Curl SSL connection problem

giacombum · 2017-06-26 15:50:21

Foodie (and other aur packages obviously) are not in my repository, so I don't think it's a problem related to the public key...

Last edited by giacombum (2017-06-26 15:51:07)

seth · 2017-06-26 15:56:19

You authenticate to github with the ssh credentials assigned to your account, it doesn't matter whether you cloned a repo into your account, or fetch it from there.
You need a working ssh setup for github in order to clone any repo via ssh.

giacombum · 2017-06-26 17:17:25

seth wrote:

You authenticate to github with the ssh credentials assigned to your account, it doesn't matter whether you cloned a repo into your account, or fetch it from there.
You need a working ssh setup for github in order to clone any repo via ssh.

Maybe I'm not a git expert, but I don't use ssh to clone a git repo...
Or maybe I haven't understand your statement...

If I use a git clone repo.git, I'm using ssh?

And what do you mean when you say "a working ssh setup for github"?

seth · 2017-06-26 19:22:10

You can use git over https or ssh, "git@github.com:" here indicates the ssh protocol.
Please see the link I posted in https://help.github.com/articles/connec … -with-ssh/
You *must* set this up in order to use ssh.

Btw: if you say "clone or download" on github.com, it lets you select a protocol. Look at the link on the upper right of the popup. What does it say? :-P

giacombum · 2017-06-27 07:20:24

seth wrote:

Do you have a github account?
git clone git@github.com:Fortran-FOSS-Programmers/FOODIE.git

I've added my key to github and now the github cloning works!!!!! Thanks!!!!

So, how can I clone from aur? Can you do a very minimal howto?

jasonwryan · 2017-06-27 07:26:51

There is one on the wiki: https://wiki.archlinux.org/index.php/Ar … uild_files

seth · 2017-06-27 07:41:17

He though needs to clone via ssh to sidestep his weird openssl/TLS handshake issue and I frankly don't even know whether AUR supports that.

giacombum · 2017-06-27 07:45:38

It is very very strange... I'm trying pacaur and I obtain this error:

[giacomo@sputnik]: ~>$ pacaur -Syu -a
:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
:: Starting AUR upgrade...
:: Failed to parse JSON
:: Failed to parse JSON
:: cower is not present in AUR -- skipping
:: pacaur is not present in AUR -- skipping
:: package-query is not present in AUR -- skipping
:: paraview-bin is not present in AUR -- skipping
:: yaourt is not present in AUR -- skipping
 there is nothing to do

So my cluster doesn't "see" aur packages online.

Do you think it could be a firewall problem?

seth · 2017-06-27 13:28:00

pacaur depends on cower depends on curl, so it'll likely directly invoke curl at some point and in this case probably fail to get the databases or anything else - "Failed to parse JSON" sounds like something is unexpectedly no json file (but likely an error message or empty)

Are you behind some external firewall?

giacombum · 2017-06-27 13:58:19

seth wrote:

Are you behind some external firewall?

Yes, I'm behind the firewall of my university department. But if I try to simply go to https://github.com via web browser from the cluster, it works smoothly...

seth · 2017-06-27 14:18:56

=> Install wireshark and record a curl download.
There'll be some "Client Hello" package and then some mess that is not a "Server Hello" package - or nothing...
Ask your admins about whether they impede TLS in any way.

Can you carry the system into another network (because it's a notebook or in doubt via VPN)?

Spyhawk · 2017-06-27 14:59:35

Pacaur uses curl directly, and also through cower for search and info.

Try the following:

curl -sfg --compressed -C 0 "https://aur.archlinux.org/rpc/?v=5&type=info&arg[]=pacaur"

If curl doesn't return any json data here, pacaur will fail.

kokoko3k · 2017-06-27 15:37:47

I encountered the same:
https://bbs.archlinux.org/viewtopic.php?id=226721
...and filed a github bug too:
https://github.com/curl/curl/issues/1520

-EDIT-
D' you have this problem with "unina" network (italy)?
(and/or)
Is your network admin running a content filtering proxy from Palo Alto Networks?

-EDIT2-
Pacman is not the only tool using libcurl, so your best bet, 'till your network admin will "fix" the issue, is to block curl update to 7.53 or (better) compile curl by linking it to openssl 1.0, that way you can continue to use updated curl versions.

