adoptium / adoptium/TKG

Removal of curl -k option failed to download test artifacts.

Open
#901 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
22
Forks
114
Avg merge
4d 2h
Merged PRs (30d)
8

Description

Recently [this commit](https://github.com/adoptium/TKG/pull/897) has removed curl -k option, this is breaking on z/OS with the below error.

```
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
```
To re-create
Login to any z/OS node, https://hyc-runtimes-jenkins.swg-devops.com/label/sw.os.zos/
Run curl https://ci.adoptium.net/job/dependency_pipeline/lastSuccessfulBuild/artifact/jtreg/jtreg-8+2.tar.gz

Contributor guide

Open the contributing guide

Research direction

Start by reviewing commit 897 to find the artifact-download path that changed curl behavior. Reproduce the failure on a z/OS node with the provided dependency_pipeline URL and compare the download behavior before and after that change. Done means test artifacts download successfully on z/OS without weakening certificate verification unnecessarily.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, shell
Domain
build-system, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.