pkg/58273: pkgin cannot download repo index over SSL in default install

[2857%gmx.de@localhost]

>Number:         58273
>Category:       pkg
>Synopsis:       pkgin cannot download repo index over SSL in default install
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 22 17:15:00 +0000 2024
>Originator:     zip100
>Release:        10
>Organization:
>Environment:
NetBSD netbsd 10.0 NetBSD 10.0 (GENERIC) #0: Thu Mar 28 08:33:33 UTC 2024  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
All defaults install (Xorgless) on VirtualBox. I've picked an option to add pkgin during the install, but that didn't work, so I decided to sort it out after booting into fresh install. However, pkgin doesn't seem to like "https" in repo address unless I install mozilla-certs manually.

=================================
trying with HTTPS from the start:


netbsd# export PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All/";
netbsd# pkg_add pkgin
pkgin-23.8.1nb3: copying /usr/pkg/share/examples/pkgin/repositories.conf.example to /usr/pkg/etc/pkgin/repositories.conf
netbsd# pkgin install nano
processing remote summary (https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All)...
pkg_summary.gz                                                                                       50% 3136KB 308.0KB/s   00:09 ETApkgin: failure during fetch of file: Input/output error

===================================================
removing HTTPS and trying it out, installing certs:


netbsd# vi /usr/pkg/etc/pkgin/repositories.conf
netbsd# pkgin install nano
cleaning database from https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All entries...
reading local summary...
processing local summary...
processing remote summary (http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All)...
pkg_summary.gz                                                                                      100% 6210KB 207.0KB/s   00:30    
calculating dependencies...done.

1 package to install:
  nano-7.2nb2

0 to remove, 0 to refresh, 0 to upgrade, 1 to install
539K to download, 2646K of additional disk space will be used

proceed ? [Y/n] y
[1/1] nano-7.2nb2.tgz                                                                               100%  539KB 539.5KB/s   00:00    
[1/1] installing nano-7.2nb2...
nano-7.2nb2: copying /usr/pkg/share/examples/nano/nanorc to /usr/pkg/etc/nanorc
pkg_install warnings: 0, errors: 0
reading local summary...
processing local summary...
netbsd# pkgin install mozilla-rootcerts-openssl
calculating dependencies...done.

1 package to install:
  mozilla-rootcerts-openssl-2.14

0 to remove, 0 to refresh, 0 to upgrade, 1 to install
325K to download, 1722K of additional disk space will be used

proceed ? [Y/n] y
[1/1] mozilla-rootcerts-openssl-2.14.tgz                                                            100%  325KB 324.7KB/s   00:00    
[1/1] installing mozilla-rootcerts-openssl-2.14...
pkg_install warnings: 0, errors: 0
reading local summary...
processing local summary...
netbsd# pkgin install mozilla-rootcerts
calculating dependencies...done.

1 package to install:
  mozilla-rootcerts-1.0.20240214

0 to remove, 0 to refresh, 0 to upgrade, 1 to install
532K to download, 2196K of additional disk space will be used

proceed ? [Y/n] y
[1/1] mozilla-rootcerts-1.0.20240214.tgz                                                            100%  532KB 532.4KB/s   00:00    
[1/1] installing mozilla-rootcerts-1.0.20240214...
pkg_install warnings: 0, errors: 0
reading local summary...
processing local summary...

=======================
changing back to HTTPS:

netbsd# vi /usr/pkg/etc/pkgin/repositories.conf
netbsd# pkgin install htop
cleaning database from http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All entries...
reading local summary...
processing local summary...
processing remote summary (https://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All)...
pkg_summary.gz                                                                                      100% 6210KB 207.0KB/s   00:30    
calculating dependencies...done.

2 packages to install:
  hicolor-icon-theme-0.17nb1 htop-3.3.0

0 to remove, 0 to refresh, 0 to upgrade, 2 to install
108K to download, 320K of additional disk space will be used

proceed ? [Y/n] y
[1/2] hicolor-icon-theme-0.17nb1.tgz                                                                100%   11KB  11.0KB/s   00:00    
[2/2] htop-3.3.0.tgz                                                                                100%   97KB  96.5KB/s   00:00    
[1/2] installing hicolor-icon-theme-0.17nb1...
[2/2] installing htop-3.3.0...
pkg_install warnings: 0, errors: 0
reading local summary...
processing local summary...

>How-To-Repeat:
Install 10 iso in VirtualBox, all defaults but without X. Try to use pkgsrc with HTTPS after.
>Fix:
I remember there was some discussion over IRC that VirtualBox *may* corrupt some network packets ocassionally, but it seems to me that root certs are missing in default install and thus even NetBSD mirrors are affected. Maybe they're installed as some dependencies of X set, that's why it's not always triggered in a console install.