前言
前兩天IT部發(fā)了封郵件，將gitlab由HTTP改為了HTTPS，正好要去Jenkins構(gòu)建部署上線包，將原有的克隆鏈接由HTTP改為了HTTPS，然后點擊構(gòu)建，沒想到的是，構(gòu)建直接就報錯了。
Fetching changes from the remote Git repository
ERROR: Error fetching remote repo 'origin'
hudson.plugins.git.GitException: Failed to fetch from https://xxx@gitlab.xxx.com/xxx
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:899)
at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1114)
at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1145)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:124)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:93)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:80)
at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --force --progress -- https://xxx@gitlab.xxx.com/xxx+refs/heads/*:refs/remotes/origin/*" returned status code 128:
stdout:
stderr: fatal: unable to access 'https://gitlab.xxx.com/xxx/': SSL connect error
看到這個報錯returned status code 128: SSL connect error我就很郁悶了，就改為了HTTPS鏈接，怎么就能報SSL錯誤了。
解決方案
詳細查閱了各類資料，發(fā)現(xiàn)git克隆的步驟，簡單描述就是git通過curl命令去下載代碼庫。不清楚curl命令的請移步至curl的百度百科。
[root@localhost ~]# curl -v https://xxx@gitlab.xxx.com/xxx.git
* About to connect() to gitlab.xxx.com port 443 (#0)
* Trying xxx.xxx.xxx.xxx... connected
* Connected to gitlab.xxx.com (xxx.xxx.xxx.xxx) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12190
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
在curl本人克隆代碼庫的HTTPS連接后，發(fā)現(xiàn)根源所在了，是由于NSS error -12190這個錯誤導致curl拋出了SSL連接錯誤從而由Jenkins拋出，看來問題根源在這里。
繼續(xù)查找NSS error -12190錯誤的解決辦法，終于在stackoverflow找到了有關于這個問題的丁點解釋：
The reason you failed:
Some old/vulnerable NSS is used for SSL within cURL library when you go to some url, so it's rejected. So within this machine you have chance to fail to run cURL related commands such as pycurl.
The solution:
IMO the NSS is bundle with CentOS 7.0 VM, so you can update NSS libraries as following.
yum update nss nss-util nspr
即當訪問某些URL時，cURL庫中的SSL使用了一些較舊/易受攻擊的NSS，因此將其拒絕。IMO NSS與CentOS 7.0 VM捆綁在一起，因此可以按上述方式更新NSS庫。在更新curl與nss后，再次克隆成功，到此問題解決。
查閱了各大博客網(wǎng)站，經(jīng)過整理，總結(jié)如下(一般來說遇到這種問題直接看第三種解決方案即可)：
1、重新配置git賬戶。
2、更新構(gòu)建機器上的git版本(使用安裝命令也可更新git)。
yum -y install git
3、更新curl與nss。
yum update curl
yum update nss nss-util nspr
歡迎訪問我的個人博客：Lemon - 萬事順遂
