Build>Core>KnowledgeMW build failure AND CA cert store is out-dated

[heungheung]

Issue 1: build failed - with release-5.2.0_RC1

https://github.com/Sunbird-Knowlg/knowledge-mw-service/blob/release-5.2.0_RC1/Dockerfile#L8

image is based on node:8.11-slim, all jessie repos were already moved to

• http://archive.debian.org/debian/
• http://archive.debian.org/debian-archive/debian-security/

and the apt update will failed

apt update
Ign http://deb.debian.org jessie InRelease
Ign http://deb.debian.org jessie Release.gpg
Ign http://deb.debian.org jessie Release
Err http://deb.debian.org jessie/main amd64 Packages
  
Err http://deb.debian.org jessie/main amd64 Packages
  
Err http://deb.debian.org jessie/main amd64 Packages
  
Err http://deb.debian.org jessie/main amd64 Packages
  
Err http://deb.debian.org jessie/main amd64 Packages
  404  Not Found
Ign http://security.debian.org jessie/updates InRelease
Ign http://security.debian.org jessie/updates Release.gpg
Ign http://security.debian.org jessie/updates Release
Err http://security.debian.org jessie/updates/main amd64 Packages
  
Err http://security.debian.org jessie/updates/main amd64 Packages
  
Err http://security.debian.org jessie/updates/main amd64 Packages
  
Err http://security.debian.org jessie/updates/main amd64 Packages
  
Err http://security.debian.org jessie/updates/main amd64 Packages
  404  Not Found [IP: 151.101.194.132 80]
W: Failed to fetch http://deb.debian.org/debian/dists/jessie/main/binary-amd64/Packages  404  Not Found

W: Failed to fetch http://security.debian.org/debian-security/dists/jessie/updates/main/binary-amd64/Packages  404  Not Found [IP: 151.101.194.132 80]

E: Some index files failed to download. They have been ignored, or old ones used instead.

Even change to archive url, the GPG signature verification will fail.

Issue 2: CA cert store in the container is old and some CA cert already expired. Even build success, after deploy to k8s, there will be runtime error if the Ed-portal is using TLS cert with a new root CA cert.

Right now, one of the possible workaround will be run dpkg-reconfigure ca-certificates to update the cert store. This workaround has to be done in build time (or before build) because in run time, the user is sunbird and not able to run dpkg as root

[Krishnaj20]

@gandham-santhosh - can you look into this please?

@chitranshu-keshav @maheshkumargangula

[gandham-santhosh]

We did changes to dockerfile as workaround and tested in dev env and found that its working fine
Sunbird-Knowlg/knowledge-mw-service#301

@heungheung can you please try the same in your env and check and let us know?

[heungheung]

The build is ok but it doesn't solve the cert expire problem. I've done some more tests and found even curl and openssl s_connect report TLS cert is valid, nodejs (the application) still rejects it. It seems to me that nodejs engine is actually using ca cert store other than what curl or openssl is using.

Sorry that I really don't have time to deep dive to the problem. FYI, the cert trust problem is actually different microservices which based on node v8. Another critical one will be program-service in coKreat, as it will directly send post req to public fqdn instead of just using private ingress.

and I've x-posted in cokreat discussion https://github.com/orgs/Sunbird-coKreat/discussions/74

[Krishnaj20]

thanks @heungheung .

@gandham-santhosh - Can your team contribute this fix?

[gandham-santhosh]

@heungheung we did workaround for cert issue and found that its working. Update the details in the same PR https://github.com/Sunbird-Knowlg/knowledge-mw-service/pull/301/files Please check if this is working in your environment.
However, @pallakartheekreddy nodejs version upgrade need to be planned. Please take this up

[chitranshu-keshav]

@gandham-santhosh @pallakartheekreddy Can you please create JIRA issue in the issue tracker and update the link here so that we can close this thread