Re: Time to upgrade buildfarm coverage for some EOL'd OSes?

On 2021-10-08 21:40, Thomas Munro wrote:

>> Sure I can keep curculio as is.  Will just upgrade morepork to OpenBSD
>> 6.9 then.
> 
> Thanks very much for doing all these upgrades!

No problem.

Current status is:

loach: Upgraded to FreeBSD 12.2
morepork: Upgraded to OpenBSD 6.9
conchuela: Upgraded to DragonFly BSD 6.0
sidewinder: Upgraded to NetBSD 9.2

curculio: Is not able to connect to https://git.postgresql.org due to 
the Let's Encrypt expired CA.

Without doing anything:

$ git clone https://git.postgresql.org
Cloning into 'git.postgresql.org'...
fatal: unable to access 'https://git.postgresql.org/': SSL certificate 
problem: certificate has expired

Modifying /etc/ssl/certs.pem by removing expired DST Root CA X3:

$ git clone https://git.postgresql.org
Cloning into 'git.postgresql.org'...
fatal: unable to access 'https://git.postgresql.org/': SSL certificate 
problem: unable to get local issuer certificate

Then I tried to download the new CA and Intermediate from:

https://letsencrypt.org/certificates/

and adding them manually to /etc/ssl/cert.pem

but no dice.  Only getting:

$ git clone https://git.postgresql.org
Cloning into 'git.postgresql.org'...
fatal: unable to access 'https://git.postgresql.org/': SSL certificate 
problem: unable to get local issuer certificate

If anybody have any tips about how to get SSL-working again, I'll gladly 
take it.

/Mikael