From nobody Thu Jan 19 08:42:26 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NyGN62gSRz30xgH; Thu, 19 Jan 2023 08:42:30 +0000 (UTC) (envelope-from grembo@freebsd.org) Received: from mail.evolve.de (mail.evolve.de [213.239.217.29]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA512 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail.evolve.de", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NyGN54LDHz46v3; Thu, 19 Jan 2023 08:42:29 +0000 (UTC) (envelope-from grembo@freebsd.org) Authentication-Results: mx1.freebsd.org; none Received: by mail.evolve.de (OpenSMTPD) with ESMTP id efd2d91e; Thu, 19 Jan 2023 08:42:27 +0000 (UTC) Received: by mail.evolve.de (OpenSMTPD) with ESMTPSA id 0499524e (TLSv1.3:AEAD-AES256-GCM-SHA384:256:NO); Thu, 19 Jan 2023 08:42:27 +0000 (UTC) Content-Type: multipart/alternative; boundary=Apple-Mail-1B0D71FF-0304-4879-BD3F-77AEFDA16A83 Content-Transfer-Encoding: 7bit List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org Mime-Version: 1.0 (1.0) Subject: Re: git: acd6144c488b - main - devel/git: Update to 2.39.1 From: Michael Gmelin In-Reply-To: Date: Thu, 19 Jan 2023 09:42:26 +0100 Cc: Renato Botelho , ports-committers@freebsd.org, dev-commits-ports-all@freebsd.org, dev-commits-ports-main@freebsd.org, FreeBSD Ports Management Team Message-Id: References: To: Antoine Brodin X-Mailer: iPhone Mail (20B110) X-Rspamd-Queue-Id: 4NyGN54LDHz46v3 X-Spamd-Bar: ---- X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:24940, ipnet:213.239.192.0/18, country:DE] X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-ThisMailContainsUnwantedMimeParts: N --Apple-Mail-1B0D71FF-0304-4879-BD3F-77AEFDA16A83 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On 19. Jan 2023, at 09:33, Antoine Brodin wrote: >=20 > =EF=BB=BFOn Thu, Jan 19, 2023 at 8:22 AM Antoine Brodin wrote: >>=20 >>> On Thu, Jan 19, 2023 at 8:19 AM Antoine Brodin wro= te: >>>=20 >>> On Thu, Jan 19, 2023 at 7:55 AM Michael Gmelin wrot= e: >>>>=20 >>>>=20 >>>>=20 >>>>> On 19. Jan 2023, at 08:39, Antoine Brodin wrote:= >>>>>=20 >>>>> =EF=BB=BFOn Thu, Jan 19, 2023 at 7:38 AM Antoine Brodin wrote: >>>>>>=20 >>>>>>> On Tue, Jan 17, 2023 at 7:13 PM Renato Botelho w= rote: >>>>>>>=20 >>>>>>> The branch main has been updated by garga: >>>>>>>=20 >>>>>>> URL: https://cgit.FreeBSD.org/ports/commit/?id=3Dacd6144c488bbe15cd8= 1c41f14d9fb96636b4c1f >>>>>>>=20 >>>>>>> commit acd6144c488bbe15cd81c41f14d9fb96636b4c1f >>>>>>> Author: Renato Botelho >>>>>>> AuthorDate: 2023-01-17 19:12:17 +0000 >>>>>>> Commit: Renato Botelho >>>>>>> CommitDate: 2023-01-17 19:13:51 +0000 >>>>>>>=20 >>>>>>> devel/git: Update to 2.39.1 >>>>>>>=20 >>>>>>> Security: CVE-2022-41903 >>>>>>> CVE-2022-23521 >>>>>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>>>>> --- >>>>>>> devel/git/Makefile | 2 +- >>>>>>> devel/git/distinfo | 14 +++++++------- >>>>>>> devel/git/pkg-plist | 10 ++++++++++ >>>>>>> 3 files changed, 18 insertions(+), 8 deletions(-) >>>>>>=20 >>>>>> Hello, >>>>>>=20 >>>>>> git seems to be unable to clone or pull over https after this update >>>>>> unable to access 'https://git.freebsd.org/ports.git/': SSL certificat= e >>>>>> problem: unable to get local issuer certificate >>>>>>=20 >>>>>> Could you investigate? >>>>>=20 >>>>> Adding portmgr in cc: as this affects package builders. >>>>>=20 >>>>=20 >>>> Does installing ca-root-nss explicitly make a difference? >>>=20 >>> ca_root_nss is installed. >>=20 >> Using an old git package doesn't fix the issue, maybe the problem is >> in a dependency? >=20 > Going back from curl-7.87.0 to curl-7.86.0 seems to fix the issue >=20 Well, there was this https://lists.freebsd.org/archives/dev-commits-ports-all/2023-January/049380= .html which unfortunately remained unanswered. It seems like disabling CA_BUNDLE by default not only removes the dependency= on ca_root_nss, but also disables a configuration option to look for certs i= n the right place: > +CA_BUNDLE_CONFIGURE_WITH=3D ca-bundle=3D${LOCALBASE}/share/certs/ca-ro= ot-nss.crt Michael --Apple-Mail-1B0D71FF-0304-4879-BD3F-77AEFDA16A83 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On 19. Jan 2023, at 09= :33, Antoine Brodin <antoine@freebsd.org> wrote:

