Re: [Buildroot] [PATCH for-2021.08.x] support/docker: remove expired mozilla/DST_Root_CA_X3.crt

From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@gmail.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH for-2021.08.x] support/docker: remove expired mozilla/DST_Root_CA_X3.crt
Date: Sat, 20 Nov 2021 09:50:04 +0100	[thread overview]
Message-ID: <20211120085004.GS247986@scaer> (raw)
In-Reply-To: <87a6i1r6va.fsf@dell.be.48ers.dk>

Peter, Romain, All,

On 2021-11-18 13:22 +0100, Peter Korsgaard spake thusly:
> >>>>> "Romain" == Romain Naour <romain.naour@gmail.com> writes:
>  >> > https://stackoverflow.com/questions/69408776/how-to-force-older-debian-to-forget-about-dst-root-ca-x3-expiration-and-use-isrg
>  >> > Signed-off-by: Romain Naour <romain.naour@gmail.com>
>  >> > Cc: Yann E. MORIN <yann.morin.1998@free.fr>
>  >> > ---
>  >> > Backport this patch for 2021.08.x and 2021.02.x using buildroot/base:20200814.2228
>  >> 
>  >> How does this actually work? Who builds that container? Do we not need
>  >> a corresponding update of .gitlab-ci.yml then?
> 
>  > Well, usually it's Arnout or Yann that build and push containers to dockerhub.
>  > On master we recently switched to gitlab registry, so maintainers and developers
>  > of Buildroot gitlab project can update containers.
> 
>  > The .gitlab-ci.yml is changed as soon as the container is rebuild using the
>  > updated Dockerfile (after the commit of Dockerfile change).
> 
> Ok, so all manually.
> 
>  >> 2021-11-18 09:20:10 (16.5 MB/s) - 'aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2' saved [127456563/127456563]
>  >> 
>  > Indeed but we may introduce some (unlikely) regression in the testsuite.
> 
> If there are regressions, then it would be better to handle them as
> people might run into the same issues. Debian 9 is old, no matter if we
> look at the 2017 snapshot or the last bugfix (2020), so I testing
> against that might be the best solution?

I was not sure Stretch was still maintained (I did not even check), but
now I tested the stretch-20211115 snapshot, and indeed the certificate
issue is no longer.

The risk of regressioni if we update is very low, because Debian really
is stable; after 4 years of maintenance, there is not many things that
move anymore.

So I agree that updating to the latest stretch image is better than
hacking our ways by removing some certificate.

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot