Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update certificates in some Ubuntu 16 images. #90550

Merged
merged 1 commit into from
Dec 8, 2021
Merged

Update certificates in some Ubuntu 16 images. #90550

merged 1 commit into from
Dec 8, 2021

Conversation

ehuss
Copy link
Contributor

@ehuss ehuss commented Nov 3, 2021

These images use crosstool-ng, which needs to download various things off the internet. The certificate for www.kernel.org no longer works with the ca-certificates in Ubuntu 16. This resolves the issue by grabbing from a newer image a certificate bundle from https://curl.se/ca/cacert.pem, which is usually somewhat up to date.

@rust-highfive
Copy link
Collaborator

r? @kennytm

(rust-highfive has picked a reviewer for you, use r? to override)

@rust-highfive rust-highfive added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Nov 3, 2021
@ehuss
Copy link
Contributor Author

ehuss commented Nov 3, 2021

There are some alternate approaches this could take:

  • Try to download everything that's needed outside of Ubuntu 16 (like what was done in CI: Use ubuntu image to download openssl, curl sources, cacert.pem for x86 dist builds #90457). However, I don't know how to hook those cached downloads into the crosstools script.
  • Download the ca-certificates.deb file from Ubuntu 20 and copy that over and install it manually. I think that is relatively simple, so I'm happy to try that solution if desired.
  • Update to a newer image. I tried briefly to update to Ubuntu 18, but the crosstools config needs updating for that to work, and I don't want to dig into that. However, I think this in general is a good idea, as these images continue to get older.

I only updated the images that are using crosstools. I did not check if other Ubuntu 16 images need to download things, but a quick skim I didn't see any.

BTW, is there a way to reuse parts of a Dockerfile? I looked around, and didn't see any simple solutions.

@apiraino apiraino added the T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue. label Nov 11, 2021
@JohnCSimon
Copy link
Member

Triage: looks like this still needs work
@rustbot label: +S-waiting-on-author -S-waiting-on-review

@rustbot rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Dec 5, 2021
@ehuss
Copy link
Contributor Author

ehuss commented Dec 5, 2021

@JohnCSimon This is actually waiting on review.

@kennytm Do you think this is something you can review? Or perhaps @Mark-Simulacrum would prefer to review it?

@ehuss ehuss added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Dec 5, 2021
@Mark-Simulacrum Mark-Simulacrum self-assigned this Dec 5, 2021
@Mark-Simulacrum
Copy link
Member

I think this is okay.

I'm not too happy with the impl here, but in general I'm not sure we have great alternatives, and the duplication seems OK. I suspect there's no really great way to change this that is still nice in general. The general pattern we seem to have is that our Dockerfiles get increasingly mangled with workarounds over time, unfortunately, and I'm not sure we can do much to help there.

@bors r+ rollup=iffy

@bors
Copy link
Contributor

bors commented Dec 7, 2021

📌 Commit 951dad6 has been approved by Mark-Simulacrum

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Dec 7, 2021
matthiaskrgr added a commit to matthiaskrgr/rust that referenced this pull request Dec 8, 2021
@matthiaskrgr
Rollup merge of rust-lang#90550 - ehuss:update-ca, r=Mark-Simulacrum
da9f1ee 
Update certificates in some Ubuntu 16 images.

These images use crosstool-ng, which needs to download various things off the internet. The certificate for `www.kernel.org` no longer works with the ca-certificates in Ubuntu 16. This resolves the issue by grabbing from a newer image a certificate bundle from https://curl.se/ca/cacert.pem, which is usually somewhat up to date.
This was referenced Dec 8, 2021
Closed
Merged
bors added a commit to rust-lang-ci/rust that referenced this pull request Dec 8, 2021
@bors
Auto merge of rust-lang#91656 - matthiaskrgr:rollup-lk96y6d, r=matthi…
4459e72 
…askrgr

Rollup of 7 pull requests

Successful merges:

 - rust-lang#83744 (Deprecate crate_type and crate_name nested inside #![cfg_attr])
 - rust-lang#90550 (Update certificates in some Ubuntu 16 images.)
 - rust-lang#91272 (Print a suggestion when comparing references to primitive types in `const fn`)
 - rust-lang#91467 (Emphasise that an OsStr[ing] is not necessarily a platform string)
 - rust-lang#91531 (Do not add `;` to expected tokens list when it's wrong)
 - rust-lang#91577 (Address some FIXMEs left over from rust-lang#91475)
 - rust-lang#91638 (Remove `in_band_lifetimes` from `rustc_mir_transform`)

Failed merges:

r? `@ghost`
`@rustbot` modify labels: rollup
@bors bors merged commit c104236 into rust-lang:master Dec 8, 2021
@rustbot rustbot added this to the 1.59.0 milestone Dec 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@kennytm kennytm

@Mark-Simulacrum Mark-Simulacrum

Labels
S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue.
Projects
None yet
Milestone
1.59.0
Development

Successfully merging this pull request may close these issues.
8 participants
@ehuss @rust-highfive @JohnCSimon @Mark-Simulacrum @bors @kennytm @apiraino @rustbot