16077 2025-11-26 12:47:00 +0000 opkg in SDK fails to validate server certificates 2025-12-22 10:32:19 +0000 1 1 7 Build System, Metadata & Runtime OE-Core oe-core other unspecified x86 Multiple RESOLVED FIXED Medium+ normal 5.0.15 1 Moritz.Haase Moritz.Haase randy.macleod steve --- --- Don't know oldest_to_newest 103378 0 Moritz.Haase 2025-11-26 12:47:00 +0000 Change https://git.openembedded.org/openembedded-core/commit/?id=4909a46e93ba774c960c3d3c277e2a669af3fea6 (or more specifically, it's backport to Scarthgap) has broken opkg in the SDK for us: It now fails to download packages via HTTPS (from a server with a "proper" certificate from a public CA), reporting: > SSL certificate problem: self-signed certificate in certificate chain It looks like the env variables set by [0] and others like 'SSL_CERT_(DIR|FILE)' (see [1]) are only taken into account by curl on the command line (see [2]), but not by libcurl, which opkg uses. Removing the default CA bundle option from the build now means that libcurl doesn't have any CA certificates to verify against unless explicitly configured (previously it was using 'ca-certificates.crt' shipped by the SDK). Since opkg doesn't have any env var handling built-in, it ends up without a CA bundle and fails to verify certificates. Based on a discussion on the mailing list, the workaround suggested in [3] seems to be the best course of action to fix this and still respect host settings. It'd mean that there is a sensible default of using the host system's bundle for verification for all programs using libcurl (unless they implement their own override mechanisms). [0]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl/environment.d-curl.sh [1]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh [2]: https://github.com/curl/curl/blob/de7b3e89218467159a7af72d58cea8425946e97d/src/tool_operate.c#L2586-L2623 [3]: https://lists.openembedded.org/g/openembedded-core/topic/115993530#msg226756 103379 1 Moritz.Haase 2025-11-26 12:47:39 +0000 I'm currently preparing a patch with the aforementioned fix for submission to the mailing list. 103429 2 Moritz.Haase 2025-11-28 06:25:11 +0000 Patch has been submitted to the mailing list for 'master': https://patchwork.yoctoproject.org/project/oe-core/patch/20251127103129.2564918-1-Moritz.Haase@bmw.de/ 103459 3 randy.macleod 2025-12-02 19:43:15 +0000 Merged so resolving: https://git.openembedded.org/openembedded-core/commit/?id=545e43a7a45be02fda8fc3af69faa20e889f58c4 ❯ git branch -a --contains 545e43a7a45be02fda8fc3af69faa20e889f58c4 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/master-next Thanks Moritz! 103464 4 Moritz.Haase 2025-12-03 06:35:20 +0000 @Randy: Looks like there has been a minor mix-up and the ticket will need to be re-opened. My commit that got merged and that you linked to ("curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respected") is related, but not the actual fix. That'd be "curl: Use host CA bundle by default for native(sdk) builds" (linked in my previous comment), which hasn't been accepted yet. 103482 5 randy.macleod 2025-12-04 00:54:52 +0000 Moritz, Oops, my bad. Thanks for correcting the situation. I'll leave resolution of this bug to you but I've moved it to "IN PROGRESS DESIGN" since it is in that state. ../Randy 103634 6 Moritz.Haase 2025-12-22 10:32:19 +0000 Actual fix has now been merged: https://git.openembedded.org/openembedded-core/commit/?id=3f819f57aa1960af36ac0448106d1dce7f38c050 ❯ git branch -a --contains 3f819f57aa1960af36ac0448106d1dce7f38c050 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/master-next