dev.java.net errors

Dusty · 2005-06-13 17:31:13

When I try to use makepkg on a PKGBUILD that downloads files from java.net, I get this error:

==> Retrieving Sources...
==>     Downloading java3d-1_3_2-linux-i586.zip
--11:25:09--  https://j3d-core.dev.java.net/files/documents/1674/12428/java3d-1_3_2-linux-i586.zip
           => `java3d-1_3_2-linux-i586.zip'
Resolving j3d-core.dev.java.net... 64.125.133.206
Connecting to j3d-core.dev.java.net|64.125.133.206|:443... connected.
ERROR: Certificate verification error for j3d-core.dev.java.net: self signed certificate in certificate chain
To connect to j3d-core.dev.java.net insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.

Its not possible to not use https. This same file worked fine for me a week ago. I'm getting the same problem with j3d-vrml, a java.net file. I suspect they are all like that.

My question: Is this a bug that could be fixed in makepkg, or something that only java.net should fix? Maybe I should just wait on it?

Dusty

phrakture · 2005-06-13 17:53:29

I'd say java.net should fix it - I mean seriously, who puts downloads behind https 8)

did you try it with wget instead of pacman's internal downloading?

Dusty · 2005-06-13 18:00:16

Its makepkg -- it uses wget internally. I tried it direct too, same error. To get aronud it, you have to pass --no-check-certificates to wget. Works fine then. So as a makepkg bug, we could have makepkg pass this flag to java.net sites (or all https sites...) But I think I'll wait and see if java.net fixes it themselves. Or I'll post a bug report.

Dusty

phrakture · 2005-06-13 18:33:13

Dusty wrote:

Its makepkg -- it uses wget internally.

aha, I spaced that part...

is there anything wrong with using "--no-check-certificates" all the time? I doubt it'd harm anything else....

Dusty · 2005-06-13 18:59:48

that is the question... I'm not sure what to do. I'm bored, I'll go log into java.net and ask about it.

Dusty

cactus · 2005-06-13 19:04:48

A bit less security against dns poisoning/site hijacking, maybe..
Other than that, should be no biggie. It is not like we are exchanging credit card information here, so even if the dns/site was spoofed, the checksum should still work.
It would be odd for someone to spoof a site, and provide pristine source...unless they were doing it as a favor..lol

Arch Linux

#1 2005-06-13 17:31:13

dev.java.net errors

#2 2005-06-13 17:53:29

Re: dev.java.net errors

#3 2005-06-13 18:00:16

Re: dev.java.net errors

#4 2005-06-13 18:33:13

Re: dev.java.net errors

#5 2005-06-13 18:59:48

Re: dev.java.net errors

#6 2005-06-13 19:04:48

Re: dev.java.net errors

Board footer