Error while contacting org repository with Emacs 25.3

[JAremko]

With Emacs 25.3 I'm getting:

Contacting host: elpa.gnu.org:443
Opening TLS connection to `elpa.gnu.org'...
Opening TLS connection with `gnutls-cli --x509cafile nil -p 443 elpa.gnu.org'...
Opening TLS connection with `gnutls-cli --x509cafile nil -p 443 elpa.gnu.org'...failed
Opening TLS connection with `gnutls-cli --x509cafile nil -p 443 elpa.gnu.org --protocols ssl3'...
Opening TLS connection with `gnutls-cli --x509cafile nil -p 443 elpa.gnu.org --protocols ssl3'...failed
Opening TLS connection with `openssl s_client -connect elpa.gnu.org:443 -no_ssl2 -ign_eof'...
Opening TLS connection with `openssl s_client -connect elpa.gnu.org:443 -no_ssl2 -ign_eof'...failed
Opening TLS connection to `elpa.gnu.org'...failed

It works fine with newer versions. Could it be that some certificates become outdated?

[jcs090218]

It works fine with newer versions.

I think there are changes after version 25.3. Anyway, I don't think here is the proper place to report this such of issue because this is a CI project that only responsible ensuring the environment is good to execute Emacs successfully.

Could it be that some certificates become outdated?

Base on the log you have put out, it seems like there is significant changes to SSL certification throughout the version from 25.3 to 26.1? 😕

Hope this helps!

[JAremko]

Yeah.. I was hoping that it can be fixed with bundling fresh certificates or something. Like in https://github.com/purcell/nix-emacs-ci 🤔

[jcs090218]

hmmm... do you think this should be resolved by CI? I feel like this isn't something that CI should handle. 😕

I might need more suggestions on this issue. Feel free to ping anyone if you think they can suggest on this!

[JAremko]

@jcs090218 I agree with that. It will be better if Gnus fix it upstream. Or maybe it can be fixed in Windows configs:

On MS-Windows Emacs is supposed to use the system certificate store through MS-Windows native interfaces. 
No additional certificates in a separate bundle should be needed.

So either your GnuTLS version has a bug of some kind, or your Windows system lacks some updates,
 or there's a genuine problem with ELPA's certificates.

If there is a way to fix it via windows configs it can be helpfull to mention it in this repo readme since most of Emacs users might have no idea how windows work while wanting to make sure that their stuff works on Win by using your CI action.

I'll mail dudes at GNU.org.

---

Posted https://debbugs.gnu.org/cgi/bugreport.cgi?bug=43168

[rpluim]

Does your CI have gnutls-cli or openssl s_client installed?

[JAremko]

@rpluim that's what it has https://github.com/actions/virtual-environments/blob/main/images/win/Windows2019-Readme.md

[JAremko]

I'll see if installing them helps.

[jcs090218]

Or maybe it can be fixed in Windows configs:

If there is a way to fix it via windows configs it can be helpfull to mention it in this repo readme since most of Emacs users might have no idea how windows work while wanting to make sure that their stuff works on Win by using your CI action.

I am good to fix it by tweaking the config but that would also be a potential issue when user trying to use Emacs on Windows, then this issue might occurs. I support your thought on maybe somehow mentioned it.

I will leave this issue opened. Let me know if there is any update! :)

[JAremko]

From: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=43168#14

This never worked on Windows, and never will.

You must have an Emacs built with GnuTLS to have HTTPS connections
from Emacs on MS-Windows.  Please get a later release from the GNU FTP
site, it should have GnuTLS built-in.

[JAremko]

If it's true then not working https is a limitation that should be present for proper CI tests

[JAremko]

Actually installing gnutls-cli:

    - name: Install gnutls
      shell: cmd
      run: C:\msys64\usr\bin\pacman --noconfirm -S mingw-w64-x86_64-gnutls
      if: ${{ matrix.os == 'windows-latest' }}

seems to help (also add /c/msys64/mingw64/bin/ to PATH) Now I have different error on Emacs 25.1 probably unrelated 🤔

[JAremko]

actually no. I think it is the same error. Ok then. I'll close the issue. Thanks everyone.