Building behind a firewall.

[Bruce Ferjulian]

Everything worked great at home, not at work behind a firewall with a CISCO Ironport Filter  I can no longer build.

+ exec /home/builder/chromite/bin/cros_sdk -- /home/builder/trunk/src/scripts/build_image
Attempting download: https://commondatastorage.googleapis.com/builds.developer.core-os.net/sdk/amd64/681.0.0/coreos-sdk-amd64-681.0.0.tar.bz2
14:27:50: ERROR: Download failed with certificate error? Try "sudo c_rehash".


So the question(s) are.

1. Can the fetch ( wget, curl, etc ) be turned off during the build to just work with what's there and not try to update itself?

2. Can the fetch me tailored to use ( http ) instead of ( https )?


-Bruce-

[Bruce Ferjulian]

I tried these two tricks which did not help.

echo insecure > ~/.curlrc
echo check_certificate=off >> ~/.wgetrc

[Michael Marineau]

To create the SDK with a previously downloaded tarball you can specify
a local path: ./cros_sdk --url
file:///home/builder/.cache/sdks/coreos-sdk-amd64-745.1.0.tar.bz2

Many other downloads are over http instead of https but that is likely
to change in the future, when that happens we'll need to add an option
to easily add the CA cert of the firewall that is hijacking
connections.

[Bruce Ferjulian]

Thank you for the reply.

I did make some progress after using "strace" to see where all this was failing. Seems the two resource files that I modified to ignore the certificate checking ( .wgetrc && .curlrc ) were failing not in the regular user but the root user. When I also updated the resource files for the "root" user, I could proceed.

echo insecure > /root/.curlrc
echo check_certificate=off >> /root/.wgetrc