{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/33330","labels_url":"https://api.github.com/repos/Homebrew/homebrew/issues/33330/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/33330/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/33330/events","html_url":"https://github.com/Homebrew/homebrew/issues/33330","id":46190821,"number":33330,"title":"Decide what to do with sourceforge svn checkouts","user":{"login":"jacknagel","id":568243,"avatar_url":"https://avatars.githubusercontent.com/u/568243?v=3","gravatar_id":"","url":"https://api.github.com/users/jacknagel","html_url":"https://github.com/jacknagel","followers_url":"https://api.github.com/users/jacknagel/followers","following_url":"https://api.github.com/users/jacknagel/following{/other_user}","gists_url":"https://api.github.com/users/jacknagel/gists{/gist_id}","starred_url":"https://api.github.com/users/jacknagel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacknagel/subscriptions","organizations_url":"https://api.github.com/users/jacknagel/orgs","repos_url":"https://api.github.com/users/jacknagel/repos","events_url":"https://api.github.com/users/jacknagel/events{/privacy}","received_events_url":"https://api.github.com/users/jacknagel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-10-18T23:39:24Z","updated_at":"2015-07-07T07:43:18Z","closed_at":null,"body":"We're not very consistent in how we handle svn checkouts from sourceforge.\r\n\r\nChecking out over HTTPS from sourceforge produces a certification verification error and an interactive prompt like this:\r\n\r\n```\r\nError validating server certificate for 'https://wladx.svn.sourceforge.net:443':\r\n - The certificate is not issued by a trusted authority. Use the\r\n   fingerprint to validate the certificate manually!\r\nCertificate information:\r\n - Hostname: *.svn.sourceforge.net\r\n - Valid: from Thu, 08 May 2014 00:00:00 GMT until Sun, 07 Jun 2015 23:59:59 GMT\r\n - Issuer: GeoTrust Inc., US\r\n - Fingerprint: 39:14:cc:ac:41:da:21:19:9a:70:d8:a9:a0:da:62:e9:b1:4a:3f:64\r\n(R)eject, accept (t)emporarily or accept (p)ermanently?\r\n```\r\n\r\nSo here are some options:\r\n  * Always check out over HTTPS. This is of little value if we cannot trust the certificate, but it may work behind corporate firewalls when regular HTTP does not. The error and prompt can be suppressed using `UnsafeSubversionDownloadStrategy`, but I'd like to eliminate rather than encourage its use.\r\n  * Always check out over regular HTTP. May not work behind firewalls.\r\n  * Always check out over the SVN protocol. Faster than HTTP, but unlikely to work behind firewalls.\r\n\r\nHere's a summary of current sourceforge svn checkouts:\r\n\r\n#### HTTP\r\n  * netpbm `http://svn.code.sf.net/p/netpbm/code/advanced` (stable)\r\n  * ode: `http://opende.svn.sourceforge.net/svnroot/opende/trunk` (head)\r\n  * spim:  `http://svn.code.sf.net/p/spimsimulator/code` (stable)\r\n  * vgmstream: `http://svn.code.sf.net/p/vgmstream/code` (stable)\r\n  * xmlrpc-c: `http://svn.code.sf.net/p/xmlrpc-c/code/stable` (stable)\r\n  * sdcv `http://svn.code.sf.net/p/sdcv/code/trunk` (stable)\r\n\r\n#### HTTPS\r\n  * ctags: `https://svn.code.sf.net/p/ctags/code/trunk` (head)\r\n  * <strike>doxygen: `https://doxygen.svn.sourceforge.net/svnroot/doxygen/trunk` (head)</strike> switched to git\r\n  * gmtl: `https://ggt.svn.sourceforge.net/svnroot/ggt/trunk` (head)\r\n  * gpac: `https://gpac.svn.sourceforge.net/svnroot/gpac/trunk/gpac` (head)\r\n  * irrlicht: `https://irrlicht.svn.sourceforge.net/svnroot/irrlicht/trunk` (head)\r\n  * lasi: `https://lasi.svn.sourceforge.net/svnroot/lasi/trunk` (head)\r\n  * nzbget: `https://nzbget.svn.sourceforge.net/svnroot/nzbget/trunk` (head)\r\n  * sdcc: `https://sdcc.svn.sourceforge.net/svnroot/sdcc/trunk/sdcc` (head)\r\n  * teem: `https://teem.svn.sourceforge.net/svnroot/teem/teem/trunk` (head)\r\n  * unfs3: `https://svn.code.sf.net/p/unfs3/code/trunk` (head)\r\n  * wla-dx: `https://wladx.svn.sourceforge.net/svnroot/wladx` (head)\r\n\r\n#### SVN protocol\r\n  * dasm: `svn://svn.code.sf.net/p/dasm-dillon/code/trunk` (head)\r\n  * gpsim: `svn://svn.code.sf.net/p/gpsim/code/trunk` (head)\r\n  * rcslogplayer: `svn://svn.code.sf.net/p/sserver/code/rcss/trunk/rcsslogplayer` (head + resources)"},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments/119106291","html_url":"https://github.com/Homebrew/homebrew/issues/33330#issuecomment-119106291","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/33330","id":119106291,"user":{"login":"apjanke","id":2618447,"avatar_url":"https://avatars.githubusercontent.com/u/2618447?v=3","gravatar_id":"","url":"https://api.github.com/users/apjanke","html_url":"https://github.com/apjanke","followers_url":"https://api.github.com/users/apjanke/followers","following_url":"https://api.github.com/users/apjanke/following{/other_user}","gists_url":"https://api.github.com/users/apjanke/gists{/gist_id}","starred_url":"https://api.github.com/users/apjanke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apjanke/subscriptions","organizations_url":"https://api.github.com/users/apjanke/orgs","repos_url":"https://api.github.com/users/apjanke/repos","events_url":"https://api.github.com/users/apjanke/events{/privacy}","received_events_url":"https://api.github.com/users/apjanke/received_events","type":"User","site_admin":false},"created_at":"2015-07-07T07:43:18Z","updated_at":"2015-07-07T07:43:18Z","body":"Hi folks.\r\n\r\nI think the issue here is that a) the system `svn` is using the system OpenSSL library, and b) the system OpenSSL library ships without a list of trusted root certificates. (Why? I dunno.) The HTTPS downloads with the system `svn` could be fixed by making it aware of the root certificates.\r\n\r\nThe Homebrew `openssl` formula [bootstraps a cert.pem file from the system keychains](https://github.com/Homebrew/homebrew/blob/b35c6403392e2829291ef0833b05fd25e588992e/Library/Formula/openssl.rb#L104-L122). With that file in existence, I was able to get the system `svn` on 10.9.5 to work using the `SSL_CERT_FILE` openssl configuration variable.\r\n\r\n```\r\n➜  svn  /usr/bin/svn checkout https://svn.code.sf.net/p/ctags/code/trunk work/foo\r\nError validating server certificate for 'https://svn.code.sf.net:443':\r\n - The certificate is not issued by a trusted authority. Use the\r\n   fingerprint to validate the certificate manually!\r\nCertificate information:\r\n - Hostname: *.code.sf.net\r\n - Valid: from Thu, 16 Apr 2015 00:00:00 GMT until Sun, 15 May 2016 23:59:59 GMT\r\n - Issuer: GeoTrust Inc., US\r\n - Fingerprint: 1f:7b:73:d5:cf:71:18:76:d5:23:f3:07:c9:2f:f5:4a:52:67:0f:68\r\n(R)eject, accept (t)emporarily or accept (p)ermanently? r\r\nsvn: E175002: Unable to connect to a repository at URL 'https://svn.code.sf.net/p/ctags/code/trunk'\r\nsvn: E175002: OPTIONS of 'https://svn.code.sf.net/p/ctags/code/trunk': Server certificate verification failed: issuer is not trusted (https://svn.code.sf.net)\r\n➜  svn  SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem /usr/bin/svn checkout https://svn.code.sf.net/p/ctags/code/trunk work/foo\r\nA    work/foo/sql.c\r\nA    work/foo/tex.c\r\nA    work/foo/options.h\r\nA    work/foo/args.h\r\nA    work/foo/Makefile.in\r\nA    work/foo/entry.c\r\n```\r\n\r\nThis lets you use HTTPS securely (still validating the server certificate), consistent with the system's own trust policy.\r\n\r\nMaybe you could have a build-time dependency on Homebrew's `openssl` just to get that `certs.pem` file to point to, even if you're using the system `svn`. Or make a special formula that just bootstraps a `certs.pem` file from the system keychain using the system OpenSSL. "}}