Loading pico-extras/lib/lwip fails due to certificate issue

[jhmaloney]

Thank you for making it possible to use Earle Philhower's Arduino framework for the Raspberry Pico Pico and other RP2040 boards.

Unfortunately, I hit a snag when trying to install the tool chain due to a certificate issue with git.savannah.nongnu.org (see below). The issue may be that the certificate name, git.savannah.gnu.org, doesn't match the domain name rather than an expired certificate. Unfortunately, due the failure of that one component Platformio aborts the entire toolchain installation.

I don't think lwip is essential since many folks won't be using TCP/IP on their Pico boards, so I wonder if you could temporarily drop that library or make it optional. Or maybe create a fork of that repository on Github?

I'm using your example platformio.ini file entry:

[env:pico_earlephilhower]
; switch to forked platform with new extensions :)
platform = https://github.com/maxgerhardt/platform-raspberrypi.git
board = pico
framework = arduino
; select new core
board_build.core = earlephilhower
; configure filesystem size. Default 0 Mbyte.
board_build.filesystem_size = 1M
lib_ldf_mode = chain+
; inject core package.. not yet registered with PlatformIO
; registry, so pull working version directly from git / download page.
; note that download link for toolchain is specific for OS. see https://github.com/earlephilhower/pico-quick-toolchain/releases.
platform_packages =
    maxgerhardt/framework-arduinopico@https://github.com/maxgerhardt/arduino-pico.git
    maxgerhardt/toolchain-pico@https://github.com/earlephilhower/pico-quick-toolchain/releases/download/1.3.1-a/x86_64-w64-mingw32.arm-none-eabi-7855b0c.210706.zip

Here's the error:

Submodule path 'pico-extras': checked out '77eae2836638baf2f61b321eb61125da99bb4445'
Submodule 'lwip' (https://git.savannah.nongnu.org/git/lwip.git) registered for path 'pico-extras/lib/lwip'
Cloning into '/Users/johnmaloney/.platformio/.cache/tmp/pkg-installing-pyccw8un/pico-extras/lib/lwip'...
fatal: unable to access 'https://git.savannah.nongnu.org/git/lwip.git/': SSL certificate problem: certificate has expired
fatal: clone of 'https://git.savannah.nongnu.org/git/lwip.git' into submodule path '/Users/johnmaloney/.platformio/.cache/tmp/pkg-installing-pyccw8un/pico-extras/lib/lwip' failed
Failed to clone 'lib/lwip'. Retry scheduled
Cloning into '/Users/johnmaloney/.platformio/.cache/tmp/pkg-installing-pyccw8un/pico-extras/lib/lwip'...
fatal: unable to access 'https://git.savannah.nongnu.org/git/lwip.git/': SSL certificate problem: certificate has expired
fatal: clone of 'https://git.savannah.nongnu.org/git/lwip.git' into submodule path '/Users/johnmaloney/.platformio/.cache/tmp/pkg-installing-pyccw8un/pico-extras/lib/lwip' failed
Failed to clone 'lib/lwip' a second time, aborting

[maxgerhardt]

..Unable to reproduce o_O

>git clone https://git.savannah.nongnu.org/git/lwip.git
Cloning into 'lwip'...
remote: Counting objects: 55161, done.
remote: Compressing objects: 100% (12820/12820), done.
remote: Total 55161 (delta 41660), reused 55161 (delta 41660)
Receiving objects: 100% (55161/55161), 10.59 MiB | 4.47 MiB/s, done.
Resolving deltas: 100% (41660/41660), done.

What does it say when you try it on the commandline?

[jhmaloney]

I get a similar error:

$ git clone https://git.savannah.nongnu.org/git/lwip.git
Cloning into 'lwip'...
fatal: unable to access 'https://git.savannah.nongnu.org/git/lwip.git/': SSL certificate problem

Strange. I'm running on Mac OS 10.14.6. Maybe my git is more picky about certificates than yours? I'm not sure where that git came from; I'm guessing it was part of XCode. Anyhow, it looks like it could a problem on my end.

$ git --version
git version 2.20.1 (Apple Git-117)

[maxgerhardt]

I'm on Windows 10 x64. Going on https://git.savannah.nongnu.org/git/lwip.git/ with firefox and viewing certificate info I get that the certificate for the website itself is valid until 18th March 2022, so that's alright. All other certificates in the chain are valid too.

What does your browser say about the used certificate?

[maxgerhardt]

Also my git version seems newer although I haven't updated it in what is probably 2 years..

>git --version
git version 2.29.2.windows.2

[jhmaloney]

My browser is showing the certificate expiration of Friday, March 18, 2022 at 6:32:26 AM Eastern Daylight Time.

I'm guessing my git is being picky about the fact that the certificate domain "git.savannah.gnu.org" is not exactly the same as "git.savannah.nongnu.org".

I'll see if I can update my git...

[maxgerhardt]

The certificate does contain a section about alternate DNS names, the git client should respect that.

[maxgerhardt]

Plus, you should be using

platform_packages =
    maxgerhardt/framework-arduinopico@https://github.com/maxgerhardt/arduino-pico.git
    maxgerhardt/toolchain-pico@https://github.com/earlephilhower/pico-quick-toolchain/releases/download/1.3.1-a/x86_64-apple-darwin14.arm-none-eabi-7855b0c.210706.tar.gz

as your platform_packages expression, containing the download link for x64 Mac OS.

[jhmaloney]

Oh, good catch! I didn't notice the x86_64-w64-mingw32 in the path I was using. That would have been a problem if Platformio had gotten that far. Installing git now...

[jhmaloney]

The updated git allowed me to install the tools so I'm up and running! Thank you so much for your extremely prompt and helpful response.