Error building ca-certificates from master

dsouza · December 1, 2021, 2:46pm

Since this commit building from master started failing with the following error:

 make[3] -C package/system/ca-certificates compile
    ERROR: package/system/ca-certificates failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/home/dsouza/src/openwrt/master/include/toplevel.mk:230: world] Error 1

The cause is this:

Traceback (most recent call last):
  File "certdata2pem.py", line 125, in <module>
    cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend'

Below is the verbose output from V=s:

Output from make V=s

(...)
make[3]: Entering directory '/home/dsouza/src/openwrt/master/package/system/ca-certificates'
rm -f /home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/.built
touch /home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/.built_check
CFLAGS="-Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -mips16 -minterlink-mips16 -fmacro-prefix-map=/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016=ca-certificates-20211016 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro  -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/usr/include -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/include/fortify -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/include " CXXFLAGS="-Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -mips16 -minterlink-mips16 -fmacro-prefix-map=/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016=ca-certificates-20211016 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro  -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/usr/include -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/include/fortify -I/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/include " LDFLAGS="-L/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/usr/lib -L/home/dsouza/src/openwrt/master/staging_dir/toolchain-mipsel_24kc_gcc-11.2.0_musl/lib -znow -zrelro " make -j1 -C /home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/work AR="mipsel-openwrt-linux-musl-gcc-ar" AS="mipsel-openwrt-linux-musl-gcc -c -Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -fmacro-prefix-map=/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016=ca-certificates-20211016 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro" LD=mipsel-openwrt-linux-musl-ld NM="mipsel-openwrt-linux-musl-gcc-nm" CC="mipsel-openwrt-linux-musl-gcc" GCC="mipsel-openwrt-linux-musl-gcc" CXX="mipsel-openwrt-linux-musl-g++" RANLIB="mipsel-openwrt-linux-musl-gcc-ranlib" STRIP=mipsel-openwrt-linux-musl-strip OBJCOPY=mipsel-openwrt-linux-musl-objcopy OBJDUMP=mipsel-openwrt-linux-musl-objdump SIZE=mipsel-openwrt-linux-musl-size CROSS="mipsel-openwrt-linux-musl-" ARCH="mipsel" ;
make[4]: Entering directory '/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/work'
for dir in mozilla; do \
  make -C $dir all; \
done
make[5]: Entering directory '/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/work/mozilla'
python3 certdata2pem.py
Ignoring certificate "Verisign Class 1 Public Primary Certification Authority - G3".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Verisign Class 2 Public Primary Certification Authority - G3".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Certum Root CA".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Camerfirma Chambers of Commerce Root".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Camerfirma Global Chambersign Root".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Certificate "DST Root CA X3" blacklisted, ignoring.
Ignoring certificate "SwissSign Platinum CA - G2".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "OISTE WISeKey Global Root GA CA".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Chambers of Commerce Root - 2008".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Global Chambersign Root - 2008".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Certificate "Explicitly Distrust DigiNotar Root CA" blacklisted, ignoring.
Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" blacklisted, ignoring.
Certificate "MITM subCA 1 issued by Trustwave" blacklisted, ignoring.
Certificate "MITM subCA 2 issued by Trustwave" blacklisted, ignoring.
Certificate "TURKTRUST Mis-issued Intermediate CA 1" blacklisted, ignoring.
Certificate "TURKTRUST Mis-issued Intermediate CA 2" blacklisted, ignoring.
Ignoring certificate "Staat der Nederlanden Root CA - G3".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Symantec Class 1 Public Primary Certification Authority - G6".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "Symantec Class 2 Public Primary Certification Authority - G6".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "D-TRUST Root CA 3 2013".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "GlobalSign Secure Mail Root R45".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Ignoring certificate "GlobalSign Secure Mail Root E45".  SAUTH=CKT_NSS_MUST_VERIFY_TRUST, EPROT=CKT_NSS_TRUSTED_DELEGATOR
Traceback (most recent call last):
  File "certdata2pem.py", line 125, in <module>
    cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend'
make[5]: *** [Makefile:6: all] Error 1
make[5]: Leaving directory '/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/work/mozilla'
make[4]: *** [Makefile:9: all] Error 2
make[4]: Leaving directory '/home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/work'
make[3]: *** [Makefile:73: /home/dsouza/src/openwrt/master/build_dir/target-mipsel_24kc_musl/ca-certificates-20211016/.built] Error 2
make[3]: Leaving directory '/home/dsouza/src/openwrt/master/package/system/ca-certificates'
time: package/system/ca-certificates/compile#0.51#0.04#0.52
    ERROR: package/system/ca-certificates failed to build.
make[2]: *** [package/Makefile:116: package/system/ca-certificates/compile] Error 1
make[2]: Leaving directory '/home/dsouza/src/openwrt/master'
make[1]: *** [package/Makefile:110: /home/dsouza/src/openwrt/master/staging_dir/target-mipsel_24kc_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/home/dsouza/src/openwrt/master'
make: *** [/home/dsouza/src/openwrt/master/include/toplevel.mk:230: world] Error 2

Anyone else seeing this problem? I'm building for Archer C6 v3 (mt7621).

hnyman · December 1, 2021, 4:55pm

See the probable fix:

github.com/openwrt/openwrt

ca-certificates: fix python3-cryptography woes in certdata2pem.py

committed 02:01PM - 01 Dec 21 UTC

chunkeey

+53 -0

This patch is a revert of the upstream patch to Debian's ca-certificate commit 0…33d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.") The reason is, that this change broke builds with the popular Ubuntu 20.04 LTS (focal) releases which are shipping with an older version of the python3-cryptography package that is not compatible. |Traceback (most recent call last): | File "certdata2pem.py", line 125, in <module> | cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend' |make[5]: *** [Makefile:6: all] Error 1 ...or if the python3-cryptography was missing all together: |Traceback (most recent call last): | File "/certdata2pem.py", line 31, in <module> | from cryptography import x509 |ModuleNotFoundError: No module named 'cryptography' More concerns were raised by Jo-Philipp Wich: "We don't want the build to depend on the local system time anyway. Right now it seems to be just a warning but I could imagine that eventually certs are simply omitted of found to be expired at build time which would break reproducibility." Link: <https://github.com/openwrt/openwrt/commit/7c99085bd697> Reported-by: Chen Minqiang <ptpt52@gmail.com> Reported-by: Shane Synan <digitalcircuit36939@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com>

dsouza · December 1, 2021, 10:14pm

Yep, this patch solved the problem. Thanks!

system · December 11, 2021, 10:14pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.