Bug 1734788 - Failure trying to conntect to image registry using TLS when buildah is compiled with FIPS mode [rhel-8.1] [NEEDINFO]
Summary: Failure trying to conntect to image registry using TLS when buildah is compil...
Keywords:
Status: CLOSED DUPLICATE of bug 1731550
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: golang
Version: 8.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.1
Assignee: Derek Parker
QA Contact: Edjunior Barbosa Machado
URL:
Whiteboard:
Depends On: 1731550
Blocks: 1734781 1734784
TreeView+ depends on / blocked
 
Reported: 2019-07-31 12:37 UTC by Tomas Borcin
Modified: 2019-09-09 17:09 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1731550
Environment:
Last Closed: 2019-09-09 17:09:30 UTC
Type: Bug
Target Upstream Version:
emachado: needinfo? (deparker)
mcermak: needinfo? (tborcin)

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Tomas Borcin 2019-07-31 12:37:39 UTC 
+++ This bug was initially created as a clone of Bug #1731550 +++

Description of problem:
We compiled buildah with fips mode enabled to run smoke tests.
However, one of the tests that tries to reach a registry using TLS failed.

Logs:
----
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/registry.fedoraproject.org 
DEBU[0000] GET https://registry.fedoraproject.org/v2/   
DEBU[0000] Ping https://registry.fedoraproject.org/v2/ err Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v2/", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0000e2680), Reason:4, Detail:""}}) 
DEBU[0000] GET https://registry.fedoraproject.org/v1/_ping 
DEBU[0000] Ping https://registry.fedoraproject.org/v1/_ping err Get https://registry.fedoraproject.org/v1/_ping: x509: certificate specifies an incompatible key usage (&url.Error{Op:"Get", URL:"https://registry.fedoraproject.org/v1/_ping", Err:x509.CertificateInvalidError{Cert:(*x509.Certificate)(0xc0009d8000), Reason:4, Detail:""}}) 
DEBU[0000] error copying src image ["docker://registry.fedoraproject.org/fedora:latest"] to dest image ["registry.fedoraproject.org/fedora:latest"] err: Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] error pulling image "docker://registry.fedoraproject.org/fedora:latest": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
DEBU[0000] unable to pull and read image "registry.fedoraproject.org/fedora": Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage 
Error initializing source docker://registry.fedoraproject.org/fedora:latest: pinging docker registry returned: Get https://registry.fedoraproject.org/v2/: x509: certificate specifies an incompatible key usage
---

We tried to restrict the TLS version to max of 1.2 but that didn't help with the test either.





Version-Release number of selected component (if applicable):
golang-1.12.6-1.module+el8.1.0+3387+928f3647.x86_64


How reproducible:
Always

Steps to Reproduce:
1. compile buildah with fips mode golang compiler
2. run buildah tests from the repo

--- Additional comment from Seth Jennings on 2019-07-19 20:52:16 UTC ---
Note You need to log in before you can comment on or make changes to this bug.