bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Dennis Mungai]

Hello there,

I'm using git 2.7.4 from a guix profile, and here is my current environment:

guix package -p ~/opt/guix-build-system --search-paths
warning: failed to install locale: Invalid argument
export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
export INFOPATH="/home/lin/opt/guix-build-system/share/info"
export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"

which env returns:

which env
/home/lin/opt/guix-build-system/bin/env

Now, with git clone example over HTTPS:

git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
Cloning into 'guix-bioinformatics'...
fatal: unable to access
'https://github.com/genenetwork/guix-bioinformatics/': server
certificate verification failed. CAfile: none CRLfile: none

The system git does not present such an error.

What could be wrong with my setup? Missing certificates?

At the moment, I've installed the nss-certs package hoping it would be
a workaround as these are Mozilla certs, but to no avail.

Thanks and regards,

Dennis.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Ricardo Wurmus]

Dennis Mungai <dmngaie@gmail.com> writes:

> Hello there,
>
> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>
> guix package -p ~/opt/guix-build-system --search-paths
> warning: failed to install locale: Invalid argument
> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>
> which env returns:
>
> which env
> /home/lin/opt/guix-build-system/bin/env
>
> Now, with git clone example over HTTPS:
>
> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> Cloning into 'guix-bioinformatics'...
> fatal: unable to access
> 'https://github.com/genenetwork/guix-bioinformatics/': server
> certificate verification failed. CAfile: none CRLfile: none
>
> The system git does not present such an error.
>
> What could be wrong with my setup? Missing certificates?

Please try this:

    export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs

Assuming that nss-certs has been installed into $HOME/.guix-profile this
should be enough to make it work.

I wonder how we can make it easier to tell the user that this
environment variable must be set.

~~ Ricardo

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Dennis Mungai]

Hmmm, thanks ;-)

Perhaps one could set the installation of nss-certs as:

1. A dependency to git, and
2. To print out the environment variable export GTI_SSL_CAPATH once
nss-certs is installed.

I have seen packages such as gtk3 on guix trigger similar variables to
be set when they are installed and loaded from a specific guix
profile, as such:

guix package -p ~/some-profile -i -some-gtk3-app

And then this would be recommended when calling up guix package -p
~/some-profile --search-paths

Taken from the email above as an example:

export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"

So yeah, it can be done ;-)


On 10 May 2016 at 16:11, Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de> wrote:
>
> Dennis Mungai <dmngaie@gmail.com> writes:
>
>> Hello there,
>>
>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>
>> guix package -p ~/opt/guix-build-system --search-paths
>> warning: failed to install locale: Invalid argument
>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>
>> which env returns:
>>
>> which env
>> /home/lin/opt/guix-build-system/bin/env
>>
>> Now, with git clone example over HTTPS:
>>
>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>> Cloning into 'guix-bioinformatics'...
>> fatal: unable to access
>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>> certificate verification failed. CAfile: none CRLfile: none
>>
>> The system git does not present such an error.
>>
>> What could be wrong with my setup? Missing certificates?
>
> Please try this:
>
>     export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs
>
> Assuming that nss-certs has been installed into $HOME/.guix-profile this
> should be enough to make it work.
>
> I wonder how we can make it easier to tell the user that this
> environment variable must be set.
>
> ~~ Ricardo

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Ludovic Courtès]

Dennis Mungai <dmngaie@gmail.com> skribis:

> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>
> guix package -p ~/opt/guix-build-system --search-paths
> warning: failed to install locale: Invalid argument
> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>
> which env returns:
>
> which env
> /home/lin/opt/guix-build-system/bin/env
>
> Now, with git clone example over HTTPS:
>
> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> Cloning into 'guix-bioinformatics'...
> fatal: unable to access
> 'https://github.com/genenetwork/guix-bioinformatics/': server
> certificate verification failed. CAfile: none CRLfile: none
>
> The system git does not present such an error.
>
> What could be wrong with my setup? Missing certificates?
>
> At the moment, I've installed the nss-certs package hoping it would be
> a workaround as these are Mozilla certs, but to no avail.

I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
For instance:

     $ guix package -i nss-certs
     $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
     $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
     $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"

Can you confirm?

Thanks,
Ludo’.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Dennis Mungai]

Sure, will do.

On 10 May 2016 at 16:38, Ludovic Courtès <ludo@gnu.org> wrote:
> Dennis Mungai <dmngaie@gmail.com> skribis:
>
>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>
>> guix package -p ~/opt/guix-build-system --search-paths
>> warning: failed to install locale: Invalid argument
>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>
>> which env returns:
>>
>> which env
>> /home/lin/opt/guix-build-system/bin/env
>>
>> Now, with git clone example over HTTPS:
>>
>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>> Cloning into 'guix-bioinformatics'...
>> fatal: unable to access
>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>> certificate verification failed. CAfile: none CRLfile: none
>>
>> The system git does not present such an error.
>>
>> What could be wrong with my setup? Missing certificates?
>>
>> At the moment, I've installed the nss-certs package hoping it would be
>> a workaround as these are Mozilla certs, but to no avail.
>
> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
> For instance:
>
>      $ guix package -i nss-certs
>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>
> Can you confirm?
>
> Thanks,
> Ludo’.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Dennis Mungai]

Hey there,

Sorry for the late reply.

