Bug 1734781 - Failure trying to conntect to image registry using TLS when buildah is compiled with FIPS mode [devtools-2019.3.z]
Summary: Failure trying to conntect to image registry using TLS when buildah is compil...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: DevTools
Classification: Red Hat
Component: golang
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 2019.3
Assignee: Derek Parker
QA Contact: Martin Cermak
URL:
Whiteboard:
Depends On: 1731550 1734784 1734788
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-31 12:32 UTC by Tomas Borcin
Modified: 2019-08-21 13:17 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1731550
Environment:
Last Closed: 2019-08-21 13:17:32 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2537 None None None 2019-08-21 13:17:33 UTC

Description Tomas Borcin 2019-07-31 12:32:31 UTC
+++ This bug was initially created as a clone of Bug #1731550 +++

Description of problem:
We compiled buildah with fips mode enabled to run smoke tests.
However, one of the tests that tries to reach a registry using TLS failed.

Logs:
----
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/registry.fedoraproject.org 
DEBU[0000] GET https://registry.fedoraproject.org/v2/   
DEBU[0000] Ping https://registry.fedoraproject.org/v2/ err Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v2/", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0000e2680), Reason:4, Detail:""}}) 
DEBU[0000] GET https://registry.fedoraproject.org/v1/_ping 
DEBU[0000] Ping https://registry.fedoraproject.org/v1/_ping err Get https://registry.fedoraproject.org/v1/_ping: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v1/_ping", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0009d8000), Reason:4, Detail:""}}) 
DEBU[0000] error copying src image ["docker://registry.fedoraproject.org/fedora:latest"] to dest image ["registry.fedoraproject.org/fedora:latest"] err: Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] error pulling image "docker://registry.fedoraproject.org/fedora:latest": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] unable to pull and read image "registry.fedoraproject.org/fedora": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage
---

We tried to restrict the TLS version to max of 1.2 but that didn't help with the test either.





Version-Release number of selected component (if applicable):
golang-1.12.6-1.module+el8.1.0+3387+928f3647.x86_64


How reproducible:
Always

Steps to Reproduce:
1. compile buildah with fips mode golang compiler
2. run buildah tests from the repo

--- Additional comment from Seth Jennings on 2019-07-19 20:52:16 UTC ---

Comment 6 errata-xmlrpc 2019-08-21 13:17:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2537


Note You need to log in before you can comment on or make changes to this bug.