public inbox for [email protected]  

help / color / mirror / Atom feed

From: Peter Eisentraut <[email protected]>
To: PostgreSQL on Debian and Ubuntu <[email protected]>
Subject: should postgresql-common depend on ca-certificates?
Date: Sun, 5 Oct 2025 15:33:14 +0200
Message-ID: <[email protected]> (raw)

If I follow the Quickstart at 
https://wiki.postgresql.org/wiki/Apt#Quickstart but use 
--no-install-recommends, things don't quite work.  (I realize I'm going 
off the well-trodden path, but this is useful for CI setups to avoid 
installing packages you don't strictly need.)  For example, on Ubuntu 24.04:

apt-get update
apt-get -y --no-install-recommends install gnupg postgresql-common
/usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y

Then you get warnings like this:

   Certificate verification failed: The certificate is NOT trusted. The 
certificate issuer is unknown.  Could not handshake: Error in the 
certificate verification. [IP: 151.101.3.52 443]
W: https://apt.postgresql.org/pub/repos/apt/dists/noble-pgdg/InRelease: 
No system certificates available. Try installing ca-certificates.

When you install ca-certificates, then the whole thing works. 
Apparently, there is a "recommends" dependency somewhere down the chain, 
but postgresql-common itself doesn't mention it.

I don't know what the right solution is, but maybe a combination of

1) postgresql-common at least "suggests" ca-certificates.
2) apt.postgresql.org.sh should do more checking that the setup it 
creates actually works.
3) The wiki page quickstart makes more explicit mention of 
ca-certificates.  (It is mentioned for the manual setup.)

view thread (3+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: should postgresql-common depend on ca-certificates?
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox