From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Subject: bug#37371: =?UTF-8?Q?CMake=E2=80=99s_?= =?UTF-8?Q?=E2=80=9Cctest=E2=80=9D_?= =?UTF-8?Q?doesn=E2=80=99t?= know about X.509 certificates Date: Tue, 10 Sep 2019 17:37:43 +0200 Message-ID: <87tv9k17so.fsf@inria.fr> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:35689) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i7iDV-0001BK-Hv for bug-guix@gnu.org; Tue, 10 Sep 2019 11:38:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1i7iDU-0003EL-F9 for bug-guix@gnu.org; Tue, 10 Sep 2019 11:38:05 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:32770) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1i7iDU-0003E9-BV for bug-guix@gnu.org; Tue, 10 Sep 2019 11:38:04 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1i7iDT-0000j4-DS for bug-guix@gnu.org; Tue, 10 Sep 2019 11:38:03 -0400 Sender: "Debbugs-submit" Resent-Message-ID: Received: from eggs.gnu.org ([2001:470:142:3::10]:35632) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1i7iDI-00017o-Aq for bug-Guix@gnu.org; Tue, 10 Sep 2019 11:37:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1i7iDF-00035M-VC for bug-Guix@gnu.org; Tue, 10 Sep 2019 11:37:51 -0400 Received: from mail2-relais-roc.national.inria.fr ([192.134.164.83]:45099) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1i7iDE-00032j-3a for bug-Guix@gnu.org; Tue, 10 Sep 2019 11:37:49 -0400 List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: bug-Guix@gnu.org Hello, The =E2=80=98ctest=E2=80=99 command uses libcurl to submit reports to CDash= servers. However, it does not =E2=80=9Cgetenv=E2=80=9D anything related to CA certs,= and it does not either look at /etc/ssl/certs. The culprit is this function: --8<---------------cut here---------------start------------->8--- std::string cmCurlSetCAInfo(::CURL* curl, const char* cafile) { std::string e; if (cafile && *cafile) { ::CURLcode res =3D ::curl_easy_setopt(curl, CURLOPT_CAINFO, cafile); check_curl_result(res, "Unable to set TLS/SSL Verify CAINFO: "); } #ifdef CMAKE_FIND_CAFILE # define CMAKE_CAFILE_FEDORA "/etc/pki/tls/certs/ca-bundle.crt" else if (cmSystemTools::FileExists(CMAKE_CAFILE_FEDORA, true)) { ::CURLcode res =3D ::curl_easy_setopt(curl, CURLOPT_CAINFO, CMAKE_CAFILE_FEDORA); check_curl_result(res, "Unable to set TLS/SSL Verify CAINFO: "); } # undef CMAKE_CAFILE_FEDORA else { # define CMAKE_CAFILE_COMMON "/etc/ssl/certs/ca-certificates.crt" if (cmSystemTools::FileExists(CMAKE_CAFILE_COMMON, true)) { ::CURLcode res =3D ::curl_easy_setopt(curl, CURLOPT_CAINFO, CMAKE_CAFILE_COMMON); check_curl_result(res, "Unable to set TLS/SSL Verify CAINFO: "); } # undef CMAKE_CAFILE_COMMON # define CMAKE_CAPATH_COMMON "/etc/ssl/certs" if (cmSystemTools::FileIsDirectory(CMAKE_CAPATH_COMMON)) { ::CURLcode res =3D ::curl_easy_setopt(curl, CURLOPT_CAPATH, CMAKE_CAPATH_COMMON); check_curl_result(res, "Unable to set TLS/SSL Verify CAPATH: "); } # undef CMAKE_CAPATH_COMMON } #endif return e; } --8<---------------cut here---------------end--------------->8--- The problem is that =E2=80=98CMAKE_FIND_CAFILE=E2=80=99 is undefined in our= case: --8<---------------cut here---------------start------------->8--- #if !defined(CMAKE_USE_SYSTEM_CURL) && !defined(_WIN32) && = \ !defined(__APPLE__) && !defined(CURL_CA_BUNDLE) && !defined(CURL_CA_PATH) # define CMAKE_FIND_CAFILE # include "cmSystemTools.h" #endif --8<---------------cut here---------------end--------------->8--- Thus it doesn=E2=80=99t look for certificates *at all*, and eventually fails with: --8<---------------cut here---------------start------------->8--- Error when uploading file: =E2=80=A6 Error message was: server certificate verification failed. CAfile: none = CRLfile: none Problems when submitting via HTTP Errors while running CTest --8<---------------cut here---------------end--------------->8--- For now I propose to provide a patched =E2=80=98cmake=E2=80=99 package that= does the right thing. On #guix, Tobias also rightfully suggested adding a =E2=80=98getenv=E2=80= =99 call directly in libcurl, which may be the better long-term solution (though it=E2=80=99s unclear whether that could interfere with application logic.) Ludo=E2=80=99.