Upgrade ca-certificates when creating container#70
Upgrade ca-certificates when creating container#70amartinz wants to merge 1 commit intoubports:masterfrom
Conversation
|
Hmm... the commit message gives an impression that |
would that be ok? |
Maybe the long description of the commit message could be: "Explicitly add the ca-certificate packages to force it to be upgraded to the latest version". I wonder, though, if it wouldn't be better to run a full |
Xenial's ca-certificates is outdated and needs to be updated or websites using Let's encrypt will not be reachable. This will break building certain packages which fetch from such websites, like bluez: ----- Installing arm64 (host amd64) build dependencies for bluez in container bluez-usdk-16-04-amd64-arm64-dev. Downloading upstream source tarball of bluez in container to bluez_5.42+ubports5.orig.tar.xz. --2022-06-21 16:17:11-- http://www.kernel.org/pub/linux/bluetooth/bluez-5.41.tar.xz Resolving www.kernel.org (www.kernel.org)... 145.40.68.75, 2604:1380:4601:e00::1 Connecting to www.kernel.org (www.kernel.org)|145.40.68.75|:80... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://www.kernel.org/pub/linux/bluetooth/bluez-5.41.tar.xz [following] --2022-06-21 16:17:12-- https://www.kernel.org/pub/linux/bluetooth/bluez-5.41.tar.xz Connecting to www.kernel.org (www.kernel.org)|145.40.68.75|:443... connected. ERROR: cannot verify www.kernel.org's certificate, issued by 'CN=R3,O=Let\'s Encrypt,C=US': Issued certificate has expired. To connect to www.kernel.org insecurely, use `--no-check-certificate'. ----- Explicitly add ca-certificate to the list of packages to install to force it to be upgraded to the latest version. Signed-off-by: Alexander Martinz <alexander@ubports.com>
amartinz
changed the title
This failed spectaculary on my end, tried this before sending this PR. Another option would be to update the sdk images we provide. |
3 participants
Xenial's ca-certificates is outdated and needs to be updated or
websites using Let's encrypt will not be reachable.
This will break building certain packages which fetch from such
websites, like bluez:
Explicitly add ca-certificate to the list of packages to install to force it to be upgraded to the latest version.