From: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>
Subject: Re: Moving to HTTPS
To: Tom Lane <tgl@sss.pgh.pa.us>
References: <89d566b4-58fb-c1e9-97ef-46d4d915b86c@dunslane.net>
 <20170107215523.GA294152@tornado.leadboat.com>
 <96080bc2-086f-c47f-6cee-b7f00a9bcd38@2ndQuadrant.com>
 <3104.1483834327@sss.pgh.pa.us>
 <a04ba257-712f-b47e-54bd-a2ee1087f014@2ndQuadrant.com>
 <7217.1484469582@sss.pgh.pa.us>
Cc: buildfarm-members@postgresql.org, buildfarm-admins@postgresql.org
Message-ID: <9535692b-fe3d-18fc-0080-68914f1bf7f1@2ndQuadrant.com>
Date: Sun, 15 Jan 2017 08:59:28 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.0
MIME-Version: 1.0
In-Reply-To: <7217.1484469582@sss.pgh.pa.us>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: buildfarm-members-owner@postgresql.org


On 01/15/2017 03:39 AM, Tom Lane wrote:
> Andrew Dunstan <andrew.dunstan@2ndquadrant.com> writes:
>> On 01/07/2017 07:12 PM, Tom Lane wrote:
>>> Andrew Dunstan <andrew.dunstan@2ndquadrant.com> writes:
>>>> Yeah, you're right. Or perhaps even more simply we could do:
>>>> perl -MLWP::Simple -e 'print qq{BAD\n} unless head(q{https://www.postgresql.org});'
>>> Hmm, so that reports BAD on all four of my buildfarm critters :-(.
>> Ugh. I was afraid of something like that. We might need to look at
>> providing a proxy or something.
> After further fooling with this, it seems the root cause is that you
> need Perl (specifically Net::SSLeay) to be linked to OpenSSL 0.9.8
> or later.  Since we require at least 0.9.8 for PG itself, this does
> not seem like an unreasonably heavy lift.
>
> I found that some of the involved modules, particularly IO::Socket::SSL
> and LWP::Protocol::https, fail a few of their regression tests even
> with 0.9.8.  But if you tell cpan to ignore that and install them
> anyway, it seems like things work; at least, the simple test proposed
> above now works on all four of my buildfarm critters.  It will be
> interesting to see whether that equates to "buildfarm script can talk
> to https server".  Do we have any more-thorough test case available?


The test should be thorough enough. If you want to try it for real and 
you're using the same that you built against, just change the URLs in 
your config file, i.e.:

     sed -i -e 
s,http://www.pgbuildfarm.org/,https://buildfarm.postgresql.org/, 
your-config-file


cheers

andrew


-- 
Andrew Dunstan                https://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via buildfarm-members mailing list (buildfarm-members@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/buildfarm-members