Re: git ca cert problems

[Alex Vong <alexvong1995@gmail.com>]

Hi,

I change the title to a better one.

ludo@gnu.org (Ludovic Courtès) writes:

> Hello,
>
> It works for me (on GuixSD, but that shouldn’t make a difference.)
>
> What does “wc -l $GIT_SSL_CAINFO” say?
>
The output I get without setting any environment variable is the
following:

alexvong1995@debian:~$ ltrace -f -e getenv bash -c 'git clone https://github.com/elm-lang/elm-compiler' 2>&1 |grep SSL
[pid 6906] sh->getenv("GIT_SSL_NO_VERIFY")       = nil
[pid 6906] sh->getenv("GIT_SSL_CERT")            = nil
[pid 6906] sh->getenv("GIT_SSL_KEY")             = nil
[pid 6906] sh->getenv("GIT_SSL_CAPATH")          = nil
[pid 6906] sh->getenv("GIT_SSL_CAINFO")          = "/home/alexvong1995/.guix-profile"...
[pid 6906] sh->getenv("GIT_SSL_CERT_PASSWORD_PROTECTED") = nil
[pid 6906] sh->getenv("GIT_SSL_VERSION")         = nil
[pid 6906] sh->getenv("GIT_SSL_CIPHER_LIST")     = nil
fatal: unable to access 'https://github.com/elm-lang/elm-compiler/': Problem with the SSL CA cert (path? access rights?)


Printing the environemt variable GIT_SSL_NO_VERIFY gives:

alexvong1995@debian:~$ echo $GIT_SSL_CAINFO
/home/alexvong1995/.guix-profile/etc/ssl/certs/ca-certificates.crt:/home/alexvong1995/.guix-profile/etc/ssl/certs/ca-certificates.crt


Is the problem related to having more than one ca cert files?

> From a quick look, Git honors a bunch of additional environment
> variables in this area:
>
> $ ltrace -f -e getenv sh -c 'git clone https://github.com/elm-lang/elm-compiler' 2>&1 |grep SSL
> [pid 21398] sh->getenv("GIT_SSL_NO_VERIFY")      = nil
> [pid 21398] sh->getenv("GIT_SSL_CERT")           = nil
> [pid 21398] sh->getenv("GIT_SSL_KEY")            = nil
> [pid 21398] sh->getenv("GIT_SSL_CAPATH")         = nil
> [pid 21398] sh->getenv("GIT_SSL_CAINFO")         = "/etc/ssl/certs/ca-certificates.c"...
> [pid 21398] sh->getenv("GIT_SSL_CERT_PASSWORD_PROTECTED") = nil
> [pid 21398] sh->getenv("GIT_SSL_VERSION")        = nil
> [pid 21398] sh->getenv("GIT_SSL_CIPHER_LIST")    = nil
>
> Could it be that one of these is shadowing GIT_SSL_CAINFO?
>
> There’s also ‘http.sslCAInfo’ and similar (see git-config(1)).
>
> HTH,
> Ludo’.

Thanks,
Alex