# $Id: PKGBUILD 295444 2017-05-07 21:04:33Z jgc $
# Maintainer: Dave Reisner <dreisner@archlinux.org>
# Contributor: Angel Velasquez <angvp@archlinux.org>
# Contributor: Eric Belanger <eric@archlinux.org>
# Contributor: Lucien Immink <l.immink@student.fnt.hvu.nl>
# Contributor: Daniel J Griffiths <ghost1227@archlinux.us>

pkgname=curl-openssl-1.0
pkgver=7.54.0
pkgrel=3
pkgdesc="An URL retrieval utility and library linked against openssl 1.0"
arch=('i686' 'x86_64')
url="https://curl.haxx.se"
license=('MIT')
depends=('ca-certificates' 'krb5' 'libssh2' 'openssl-1.0' 'zlib' 'libpsl' 'libnghttp2')
provides=('libcurl.so' "curl=$pkgver")
conflicts=('curl')
options=('strip' 'debug')
source=("https://curl.haxx.se/download/curl-$pkgver.tar.gz"{,.asc})
sha512sums=('57f73a4ffece65f4e12e30b1d4be4f54f434693ba64d32eca0da036830389854b699a6e0ad6c3d9e847eab73981de6d8ebdb1820cc8a40a5d163aec37ab554aa'
            'SKIP')
validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2'   # Daniel Stenberg
              '914C533DF9B2ADA2204F586D78E11C6B279D5C91')  # Daniel Stenberg (old key)

build() {
  cd "curl-$pkgver"
  export PKG_CONFIG_PATH=/usr/lib/openssl-1.0/pkgconfig
  ./configure \
      --prefix=/usr \
      --mandir=/usr/share/man \
      --disable-ldap \
      --disable-ldaps \
      --enable-ipv6 \
      --enable-manual \
      --enable-versioned-symbols \
      --enable-threaded-resolver \
      --with-gssapi \
      --with-random=/dev/urandom \
      --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt

  make
}

package() {
  cd "curl-$pkgver"

  make DESTDIR="$pkgdir" install

  # license
  install -Dm644 COPYING "$pkgdir/usr/share/licenses/curl/COPYING"
}

I already submitted a ticket to my network admin with dumps from wireshark and explained what was all about, but he just ignored me... i'm not even sure he understood what i wrote, to be fair.
...but soon or later, they will encounter the issue (php+libcurl comes to mind!) and i'll laugh because i'm sure they will spend so much time in trying to identify it

Last edited by kokoko3k (2017-06-27 15:52:07)

Spyhawk · 2017-06-27 16:36:48

kokoko3k wrote:

...but soon or later, they will encounter the issue (php+libcurl comes to mind!) and i'll laugh because i'm sure they will spend so much time in trying to identify it

That could be reeaaally later, if they use servers with some long term support. At which point the issue might not be relevant anymore.
Use bleeding edge at your own risk

giacombum · 2017-06-28 10:50:00

Is there a way to use aria2 instead of curl in any AUR helper?

giacombum · 2017-06-28 10:53:06

kokoko3k wrote:

I encountered the same:
https://bbs.archlinux.org/viewtopic.php?id=226721
...and filed a github bug too:
https://github.com/curl/curl/issues/1520
-EDIT-
D' you have this problem with "unina" network (italy)?
(and/or)
Is your network admin running a content filtering proxy from Palo Alto Networks?
-EDIT2-
Pacman is not the only tool using libcurl, so your best bet, 'till your network admin will "fix" the issue, is to block curl update to 7.53 or (better) compile curl by linking it to openssl 1.0, that way you can continue to use updated curl versions.
# $Id: PKGBUILD 295444 2017-05-07 21:04:33Z jgc $
# Maintainer: Dave Reisner <dreisner@archlinux.org>
# Contributor: Angel Velasquez <angvp@archlinux.org>
# Contributor: Eric Belanger <eric@archlinux.org>
# Contributor: Lucien Immink <l.immink@student.fnt.hvu.nl>
# Contributor: Daniel J Griffiths <ghost1227@archlinux.us>

