Install and use Homebrew's `ca-certificates` on macOS <= 10.15.5 by Bo98 · Pull Request #12167 · Homebrew/brew

Bo98 · 2021-10-01T14:07:12Z

Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same change?
Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes? Here's an example.
Have you successfully run brew style with your changes locally?
Have you successfully run brew typecheck with your changes locally?
Have you successfully run brew tests with your changes locally?

The final step. Must be merged after #12166.

BrewTestBot · 2021-10-01T14:07:29Z

Review period skipped due to critical label.

MikeMcQuaid

😭 👍🏻

Bo98 · 2021-10-03T01:30:18Z

Following discussion Homebrew/homebrew-core#86291 (comment), I've changed this PR so that we only install one formula: ca-certificates (arriving soon to homebrew-core) and then set SSL_CERT_FILE. This allows system curl to still be used, which greatly simplifies the situation with homebrew-test-bot.

Bo98 · 2021-10-03T01:46:44Z

One caveat with this new approach is that the SSL bug is still present so this issue can resurface in the future.

If this happens, it can be fixed by brew postinstall ca-certificates or we can revision bump the formula to force this to happen. Though this can sometimes be paired with a cert bundle update anyway - Curl/Mozilla released a new version on 2021-09-30, the day of the expiry of the old Let's Encrypt root certificate, to remove it from Curl/Mozilla's copy (and the postinstall should filter it out from the keychain too, if the update is done post-expiry).

Library/Homebrew/cmd/update.sh

Bo98 · 2021-10-03T04:06:53Z

Hmm SecureTransport on 10.10 still doesn't seem to work even with this. Might end up with a hybrid here where some really old versions need a full brewed curl but Mojave etc can live with just ca-certificates - will investigate more tomorrow.

Rylan12

Looks good to me. At some point, it will be great to check that the brew install calls here work with HOMEBREW_INSTALL_FROM_API but that isn't a priority at the moment.

carlocab · 2021-10-03T06:36:17Z

Hmm SecureTransport on 10.10 still doesn't seem to work even with this. Might end up with a hybrid here where some really old versions need a full brewed curl but Mojave etc can live with just ca-certificates - will investigate more tomorrow.

Given @EricFromCanada's tests this seems to work on Sierra or newer. I suggest we ship this as soon as we can to fix users who are on those systems. We can always work on a fix for older OSs after.

Rylan12 · 2021-10-03T06:46:03Z

I suggest we ship this as soon as we can

We need to wait for Homebrew/homebrew-core#86304 gets through, first

Also just a reminder that this will need a new brew tag

carlocab · 2021-10-03T11:12:17Z

Also, I wonder if this will allow us to get rid of using: :homebrew_curl.

Bo98 · 2021-10-03T13:43:41Z

Also, I wonder if this will allow us to get rid of using: :homebrew_curl.

I wasn't around when this was added. Why was this necessary? Which platforms did this affect?

carlocab · 2021-10-03T13:49:02Z

Cert errors on Mojave, I think. @iMichka should know the details.

Let's find out ourselves, shall we? Homebrew/homebrew-core#86378.

Edit: Hmm, no, it's not a cert error:

❯ /usr/bin/curl https://www.theora.org
curl: (35) error:1400442E:SSL routines:CONNECT_CR_SRVR_HELLO:tlsv1 alert protocol version

Bo98 · 2021-10-03T14:31:02Z

Ok xiph seems to require TLS 1.3, which macOS LibreSSL does not support. Neither does Secure Transport.

Bo98 · 2021-10-03T16:53:27Z

Ok so I've added an extra < Sierra check, which will install a full brewed curl. 10.12-10.15.5 will have the lightweight ca-certificates route.

Rylan12 · 2021-10-03T17:43:50Z

Ok so I've added an extra < Sierra check, which will install a full brewed curl. 10.12-10.15.5 will have the lightweight ca-certificates route.

