The changes from https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile seem to be indirectly affecting DNF and cause it to fail to update repositories that include something like "sslcacert=/etc/pki/tls/certs/ca-bundle.crt". Slack, when installed from the RPM available on their website creates "/etc/yum.repos.d/slack.repo" which includes "sslcacert=/etc/pki/tls/certs/ca-bundle.crt". This file however does no longer exist on F43. Reproducible: Always Steps to Reproduce: 1. Download and install Slack RPM package from https://slack.com/downloads/linux 2. Run "sudo dnf update --refresh" Actual Results: DNF fails to update the "slack" repo with this error message: Curl error (77): Problem with the SSL CA cert (path? access rights?) for https://packagecloud.io/slacktechnologies/slack/fedora/21/x86_64/repodata/repomd.xml [error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt] - https://packagecloud.io/slacktechnologies/slack/fedora/21/x86_64/repodata/repomd.xml Expected Results: Updating the repo Additional Information: After commenting out the line "sslcacert" line from the "slack.repo" updating the repo works again. Unfortunately this error means that even if Slack change their package to no longer include that path, users would not receive that update. Maybe a DNF (or curl?) need to ignore certain cert paths?
I don't think there is anything DNF should do here, unfortunately. Slack needs to update their repo file and not hardcode the path to this CA bundle. The `sslcacert` option should not have been set in the first place, IMO. I filed a similar bug report on Grafana [1] since their repo file also has this error, and I commented on the discussion thread for Changes/dropingOfCertPemFile [2] Looking at Slack specifically, I did not see a repo file in the latest Slack RPM package: `rpm -qlp ./slack-4.45.64-0.1.el8.x86_64.rpm | grep repo` yields no matches. And after installing the RPM, there is no `/etc/yum.repos.d/slack.repo`. Are you sure the repo file is provided by the RPM? [1] https://github.com/grafana/grafana/issues/109365 [2] https://discussion.fedoraproject.org/t/f42-change-proposal-dropping-of-cert-pem-file-system-wide/135119/35
The repo file is generated by "/etc/cron.daily/slack" which is part of the rpm package. I think this way of adding repos is commonly found in chrome/electron based applications that ship their own rpm packages.
Ah, I see, thanks. I sent a bug report via https://redhat-internal.slack.com/help/requests/new.