public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
From: Adam Dinwoodie <adam@dinwoodie.org>
To: cygwin@cygwin.com
Subject: Re: Setup 2.917 fails to load mirror list
Date: Thu, 10 Feb 2022 15:27:25 +0000	[thread overview]
Message-ID: <20220210152725.wly2ghd3i55dovfu@lucy.dinwoodie.org> (raw)
In-Reply-To: <CA+GYywBfXptowQ-2oAOyvUfxXxoG_gE+q774qg1MSHigr0Mbqg@mail.gmail.com>

On Thu, Feb 10, 2022 at 03:49:38PM +0100, Vanda Vodkamilkevich wrote:
> Le jeu. 10 févr. 2022 à 14:54, Jon Turney <jon.turney@dronecode.org.uk> a
> écrit :
> 
> > > Le mer. 9 févr. 2022 à 12:11, Jon Turney a
> > > écrit :
> > >
> > >> On 08/02/2022 18:09, Vanda Vodkamilkevich wrote:
> > >>> Hi,
> > >>> When behind a (corporate) proxy the mirror list is apparently fetched
> > >>> without using the proxy configuration. This can only be seen in a fresh
> > >>> install, I tried with 2.908 and it worked then the new version can use
> > >> the
> > >>
> > >> Only appearing on a fresh install makes sense, as a failure to fetch the
> > >> mirror list is silent is we have a cached mirror list data.
> > >>
> > >>> cached file...
> > >>> I'll try to add the logs provided by '-v' but it's complicated to get
> > >> them
> > >>> out of my corporate network.
> > >>> I can't debug more precisely as I have to reinstall my complete cygwin
> > >> tree
> > >>> before :-(
> > >>
> > >> This is puzzling, since I don't see any changes which could cause this.
> > >>
> >
> > On 09/02/2022 15:35, Vanda Vodkamilkevich wrote:
> >  > If it helps, the output log when I saw the issues with setup
> >
> > > ########### Try to download with proxy set
> > [...]
> > > Cached mirror list unavailable
> > [...]
> > > HTTP status 403 fetching https://cygwin.com/mirrors.lst
> >
> > > ########### Using 2.908 version: it works
> > [...]
> > > Cached mirror list unavailable
> > [...]
> > > Fetched URL: http://cygwin.com/mirrors.lst
> >
> > > ########### Rerun with new version
> > [...]
> > > Loaded cached mirror list
> > [...]> connection error: 12057 fetching https://cygwin.com/mirrors.lst
> > > Using cached mirror list
> >
> > The significant change seems to be we now fetch the mirror list using
> > https (since 2.892, but since you are using a self-built setup with
> > local changes, you don't seem to have picked that up until now)
> >
> > 12057 is ERROR_INTERNET_SEC_CERT_REV_FAILED, which leads down quite a
> > rabbit hole, but apparently this means something like 'certificate
> > validity isn't checked in the process using wininet, but in a service,
> > which doesn't have access to the proxy credentials we are using, so
> > fails trying to fetch any CRL'.
> >
> > You don't mention that your proxy actually needs any credentials.
> >
> > Why we get a different error code the second time is mysterious.
> >
> > How we can then go on to successfully fetch from a https:// mirror if it
> > presents a CRL doesn't make a lot of sense.
> >
> > I'm baffled.
> >
> 
> You nailed it... My corporate proxy blocks the https to the mirror list.
> And my old version of setup was using http.
> 
> Maybe if https failed you should retry with http?

This is generally considered A Bad Idea; it may well be a good plan to
make the error behaviour clearer (this is basically always true of any
software), but automatically falling back to HTTP is the sort of thing
that will make the installer much more vulnerable to man-in-the-middle
attacks.

> Btw where is this mirror list file saved? I could cheat by fetching it with
> http before using setup?

  reply	other threads:[~2022-02-10 15:27 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-08 18:09 Vanda Vodkamilkevich
2022-02-09  8:21 ` Brian Inglis
2022-02-09 11:11 ` Jon Turney
     [not found]   ` <CA+GYywDYS8f54E_B1zkcsn1otgNGJJyqBy+RiEq4unxS3ter+A@mail.gmail.com>
2022-02-10 13:54     ` Jon Turney
2022-02-10 14:49       ` Vanda Vodkamilkevich
2022-02-10 15:27         ` Adam Dinwoodie [this message]
2022-02-11 15:08         ` Jon Turney

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220210152725.wly2ghd3i55dovfu@lucy.dinwoodie.org \
    --to=adam@dinwoodie.org \
    --cc=cygwin@cygwin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).