Sorry if I just missed this, but why won't the ca-certificates route work on < Sierra?

Bo98 · 2021-10-03T17:48:31Z

It seems there's some Secure Transport bug or something. Tests on 10.10 & 10.11 reveal that ftp.gnu.org just returns "not trusted" even when passed the ISRG Root X1 alone. Hard to get any meaningful information from Secure Transport - it has poor debugging support.

My guess is it doesn't handle alernative chains properly.

Eric tested all macOS versions and found it works on 10.12 and later.

Bo98 · 2021-10-03T17:50:35Z

Basically we're seeing curl/curl#976 on < Sierra.

Bo98 · 2021-10-04T04:29:22Z

Must be merged after #12166.

I hate chickens, and I hate eggs.

This can't happen because it needs the nghttp2 PR, but the nghttp2 PR fails because it needs to revision bump formulae outside the curl dep tree and they use HTTPS, which is broken and needs this PR, and the brewed curl test-bot workaround also doesn't work because the nghttp2 PR revision bumps brewed curl itself.

Lost? I don't blame you.

Luckily nghttp2 and its remaining deps all use GitHub so it should be ok.

This is needed to fix Homebrew/core CI. See Homebrew/brew#12167.

carlocab · 2021-10-04T08:12:12Z

Here's the first successful Homebrew/core CI job from this change: https://github.com/Homebrew/homebrew-core/pull/86421/checks?check_run_id=3788099599

I needed Homebrew/homebrew-test-bot@4fd658e before it worked though. Not sure why.

Bo98 · 2021-10-04T11:57:16Z

I needed Homebrew/homebrew-test-bot@4fd658e before it worked though. Not sure why.

This'll be because we never export HOMEBREW_FORCE_BREWED_CA_CERTIFICATES, so it can't be checked in Ruby.

Either we start exporting it or we instead check DevelopmentTools.ca_file_handles_most_https_certificates?.

(Same scenario with curl, even though we don't really need it for any of our CI.)

MikeMcQuaid

Thanks for this!

MikeMcQuaid · 2021-10-04T12:13:18Z

Library/Homebrew/cmd/update.sh

+    # we cannot install Homebrew CA certificates if homebrew/core is unavailable.
+    if [[ -d "${HOMEBREW_LIBRARY}/Taps/homebrew/homebrew-core" || -n "${HOMEBREW_INSTALL_FROM_API}" ]]
+    then
+      brew install ca-certificates || true


the || true seems undesirable here, we want to handle if this fails (with at least a message), no?

I had a reason in my head before but so much has changed that I can't remember it and it probably no longer applies.

I'm not sure what the message would be though. The solution for brewed curl and git is to install it yourself and put it in the PATH. This doesn't apply to CA certificates.

I think it's worth just failing in this case, then.

carlocab · 2021-10-04T12:38:20Z

Either we start exporting it or we instead check DevelopmentTools.ca_file_handles_most_https_certificates?.

Homebrew/homebrew-test-bot#674

Bo98 added do not merge critical Critical change which should be shipped as soon as possible. labels Oct 1, 2021

BrewTestBot approved these changes Oct 1, 2021

View reviewed changes

Bo98 changed the title ~~brew.sh: required brewed curl on macOS <= 10.15.5~~ brew.sh: require brewed curl on macOS <= 10.15.5 Oct 1, 2021

Bo98 force-pushed the brewed-curl-old-macos branch from 9395c36 to f312e3c Compare October 1, 2021 14:11

MikeMcQuaid approved these changes Oct 1, 2021

View reviewed changes

Bo98 force-pushed the brewed-curl-old-macos branch from f312e3c to 5ff474c Compare October 3, 2021 01:30

Bo98 changed the title ~~brew.sh: require brewed curl on macOS <= 10.15.5~~ Install and use Homebrew's ca-certificates on macOS <= 10.15.5 Oct 3, 2021

