git clone https://gitlab.haskell.org/ghc/ghc.git on travis doesn't work

[Michael Sloan]

Whoah, I can't get https://ghc.haskell.org/ to load at all - it's also
trying to use the gitlab.staging.haskell.org cert.  I can't get chrome
to ignore the cert error because it's using HSTS - HTTP Strict
Transport Security.

On Sat, Mar 9, 2019 at 5:53 PM Michael Sloan <mgsloan at gmail.com> wrote:
>
> I just encountered this when doing a "git pull" on my Ubuntu 18.04.1 machine:
>
> > fatal: unable to access 'https://gitlab.haskell.org/ghc/ghc/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
>
> Chrome also believes that the certificate of
> https://gitlab.haskell.org/ghc/ghc is invalid and I have to click the
> "Proceed to ... (unsafe)" link.  Chrome's certificate viewer shows
> that the certificate is for "gitlab.staging.haskell.org" whereas the
> domain is "gitlab.haskell.org", so I'm guessing that's the problem.
> I'm not very experienced with such cert stuff, but  perhaps a wildcard
> cert like "*.haskell.org" could allow using the same cert regardless
> of whether it's on staging vs prod.
>
> For now I've just done "git config --global http.sslverify false"
> temporarily to do the pull.  Perhaps this is Shayne Fletcher's cheeky
> workaround? :)
>
> -Michael
>
> On Fri, Mar 8, 2019 at 10:23 PM Ben Gamari <ben at well-typed.com> wrote:
> >
> > Shayne Fletcher via ghc-devs <ghc-devs at haskell.org> writes:
> >
> > > I appreciate this isn't really "our" problem :) Nonetheless, if there's any
> > > config we can do on the repo on gitlab, that would be cool. Other URLs
> > > (like github) for example are fine - something specific to gitlab.
> > >
> > I feel like I'm missing something here. I recall you mentioned this in
> > your previous message but there I'm still lacking crucial context. Can
> > you offer any additional details? How exactly does it fail?
> >
> > In principle there is no reason why cloning from gitlab.haskell.org from
> > Travis shouldn't work. I'd be happy to fix the issue if there is one but
> > without knowing more I'm pretty powerless to change the situation.
> >
> > Cheers,
> >
> > - Ben
> >
> > _______________________________________________
> > ghc-devs mailing list
> > ghc-devs at haskell.org
> > http://mail.haskell.org/cgi-bin/mailman/listinfo/ghc-devs