NetBSD Problem Report #60359

From www@netbsd.org  Wed Jun 24 01:14:34 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 50AEE1A923A
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 24 Jun 2026 01:14:34 +0000 (UTC)
Message-Id: <20260624011433.1A76F1A923B@mollari.NetBSD.org>
Date: Wed, 24 Jun 2026 01:14:33 +0000 (UTC)
From: agc@pkgsrc.org
Reply-To: agc@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: Sysinst, installing new 11.99.6 aarch64 vm: "ftp: Unsupported URL scheme `https'"
X-Send-Pr-Version: www-1.0
X-From4GNATS: "agc@pkgsrc.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60359
>Category:       install
>Synopsis:       Sysinst, installing new 11.99.6 aarch64 vm: "ftp: Unsupported URL scheme `https'"
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    install-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 24 01:15:00 +0000 2026
>Last-Modified:  Fri Jun 26 09:15:01 +0000 2026
>Originator:     Alistair Crooks
>Release:        NetBSD-11.99.6 using DAILY iso from morden with mtime 23-Jun-2026 19:53
>Organization:
None
>Environment:
Similar to this (I built this myself, but used the ISO from DAILY on morden): NetBSD agc-vm-20250222.localdomain 11.99.6 NetBSD 11.99.6 (GENERIC64) #0: Mon Jun 22 13:50:23 PDT 2026  agc@agc-vm-20250222.localdomain:/usr/build/obj/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
>Description:
Using sysinst to make a new aarch64 VM (on Fusion)

Network is set up.

Unable to fetch and unpack pkgsrc, with the URL scheme as https (the default) - I get the error message "ftp: Unsupported URL scheme `https'"

(the http scheme will just hang. However, the ftp scheme connects, and fetches properly)

Not sure if the CDN has anything to do with it
>How-To-Repeat:
See description
>Fix:
Workaround is to use ftp scheme, but not a particularly good first impression.

>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: "ftp:
 Unsupported URL scheme `https'"
Date: Wed, 24 Jun 2026 11:11:31 +0200

 On Wed, Jun 24, 2026 at 01:15:00AM +0000, agc@pkgsrc.org via gnats wrote:
 > Using sysinst to make a new aarch64 VM (on Fusion)

 Which install medium (or ramdisk kernel) are you using?
 I did this yesterday from the USB image and all worked fine.

 I could imagine a ftp version compiled with -DSMALL as part of a ramdisk
 having no https support, but for aarch64 this sounds super strange.
 And it would be kinda tricky to auto-detect this for sysinst, so we'd have
 to pass a -DFTP_HAS_NO_HTTPS or simmilar to the crunched sysinst build
 for that case.

 Martin

From: Alistair Crooks <alistaircrooks@gmail.com>
To: gnats-bugs@netbsd.org
Cc: install-manager@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: "ftp:
 Unsupported URL scheme `https'"
Date: Wed, 24 Jun 2026 14:33:46 -0700

 --00000000000027884c065506a27a
 Content-Type: text/plain; charset="UTF-8"

 The iso from
 https://nycdn.netbsd.org/pub/NetBSD-daily/HEAD/20260623165324Z/images/NetBSD-11.99.6-evbarm-aarch64.iso
 was used.

 I also tried later with the 11.0_RC5 iso, and the same thing happened
 i.e. https scheme => invalid scheme, http => just hangs, ftp scheme => just
 works

 Networking was set up in the VM, autoselect.

 I think the certctl line completed successfully after unpacking the sets,
 but it was really difficult to tell, it happened very quickly.

