SSL Error with AUR using Curl

[Tuxnewbie]

Hello Everyone,

I have installed the latest Gnome Iso with all updates so the certificates should be up-to-date however when attempting to install free download manager from the AUR, I’m seeing an SSL verification Error. The documentation says you can skip the verification but I can’t seem to get that to work. How can I fix this?

paru -S freedownloadmanager
:: Resolving dependencies…
:: Calculating conflicts…
:: Calculating inner conflicts…

Aur (1) freedownloadmanager-6.24.2.5857-1

:: Proceed to review? [Y/n]: y

:: Downloading PKGBUILDs…
PKGBUILDs up to date
nothing new to review
fetching devel info…
==> Making package: freedownloadmanager 6.24.2.5857-1 (Sat 14 Dec 2024 08:33:57 PM EST)
==> Retrieving sources…
→ Downloading freedownloadmanager.deb…
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:–:-- --:–:-- --:–:-- 0
curl: (60) SSL peer certificate or SSH remote key was not OK
More details here…

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
==> ERROR: Failure while downloading…
Aborting…
error: failed to download sources for ‘freedownloadmanager-6.24.2.5857-1’:
error: packages failed to build: freedownloadmanager-6.24.2.5857-1

[linux-aarhus]

The verification you are are thinking of is the checksum verification of the downloaded sources.

Skipping verification cannot be done for a https connection as it is the server providing an invalid certificate.

[Tuxnewbie]

Linux-aarhus

So you’re saying the issue must be fixed by upstream?

[linux-aarhus]

@Tuxnewbie

So you’re saying the issue must be fixed by upstream?

This happens from time to time for almost any administrator.

I am saying the server hosting the source is providing an invalid certificate - possibly expired - the server admin for the domain in question need to renew certificate.

[Tuxnewbie]

ah! would it be possible to convert the deb package to a local package - ALPM for pamac to install?

[linux-aarhus]

The deb file is at https://files2.freedownloadmanager.org/6/latest/freedownloadmanager.deb which has an invalid certificate

Try persepolis from the extra repo

sudo pacman -Syu persepolis

[Mirdarthos]

@Tuxnewbie

would it be possible to convert the deb package to a local package - ALPM for pamac to install?

In short: don’t.

Still want to? You are on your own:

[root tip] [How To] Install a .deb package on Manjaro

Install Convert deb to pkg.tar.zst One could consider the topic title clickbait but the question surfaces from time to time The short answer is You cannot! Keep reading for the longer answer. If you reach the bottom of this thread - you also get an idea of how much work there is for a package maintainer to keep up with upstream changes. Think of the work if the package is compiled from source … Perhaps then you will appreciate the work done by the team voluntering their free time to mainta…

[Tuxnewbie]

Thank you. Where can issues such as this be reported?

[Tuxnewbie]

Thank you. I was just wondering because pamac accepts ALPM packages

[soundofthunder]

@Tuxnewbie

Where can issues such as this be reported?

Ordinarilly I’d suggest the originating site itself; in this case freedownloadmanager.org; should be your first port of call.

[cscs]

Free Download Manager has been a point of exploitation multiple times, and sometimes in the same ways for years. I wouldnt trust it at all, but I doubly wouldnt trust it with some broken cert.

Random search hits…

Compromised Free Download Manager website was delivering malware for years

Trojanized Free Download Manager found to contain a Linux backdoor

Also this should be a warning to other helpers or tinkerers … sometimes actors may ask for help with ~some software~ in order to encourage more infections. Be Safe. <3

[Tuxnewbie]

Issue fixed as of 12.17.24. Admin must have corrected the issue.

[Tuxnewbie]

Thank you cscs. I have read those articles from the past. FDM works well for me.