bug#34861: TLS Error with Flatpak

[Raghav Gururajan]

Thank you very much.

Should I be running just "export GIO_USE_TLS=tls" as it is mentioned or should 
I insert it in some other command/syntax?

Thanks!

Regards,
RG.

March 22, 2019 5:15 PM, "Ludovic Courtès" <address@hidden> wrote:

> Hi Raghav,
> 
> "Raghav Gururajan" <address@hidden> skribis:
> 
>> Please find the log at:
>> https://bin.disroot.org/?597e32cb7e42e40e#r9lqwZ6w7sIAWlY2mt6dsgKCKRO5q0ZVt9U69vnZVZs=
>> 
>> 5462 connect(12, {sa_family=AF_INET, sin_port=htons(443), 
>> sin_addr=inet_addr("93.93.130.103")}, 16)
>> = -1 EINPROGRESS (Operation now in progress)
> 
> [...]
> 
>> 5462 getsockopt(12, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
>> 5462 setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0
> 
> [...]
> 
>> 5462 close(12) = 0
> 
> [...]
> 
>> 5461 write(2, "\33[31m\33[1merror: \33[22m\33[0mTLS support is not 
>> available\n", 54) = 54
> 
> Thanks for sending the strace output. That output shows that Flatpak
> never tries to access /etc/ssl/certs, ~/.guix-profile/etc/ssl/certs or
> anything like that.
> 
> The error message comes from GLib, in gdummytlsbackend.c. AFAICS our
> GLib also includes the TLS (not dummy) backend:
> 
> --8<---------------cut here---------------start------------->8---
> $ objdump -T 
> /gnu/store/0q9pq9flr76rh4bv2524niknknnl2kvq-glib-2.56.3/lib/libgio-2.0.so | 
> grep
> g_tls_backend
> 0000000000093e90 g DF .text 0000000000000082 Base 
> g_tls_backend_get_default_database
> 0000000000093dd0 g DF .text 000000000000006f Base g_tls_backend_supports_tls
> 0000000000093f40 g DF .text 000000000000001b Base 
> g_tls_backend_get_client_connection_type
> 0000000000093e40 g DF .text 0000000000000049 Base g_tls_backend_supports_dtls
> 0000000000093db0 g DF .text 0000000000000015 Base g_tls_backend_get_default
> 0000000000093f80 g DF .text 0000000000000072 Base 
> g_tls_backend_get_dtls_client_connection_type
> 0000000000093f60 g DF .text 000000000000001b Base 
> g_tls_backend_get_server_connection_type
> 0000000000094000 g DF .text 0000000000000072 Base 
> g_tls_backend_get_dtls_server_connection_type
> 0000000000094080 g DF .text 000000000000007f Base 
> g_tls_backend_get_file_database_type
> 0000000000093d20 g DF .text 0000000000000084 Base g_tls_backend_get_type
> 0000000000093f20 g DF .text 000000000000001b Base 
> g_tls_backend_get_certificate_type
> --8<---------------cut here---------------end--------------->8---
> 
> Libsoup does this:
> 
> --8<---------------cut here---------------start------------->8---
> static gboolean
> soup_socket_setup_ssl (SoupSocket *sock,
> const char *ssl_host,
> GCancellable *cancellable,
> GError **error)
> {
> SoupSocketPrivate *priv = soup_socket_get_instance_private (sock);
> GTlsBackend *backend = g_tls_backend_get_default ();
> --8<---------------cut here---------------end--------------->8---
> 
> ‘g_tls_backend_get_default’ itself looks like this:
> 
> --8<---------------cut here---------------start------------->8---
> GTlsBackend *
> g_tls_backend_get_default (void)
> {
> return _g_io_module_get_default (G_TLS_BACKEND_EXTENSION_POINT_NAME,
> "GIO_USE_TLS", NULL);
> }
> --8<---------------cut here---------------end--------------->8---
> 
> Could you try setting the ‘GIO_USE_TLS’ environment variable? Like:
> 
> export GIO_USE_TLS=tls
> 
> or maybe:
> 
> export GIO_USE_TLS=GTlsBackend
> 
> and then run Flatpak in that environment?
> 
> TIA,
> Ludo’.