Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wget: TLS error from peer (alert code 40): handshake failure reported by the builder #3417

Open
vguaglione opened this issue Feb 19, 2025 · 0 comments

Comments

@vguaglione
Copy link

Actual behavior
A clear and concise description of what the bug is.
When calling wget to pull down a repo from GitLab, the builder is reporting the following errors:

Connecting to gitlab.dhe.duke.edu (...)
wget: note: TLS certificate validation not implemented
wget: TLS error from peer (alert code 40): handshake failure
wget: error getting response: Connection reset by peer

Our team has verified that Gitlab has dropped support for TLS versions below 1.2 as well as various cyphers. The latest builder is using busybox 1.36, which has a buggy version of wget that can't handle some modern tls.

Expected behavior
wget runs without issue.

To Reproduce
When using the kaniko image, the shell script command:

   - 'wget --header "PRIVATE-TOKEN: ..." -O build/Dockerfile "${CI_API_V4_URL}/projects/2464/repository/files/${TEMPLATE_DOCKERFILE}/raw?ref=${TEMPLATE_BRANCH}"'

is returning the error stated above.

Additional Information
In following this issue that had previously been closed (see below), looks like this is solved with busybox 1.37. Latest busybox:musl includes this fix, however, that fix seemed to get moved after the most recent kaniko build, so a recompile may be all that's needed here.

(#2765

Triage Notes for the Maintainers

Description Yes/No
Please check if this a new feature you are proposing
Please check if the build works in docker but not in kaniko
Please check if this error is seen when you use --cache flag
Please check if your dockerfile is a multistage dockerfile
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant