0

I followed the procedure described here https://packages.sury.org/php/README.txt for adding an APT repository that has some packages i need to install ( for example i need php7.0-dev).

sudo apt-get -y install apt-transport-https lsb-release ca-certificates
sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
sudo sh -c 'echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get update

AFAIU, the above commands intend to install the SSL certificate for packages.sury.org, so that the APT command can communicate to the packages.sury.org server via SSL.

Then the APT repository is added to sources.list.d.

On the last command, apt-get update, i get the following error:

W: Failed to fetch https://packages.sury.org/php/dists/trusty/main/binary-amd64/Packages gnutls_handshake() failed: Handshake failed

I think the SSL certificate has not been correctly installed to my local machine, so the first two commands were ineffective apparently.

What did go wrong?

Alternatively, would it be a good idea to clone the sury.org repository on a local website on my machine, with no SSL, and add the http://localhost repository instead of https://packages.sury.org? That would eliminate the need for APT to communicate via SSL.

Thanks

EDIT: this is the output of gnutls-cli

gnutls-cli -V -V packages.sury.org:443
Resolving 'packages.sury.org:443'...
Cannot resolve packages.sury.org:443:443: Name or service not known

gnutls-cli -V -V packages.sury.org
Resolving 'packages.sury.org'...
Connecting to '104.31.95.169:443'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [40]: Handshake failed
*** Handshake has failed
GnuTLS error: A TLS fatal alert has been received.


gnutls-cli -v
gnutls-cli (GnuTLS) 2.12.23
Packaged by Debian (2.12.23-12ubuntu2.8)
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Nikos Mavrogiannopoulos.
  • "AFAIU, the above commands intend to install the SSL certificate for packages.sury.org, so that the APT command can communicate to the packages.sury.org server via SSL." - this is wrong. They install add the PGP key which is used to sign the packages as trusted. It is nothing to do with SSL at all. But importing a SSL certificate should also not be necessary in the first place, the server is properly setup. It might be a problem of some firewall in your network tampering with the connection or that you are using some old version of Ubuntu with a buggy gnutls - both is unknown. – Steffen Ullrich Aug 29 '19 at 16:27
  • You might try gnutls-cli packages.sury.org:443 and see if this succeeds. – Steffen Ullrich Aug 29 '19 at 16:32
  • @SteffenUllrich Thanks. So do i need to install the SSL certificate to solve the issue? P.S. I have just read your second comment. I will try it out. If it works, copy your comment in a new answer and i will accept it. – HelloWorld Aug 29 '19 at 16:33
  • @SteffenUllrich Didn't work. It says Received alert [40] : Handshake failed. Hansdhake has failed – HelloWorld Aug 29 '19 at 16:47
  • Could you do a gnutls-cli -V -V packages.sury.org:443 and include the full output in your question or provide as pastebin? Also please provide the output of gnutls-cli -v to show the version of gnutls. – Steffen Ullrich Aug 29 '19 at 17:03
0

Looks like you are using a release which is no longer supported (The gnutls version is specific for Ubuntu 14.04). And you are trying to use a server for the packages which requires SNI which can be seen from the SSLLabs report. Only, it is a known problem at least with the release you are using that APT server which require SNI do not properly work - see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1551464. Given that your release is no longer supported this is unlikely to get fixed.

... would it be a good idea to clone the sury.org repository on a local website on my machine, with no SSL ...

That would be ok. The main security is provided by the signature of the package and not by HTTPS. And you've already installed the key to check the signature as trusted.

| improve this answer | |
  • I have tried by cloning the repository with "rsync rsync://packages.sury.xyz/repositories/php ." and it worked. Before that i have tried updating gnutls-bin but it didn't update, so i still have gnutls-cli 2.12. Maybe i need to upgrade Ubuntu first? I have Ubuntu 14 – HelloWorld Sep 1 '19 at 16:21
  • @HelloWorld: As long as you stay with the same release most packages will only receive bug and security fixes. So you need to upgrade to get a more recent gnutls. – Steffen Ullrich Sep 1 '19 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.