GNU bug report logs - #23504
git 2.7.4 fails to clone repositories over HTTPS sources

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 23504 in the body.
You can then email your comments to 23504 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Dennis Mungai <dmngaie <at> gmail.com>
To: bug-guix <at> gnu.org
Subject: git 2.7.4 fails to clone repositories over HTTPS sources
Date: Tue, 10 May 2016 15:30:22 +0300

Hello there,

I'm using git 2.7.4 from a guix profile, and here is my current environment:

guix package -p ~/opt/guix-build-system --search-paths
warning: failed to install locale: Invalid argument
export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
export INFOPATH="/home/lin/opt/guix-build-system/share/info"
export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"

which env returns:

which env
/home/lin/opt/guix-build-system/bin/env

Now, with git clone example over HTTPS:

git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
Cloning into 'guix-bioinformatics'...
fatal: unable to access
'https://github.com/genenetwork/guix-bioinformatics/': server
certificate verification failed. CAfile: none CRLfile: none

The system git does not present such an error.

What could be wrong with my setup? Missing certificates?

At the moment, I've installed the nss-certs package hoping it would be
a workaround as these are Mozilla certs, but to no avail.

Thanks and regards,

Dennis.

Message #8 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: Dennis Mungai <dmngaie <at> gmail.com>
To: Ricardo Wurmus <ricardo.wurmus <at> mdc-berlin.de>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Tue, 10 May 2016 16:36:05 +0300

Hmmm, thanks ;-)

Perhaps one could set the installation of nss-certs as:

1. A dependency to git, and
2. To print out the environment variable export GTI_SSL_CAPATH once
nss-certs is installed.

I have seen packages such as gtk3 on guix trigger similar variables to
be set when they are installed and loaded from a specific guix
profile, as such:

guix package -p ~/some-profile -i -some-gtk3-app

And then this would be recommended when calling up guix package -p
~/some-profile --search-paths

Taken from the email above as an example:

export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"

So yeah, it can be done ;-)


On 10 May 2016 at 16:11, Ricardo Wurmus <ricardo.wurmus <at> mdc-berlin.de> wrote:
>
> Dennis Mungai <dmngaie <at> gmail.com> writes:
>
>> Hello there,
>>
>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>
>> guix package -p ~/opt/guix-build-system --search-paths
>> warning: failed to install locale: Invalid argument
>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>
>> which env returns:
>>
>> which env
>> /home/lin/opt/guix-build-system/bin/env
>>
>> Now, with git clone example over HTTPS:
>>
>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>> Cloning into 'guix-bioinformatics'...
>> fatal: unable to access
>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>> certificate verification failed. CAfile: none CRLfile: none
>>
>> The system git does not present such an error.
>>
>> What could be wrong with my setup? Missing certificates?
>
> Please try this:
>
>     export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs
>
> Assuming that nss-certs has been installed into $HOME/.guix-profile this
> should be enough to make it work.
>
> I wonder how we can make it easier to tell the user that this
> environment variable must be set.
>
> ~~ Ricardo

Message #11 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Dennis Mungai <dmngaie <at> gmail.com>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Tue, 10 May 2016 15:38:57 +0200

Dennis Mungai <dmngaie <at> gmail.com> skribis:

> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>
> guix package -p ~/opt/guix-build-system --search-paths
> warning: failed to install locale: Invalid argument
> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>
> which env returns:
>
> which env
> /home/lin/opt/guix-build-system/bin/env
>
> Now, with git clone example over HTTPS:
>
> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> Cloning into 'guix-bioinformatics'...
> fatal: unable to access
> 'https://github.com/genenetwork/guix-bioinformatics/': server
> certificate verification failed. CAfile: none CRLfile: none
>
> The system git does not present such an error.
>
> What could be wrong with my setup? Missing certificates?
>
> At the moment, I've installed the nss-certs package hoping it would be
> a workaround as these are Mozilla certs, but to no avail.

I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
For instance:

     $ guix package -i nss-certs
     $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
     $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
     $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"

Can you confirm?

Thanks,
Ludo’.

Message #14 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: Dennis Mungai <dmngaie <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Tue, 10 May 2016 16:46:45 +0300

Sure, will do.

