Bug 1734788

Summary: Failure trying to conntect to image registry using TLS when buildah is compiled with FIPS mode [rhel-8.1]
Product: Red Hat Enterprise Linux 8 Reporter: Tomas Borcin <tborcin>
Component: golangAssignee: Derek Parker <deparker>
Status: CLOSED DUPLICATE QA Contact: Edjunior Barbosa Machado <emachado>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.1CC: chuyu, deparker, dornelas, emachado, fweimer, mcermak, mpatel, qe-baseos-tools, schoudha, tstellar
Target Milestone: rcFlags: emachado: needinfo? (deparker)
mcermak: needinfo? (tborcin)
Target Release: 8.1   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1731550 Environment:
Last Closed: 2019-09-09 17:09:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1731550    
Bug Blocks: 1734781, 1734784    

Description Tomas Borcin 2019-07-31 12:37:39 UTC
+++ This bug was initially created as a clone of Bug #1731550 +++

Description of problem:
We compiled buildah with fips mode enabled to run smoke tests.
However, one of the tests that tries to reach a registry using TLS failed.

Logs:
----
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/registry.fedoraproject.org 
DEBU[0000] GET https://registry.fedoraproject.org/v2/   
DEBU[0000] Ping https://registry.fedoraproject.org/v2/ err Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v2/", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0000e2680), Reason:4, Detail:""}}) 
DEBU[0000] GET https://registry.fedoraproject.org/v1/_ping 
DEBU[0000] Ping https://registry.fedoraproject.org/v1/_ping err Get https://registry.fedoraproject.org/v1/_ping: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v1/_ping", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0009d8000), Reason:4, Detail:""}}) 
DEBU[0000] error copying src image ["docker://registry.fedoraproject.org/fedora:latest"] to dest image ["registry.fedoraproject.org/fedora:latest"] err: Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] error pulling image "docker://registry.fedoraproject.org/fedora:latest": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] unable to pull and read image "registry.fedoraproject.org/fedora": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage
---

We tried to restrict the TLS version to max of 1.2 but that didn't help with the test either.





Version-Release number of selected component (if applicable):
golang-1.12.6-1.module+el8.1.0+3387+928f3647.x86_64


How reproducible:
Always

Steps to Reproduce:
1. compile buildah with fips mode golang compiler
2. run buildah tests from the repo

--- Additional comment from Seth Jennings on 2019-07-19 20:52:16 UTC ---