[Buildroot] [PATCH for-2021.08.x] support/docker: remove expired mozilla/DST_Root_CA_X3.crt

[Romain Naour]

Hello Peter,

Le 18/11/2021 à 10:22, Peter Korsgaard a écrit :
>>>>>> "Romain" == Romain Naour <romain.naour at gmail.com> writes:
> 
>  > Since the 30th Sep 2021 the docker image used the gitlab-ci is not able
>  > to download the toolchain archive from https://toolchains.bootlin.com due
>  > to an expired certificate.
> 
>  > wget https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
>  > Connecting to toolchains.bootlin.com (toolchains.bootlin.com)|51.254.149.199|:443... connected.
>  > ERROR: The certificate of ‘toolchains.bootlin.com’ is not trusted.
>  > ERROR: The certificate of ‘toolchains.bootlin.com’ has expired.
> 
>  > Remove expired mozilla/DST_Root_CA_X3.crt [1].
> 
>  > [1] https://stackoverflow.com/questions/69408776/how-to-force-older-debian-to-forget-about-dst-root-ca-x3-expiration-and-use-isrg
> 
>  > Signed-off-by: Romain Naour <romain.naour at gmail.com>
>  > Cc: Yann E. MORIN <yann.morin.1998 at free.fr>
>  > ---
>  > Backport this patch for 2021.08.x and 2021.02.x using buildroot/base:20200814.2228
> 
> How does this actually work? Who builds that container? Do we not need
> a corresponding update of .gitlab-ci.yml then?

Well, usually it's Arnout or Yann that build and push containers to dockerhub.
On master we recently switched to gitlab registry, so maintainers and developers
of Buildroot gitlab project can update containers.

The .gitlab-ci.yml is changed as soon as the container is rebuild using the
updated Dockerfile (after the commit of Dockerfile change).

> 
> 
>  > ---
>  >  support/docker/Dockerfile | 2 ++
>  >  1 file changed, 2 insertions(+)
> 
>  > diff --git a/support/docker/Dockerfile b/support/docker/Dockerfile
>  > index a9bacca3a0..e65f840da8 100644
>  > --- a/support/docker/Dockerfile
>  > +++ b/support/docker/Dockerfile
>  > @@ -47,6 +47,8 @@ RUN apt-get install -y --no-install-recommends \
>  >          unzip \
>  >          wget \
>  >          && \
>  > +    sed -i '/^mozilla\/DST_Root_CA_X3.crt$/ s/^/!/' /etc/ca-certificates.conf && \
>  > +    update-ca-certificates && \
> 
> Alternatively we could just update to the latest stretch release instead
> of this snapshot from 2017:
> 
> docker run --rm -it debian:9.13
> root at 42ec5ca75f0a:/# apt-get update && \
>   apt-get install -y --no-install-recommends ca-certificates wget
> 
> root at 42ec5ca75f0a:/# wget https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
> --2021-11-18 09:20:03--  https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2
> Resolving toolchains.bootlin.com (toolchains.bootlin.com)... 51.254.149.199
> Connecting to toolchains.bootlin.com (toolchains.bootlin.com)|51.254.149.199|:443... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 127456563 (122M) [application/x-bzip2]
> Saving to: 'aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2'
> 
> ing-edge-2020.08-1.t  85%[==================>    ] 103.51M  16.9MB/s    eta 1s     F
> aarch64--glibc--blee 100%[======================>] 121.55M  16.6MB/s    in 7.4s
> 
> 2021-11-18 09:20:10 (16.5 MB/s) - 'aarch64--glibc--bleeding-edge-2020.08-1.tar.bz2' saved [127456563/127456563]
> 
Indeed but we may introduce some (unlikely) regression in the testsuite.

Or add --no-check-certificate to BR2_WGET:

https://gitlab.com/kubu93/buildroot/-/commit/d7828f18149c7fd70c9482aac02dc1a185694442

Best regards,
Romain