 On Wed, 24 Jun 2026 at 02:15, Martin Husemann via gnats <
 gnats-admin@netbsd.org> wrote:

 > The following reply was made to PR install/60359; it has been noted by
 > GNATS.
 >
 > From: Martin Husemann <martin@duskware.de>
 > To: gnats-bugs@netbsd.org
 > Cc:
 > Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm:
 > "ftp:
 >  Unsupported URL scheme `https'"
 > Date: Wed, 24 Jun 2026 11:11:31 +0200
 >
 >  On Wed, Jun 24, 2026 at 01:15:00AM +0000, agc@pkgsrc.org via gnats wrote:
 >  > Using sysinst to make a new aarch64 VM (on Fusion)
 >
 >  Which install medium (or ramdisk kernel) are you using?
 >  I did this yesterday from the USB image and all worked fine.
 >
 >  I could imagine a ftp version compiled with -DSMALL as part of a ramdisk
 >  having no https support, but for aarch64 this sounds super strange.
 >  And it would be kinda tricky to auto-detect this for sysinst, so we'd have
 >  to pass a -DFTP_HAS_NO_HTTPS or simmilar to the crunched sysinst build
 >  for that case.
 >
 >  Martin
 >
 >
 >

 --00000000000027884c065506a27a
 Content-Type: text/html; charset="UTF-8"
 Content-Transfer-Encoding: quoted-printable

 <div dir=3D"ltr"><div>The iso from=C2=A0<a href=3D"https://nycdn.netbsd.org=
 /pub/NetBSD-daily/HEAD/20260623165324Z/images/NetBSD-11.99.6-evbarm-aarch64=
 .iso">https://nycdn.netbsd.org/pub/NetBSD-daily/HEAD/20260623165324Z/images=
 /NetBSD-11.99.6-evbarm-aarch64.iso</a> was used.</div><div><br></div><div>I=
  also tried later with the 11.0_RC5 iso, and the same thing happened</div><=
 div>i.e. https scheme =3D&gt; invalid scheme, http =3D&gt; just hangs, ftp =
 scheme =3D&gt; just works</div><div><br></div><div>Networking was set up in=
  the VM, autoselect.</div><div><br></div><div>I think the certctl line comp=
 leted successfully after unpacking the sets, but it was really difficult to=
  tell, it happened very quickly.</div></div><br><div class=3D"gmail_quote g=
 mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, 24 Jun =
 2026 at 02:15, Martin Husemann via gnats &lt;<a href=3D"mailto:gnats-admin@=
 netbsd.org">gnats-admin@netbsd.org</a>&gt; wrote:<br></div><blockquote clas=
 s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r=
 gb(204,204,204);padding-left:1ex">The following reply was made to PR instal=
 l/60359; it has been noted by GNATS.<br>
 <br>
 From: Martin Husemann &lt;<a href=3D"mailto:martin@duskware.de" target=3D"_=
 blank">martin@duskware.de</a>&gt;<br>
 To: <a href=3D"mailto:gnats-bugs@netbsd.org" target=3D"_blank">gnats-bugs@n=
 etbsd.org</a><br>
 Cc: <br>
 Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: &qu=
 ot;ftp:<br>
 =C2=A0Unsupported URL scheme `https&#39;&quot;<br>
 Date: Wed, 24 Jun 2026 11:11:31 +0200<br>
 <br>
 =C2=A0On Wed, Jun 24, 2026 at 01:15:00AM +0000, <a href=3D"mailto:agc@pkgsr=
 c.org" target=3D"_blank">agc@pkgsrc.org</a> via gnats wrote:<br>
 =C2=A0&gt; Using sysinst to make a new aarch64 VM (on Fusion)<br>
 <br>
 =C2=A0Which install medium (or ramdisk kernel) are you using?<br>
 =C2=A0I did this yesterday from the USB image and all worked fine.<br>
 <br>
 =C2=A0I could imagine a ftp version compiled with -DSMALL as part of a ramd=
 isk<br>
 =C2=A0having no https support, but for aarch64 this sounds super strange.<b=
 r>
 =C2=A0And it would be kinda tricky to auto-detect this for sysinst, so we&#=
 39;d have<br>
 =C2=A0to pass a -DFTP_HAS_NO_HTTPS or simmilar to the crunched sysinst buil=
 d<br>
 =C2=A0for that case.<br>
 <br>
 =C2=A0Martin<br>
 <br>
 <br>
 </blockquote></div>