<= /div>
=EF=BB=BFOn Thu, Jan 1= 9, 2023 at 8:22 AM Antoine Brodin <antoine@freebsd.org> wrote:<= br>

On Thu, Jan 19, 2023 at 8:19 AM Antoine Brodin <antoine@free= bsd.org> wrote:

On Thu, Jan 19, 2023 at 7:55 AM M= ichael Gmelin <grembo@freebsd.org> wrote:



On 19. Jan 2= 023, at 08:39, Antoine Brodin <antoine@freebsd.org> wrote:
<= /blockquote>

=EF=BB=BFOn Thu, Jan 19, 2023 at 7:38 AM Antoi= ne Brodin <antoine@freebsd.org> wrote:

=
On Tue, Jan 17, 2023 at 7:13 PM Renato Botelho <ga= rga@freebsd.org> wrote:
=

The b= ranch main has been updated by garga:
=

<= blockquote type=3D"cite">
URL: https://cgit.FreeBSD.org/ports/commit/?id=3Dacd6144c488bbe15cd81= c41f14d9fb96636b4c1f

=
commit acd6144= c488bbe15cd81c41f14d9fb96636b4c1f
Author:   =   Renato Botelho <garga@FreeBSD.org>
=
A= uthorDate: 2023-01-17 19:12:17 +0000
<= blockquote type=3D"cite">
Commit:  &nb= sp;  Renato Botelho <garga@FreeBSD.org>
CommitDate: 2023-01-17 19:13:51 +0000
=

<= blockquote type=3D"cite">
  devel/git: Update to 2.39.1

  Security:       = ;CVE-2022-41903
      &= nbsp;           CVE-2= 022-23521
=
  Sponsored by:   Rubic= on Communications, LLC ("Netgate")
<= blockquote type=3D"cite">
---
<= blockquote type=3D"cite">
devel/git/Makefile  |  2 +-
devel/git/d= istinfo  | 14 +++++++-------
devel/git/pkg-plist |= 10 ++++++++++
3 files changed, 18 insertions(+), 8 de= letions(-)
<= blockquote type=3D"cite">

Hello,

git seems to be unable to clone or pu= ll over https after this update
unable to access 'https://git.freebsd.org/ports.git/': SSL cert= ificate
problem: un= able to get local issuer certificate

Could you investigate?
<= /blockquote>

Adding portmgr in cc: as this affects package builders.

<= /span>
<= blockquote type=3D"cite">
Does installing ca-= root-nss explicitly make a difference?
<= /blockquote>

ca_root_nss is installed.
<= blockquote type=3D"cite">
Using an old git package doesn't fix the issue,  maybe the p= roblem is
in a depend= ency?

Going back from curl-7.8= 7.0 to curl-7.86.0 seems to fix the issue

<= /blockquote>

Well, there was this

https://lists.freebsd.org/archives/dev-commits-ports-all= /2023-January/049380.html

which unfortunately r= emained unanswered.

It seems like disabling CA_BUND= LE by default not only removes the dependency on ca_root_nss, but also disab= les a configuration option to look for certs in the right place:
<= br>
> +CA_BUNDLE_CONFIGURE_WITH=3D    ca-bundle=3D${L= OCALBASE}/share/certs/ca-root-nss.crt

Michael
=

= --Apple-Mail-1B0D71FF-0304-4879-BD3F-77AEFDA16A83--