Re: [Buildroot] [PATCH for-2021.08.x] support/docker: remove expired mozilla/DST_Root_CA_X3.crt

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Romain" == Romain Naour <romain.naour@gmail.com> writes:

 > Since the 30th Sep 2021 the docker image used the gitlab-ci is not able
 > to download the toolchain archive from https://toolchains.bootlin.com due
 > to an expired certificate.

 > wget https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
 > Connecting to toolchains.bootlin.com (toolchains.bootlin.com)|51.254.149.199|:443... connected.
 > ERROR: The certificate of ‘toolchains.bootlin.com’ is not trusted.
 > ERROR: The certificate of ‘toolchains.bootlin.com’ has expired.

 > Remove expired mozilla/DST_Root_CA_X3.crt [1].

 > [1] https://stackoverflow.com/questions/69408776/how-to-force-older-debian-to-forget-about-dst-root-ca-x3-expiration-and-use-isrg

 > Signed-off-by: Romain Naour <romain.naour@gmail.com>
 > Cc: Yann E. MORIN <yann.morin.1998@free.fr>
 > ---
 > Backport this patch for 2021.08.x and 2021.02.x using buildroot/base:20200814.2228

How does this actually work? Who builds that container? Do we not need
a corresponding update of .gitlab-ci.yml then?


 > ---
 >  support/docker/Dockerfile | 2 ++
 >  1 file changed, 2 insertions(+)

 > diff --git a/support/docker/Dockerfile b/support/docker/Dockerfile
 > index a9bacca3a0..e65f840da8 100644
 > --- a/support/docker/Dockerfile
 > +++ b/support/docker/Dockerfile
 > @@ -47,6 +47,8 @@ RUN apt-get install -y --no-install-recommends \
 >          unzip \
 >          wget \
 >          && \
 > +    sed -i '/^mozilla\/DST_Root_CA_X3.crt$/ s/^/!/' /etc/ca-certificates.conf && \
 > +    update-ca-certificates && \

Alternatively we could just update to the latest stretch release instead
of this snapshot from 2017:

docker run --rm -it debian:9.13
root@42ec5ca75f0a:/# apt-get update && \
  apt-get install -y --no-install-recommends ca-certificates wget

root@42ec5ca75f0a:/# wget https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
--2021-11-18 09:20:03--  https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
Resolving toolchains.bootlin.com (toolchains.bootlin.com)... 51.254.149.199
Connecting to toolchains.bootlin.com (toolchains.bootlin.com)|51.254.149.199|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 127456563 (122M) [application/x-bzip2]
Saving to: 'aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2'

ing-edge-2020.08-1.t  85%[==================>    ] 103.51M  16.9MB/s    eta 1s     F
aarch64--glibc--blee 100%[======================>] 121.55M  16.6MB/s    in 7.4s

2021-11-18 09:20:10 (16.5 MB/s) - 'aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2' saved [127456563/127456563]

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot