Bug 27138 - wrong pre-configured location of SSL certificates
Summary: wrong pre-configured location of SSL certificates
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: bzr (show other bugs)
Version: unstable
Hardware: all Linux
: P3 normal
Assignee: cetus@altlinux.org
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-29 22:37 MSK by Ivan Zakharyaschev
Modified: 2012-07-03 17:47 MSK (History)
21 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ivan Zakharyaschev 2012-03-29 22:37:33 MSK 
bzr-2.5.0-alt1

$ bzr checkout lp:inkscape-docs
Value "/etc/ssl/certs/ca-certificates.crt" is not valid for "ssl.ca_certs"
No valid trusted SSL CA certificates file set. See 'bzr help ssl.ca_certs' for more information on setting trusted CAs.

See `bzr help ssl.ca_certs` for how to specify trusted CAcertificates.
Pass -Ossl.cert_reqs=none to disable certificate verification entirely.

bzr: ERROR: _ssl.c:331: No root certificates specified for verification of other-side certificates.
$ locate .crt
/usr/share/ca-certificates/ca-bundle.crt
/usr/share/kde4/apps/kssl/ca-bundle.crt
$
Comment 1 Ivan Zakharyaschev 2012-03-29 22:38:13 MSK 
$ rpm -qf /usr/share/ca-certificates/ca-bundle.crt
ca-certificates-2012.01.17-alt1
$
Comment 2 Ivan Zakharyaschev 2012-03-29 22:39:22 MSK 
Workaround -- this way it works:

$ bzr -Ossl.cert_reqs=none checkout lp:inkscape-docs
Not checking SSL certificate for xmlrpc.launchpad.net: 443
You have not informed bzr of your Launchpad ID, and you must do this to
write to Launchpad or access private data.  See "bzr help launchpad-login".
$
Comment 3 Alexey Shabalin 2012-05-17 13:03:52 MSK 
Ау! почините эту тривиальную багу. Если для bzr ещё и можно использовать Workaround, то для git bzr - нет.
Comment 4 viy 2012-05-19 00:03:00 MSK 
Гм. похоже, этот пакет заброшен.
пакет формально на solo@, 
но Андрей давно не занимается пакетами.
По хорошему acl надо сбросить в nobody@
чтобы кто-то другой подхватил.

Нет возражений?
Comment 5 А. Китайкин 2012-06-29 14:18:24 MSK 
Правильный workaround -- добавить строчку в секцию DEFAULT в файле ~/.bazaar/bazaar.conf:

[DEFAULT]
ssl.ca_certs = /usr/share/ca-certificates/ca-bundle.crt

Еще один правильный workaround -- launchpad-login с последующим доступом по ssh.

Пакет не заброшен. Патчик будет.
Comment 6 Repository Robot 2012-07-03 17:47:59 MSK 
bzr-2.5.0-alt2 -> sisyphus:

* Tue Jul 03 2012 Anatoly Kitaykin <cetus@altlinux> 2.5.0-alt2
- fixed search for SSL CA certificates (Closes: 27138)