Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1943818 - Cannot accept self-signed certs in GNOME Calendar flatpak
Summary: Cannot accept self-signed certs in GNOME Calendar flatpak
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: evolution-data-server
Version: 34
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Milan Crha
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-03-27 17:20 UTC by Andrew Thurman
Modified: 2021-04-01 00:52 UTC (History)
5 users (show)

Fixed In Version: evolution-data-server-3.40.0-3.fc34
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-03-29 15:16:51 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Brief video of the behavior. (3.10 MB, application/x-matroska)
2021-03-27 17:20 UTC, Andrew Thurman
no flags Details

Description Andrew Thurman 2021-03-27 17:20:47 UTC
Created attachment 1766912 [details]
Brief video of the behavior.

Description of problem:
Cannot accept self-signed certs in GNOME Calendar flatpak. The dialog window appears to do so, but when clicking accept (or reject, or anything besides cancel) it simply disappears and reappears.

Version-Release number of selected component (if applicable):
[andythurman@rockhopper ~]$ rpm -qa evolution-data-server
evolution-data-server-3.40.0-2.fc34.x86_64

[andythurman@rockhopper ~]$ flatpak info org.gnome.Calendar

Calendar - Calendar for GNOME

          ID: org.gnome.Calendar
         Ref: app/org.gnome.Calendar/x86_64/stable
        Arch: x86_64
      Branch: stable
     Version: 3.38.2
     License: GPL-3.0-or-later
      Origin: flathub
  Collection: org.flathub.Stable
Installation: system
   Installed: 16.8 MB
     Runtime: org.gnome.Platform/x86_64/3.38
         Sdk: org.gnome.Sdk/x86_64/3.38

      Commit: 77ac076fff6756f630482bb10f63d3754c9eb231510943f24676f11e989e807b
      Parent: d646a20edfaa629ddb385e79462043e42bdf5df64e4c62825cb051baec4dce85
     Subject: Update to 3.38.2 (838e8058)
        Date: 2020-12-17 16:42:46 +0000


How reproducible:
Always.

Steps to Reproduce:
1. Launch GNOME calendar or wait for the evolution-data-server background tasks.
2. Attempt to accept self-signed cert (Nextcloud specifically.)

Actual results:
Cannot accept as described above.

Expected results:
Can accept and use calendar (behavior present currently in 33)

Additional info:
Things like mounting the https share in Nautilus and signing in the account in gnome-online-accounts works fine and accepts the cert, so I belive the problem is exclusive to this component.

Comment 1 Milan Crha 2021-03-29 07:59:51 UTC
Thanks for a bug report. This is a bit problematic. The Flathub's GNOME Calendar builds with evolution-data-server 3.38.2, while the system runs 3.40.0. The 3.40 switched from SHA1 hashes to SHA256 hashes of the certificates. As the SHA hash is computed "by the client", the Calendar computes SHA1 hash, which doesn't match the SHA256 hash, thus it's re-asked for the certificate trust.

I'll add a workaround for the transition period to accept also SHA1 hashes.

Comment 2 Andrew Thurman 2021-03-29 14:32:24 UTC
Ok, thanks. I'll also take a look upstream to see if rebasing to evolution 40 would be in order.

Comment 3 Andrew Thurman 2021-03-29 14:34:10 UTC
This work is already being done: https://github.com/flathub/org.gnome.Calendar/pull/29

Seems to still be having issues, so a local fix would be great!

Comment 4 Fedora Update System 2021-03-29 14:57:51 UTC
FEDORA-2021-e53897d7e9 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-e53897d7e9

Comment 5 Milan Crha 2021-03-29 14:58:33 UTC
I fixed this upstream in commit [1] for 3.41.1 and 3.40.1+. I'm building a new evolution-data-server for Fedora until the new upstream version is released. This requires an evolution-calendar-factory process restart once the new version is installed.

As a workaround, run a host system version on the application and accept the certificate there.

[1] https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/8c9b1cde5dcd5e20fcb6d3a84908ef536e39268a

Comment 6 Andrew Thurman 2021-03-29 14:59:39 UTC
Alright, I'll test when I get a chance.

Comment 7 Andrew Thurman 2021-03-29 15:16:51 UTC
Fixed! Thanks!

Comment 8 Fedora Update System 2021-03-30 14:38:12 UTC
FEDORA-2021-e53897d7e9 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-e53897d7e9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-e53897d7e9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2021-04-01 00:52:03 UTC
FEDORA-2021-e53897d7e9 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.