MIME-Version: 1.0
References: <20210908164806.GC6114@huehner.biz>
In-Reply-To: <20210908164806.GC6114@huehner.biz>
From: Magnus Hagander <magnus@hagander.net>
Date: Tue, 14 Sep 2021 16:33:01 +0200
Message-ID: 
 <CABUevEy1203=uzu7QHw3x04v3tgnbU8wapukZjoY04sVTCsoXw@mail.gmail.com>
Subject: Re: apt.postgresql.org repo via https will fail will some users
 starting 2021-10-01
To: Stefan Huehner <stefan@huehner.org>
Cc: pgsql-pkg-debian@postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CABUevEy1203%3Duzu7QHw3x04v3tgnbU8wapukZjoY04sVTCsoXw%40mail.gmail.com>
Precedence: bulk

On Wed, Sep 8, 2021 at 6:42 PM Stefan Huehner <stefan@huehner.org> wrote:
>
> Hello,
>
> sending this here as looks like https://apt.postgresql.org is affected by=
 this so this could trigger some support/user questions.
>
> Note this only (!) happens when using https:// in sources.list for the pg=
dg repo.
>
> Benefit of that is debatable (see recent debian-devel discussion) but i w=
ould not be surprised if some/many people use it.
>
> Trigger:
> https://community.letsencrypt.org/t/openssl-client-compatibility-changes-=
for-let-s-encrypt-certificates/143816
>
> End of this month some CA cert will expire related to Let's Encrypt which=
 will trigger an bug in clients using old openssl/gnutls.
>
> apt is using gnutls backend and at least the version in Ubuntu <=3D 18.04=
 are affected and "apt update" will already fail for people starting that d=
ate.
>
> Note that canonical is working in patching gnutls so if that finishes in =
time and (!) if people update before that date all good.
>
> If not they will get error similar to:
> Err:9 https://apt.postgresql.org/pub/repos/apt focal-pgdg Release
>   Certificate verification failed: The certificate is NOT trusted. The re=
vocation or OCSP data are old and have been superseded. The certificate cha=
in uses expired certificate.  Could not handshake: Error in the certificate=
 verification. [IP: 87.238.57.227 443]
>
> Can be triggered today i.e. with:
>
> faketime "2021-10-01" apt update
>
> Ideas:
> - Do nothing apt.postgresql suggest http:// in the instructions
> - Some on the website
> - Think on reconfiguring certbot/Let's Encrypt on the server to switch to=
 the alternative chain (avoiding this bug but breaking compatibility with o=
ld Android
>
> - Raise as bug to debian also (against openssl/gnutls) to maybe patch bot=
h in stable also to avoid this ?
>   - Not sure if that is a interesting/acceptable material for stable/old-=
stable?

Hi!

We've started looking into what can and should be done on the infra
side to see if we can get this working.

One question though. In my attempts to reproduce, it seems that *wget*
on Ubuntu 18.04 has no problem with the current chain, just apt-get,
does that match with your testing?  So if one follows our instructions
of getting the gpg key with https but the actual repo with http, it
never actually presents a problem?

That's not saying we don't need to do anything about it, just to
reconfirm our tests. For example, this appears to also break RedHat 6
as well...

--=20
 Magnus Hagander
 Me: https://www.hagander.net/
 Work: https://www.redpill-linpro.com/