 --00000000000027884c065506a27a--

From: Taylor R Campbell <riastradh@NetBSD.org>
To: Martin Husemann <martin@duskware.de>
Cc: gnats-bugs@netbsd.org, install-manager@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org, agc@pkgsrc.org
Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: "ftp:
	Unsupported URL scheme `https'"
Date: Wed, 24 Jun 2026 21:52:33 +0000

 > Date: Wed, 24 Jun 2026 11:11:31 +0200
 > From: Martin Husemann <martin@duskware.de>
 >=20
 > I could imagine a ftp version compiled with -DSMALL as part of a ramdisk
 > having no https support, but for aarch64 this sounds super strange.
 > And it would be kinda tricky to auto-detect this for sysinst, so we'd have
 > to pass a -DFTP_HAS_NO_HTTPS or simmilar to the crunched sysinst build
 > for that case.

 Do we have any automatic tests of the path to fetch pkgsrc.tgz?  Have
 you tested and confirmed it works?

 It looks like, when fetching pkgsrc.tgz, sysinst runs ftp(1) _outside_
 the chroot where certctl(8) has configured trust anchors:

     976 static int
     977 pkgsrc_fetch(const char *set_name)
     978 {
     979 	return do_ftp_fetch(set_name, true, &pkgsrc);
     980 }
     981=20
     982 static int
     983 do_ftp_fetch(const char *set_name, bool force_tgz, struct ftpinfo *=
 f)
     984 {
 ...
    1000 	rval =3D run_program(RUN_DISPLAY | RUN_PROGRESS | RUN_XFER_DIR,
    1001 		    "/usr/bin/ftp %s%s/%s%s",

 https://nxr.netbsd.org/xref/src/usr.sbin/sysinst/net.c?r=3D1.45#976

 That ftp(1) was probably built with -DSMALL, too.

 In contrast, sysinst runs pkg_add(1) _inside_ the chroot where
 certctl(8) has configured trust anchors:

     360 		/*
     361 		 * Make sure we have the TLS certs in a usable state
     362 		 * (if target is a new installation)
     363 		 */
     364 		if (pkg.xfer =3D=3D XFER_HTTPS)
     365 			run_program(RUN_CHROOT | RUN_SILENT,
     366 			    "/bin/sh /etc/rc.d/certctl_init onestart");
     367=20
     368 		make_url(pkgpath, &pkg, pkg_dir);
     369 		if (run_program(RUN_DISPLAY | RUN_PROGRESS | RUN_CHROOT,
     370 			"pkg_add %s/pkgin", pkgpath) =3D=3D 0) {

 https://nxr.netbsd.org/xref/src/usr.sbin/sysinst/configmenu.c?r=3D1.23#360

 (I'm confused by the comment there, because it looks like for a new
 installation, sysinst already runs certctl rehash on unpacking sets:
 https://nxr.netbsd.org/xref/src/usr.sbin/sysinst/util.c?r=3D1.83#1598
 Maybe the comment is about existing installations instead of new
 installations?)

From: Martin Husemann <martin@duskware.de>
To: Alistair Crooks <alistaircrooks@gmail.com>
Cc: gnats-bugs@netbsd.org
Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: "ftp:
 Unsupported URL scheme `https'"
Date: Thu, 25 Jun 2026 14:17:40 +0200

 This sounds like the ftp(1) compiled into the ramdisk.fs image in

 	src/distrib/evbarm/instkernel/ramdisk

 is not working properly.

 I found no traces of SMALLPROG disabling https: support in the ftp sources.

 Martin

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60359 CVS commit: src/usr.sbin/sysinst
Date: Thu, 25 Jun 2026 15:11:06 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Thu Jun 25 15:11:05 UTC 2026

 Modified Files:
 	src/usr.sbin/sysinst: Makefile.inc configmenu.c defs.h main.c menus.mi
 	    net.c

 Log Message:
 When compiled with SMALLPROG (i.e. as part of a crunched ramdisk userland)
 ftp(1) does not support https - so remove that option from sysinst and
 only offer http in that case.
 Should fix PR 60359.


