Set "x509ignoreCN=0" GODEBUG environment variable (bsc#1195220)

lslezak commented 2 years ago

https://bugzilla.suse.com/show_bug.cgi?id=1195220
Enable CN (Common Name) matching in SSL certificates in Go programs (e.g. suseconnect-ng). Without it the CN would be ignored and only the SAN (Subject Alternative Name) certificate fields would be used.
But the self-signed certificates usually only contain the CN field without SAN so YaST could not connect to SMT/RMT registration servers.
This error prevented from importing the SSL certificate (that's enabled only for specific known errors):

Test

Originally I wanted to fix that in yast2-registration but it turned out that Go reads the setting only at startup, changing the environment variable later does not have any effect.
During installation the registration code might be loaded early in the self-update code, we need to be sure it is set before loading suseconnect-ng from anywhere.
It needs to be set also in installed system so it cannot be fixed in yast2-installation starting scrips.
See also related fix https://github.com/SUSE/connect-ng/pull/118

yast-bot commented 2 years ago

:heavy_check_mark: Public Jenkins job #60 successfully finished :heavy_check_mark: Created OBS submit request #952626

yast-bot commented 2 years ago

:heavy_check_mark: Internal Jenkins job #52 successfully finished :heavy_check_mark: Created IBS submit request #264304