After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 783773 - gst-libav has submodule with link to https://ffmpeg.org/ffmpeg.git/
gst-libav has submodule with link to https://ffmpeg.org/ffmpeg.git/
Status: RESOLVED OBSOLETE
Product: GStreamer
Classification: Platform
Component: gst-libav
git master
Other Linux
: Normal critical
: NONE
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-06-14 01:47 UTC by bluescreen_avenger
Modified: 2018-01-13 12:10 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description bluescreen_avenger 2017-06-14 01:47:20 UTC 
Hi

I am trying to download gst-libav and all of its submodules

It seems that ffmpeg.org's startcom SSL CA causes problems (on Debian Stretch)

I am getting
gst-libav: Submodule 'gst-libs/ext/libav' (https://git.ffmpeg.org/ffmpeg.git) registered for path 'gst-libs/ext/libav'
gst-libav: Submodule path 'common': checked out '48a5d85ebf4a0bad1c997c83100f710fe2154fbf'
gst-libav: Submodule path 'gst-libs/ext/gas-preprocessor': checked out 'fad9080da871bb7924431a5e22fdaccae56b5950'
gst-libav: fatal: unable to access 'https://git.ffmpeg.org/ffmpeg.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
gst-libav: Unable to fetch in submodule path 'gst-libs/ext/libav'

Seems that it is getting tripped up by the https://git.ffmpeg.org/ffmpeg.git
A better mirror appears to be git://git.videolan.org/ffmpeg.git

Thanks
Comment 1 Tim-Philipp Müller 2017-06-14 07:42:41 UTC 
Hrm, yes, I get the same issue on debian sid.

Problem is, we can't really change the link for past releases.

Did you let the ffmpeg.org admins know there's a problem? Should really be fixed on their end I think.

Note to self: The https version of the videolan mirror is https://git.videolan.org/git/ffmpeg.git
Comment 2 bluescreen_avenger 2017-06-14 11:11:41 UTC 
That is a point... ...I have to find out the best way to inform them..
Comment 3 Sebastian Dröge (slomo) 2017-06-14 11:23:37 UTC 
What also fails is:
> curl https://git.ffmpeg.org

and

> openssl s_client -connect git.ffmpeg.org:443
> CONNECTED(00000003)
> depth=1 C = IL, O = StartCom Ltd., OU = StartCom Certification Authority, CN = StartCom Class 2 IV Server CA
> verify error:num=20:unable to get local issuer certificate
> ---
> Certificate chain
>  0 s:/C=SE/ST=Skane/L=Lund/O=Reimar D\xC3\xB6ffinger/CN=ffmpeg.org
>    i:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA
>  1 s:/C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Class 2 IV Server CA
>    i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority
Comment 4 Sebastian Dröge (slomo) 2017-06-14 11:26:33 UTC 
Problem is this from the Debian ca-certificates package changelog:
>  * Add StartCom and WoSign certificates to mozilla/blacklist.txt as they are
>    now untrusted by the major browser vendors. Closes: #858539

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858539 for details.


Basically, ffmpeg people should move away from StartSSL/StartCom
Comment 5 bluescreen_avenger 2017-06-16 02:20:55 UTC 
I am trying to create a bug report on ffmpegs bug tracker, I need to create an account, and it seems that THAT part of the site too is having problems (it hangs) ...I will see what I can do to inform ffmpeg
Comment 6 Tim-Philipp Müller 2018-01-13 12:10:21 UTC 
This seems to be fixed now.