 To generate a diff of this commit:
 cvs rdiff -u -r1.53 -r1.54 src/usr.sbin/sysinst/Makefile.inc
 cvs rdiff -u -r1.23 -r1.24 src/usr.sbin/sysinst/configmenu.c
 cvs rdiff -u -r1.95 -r1.96 src/usr.sbin/sysinst/defs.h
 cvs rdiff -u -r1.36 -r1.37 src/usr.sbin/sysinst/main.c
 cvs rdiff -u -r1.30 -r1.31 src/usr.sbin/sysinst/menus.mi
 cvs rdiff -u -r1.45 -r1.46 src/usr.sbin/sysinst/net.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Alistair Crooks <alistaircrooks@gmail.com>
To: gnats-bugs@netbsd.org
Cc: install-manager@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: install/60359: Sysinst, installing new 11.99.6 aarch64 vm: "ftp:
 Unsupported URL scheme `https'"
Date: Thu, 25 Jun 2026 23:34:52 -0700

 --00000000000004a6c50655224f21
 Content-Type: text/plain; charset="UTF-8"

 It should be easy to work out what's happening by dropping into the shell
 after unpacking sets, certctl, and network setup, to try out Taylor's idea
 about the chroot vs the "display" side of things.

 It sounds like Fusion is a different network setup to qemu, as you are
 unable to reproduce in your testing.

 I'll try dropping into the shell on a burner VM tomorrow

 --00000000000004a6c50655224f21
 Content-Type: text/html; charset="UTF-8"
 Content-Transfer-Encoding: quoted-printable

 <div dir=3D"ltr"><div>It should be easy to work out what&#39;s happening by=
  dropping into the=C2=A0shell after unpacking sets, certctl, and network se=
 tup, to try out Taylor&#39;s idea about the chroot vs the &quot;display&quo=
 t; side of things.</div><div><br></div><div>It sounds like Fusion is a diff=
 erent network setup to qemu, as you are unable to reproduce in your testing=
 .</div><div><br></div><div>I&#39;ll try dropping into the shell on a burner=
  VM tomorrow</div></div>

 --00000000000004a6c50655224f21--

From: "Julian Coleman" <jdc@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60359 CVS commit: [netbsd-11] src/usr.sbin/sysinst
Date: Fri, 26 Jun 2026 09:10:50 +0000

 Module Name:	src
 Committed By:	jdc
 Date:		Fri Jun 26 09:10:49 UTC 2026

 Modified Files:
 	src/usr.sbin/sysinst [netbsd-11]: Makefile.inc configmenu.c defs.h
 	    main.c menus.mi net.c

 Log Message:
 Pull up the following revisions, requested by martin in ticket #335:

 src/usr.sbin/sysinst/Makefile.inc               1.54
 src/usr.sbin/sysinst/configmenu.c               1.24
 src/usr.sbin/sysinst/defs.h                     1.96
 src/usr.sbin/sysinst/main.c                     1.37
 src/usr.sbin/sysinst/menus.mi                   1.31
 src/usr.sbin/sysinst/net.c                      1.46

 When compiled with SMALLPROG (i.e. as part of a crunched ramdisk
 userland) ftp(1) does not support https - so remove that option from
 sysinst and only offer http in that case.
 Should fix PR 60359.


 To generate a diff of this commit:
 cvs rdiff -u -r1.50.2.1 -r1.50.2.2 src/usr.sbin/sysinst/Makefile.inc
 cvs rdiff -u -r1.21 -r1.21.2.1 src/usr.sbin/sysinst/configmenu.c
 cvs rdiff -u -r1.94 -r1.94.2.1 src/usr.sbin/sysinst/defs.h
 cvs rdiff -u -r1.34 -r1.34.2.1 src/usr.sbin/sysinst/main.c
 cvs rdiff -u -r1.30 -r1.30.2.1 src/usr.sbin/sysinst/menus.mi
 cvs rdiff -u -r1.45 -r1.45.4.1 src/usr.sbin/sysinst/net.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search