bug#34861: TLS Error with Flatpak

[Ludovic Courtès]

Hi Raghav,

"Raghav Gururajan" <address@hidden> skribis:

> Please find the log at: 
> https://bin.disroot.org/?597e32cb7e42e40e#r9lqwZ6w7sIAWlY2mt6dsgKCKRO5q0ZVt9U69vnZVZs=
> 
> 5462  connect(12, {sa_family=AF_INET, sin_port=htons(443), 
> sin_addr=inet_addr("93.93.130.103")}, 16) = -1 EINPROGRESS (Operation now in 
> progress)

[...]

> 5462  getsockopt(12, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
> 5462  setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0

[...]

> 5462  close(12)                         = 0

[...]

> 5461  write(2, "\33[31m\33[1merror: \33[22m\33[0mTLS support is not 
> available\n", 54) = 54

Thanks for sending the strace output.  That output shows that Flatpak
never tries to access /etc/ssl/certs, ~/.guix-profile/etc/ssl/certs or
anything like that.

The error message comes from GLib, in gdummytlsbackend.c.  AFAICS our
GLib also includes the TLS (not dummy) backend:

--8<---------------cut here---------------start------------->8---
$ objdump -T 
/gnu/store/0q9pq9flr76rh4bv2524niknknnl2kvq-glib-2.56.3/lib/libgio-2.0.so | 
grep g_tls_backend
0000000000093e90 g    DF .text  0000000000000082  Base        
g_tls_backend_get_default_database
0000000000093dd0 g    DF .text  000000000000006f  Base        
g_tls_backend_supports_tls
0000000000093f40 g    DF .text  000000000000001b  Base        
g_tls_backend_get_client_connection_type
0000000000093e40 g    DF .text  0000000000000049  Base        
g_tls_backend_supports_dtls
0000000000093db0 g    DF .text  0000000000000015  Base        
g_tls_backend_get_default
0000000000093f80 g    DF .text  0000000000000072  Base        
g_tls_backend_get_dtls_client_connection_type
0000000000093f60 g    DF .text  000000000000001b  Base        
g_tls_backend_get_server_connection_type
0000000000094000 g    DF .text  0000000000000072  Base        
g_tls_backend_get_dtls_server_connection_type
0000000000094080 g    DF .text  000000000000007f  Base        
g_tls_backend_get_file_database_type
0000000000093d20 g    DF .text  0000000000000084  Base        
g_tls_backend_get_type
0000000000093f20 g    DF .text  000000000000001b  Base        
g_tls_backend_get_certificate_type
--8<---------------cut here---------------end--------------->8---

Libsoup does this:

--8<---------------cut here---------------start------------->8---
static gboolean
soup_socket_setup_ssl (SoupSocket    *sock,
                       const char    *ssl_host,
                       GCancellable  *cancellable,
                       GError       **error)
{
        SoupSocketPrivate *priv = soup_socket_get_instance_private (sock);
        GTlsBackend *backend = g_tls_backend_get_default ();
--8<---------------cut here---------------end--------------->8---

‘g_tls_backend_get_default’ itself looks like this:

--8<---------------cut here---------------start------------->8---
GTlsBackend *
g_tls_backend_get_default (void)
{
  return _g_io_module_get_default (G_TLS_BACKEND_EXTENSION_POINT_NAME,
                                   "GIO_USE_TLS", NULL);
}
--8<---------------cut here---------------end--------------->8---

Could you try setting the ‘GIO_USE_TLS’ environment variable?  Like:

  export GIO_USE_TLS=tls

or maybe:

  export GIO_USE_TLS=GTlsBackend

and then run Flatpak in that environment?

TIA,
Ludo’.