javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

So it seemed like the Gmail SSL certificate for IMAP or POP wasn’t validating. That’s weird as it would be a major problem if it didn’t and they’re certainly not using a self-signed certificate.

I checked the keystore and it appeared empty so it looks like FreeBSD’s Java doesn’t ship with the normal list of CAs. To fix this I did:

[henare@freebsd ~]$ ls -l /usr.local/diablo-jdk1.6.0/jre/lib/security/cacerts
-rw-r--r-- 1 root wheel 942 Aug 6 2007 /usr/ports/java/jdk16/files/cacerts
[henare@freebsd ~]$ #wow, that file's really small (this directory was in our JAVA_HOME - don't ask me about the usr.local thing)
[henare@freebsd ~]$ #first, backup this file
[henare@freebsd ~]$ sudo cp /usr/local/diablo-jdk1.6.0/jre/lib/security/cacerts{,_backup`date +%Y%m%d`}
[henare@freebsd ~]$ #now, copy over the file from ports
[henare@freebsd ~]$ sudo cp /usr/ports/java/jdk16/files/cacerts /usr.local/diablo-jdk1.6.0/jre/lib/security/cacerts
[henare@freebsd ~]$ ls -l /usr.local/diablo-jdk1.6.0/jre/lib/security/cacerts
-rw-r--r-- 1 root wheel 40624 Aug 6 2007 /usr/ports/java/jdk16/files/cacerts
[henare@freebsd ~]$ #that looks better

The files mirrored from the original site had a question mark in the file name due to them being queries and the fact that Unix supports question marks in file names. This wasn’t a problem for most modern browsers as they encode the question mark before doing the request and Apache happily serves up the file. After doing a test migration of the site I noticed heaps of 404s coming from visitors to the site via search engines.

I got around this with some painful mod_rewrite hacking:

RewriteEngine On
RewriteCond %{QUERY_STRING} .
RewriteCond %{REQUEST_FILENAME} \.asp$
RewriteRule ^(.*)$ http://example.com$1\%3F%{QUERY_STRING}? [NE]

In semi-human-speak:

• Turn the mod_rewrite engine on
• Look for queries that have a query string (i.e. a ? and anything after it)
• And where the filename requested is a .asp file
• Rewrite the whole request to http://example.com
  • Then the original request (sans query string)
  • Then %3F (question mark encoded)
  • Then the query string and make sure there’s no other query string appended (the ? at the end)
  • Also, don’t encode the stuff we’re throwing back to the client (the [NE])

for i in *.tif; do tifftopnm "$i" | pnmtojpeg > "${i%.tif}.jpeg"; done

That’ll convert all .tif files in a directory to JPEG (using default processing setting).

I didn’t have exiftool installed, and no internerd or media to install it from, otherwise I would’ve looked at doing the metadata too.

killall evolution-data-server-2.28

Server did not offer supported security type

To set the Apple Remote Desktop server to use “legacy” VNC mode (i.e. unencrypted passwords), you can SSH into the server (if it’s remote) and execute the following command:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -restart -agent -privs -all -clientopts -setvnclegacy -vnclegacy -yes -setvncpw -vncpw somesecretpassword

Remember that you’re now using VNC in it’s normal mode where passwords are transmitted across the wire in plaintext so if the network you’re connecting across is untrusted, tunnel the connection using SSH or similar.

I’ve created another incremental build of OpenAustralia DevLive. Version 0.0.5 simply makes the web application’s directory the twfy git source tree so you can now use the source control features of git (like resetting after making changes).

You can download the 429 MB VMWare image from SUSE Studio for the next week or so (let me know if you want it after this as I may have to initiate a rebuild to make the download available again).

Git Repository

All of the files used to create OpenAustralia DevLive are now hosted in a GitHub repository so you can now build your own if you’d like.

A few points:

• There are lots of Solaris things I don’t like after coming from Linux. Packaging first, and the tools it ships with (I want GNU grep and tar, dammit!)
• To allow an unprivileged user (our confluence user in this case) to bind to privileged ports (i.e. TCP < 1024), run this as root with the user logged out usermod -K defaultpriv=basic,net_privaddr confluence
• Use prstat, not top on Solaris
• When Atlassian says don’t use Solaris’ version of tar, they mean it. I spent about half an hour debugging only to find that Solaris had untarred the file incorrectly. Grrr.
• I love open formats and the *nix way. I did a mysqldump from our old server and found that our DB tables were using the MyISAM engine (not recommended by Atlassian), so I switched to InnoDB by a simple, quick sed through the dump. Brilliant. I love it.
• To stress test the application after the move I used siege, which worked a treat. It’s probably packaged for your Linux distro too

Confluence seems to be running fine on the new VM and withstood my siege, it’s only small (50 MB) so that might be a factor but it’s worth testing if you need to make this move yourself.

After the appliance boots, build the search index by opening a terminal and running:

/srv/www/openaustralia/twfy/search/index.pl openaustralia daterange 2007-09-19 2007-09-21

The 416 MB VMWare image can be downloaded from SUSE Studio for the next week or so. If you have any issues downloading or using the appliance, please leave a comment.

https://www.google.com/accounts/o8/id

You can hack this with this small change to the XLST, a git-diff as follows:

diff --git a/gsa-original b/gsa-smb
index ba1c66f..73751ab 100644
--- a/gsa-original
+++ b/gsa-smb
@@ -2680,8 +2680,7 @@ for (var j = 1; j < p.length; j++) { url += "&" + p[j]; }}
</xsl:when>

<xsl:when test="$protocol='nfs' or $protocol='smb'">
- <xsl:value-of disable-output-escaping='yes'
- select="concat($protocol,'/',$temp_url)"/>
+ <xsl:value-of disable-output-escaping='yes' select="concat('file://', substring-after(U, '://'))"/>
</xsl:when>
<xsl:when test="$protocol='unc'">
<xsl:value-of disable-output-escaping='yes' select="concat('file://', $display_url2)"/>

Now, after you collect your jaw from the floor when you realise that this will create URLs like file://servername/path/to/file, please remind yourself of the earlier caveats of hack and Windows. This actually took longer that it should have to debug as Firefox on Linux isn’t insane enough to make this work.

If the POC works out and we decided to go ahead with the GSA use, I’d be searching for something a bit more robust (and if I’m working on it, I’ll share the details of what we decide to do!).