Bo98 requested a review from carlocab October 3, 2021 01:31

Bo98 force-pushed the brewed-curl-old-macos branch 2 times, most recently from 4d29c33 to 6618497 Compare October 3, 2021 01:42

carlocab approved these changes Oct 3, 2021

View reviewed changes

Library/Homebrew/cmd/update.sh Outdated Show resolved Hide resolved

Bo98 force-pushed the brewed-curl-old-macos branch 2 times, most recently from cdb134a to d8e89d7 Compare October 3, 2021 04:04

Rylan12 approved these changes Oct 3, 2021

View reviewed changes

Install and use Homebrew's ca-certificates on macOS <= 10.15.5

1952d27

Bo98 force-pushed the brewed-curl-old-macos branch from d8e89d7 to 1952d27 Compare October 3, 2021 16:52

Rylan12 approved these changes Oct 3, 2021

View reviewed changes

This was referenced Oct 4, 2021

nghttp2: split libraries into separate libnghttp2 formula Homebrew/homebrew-core#86291

Closed

ca-certificates 2021-07-05 (new formula) Homebrew/homebrew-core#86304

Closed

Bo98 removed the do not merge label Oct 4, 2021

Bo98 merged commit ebc0783 into Homebrew:master Oct 4, 2021

Bo98 deleted the brewed-curl-old-macos branch October 4, 2021 04:30

carlocab added a commit to carlocab/homebrew-test-bot that referenced this pull request Oct 4, 2021

lib/tests/formulae: install ca-certificates if needed

b2b7bb0

This is needed to fix Homebrew/core CI. See Homebrew/brew#12167.

This was referenced Oct 4, 2021

lib/tests/formulae: install ca-certificates if needed Homebrew/homebrew-test-bot#672

Merged

lib/test_bot: set HOMEBREW_FORCE_BREWED_CA_CERTIFICATES on Mojave Homebrew/homebrew-test-bot#673

Merged

MikeMcQuaid reviewed Oct 4, 2021

View reviewed changes

carlocab mentioned this pull request Oct 4, 2021

MacOS system curl broken after letsencrypt CA cert expiry #12161

Closed

2 tasks

github-actions bot added the outdated PR was locked due to age label Nov 4, 2021

github-actions bot locked as resolved and limited conversation to collaborators Nov 4, 2021

Uh oh!

Conversation

Bo98 commented Oct 1, 2021

Uh oh!

BrewTestBot commented Oct 1, 2021

Uh oh!

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Uh oh!

Bo98 commented Oct 3, 2021

Uh oh!

Bo98 commented Oct 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Bo98 commented Oct 3, 2021

Uh oh!

Rylan12 left a comment

Choose a reason for hiding this comment

Uh oh!

carlocab commented Oct 3, 2021

Uh oh!

Rylan12 commented Oct 3, 2021

Uh oh!

carlocab commented Oct 3, 2021

Uh oh!

Bo98 commented Oct 3, 2021

Uh oh!

carlocab commented Oct 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Bo98 commented Oct 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Bo98 commented Oct 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Rylan12 commented Oct 3, 2021

Uh oh!

Bo98 commented Oct 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Bo98 commented Oct 3, 2021

Uh oh!

Bo98 commented Oct 4, 2021

Uh oh!

carlocab commented Oct 4, 2021

Uh oh!

Bo98 commented Oct 4, 2021

Uh oh!

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Oct 4, 2021

Choose a reason for hiding this comment

Uh oh!

Bo98 Oct 4, 2021

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Oct 4, 2021

Choose a reason for hiding this comment

Uh oh!

carlocab commented Oct 4, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Bo98 commented Oct 3, 2021 •

edited

Loading

carlocab commented Oct 3, 2021 •

edited

Loading

Bo98 commented Oct 3, 2021 •

edited

Loading

Bo98 commented Oct 3, 2021 •

edited

Loading

Bo98 commented Oct 3, 2021 •

edited

Loading