bhearsum@mozilla.com (:bhearsum) Reporter
	Description • 12 years ago

We should be configuring it to actually verify certificates rather than ignoring them.

	Stefan Arentz | :st3fan | ⏰ EST | he/him
	Comment 1 • 11 years ago

Context: On for example https://developer.mozilla.org/en-US/docs/Simple_Firefox_build/Linux_and_MacOS_build_preparation we recommend to use --no-check-certificate in case wget gives a certificate validation error. This can happen if the root certificates that shipped with the OS or with wget (?) do not include the root or intermediate for hg.mozilla.org.

I agree that this is a bad practice. Instead of telling people to ignore the error, they should really get their linux distribution or installation of wget up to date.

Note that the suggestion to use --no-check-certificate is bogus anyway because if wget fails then a hg clone will most likely also fail with the same error.

	Stefan Arentz | :st3fan | ⏰ EST | he/him
	Comment 2 • 11 years ago

Oh maybe Ben actually filed a bug for a releng component. I moved it to Core/Build Config but maybe that means I have hijacked his bug? :-)

	Gregory Szorc [:gps]
	Comment 3 • 11 years ago

--no-check-certificate references in the tree:

testing/release/common/download_builds.sh
testing/release/common/download_mars.sh
testing/release/updates/verify.sh
testing/tools/grabber/getpages.sh

	bhearsum@mozilla.com (:bhearsum) Reporter
	Comment 4 • 11 years ago

(In reply to Gregory Szorc [:gps] from comment #3)
> --no-check-certificate references in the tree:
> 
> testing/release/common/download_builds.sh
> testing/release/common/download_mars.sh
> testing/release/updates/verify.sh

These three aren't used anymore - they got moved to hg.mozilla.org/build/tools. They still use this option though, and there's some other references to it in RelEng repos:
https://mxr.mozilla.org/build-central/search?string=--no-check-certificate

	(not currently active) Ted Mielczarek
	Comment 5 • 11 years ago

(In reply to Stefan Arentz [:st3fan] from comment #1)
> Context: On for example
> https://developer.mozilla.org/en-US/docs/Simple_Firefox_build/
> Linux_and_MacOS_build_preparation we recommend to use --no-check-certificate
> in case wget gives a certificate validation error. This can happen if the
> root certificates that shipped with the OS or with wget (?) do not include
> the root or intermediate for hg.mozilla.org.

Can you file a separate bug on this?

I agree that this is terrible, but I'm also sympathetic to having it there because it's probably the difference between "got a working build environment" and "spent 4 hours getting wget working with SSL".

	Nick Thomas [:nthomas] (UTC+12)
	Comment 6 • 10 years ago

Was about to file this bug again ... whoops.

Bug 1066403 upgraded wget on linux, and we don't get cert warnings on hg/ftp/aus3 any more. Mac is OK too, but windows still has 1.10.2 and (presumably) a stale cert bundle. Bug 971157 would get us a newer wget, at which point we may be able to start verifying certs when doing things like update verify.

	Kendall Libby [:fubar] (he/him)
	Comment 7 • 7 years ago

Still an issue, still should be fixed (bug 1391275#c3 etc).

https://dxr.mozilla.org/build-central/search?q=no-check-cert&redirect=false

	:Atoll
	Comment 8 • 7 years ago

Windows has OpenSSL 0.9 as well, for the record, which may or may not contribute to this problem.