I used Pjotr's Guix hacking notes to fix the problem , solution:

https://github.com/pjotrp/guix-notes/blob/master/HACKING.org#git-ca-certificates



On 10 May 2016 at 16:46, Dennis Mungai <dmngaie@gmail.com> wrote:
> Sure, will do.
>
> On 10 May 2016 at 16:38, Ludovic Courtès <ludo@gnu.org> wrote:
>> Dennis Mungai <dmngaie@gmail.com> skribis:
>>
>>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>>
>>> guix package -p ~/opt/guix-build-system --search-paths
>>> warning: failed to install locale: Invalid argument
>>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>>
>>> which env returns:
>>>
>>> which env
>>> /home/lin/opt/guix-build-system/bin/env
>>>
>>> Now, with git clone example over HTTPS:
>>>
>>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>>> Cloning into 'guix-bioinformatics'...
>>> fatal: unable to access
>>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>>> certificate verification failed. CAfile: none CRLfile: none
>>>
>>> The system git does not present such an error.
>>>
>>> What could be wrong with my setup? Missing certificates?
>>>
>>> At the moment, I've installed the nss-certs package hoping it would be
>>> a workaround as these are Mozilla certs, but to no avail.
>>
>> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
>> For instance:
>>
>>      $ guix package -i nss-certs
>>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>>
>> Can you confirm?
>>
>> Thanks,
>> Ludo’.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Dennis Mungai]

Also, your workaround worked (in git, at least).

I'm not sure if there are other cases affected by this in the wild.

On 11 May 2016 at 11:10, Dennis Mungai <dmngaie@gmail.com> wrote:
> Hey there,
>
> Sorry for the late reply.
>
> I used Pjotr's Guix hacking notes to fix the problem , solution:
>
> https://github.com/pjotrp/guix-notes/blob/master/HACKING.org#git-ca-certificates
>
>
>
> On 10 May 2016 at 16:46, Dennis Mungai <dmngaie@gmail.com> wrote:
>> Sure, will do.
>>
>> On 10 May 2016 at 16:38, Ludovic Courtès <ludo@gnu.org> wrote:
>>> Dennis Mungai <dmngaie@gmail.com> skribis:
>>>
>>>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>>>
>>>> guix package -p ~/opt/guix-build-system --search-paths
>>>> warning: failed to install locale: Invalid argument
>>>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>>>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>>>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>>>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>>>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>>>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>>>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>>>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>>>
>>>> which env returns:
>>>>
>>>> which env
>>>> /home/lin/opt/guix-build-system/bin/env
>>>>
>>>> Now, with git clone example over HTTPS:
>>>>
>>>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>>>> Cloning into 'guix-bioinformatics'...
>>>> fatal: unable to access
>>>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>>>> certificate verification failed. CAfile: none CRLfile: none
>>>>
>>>> The system git does not present such an error.
>>>>
>>>> What could be wrong with my setup? Missing certificates?
>>>>
>>>> At the moment, I've installed the nss-certs package hoping it would be
>>>> a workaround as these are Mozilla certs, but to no avail.
>>>
>>> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
>>> For instance:
>>>
>>>      $ guix package -i nss-certs
>>>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>>>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>>>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>>>
>>> Can you confirm?
>>>
>>> Thanks,
>>> Ludo’.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[Ludovic Courtès]

Dennis Mungai <dmngaie@gmail.com> skribis:

> Also, your workaround worked (in git, at least).
>
> I'm not sure if there are other cases affected by this in the wild.

Great, thanks for letting us know.

Ludo’.

bug#23504: git 2.7.4 fails to clone repositories over HTTPS sources

[ng0]

[-- Attachment #1: Type: text/plain, Size: 2183 bytes --]

On 2016-05-10(03:11:34+0200), Ricardo Wurmus wrote:
> 
> Dennis Mungai <dmngaie@gmail.com> writes:
> 
> > Hello there,
> >
> > I'm using git 2.7.4 from a guix profile, and here is my current environment:
> >
> > guix package -p ~/opt/guix-build-system --search-paths
> > warning: failed to install locale: Invalid argument
> > export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> > export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> > export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> > export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> > export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> > export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> > export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> > export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> > export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> > export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
> >
> > which env returns:
> >
> > which env
> > /home/lin/opt/guix-build-system/bin/env
> >
> > Now, with git clone example over HTTPS:
> >
> > git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> > Cloning into 'guix-bioinformatics'...
> > fatal: unable to access
> > 'https://github.com/genenetwork/guix-bioinformatics/': server
> > certificate verification failed. CAfile: none CRLfile: none
> >
> > The system git does not present such an error.
> >
> > What could be wrong with my setup? Missing certificates?
> 
> Please try this:
> 
>     export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs
> 
> Assuming that nss-certs has been installed into $HOME/.guix-profile this
> should be enough to make it work.
> 
> I wonder how we can make it easier to tell the user that this
> environment variable must be set.
> 
> ~~ Ricardo

Assuming this currently does not exist (I have not checked it), what
about a note in the manual, application specific, and maybe something
like a message after guix package -i git was run?

-- 
♥Ⓐ ng0

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]