ruby-packer: SSL "Certificate verify failed" when running trivial test program

Here’s my trivial test program:

require 'rss'
require 'open-uri'

def pull(url)
  open(url) do |rss|
    feed = RSS::Parser.parse(rss)
    feed.items.each{ |item| puts item.title }
  end
end

pull 'https://www.theguardian.com/uk-news/rss'

This program works when I run it using ruby. But the compiled (gcc) version does this:

/__enclose_io_memfs__/lib/ruby/2.4.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (OpenSSL::SSL::SSLError)
        from /__enclose_io_memfs__/lib/ruby/2.4.0/net/protocol.rb:44:in `ssl_socket_connect'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/net/http.rb:948:in `connect'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/net/http.rb:887:in `do_start'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/net/http.rb:876:in `start'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:323:in `open_http'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:741:in `buffer_open'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:212:in `block in open_loop'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:210:in `catch'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:210:in `open_loop'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:151:in `open_uri'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:721:in `open'
        from /__enclose_io_memfs__/lib/ruby/2.4.0/open-uri.rb:35:in `open'
        from /__enclose_io_memfs__/local/one.rb:6:in `pull'
        from /__enclose_io_memfs__/local/one.rb:12:in `<main>'

Not sure what is going on here; I’m far from clever with SSL.

If change ‘https://’ to ‘http://’ in the code, then there is no change: it still retrieves the headlines in ruby, and still returns the exact same error message when compiled.

About this issue

  • Original URL
  • State: open
  • Created 7 years ago
  • Comments: 15 (8 by maintainers)

Most upvoted comments

That would be ok for people wanting to compile a package. But then when the package gets distributed and other systems don’t have the certifications in /usr/local/etc/openssl the program will not be able to do https requests.