Error copier fails trying to build for Odoo v8: Err https://deb.nodesource.com jessie/main Sources

[carlosecv]

Describe the bug

If I try invoke img-build or invoke img-build --pull

To Reproduce

Affected versions:
Odoo v8

Steps to reproduce the behavior:

run invoke img-build or invoke img-build --pull

The process stops with the present error:

Err https://deb.nodesource.com jessie/main Sources
server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Err https://deb.nodesource.com jessie/main amd64 Packages
server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
W: Failed to fetch https://deb.nodesource.com/node_6.x/dists/jessie/main/source/Sources server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

W: Failed to fetch https://deb.nodesource.com/node_6.x/dists/jessie/main/binary-amd64/Packages server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

E: Some index files failed to download. They have been ignored, or old ones used instead.
Fetched 11.8 MB in 3s (3215 kB/s)
Traceback (most recent call last):
File "/opt/odoo/common/build", line 30, in
subprocess.check_call(command)
File "/usr/lib/python2.7/subprocess.py", line 540, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '/opt/odoo/custom/build.d/20-update-pg-repos' returned non-zero exit status 100
ERROR: Service 'odoo' failed to build: The command '/bin/sh -c /opt/odoo/common/build && sync' returned a non-zero code: 1

Expected behavior A clear and concise description of what you expected to happen.

We expect the process as no problem with certificate issue

Additional context Add any other context about the problem here. (e.g. OS, Docker
version, ...)

Docker version 20.10.7, build 20.10.7-0ubuntu1~20.04.1
Invoke 1.5.0
Copier _commit: v2.8.0

[carlosecv]

Also for productive environment

Steps to reproduce:
copier copy gh:Tecnativa/doodba-copier-template
answer all questions:
Odoo v8
Postgresql 9.5

docker-compose -f prod.yaml down ; docker-compose -f prod.yaml build --no-cache ; docker-compose -f prod.yaml up --build --remove-orphans --force-recreate -d

Then fails and no instance created:

Err https://deb.nodesource.com jessie/main Sources
server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Err https://deb.nodesource.com jessie/main amd64 Packages
server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Get:5 http://deb.debian.org jessie/main amd64 Packages [9098 kB]
Get:6 http://security.debian.org jessie/updates/main amd64 Packages [992 kB]
Get:7 https://apt-archive.postgresql.org jessie-pgdg-archive/main Sources [422 kB]
Get:8 https://apt-archive.postgresql.org jessie-pgdg-archive/main amd64 Packages [1142 kB]
Fetched 11.8 MB in 9s (1249 kB/s)
W: Failed to fetch https://deb.nodesource.com/node_6.x/dists/jessie/main/source/Sources server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

W: Failed to fetch https://deb.nodesource.com/node_6.x/dists/jessie/main/binary-amd64/Packages server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

E: Some index files failed to download. They have been ignored, or old ones used instead.
Traceback (most recent call last):
File "/opt/odoo/common/build", line 30, in
subprocess.check_call(command)
File "/usr/lib/python2.7/subprocess.py", line 540, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '/opt/odoo/custom/build.d/20-update-pg-repos' returned non-zero exit status 100
ERROR: Service 'odoo' failed to build: The command '/bin/sh -c /opt/odoo/common/build && sync' returned a non-zero code: 1

[joao-p-marques]

This is not a problem with the copier template, as it comes from invalid certificates from the Debian repo servers.

There is nothing we can do about it, but wait that they fix it, so closing...

[carlosecv]

I read you can put an external certificate on Docker file and with RUN command we can update this certificate this can be a good opportunity to update the images with this possibility?

[carlosecv]

https://askubuntu.com/questions/1095266/apt-get-update-failed-because-certificate-verification-failed-because-handshake

[joao-p-marques]

Ok, we might be able to update ca-certificates in the image to fix this, but I don't think putting the certificate there is the solution. Re-opening this to further investigate...

[carlosecv]

debuerreotype/docker-debian-artifacts#15

I read:

My Go program running in the Debian container fails any HTTP requests towards sites using Let's Encrypt's certs with an error message as x509: certificate signed by unknown authority
Simply adding and running ca-certificates fixs the issue.
RUN apt-get update
&& apt-get install -y --no-install-recommends ca-certificates

RUN update-ca-certificates
From Docker's build log, guess this does the magic by adding the missing root ca.

[joao-p-marques]

Something like that would help, but the best solution might be placing another custom script like https://github.com/Tecnativa/doodba-copier-template/blob/main/odoo/custom/build.d/%7B%25%20if%20odoo_version%20%3C%2011%20%25%7D20-update-pg-repos%7B%25%20endif%20%25%7D.jinja with higher priority to update the packages in the Doodba images that are already frozen.

[carlosecv]

It seems promising !!!

[carlosecv]

Joao at this time how can i update modules on my productive odoo 8 environment?

Usually i run this command, but right now i cant update anithing or install a new odoo 8

docker-compose -f prod.yaml down ; docker-compose -f prod.yaml build --no-cache ; docker-compose -f prod.yaml up --build --remove-orphans --force-recreate -d

Just want to make a invoke git-aggregate like on productive environment

Any advise?

Regards

[andhit-r]

Same error here with v8.0. This issue due nodesource/distributions#1266.

I build osind/doodba:8.0-onbuild for development and precaution purpose while that issue still open. Build from latest 8.0 Dockerfile with some modification to fix cert issue + few issue regarding several change on python dependencies. Works well for my development and few of my deployments.

[joao-p-marques]

Thanks all for the suggestions. Turns out that, for this particular issue, an update to the ca-certificates package wouldn't suffice as, for the old Debian versions we use in older Doodba images, it is no longer updated. Anyway, the fix is already on the way with #279