NetBSD Problem Report #58144

From www@netbsd.org  Fri Apr 12 14:36:18 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id EA81A1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 12 Apr 2024 14:36:17 +0000 (UTC)
Message-Id: <20240412143616.8F98A1A923A@mollari.NetBSD.org>
Date: Fri, 12 Apr 2024 14:36:16 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: SSLCERTBUNDLE isn't set reliably for clean builds or cross-builds
X-Send-Pr-Version: www-1.0

>Number:         58144
>Category:       pkg
>Synopsis:       SSLCERTBUNDLE isn't set reliably for clean builds or cross-builds
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 12 14:40:00 +0000 2024
>Last-Modified:  Tue Aug 27 15:15:01 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The NetSSL Certbundle
>Environment:
>Description:
security/openssl/builtin.mk has a variable SSLCERTBUNDLE pointing to a single-file bundle of system trust anchors for TLS.

It is unconditionally initialized to ${SSLDIR}/certs/ca-bundle.crt, but only if that file exists at build-time (under ${_CROSS_DESTDIR}).

In a NetBSD 10 cross-build, this file usually _doesn't_ exist at build-time -- it's created at install- or upgrade-time by certctl(8), not at build-time by build.sh/make.

In a NetBSD 9 clean build, this file also doesn't exist in a clean build environment, such as pbulk, even if users typically use mozilla-rootcerts or mozilla-rootcerts-openssl.  Thus, e.g., https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All/curl-8.7.1.tgz has SSLCERTBUNDLE empty instead of /etc/openssl/certs/ca-bundle.crt.
>How-To-Repeat:
build www/curl for NetBSD with mozilla-rootcerts-openssl installed or not
>Fix:
Yes, please!

>Audit-Trail:
From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@NetBSD.org, pkgsrc-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/58144: SSLCERTBUNDLE isn't set reliably for clean builds or cross-builds
Date: Tue, 27 Aug 2024 15:11:36 +0000

 SSLCERTBUNDLE is also set wrong on NetBSD altogether!

 In NetBSD>=10 base, or in NetBSD<10 with mozilla-rootcerts, the
 concatenated pem bundle is at

 /etc/openssl/certs/ca-certificates.crt

 but security/openssl/builtin.mk only looks at

 ${SSLDIR}/certs/ca-bundle.crt

 where SSLDIR=/etc/openssl on NetBSD.

 I don't know which systems use ca-bundle.crt, but we should probably
 arrange to set SSLCERTBUNDLE=/etc/openssl/certs/ca-certificates.crt on
 NetBSD>=10 by default.

Home	PR Database Search