pkgname=curl-openssl-1.0
pkgver=7.54.0
pkgrel=3
pkgdesc="An URL retrieval utility and library linked against openssl 1.0"
arch=('i686' 'x86_64')
url="https://curl.haxx.se"
license=('MIT')
depends=('ca-certificates' 'krb5' 'libssh2' 'openssl-1.0' 'zlib' 'libpsl' 'libnghttp2')
provides=('libcurl.so' "curl=$pkgver")
conflicts=('curl')
options=('strip' 'debug')
source=("https://curl.haxx.se/download/curl-$pkgver.tar.gz"{,.asc})
sha512sums=('57f73a4ffece65f4e12e30b1d4be4f54f434693ba64d32eca0da036830389854b699a6e0ad6c3d9e847eab73981de6d8ebdb1820cc8a40a5d163aec37ab554aa'
            'SKIP')
validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2'   # Daniel Stenberg
              '914C533DF9B2ADA2204F586D78E11C6B279D5C91')  # Daniel Stenberg (old key)

build() {
  cd "curl-$pkgver"
  export PKG_CONFIG_PATH=/usr/lib/openssl-1.0/pkgconfig
  ./configure \
      --prefix=/usr \
      --mandir=/usr/share/man \
      --disable-ldap \
      --disable-ldaps \
      --enable-ipv6 \
      --enable-manual \
      --enable-versioned-symbols \
      --enable-threaded-resolver \
      --with-gssapi \
      --with-random=/dev/urandom \
      --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt

  make
}

package() {
  cd "curl-$pkgver"

  make DESTDIR="$pkgdir" install

  # license
  install -Dm644 COPYING "$pkgdir/usr/share/licenses/curl/COPYING"
}
I already submitted a ticket to my network admin with dumps from wireshark and explained what was all about, but he just ignored me... i'm not even sure he understood what i wrote, to be fair.
...but soon or later, they will encounter the issue (php+libcurl comes to mind!) and i'll laugh because i'm sure they will spend so much time in trying to identify it

I'm under the Sapienza SPV net, I don't know if the admins filter the traffic with proxies...

You've linked to me this (I suppose) PKGBUILD, do I use it to build a curl version linked to openssl 1.0? And after that I install the package?

kokoko3k · 2017-06-28 12:49:13

Yes, put it into an empty folder, name the file: "PKGBUILD", use makepkg to make the package and pacman -U to install it.

If you can, please open a ticket and link the bug report i opened to curl.

Assumed that with openssl-1.0 you will be able to use curl, that's weird, we're both from Italy but from two different networks (i live in Naples,you Rome), but still we're facing the very same problem.

giacombum · 2017-06-28 13:05:40

IT WORKS!!!!!!!!!!!!! thanks for your help!!! I mark it as solved!!!

kokoko3k · 2017-06-28 18:01:29

giacombum wrote:

I mark it as solved!!!

You sure?

A Future Pilot · 2017-08-05 19:37:30

I had a similar problem and installing libcurl-compat solved it for me.

kokoko3k · 2017-10-19 12:14:34

" "Fixed" " in the latest curl by the following:
https://github.com/curl/curl/commit/ea1 … 389a6510ac

Arch Linux

#26 2017-06-26 15:50:21

Re: Curl SSL connection problem

#27 2017-06-26 15:56:19

Re: Curl SSL connection problem

#28 2017-06-26 17:17:25

Re: Curl SSL connection problem

#29 2017-06-26 19:22:10

Re: Curl SSL connection problem

#30 2017-06-27 07:20:24

Re: Curl SSL connection problem

#31 2017-06-27 07:26:51

Re: Curl SSL connection problem

#32 2017-06-27 07:41:17

Re: Curl SSL connection problem

#33 2017-06-27 07:45:38

Re: Curl SSL connection problem

#34 2017-06-27 13:28:00

Re: Curl SSL connection problem

#35 2017-06-27 13:58:19

Re: Curl SSL connection problem

#36 2017-06-27 14:18:56

Re: Curl SSL connection problem

#37 2017-06-27 14:59:35

Re: Curl SSL connection problem

#38 2017-06-27 15:37:47

Re: Curl SSL connection problem

#39 2017-06-27 16:36:48

Re: Curl SSL connection problem

#40 2017-06-28 10:50:00

Re: Curl SSL connection problem

#41 2017-06-28 10:53:06

Re: Curl SSL connection problem

#42 2017-06-28 12:49:13

Re: Curl SSL connection problem

#43 2017-06-28 13:05:40

Re: Curl SSL connection problem

#44 2017-06-28 18:01:29

Re: Curl SSL connection problem

#45 2017-08-05 19:37:30

Re: Curl SSL connection problem

#46 2017-10-19 12:14:34

Re: Curl SSL connection problem

Board footer