Re: Cert problem when attemping build of mesa

On Sun, 2025-08-31 at 23:59 +0000, Richard wrote:

/* snip */

> lfs [ ~ ]$ wget  https://crates.io/api/v1/crates/syn/2.0.68/download
> --2025-08-31 11:50:05-- 
> https://crates.io/api/v1/crates/syn/2.0.68/download
> Resolving crates.io (crates.io)... 3.169.149.82, 3.169.149.7,
> 3.169.149.97, ...
> Connecting to crates.io (crates.io)|3.169.149.82|:443... connected.
> ERROR: cannot verify crates.io's certificate, issued by ‘CN=Amazon RSA
> 2048
> M02,O=Amazon,C=US’:
>   Unable to locally verify the issuer's authority.
> To connect to crates.io insecurely, use `--no-check-certificate'.
> 
> And yet firefox 140.2.0 has no problem downloading the file...
> 
> lfs [ ~/Downloads ]$ ls -latr
> total 64040
> drwxr-xr-x 30 lfs lfs     4096 Aug 31 11:49 ..
> -rw-r--r--  1 lfs lfs   265035 Aug 31 11:52 syn-2.0.68.crate
> drwxr-xr-x  2 lfs lfs     4096 Aug 31 11:52 .
> 
> Any advice would be appreciated.  Thanks very much in advance.

Firefox uses a different SSL implementation from wget.  Firefox uses
NSS, and wget uses openssl (if you don't deviate from the book).

And NSS uses an internal certificate store (unrelated to the system one
set by make-ca) if you didn't use the ln -sfv ./pkcs11/p11-kit-trust.so
/usr/lib/libnssckbi.so command.

So there are two possibilities here, if you used the ln command it means
the system certificate store is fine but somehow openssl cannot get it,
for reasons like make-ca has failed to export it to /etc/ssl/certs or
openssl has been simply misconfigured in LFS (I did it once by mistyping
the --openssldir=/etc/ssl option).

If you didn't use the ln command, maybe your system certificate store is
just wrong.

Try the "trust list" command and it should list everything in the system
certificate store.  Then try the ls /etc/ssl/certs command which should
shows the store exported for openssl.

-- 
Xi Ruoyao <[email protected]>

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page