使用dput上传deb包时遭遇SSL证书验证失败问题求助

问题场景 #

使用dh-make构建.deb包后，通过dput上传至GitLab Debian仓库，执行的配置与命令如下：

cat <<EOF > dput.cf
[gitlab]
method = https
fqdn = <my login>:<my password>@gitlab.mydomain.com
incoming = /api/v4/projects/<project id>/packages/debian
EOF

dput --config=dput.cf --unchecked --no-upload-log gitlab <my package name>_1.0.1_amd64.changes

错误日志 #

执行后出现SSL验证失败错误：

Uploading <my package name> using https to gitlab (host: <my login>:<my password>@gitlab.mydomain.com; directory: /api/v4/projects/<project id>/packages/debian)
running allowed-distribution: check whether a local profile permits uploads to the target distribution
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running gpg: check GnuPG signatures before the upload
Not checking GPG signature due to allow_unsigned_uploads being set.
Not writing upload log upon request
Uploading <my package name>_1.0.1.dsc
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)>

已尝试操作 #

在Ubuntu 22.04系统中，已通过以下步骤添加自签名GitLab SSL证书至系统信任列表，HTTP上传测试正常，但HTTPS仍报错，尝试过certifi等Python SSL配置方案无效：

mkdir -p /usr/local/share/ca-certificates

openssl s_client -showcerts -connect gitlab.mydomain.com:443 -servername gitlab.mydomain.com < /dev/null 2>/dev/null | openssl x509 -outform PEM > /usr/local/share/ca-certificates/gitlab.mydomain.com.crt

update-ca-certificates

解决方案 #

1. 为dput指定CA证书路径 #

修改dput.cf配置，将账号密码与FQDN分离，并添加ssl_ca_cert字段指向你的自签名证书：

cat <<EOF > dput.cf
[gitlab]
method = https
fqdn = gitlab.mydomain.com
login = <my login>
password = <my password>
incoming = /api/v4/projects/<project id>/packages/debian
ssl_ca_cert = /usr/local/share/ca-certificates/gitlab.mydomain.com.crt
EOF

重新执行dput命令即可：

dput --config=dput.cf --unchecked --no-upload-log gitlab <my package name>_1.0.1_amd64.changes

2. 强制Python使用系统CA证书 #

若dput依赖的Python环境未读取系统信任的CA证书，可通过环境变量指定系统证书路径：

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
dput --config=dput.cf --unchecked --no-upload-log gitlab <my package name>_1.0.1_amd64.changes

如需永久生效，可将export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt添加至~/.bashrc或~/.profile文件中。

3. 重新导入完整证书链 #

之前的证书导出命令可能只提取了服务器证书，漏掉了中间CA证书，重新导出完整证书链并更新信任列表：

# 导出完整证书链
openssl s_client -showcerts -connect gitlab.mydomain.com:443 -servername gitlab.mydomain.com < /dev/null 2>/dev/null | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{print}' > /usr/local/share/ca-certificates/gitlab.mydomain.com.crt

# 刷新系统证书
update-ca-certificates --fresh

验证证书是否生效：

curl -v https://gitlab.mydomain.com

若输出中包含SSL certificate verify ok，说明证书已被系统信任。

内容的提问来源于stack exchange，提问作者JFrol