Update repo URLs to luarocks.org instead of rocks.moonscript.org #488
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, this used an old URL and downloaded over HTTP, in cleartext. This commit updates to the URL that the old one redirects to, and changes to HTTPS encryption for security. HTTPS is currently impossible on rocks.moonscript.org because the security certificate for that domain expired in May 2015.
|
The Travis CI build is incorrectly failing the HTTPS certificate check. A check of the certificate through Firefox shows that it is still valid, so this is a bug on Travis's end. Appveyor is not throwing certificate errors. |
|
A quick hack to fix this would be to pass the |
|
After looking closer, the certificate issuer being reported by wget in the Travis CI build does NOT match what I get when I visit the site in Firefox. Something may be fishy here, and thus I would strongly recommend against the It's also worth noting that possible issues like this are one reason why HTTPS is a good idea. |
|
Can you try installing the and try again. |
|
Done, and didn't solve the issue. As I said above, the certificate issuer listed in the Travis build log does not match the issuer on the certificate I receive when visiting the site through Firefox. It sounds like something's intercepting the request or something like that. At this point I would recommend contacting Travis CI for support, because I'm pretty sure the problem is on their end. |
|
I'm no security expert but I don't think we're dealing with a man-in-the-middle attack or something like that. It seems that luarocks.org is presenting a different certificate when accessed with a browser (issued to luarocks.org) but presenting the old one (issued to rocks.moonscript.org) when accessed with wget or curl. Maybe @leafo can shed some light on why this happens. |
|
The problem is not wget or curl. Both work fine with https://luarocks.org/. The problem is right here in the test script. |
|
|
|
@siffiejoe Yet my pull request already changes that to "https://luarocks.org" (and in |
|
Right, it also says |
|
@siffiejoe can you post the output of wget with luarocks.org? My copy of wget (1.11.4) does not work. I get the certificate issued to rocks.moonscript.org |
|
Sure. |
|
Thank you. Can you post the output of |
I see an expired cert. |
|
Thanks @daurnimator that's what I get, also when using wget. I'm curious why does it work for @siffiejoe ?? |
|
Mine looks similar to @daurnimator's: And I have found a slightly older Ubuntu box (12.04), where I get the error: |
|
Somehow my wget picks up the correct certificate ... |
|
Ubuntu 12.04 is what's used by Travis CI, so that seems like a likely cause. Perhaps we need to upgrade wget in the (Side note to @siffiejoe: I love the smiley face as a shell prompt. :) ) |
Indeed. mine does too. The issue appears to be SNI related. Looks like the server's default host if no SNI is passed is rocks.moonscript.org. |
|
IIRC, luasec does not support SNI (see brunoos/luasec#44) for the https module, so this is quite possibly the issue. As a workaround, I advise @leafo to make luarocks.org the default cert served for that IP. |
|
In the meantime |
|
I updated the nginx config on the site to use luarocks.org as the default server. |
|
Thanks @leafo. The build now passes, the second commit adding ca-certificates is not needed. |
|
I'd remove that commit, but I don't know how to revert a commit once it's been pushed. (I'm not very knowledgeable about the advanced aspects of Git.) How do I remove the commit from GitHub? |
|
@jcgoble3 try |
|
Done, and Travis just threw the same error again. :/ |
|
It just reused the old result. Restarted. |
|
Yay! Thank you to @daurnimator for identifying the problem and @leafo for fixing the server. :D |
mpeterv
added a commit
that referenced
this pull request
Jan 25, 2016
Update repo URLs to luarocks.org instead of rocks.moonscript.org
|
Well thank you all. I've learnt some new stuff about certificates. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Previously, this used an old URL and downloaded over HTTP, in cleartext. This commit updates to the URL that the old one redirects to, and changes to HTTPS encryption for security. HTTPS is currently impossible on rocks.moonscript.org because the security certificate for that domain expired in May 2015.
See posts on the lua-l mailing list tonight (not yet visible in the lua-l archives) for more context.