On 10 May 2016 at 16:38, Ludovic Courtès <ludo <at> gnu.org> wrote:
> Dennis Mungai <dmngaie <at> gmail.com> skribis:
>
>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>
>> guix package -p ~/opt/guix-build-system --search-paths
>> warning: failed to install locale: Invalid argument
>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>
>> which env returns:
>>
>> which env
>> /home/lin/opt/guix-build-system/bin/env
>>
>> Now, with git clone example over HTTPS:
>>
>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>> Cloning into 'guix-bioinformatics'...
>> fatal: unable to access
>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>> certificate verification failed. CAfile: none CRLfile: none
>>
>> The system git does not present such an error.
>>
>> What could be wrong with my setup? Missing certificates?
>>
>> At the moment, I've installed the nss-certs package hoping it would be
>> a workaround as these are Mozilla certs, but to no avail.
>
> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
> For instance:
>
>      $ guix package -i nss-certs
>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>
> Can you confirm?
>
> Thanks,
> Ludo’.

Message #17 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: Dennis Mungai <dmngaie <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Wed, 11 May 2016 11:10:50 +0300

Hey there,

Sorry for the late reply.

I used Pjotr's Guix hacking notes to fix the problem , solution:

https://github.com/pjotrp/guix-notes/blob/master/HACKING.org#git-ca-certificates



On 10 May 2016 at 16:46, Dennis Mungai <dmngaie <at> gmail.com> wrote:
> Sure, will do.
>
> On 10 May 2016 at 16:38, Ludovic Courtès <ludo <at> gnu.org> wrote:
>> Dennis Mungai <dmngaie <at> gmail.com> skribis:
>>
>>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>>
>>> guix package -p ~/opt/guix-build-system --search-paths
>>> warning: failed to install locale: Invalid argument
>>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>>
>>> which env returns:
>>>
>>> which env
>>> /home/lin/opt/guix-build-system/bin/env
>>>
>>> Now, with git clone example over HTTPS:
>>>
>>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>>> Cloning into 'guix-bioinformatics'...
>>> fatal: unable to access
>>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>>> certificate verification failed. CAfile: none CRLfile: none
>>>
>>> The system git does not present such an error.
>>>
>>> What could be wrong with my setup? Missing certificates?
>>>
>>> At the moment, I've installed the nss-certs package hoping it would be
>>> a workaround as these are Mozilla certs, but to no avail.
>>
>> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
>> For instance:
>>
>>      $ guix package -i nss-certs
>>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>>
>> Can you confirm?
>>
>> Thanks,
>> Ludo’.

Message #20 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: Dennis Mungai <dmngaie <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Wed, 11 May 2016 11:16:32 +0300

Also, your workaround worked (in git, at least).

I'm not sure if there are other cases affected by this in the wild.

On 11 May 2016 at 11:10, Dennis Mungai <dmngaie <at> gmail.com> wrote:
> Hey there,
>
> Sorry for the late reply.
>
> I used Pjotr's Guix hacking notes to fix the problem , solution:
>
> https://github.com/pjotrp/guix-notes/blob/master/HACKING.org#git-ca-certificates
>
>
>
> On 10 May 2016 at 16:46, Dennis Mungai <dmngaie <at> gmail.com> wrote:
>> Sure, will do.
>>
>> On 10 May 2016 at 16:38, Ludovic Courtès <ludo <at> gnu.org> wrote:
>>> Dennis Mungai <dmngaie <at> gmail.com> skribis:
>>>
>>>> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>>>>
>>>> guix package -p ~/opt/guix-build-system --search-paths
>>>> warning: failed to install locale: Invalid argument
>>>> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
>>>> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
>>>> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
>>>> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
>>>> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
>>>> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
>>>> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>>> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
>>>> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
>>>> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>>>>
>>>> which env returns:
>>>>
>>>> which env
>>>> /home/lin/opt/guix-build-system/bin/env
>>>>
>>>> Now, with git clone example over HTTPS:
>>>>
>>>> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
>>>> Cloning into 'guix-bioinformatics'...
>>>> fatal: unable to access
>>>> 'https://github.com/genenetwork/guix-bioinformatics/': server
>>>> certificate verification failed. CAfile: none CRLfile: none
>>>>
>>>> The system git does not present such an error.
>>>>
>>>> What could be wrong with my setup? Missing certificates?
>>>>
>>>> At the moment, I've installed the nss-certs package hoping it would be
>>>> a workaround as these are Mozilla certs, but to no avail.
>>>
>>> I think you also need to set the ‘GIT_SSL_CAINFO’ environment variable.
>>> For instance:
>>>
>>>      $ guix package -i nss-certs
>>>      $ export SSL_CERT_DIR="$HOME/.guix-profile/etc/ssl/certs"
>>>      $ export SSL_CERT_FILE="$HOME/.guix-profile/etc/ssl/certs/ca-certificates.crt"
>>>      $ export GIT_SSL_CAINFO="$SSL_CERT_FILE"
>>>
>>> Can you confirm?
>>>
>>> Thanks,
>>> Ludo’.

