by the update-ca-certificates execution. > lrwxr-xr-x 1 fabian staff 51 Mar 17 19:49 > /Users/fabian/Gentoo-11.0i/etc/ssl/certs/c01cdfa2.0 -> > VeriSign_Universal_Root_Certification_Authority.pem But my $EPREFIX variable is empty. I just login into the machine and exec gentoo/startprefix but inside the shell, as you can see, the $EPREFIX variable is empty. Therefore, I even have to do "vi $HOME/gentoo/etc/portage/make.conf" although I think "vi /etc/portage/make.conf" used to work. Obviously, I have no root access here. Maybe something went wrong with the Mar 16 21:07 bootstrap-prefix.sh version with filesize 99719?
