How to manage CA certificate files for git, curl, and other open source tools #130
Replies: 7 comments 14 replies
-
|
That sounds like a good solution to me. As an alternative, we could consider modifying the buildenv of curl and git (maybe in zopen_post_install) to call 'zopen update-cacert', which would download the latest cacert.pem file. We might need to modify zopen update-cacert to be able to provide an output path. This way, when the package file is created, it would always include the latest version of the ca cert. |
Beta Was this translation helpful? Give feedback.
-
|
Can this be moved to a separate config file, so that sites with their own pem packages (TLS intercept proxies at work) can fetch from some internal URL instead? |
Beta Was this translation helpful? Give feedback.
-
|
I feel like z/OS is missing a feature here, where something like the Web Toolkit would own and manage certificates. It's as if we are having to implement this feature on our own. |
Beta Was this translation helpful? Give feedback.
-
|
Ubuntu/Debian have a separate package ca-certificates which can be a dependency for packages which rely on having the certificates in place. See https://packages.ubuntu.com/kinetic/ca-certificates for the package or this article for a description with more words. In this way a browser is not needed for a server build. |
Beta Was this translation helpful? Give feedback.
-
|
I like @ejratl 's answer here after some thinking... @IgorTodorovskiIBM and others - what do you think? Taking an approach similar to the Linux distros has a lot of value to it. |
Beta Was this translation helpful? Give feedback.
-
|
Hi all,
Any thoughts to point to a RACF keyring instead of a CA file package?
Wai
…-------- Original Message --------
From: Igor Todorovski ***@***.***>
Date: Thu, March 16, 2023 9:52 AM -0700
To: ZOSOpenTools/meta ***@***.***>
CC: Wai Choi ***@***.***>, Comment ***@***.***>
Subject: [EXTERNAL] Re: [ZOSOpenTools/meta] How to manage CA certificate files for git, curl, and other open source tools (Discussion #130)
Brew has the same thing here: https: //formulae. brew. sh/formula/ca-certificates We have the runtime dependency support in zopen now, so this is doable — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving
ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender
This message came from outside your organization.
ZjQcmQRYFpfptBannerEnd
Brew has the same thing here: https://formulae.brew.sh/formula/ca-certificates<https://formulae.brew.sh/formula/ca-certificates>
We have the runtime dependency support in zopen now, so this is doable
—
Reply to this email directly, view it on GitHub<https://github.com/orgs/ZOSOpenTools/discussions/130#discussioncomment-5336787>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AXTWEPXPFGFR2MV6FSAYXBTW4NAN7ANCNFSM6AAAAAAUCU323I>.
You are receiving this because you commented.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
I think we are now at the point where we don't actually need certs anymore? Can we close this? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I want to improve the
zopen-setuptool to have it really be a 'works out of the box' experience.There are probably a few other clunky areas, but one I'm keen to fix is around CA certificates that are needed to use tools like
gitandcurl.The current approach is ok but certainly not ideal and requires manual steps to get things setup.
Here are the goals from my perspective of a good solution (opinions wanted)
.bootenvto set up their environmentcurland/orgitand it 'just works' - they do not need any other packageszopen downloadto downloadcurlorgitinto theirproddirectory and they just workcurlorgitinto theirdevdirectory and it just worksHere's my proposal - alternatives welcome, and opinions around security and such also welcome.
metapackage to no longer have aCA certificatein the downloadable pax file for prod/boot, but have it continue to own the primary version of theCA certificatefile (perhaps calledmetacacert.pem), which can be updated periodically. The prod/boot version of meta will delegate togitandcurlto provide their associated CA certificates. Ideally this would be a generated file that we download from the cURL site as part of the build process, but we could cache it if it takes too long to download.curlandgitpackages copy themetacacert.pemfile frommetaas part of their build process into their installation tree. Sincezopen buildis packaged inmeta, we know themetacacert.pemfile will always be available.curlandgit.envfiles set up their respective environment variables, but only if the environment variables are not already set. Thecurl.envwill set upSSL_CERT_FILEto point to${CURL_HOME}/curlcacert.pemIFFSSL_CERT_FILEis not already set. Thegit.envwill set upGIT_SSL_CAINFOto point to${GIT_HOME}/gitcacert.pemIFFSSL_CERT_FILEis not already set.We will continue to have
zopen update-cacertfor people to use if they want to manage their CA certificates and do not want to upgrade their software packageAdvanced users can also have just one common cacert.pem and manually export their environment variable to point to it, if they want full control over the CA certificate.
I think this satisfies the goals at the top, but perhaps there are other goals to consider?
The reason this is different than other development platforms is that typically the web browser on the system owns and manages the CA certs file and tools like
gitandcurlcan just use them, but we don't have that luxury on z/OS.I am not sure how AIX tackles this or a stripped down Linux system that doesn't have a browser?
Everyone's opinions wanted. I would appreciate opinions specifically from @IgorTodorovskiIBM @AnthonyGiorgio @ejratl @phaumer @drbruce-git given your interest in the topic.
Beta Was this translation helpful? Give feedback.
All reactions