Message #25 received at 23504-done <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Dennis Mungai <dmngaie <at> gmail.com>
Cc: 23504-done <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Wed, 11 May 2016 11:02:01 +0200

Dennis Mungai <dmngaie <at> gmail.com> skribis:

> Also, your workaround worked (in git, at least).
>
> I'm not sure if there are other cases affected by this in the wild.

Great, thanks for letting us know.

Ludo’.

Message #28 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <ricardo.wurmus <at> mdc-berlin.de>
To: Dennis Mungai <dmngaie <at> gmail.com>
Cc: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Tue, 10 May 2016 15:11:34 +0200

Dennis Mungai <dmngaie <at> gmail.com> writes:

> Hello there,
>
> I'm using git 2.7.4 from a guix profile, and here is my current environment:
>
> guix package -p ~/opt/guix-build-system --search-paths
> warning: failed to install locale: Invalid argument
> export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
>
> which env returns:
>
> which env
> /home/lin/opt/guix-build-system/bin/env
>
> Now, with git clone example over HTTPS:
>
> git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> Cloning into 'guix-bioinformatics'...
> fatal: unable to access
> 'https://github.com/genenetwork/guix-bioinformatics/': server
> certificate verification failed. CAfile: none CRLfile: none
>
> The system git does not present such an error.
>
> What could be wrong with my setup? Missing certificates?

Please try this:

    export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs

Assuming that nss-certs has been installed into $HOME/.guix-profile this
should be enough to make it work.

I wonder how we can make it easier to tell the user that this
environment variable must be set.

~~ Ricardo

Message #31 received at 23504 <at> debbugs.gnu.org (full text, mbox):

From: ng0 <ng0 <at> n0.is>
To: 23504 <at> debbugs.gnu.org
Subject: Re: bug#23504: git 2.7.4 fails to clone repositories over HTTPS
 sources
Date: Wed, 11 May 2016 22:07:38 +0000

[Message part 1 (text/plain, inline)]

On 2016-05-10(03:11:34+0200), Ricardo Wurmus wrote:
> 
> Dennis Mungai <dmngaie <at> gmail.com> writes:
> 
> > Hello there,
> >
> > I'm using git 2.7.4 from a guix profile, and here is my current environment:
> >
> > guix package -p ~/opt/guix-build-system --search-paths
> > warning: failed to install locale: Invalid argument
> > export PATH="/home/lin/opt/guix-build-system/bin:/home/lin/opt/guix-build-system/sbin"
> > export XDG_DATA_DIRS="/home/lin/opt/guix-build-system/share"
> > export GUIX_GTK3_PATH="/home/lin/opt/guix-build-system/lib/gtk-3.0"
> > export INFOPATH="/home/lin/opt/guix-build-system/share/info"
> > export PKG_CONFIG_PATH="/home/lin/opt/guix-build-system/lib/pkgconfig"
> > export GUILE_LOAD_COMPILED_PATH="/home/lin/opt/guix-build-system/lib/guile/2.0/ccache"
> > export C_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> > export CPLUS_INCLUDE_PATH="/home/lin/opt/guix-build-system/include"
> > export LIBRARY_PATH="/home/lin/opt/guix-build-system/lib"
> > export ACLOCAL_PATH="/home/lin/opt/guix-build-system/share/aclocal"
> >
> > which env returns:
> >
> > which env
> > /home/lin/opt/guix-build-system/bin/env
> >
> > Now, with git clone example over HTTPS:
> >
> > git clone --branch gn-latest https://github.com/genenetwork/guix-bioinformatics
> > Cloning into 'guix-bioinformatics'...
> > fatal: unable to access
> > 'https://github.com/genenetwork/guix-bioinformatics/': server
> > certificate verification failed. CAfile: none CRLfile: none
> >
> > The system git does not present such an error.
> >
> > What could be wrong with my setup? Missing certificates?
> 
> Please try this:
> 
>     export GIT_SSL_CAPATH=$HOME/.guix-profile/etc/ssl/certs
> 
> Assuming that nss-certs has been installed into $HOME/.guix-profile this
> should be enough to make it work.
> 
> I wonder how we can make it easier to tell the user that this
> environment variable must be set.
> 
> ~~ Ricardo

Assuming this currently does not exist (I have not checked it), what
about a note in the manual, application specific, and maybe something
like a message after guix package -i git was run?

-- 
♥Ⓐ ng0

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.