Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-14 Thread Gerben Wierda via macports-users
I contacted NLNet Labs, they updated their certs which made NSD fetch on Mojave work again for me. Somewhere during my tests accidentally OpenSSL was activated on my machine (a destroot on nsd 4.3.8 maybe?), which killed all the installed ports that were dependent on an opensll 1.1.1 dylib

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Dave Horsfall
On Sun, 7 Nov 2021, Bill Cole wrote: So I wonder how widespread this problem is? The problem in this case is not the existence of the cert in the CA bundle, but the fact that this particular expired cert was used in an alternative validation path and the logic of verification for multi-path

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Bill Cole
On 2021-11-07 at 16:29:30 UTC-0500 (Mon, 8 Nov 2021 08:29:30 +1100 (EST)) Dave Horsfall is rumored to have said: On Sun, 7 Nov 2021, Bill Cole wrote: I have my own Mojave machines working without a problem after removing the bad certificate from /etc/ssl/cert.pem. The one that starts like

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Dave Horsfall
On Sun, 7 Nov 2021, Bill Cole wrote: I have my own Mojave machines working without a problem after removing the bad certificate from /etc/ssl/cert.pem. The one that starts like this: [...] Intrigued, I checked my own: mackie:~ dave$ grep "Not After" /etc/ssl/cert.pem Not

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Bill Cole
On 2021-11-07 at 06:40:01 UTC-0500 (Sun, 7 Nov 2021 12:40:01 +0100) Gerben Wierda via macports-users is rumored to have said: The reason is libcurl in Mojave which is less permissive than High Sierra. I'm unconvinced of that. I have my own Mojave machines working without a problem after

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread André-John Mas
Actually it was more about curl, using that as a reference point to see if it was behaving differently with certificates based on user. André-John Sent from my phone. Envoyé depuis mon téléphone. > On 07 Nov 2021, at 01:03, Kastus Shchuka wrote: > >  > >> On Nov 6, 2021, at 7:53 PM,

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Ryan Schmidt
On Nov 7, 2021, at 00:03, Kastus Shchuka wrote: > > On the other hand, it's plain dumb why it works for me. As you can see below, > org.macports.fetch does not use HTTPS, it downloads over HTTP. Certificates > are just irrelevant for that. > > I am not sure what part of macports.conf

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Gerben Wierda via macports-users
The reason is libcurl in Mojave which is less permissive than High Sierra. Sent from my iPhone > On 7 Nov 2021, at 03:08, Kastus Shchuka wrote: > > Something does not add up here. > > High Sierra is older than Mojave, right? I can fetch sources of nsd on High > Sierra without any problems:

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-07 Thread Masha Vecherkovskaya
Hi. Just out of interest I’ve tried to fetch nsd on my Mojave Absolutely standard MacPorts installation MacBook-Pro:~ mashavecher$ sudo port -d fetch nsd Password: DEBUG: Copying /Users/mashavecher/Library/Preferences/com.apple.dt.Xcode.plist to /opt/local/var/macports/home/Library/Preferences

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-06 Thread Kastus Shchuka
> On Nov 6, 2021, at 7:53 PM, André-John Mas wrote: > > Does it make a difference if you test via sudo or your own user login? > Well, it won't work as regular user. Regular user does not have write permissions to /opt/local tree. On the other hand, it's plain dumb why it works for me. As

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-06 Thread André-John Mas
Does it make a difference if you test via sudo or your own user login? André-John Sent from my phone. Envoyé depuis mon téléphone. > On 06 Nov 2021, at 22:08, Kastus Shchuka wrote: > > Something does not add up here. > > High Sierra is older than Mojave, right? I can fetch sources of nsd

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-06 Thread Kastus Shchuka
Something does not add up here. High Sierra is older than Mojave, right? I can fetch sources of nsd on High Sierra without any problems: $ sudo port -d fetch nsd DEBUG: Copying /Users/pike/Library/Preferences/com.apple.dt.Xcode.plist to /opt/local/var/macports/home/Library/Preferences

Re: port cannot fetch because of expired cert, but cert is OK according to Safari, curl (question related to Mojave / Catalina)

2021-11-06 Thread Ryan Schmidt
On Nov 6, 2021, at 05:39, Gerben Wierda wrote: > I was looking at updating nsd (for which I am maintaining and it is high time) > > But fetching failed on macOS Mojave (where I have my MacPorts setup). > > :debug:fetch Executing org.macports.fetch (nsd) > :info:fetch ---> nsd-4.3.8.tar.gz