Ruby crashes on login to imap.gmail.com (ssl)

[Geir Isene]

I do this:

ruby -r net/imap -e 'p Net::IMAP.new("imap.gmail.com", 993, ssl: true)'

...and get this:

Traceback (most recent call last):
 5: from -e:1:in `<main>'
 4: from -e:1:in `new'
 3: from /usr/lib/ruby/2.5.0/net/imap.rb:1092:in `initialize'
 2: from /usr/lib/ruby/2.5.0/net/imap.rb:1531:in `start_tls_session'
 1: from /usr/lib/ruby/2.5.0/net/protocol.rb:44:in `ssl_socket_connect'
/usr/lib/ruby/2.5.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate) (OpenSSL::SSL::SSLError)

But this is not a certificate error, because when I do this:

openssl s_client -showcerts -connect imap.gmail.com -port 993

... certs verifies as fine

And when I do this in Python:

import imaplib
imap = imaplib.IMAP4_SSL('imap.gmail.com')
imap.login("myusername", "mypassword")

...it works just fine (reports success on login).

With Ruby I don't even get to login as the connection to imap.gmail.com fails.

I have been using a script to fetch my gmail to local imap server, and this script (https://github.com/isene/mailfetch/blob/master/mail_fetch.rb) has been running every minute since 10 years ago (more than 5 million times) across many Ubuntu releases without a hitch. It stopped working when I upgraded from 18.04 to 18.10 yesterday.

apt-cache policy ruby

ruby:
  Installed: 1:2.5.1
  Candidate: 1:2.5.1
  Version table:
 *** 1:2.5.1 500
        500 http://no.archive.ubuntu.com/ubuntu cosmic/main amd64 Packages
        100 /var/lib/dpkg/status

I first thought this was a certificate issue and tried updating ca-certificates, symlinking certs manually, etc. I have had help in debugging this over at irc/freenode/#ruby and one person running Suse could not reproduce it. But another running Ubuntu 18.10 was able to reproduce this.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Seth Arnold (seth-arnold)]

GMail crashes:

 ruby -r net/imap -e 'p Net::IMAP.new("imap.gmail.com", 993, ssl: true)'
Traceback (most recent call last):
 5: from -e:1:in `<main>'
 4: from -e:1:in `new'
 3: from /usr/lib/ruby/2.5.0/net/imap.rb:1092:in `initialize'
 2: from /usr/lib/ruby/2.5.0/net/imap.rb:1531:in `start_tls_session'
 1: from /usr/lib/ruby/2.5.0/net/protocol.rb:44:in `ssl_socket_connect'
/usr/lib/ruby/2.5.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate) (OpenSSL::SSL::SSLError)

Canonical's imap server seems to work okay:
# ruby -r net/imap -e 'p Net::IMAP.new("mail.canonical.com", 993, ssl: true)'
#<Net::IMAP:0x000055fc83a42600 @mon_owner=nil, @mon_count=0, [...]

openssl itself to gmail seems fine:

# openssl s_client -verify 3 -CApath /etc/ssl/certs -connect imap.gmail.com:993
verify depth is 3
CONNECTED(00000006)
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = Google Internet Authority G3
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = imap.gmail.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = California, L = Mountain View, O = Google LLC, CN = imap.gmail.com
   i:C = US, O = Google Trust Services, CN = Google Internet Authority G3
 1 s:C = US, O = Google Trust Services, CN = Google Internet Authority G3
   i:OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEgjCCA2qgAwIBAgIIZBW8UvGAR7IwDQYJKoZIhvcNAQELBQAwVDELMAkGA1UE
BhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczElMCMGA1UEAxMc
R29vZ2xlIEludGVybmV0IEF1dGhvcml0eSBHMzAeFw0xODEyMDQwOTMzMDBaFw0x
OTAyMjYwOTMzMDBaMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
MRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKDApHb29nbGUgTExDMRcw
FQYDVQQDDA5pbWFwLmdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBANqp0f0L3OezTKrQM+F+HnIz9Y+qKh4/EujuB8LyKX9gDTk89cZEI+qj
mTFk/xKikUKuOEQp25gXrF87f9rdaMQHP1hYeCGsfbbE0zkuuavi30gzxHLChUUt
RzZUNzlFWh7sc8xYN48DEJRs6UrQ8oHMpNtZL6fCpmglmUDLKGmRqE8Kc3U1Raav
IN3jhGJi2aHOv7h1CJHjl5kLrl1k761IoZZGLPp9AuAj0jMTtRP7hcoUFQN4SYun
MA0Z4Lrh+pqzFKC+UsjAlsGtp4J+muaycdEIEDohexfPhwGuCpSRIcnXwO2dGy+F
wVZ2LA22CHahEvWJn7WnUPsL2vXU2RUCAwEAAaOCAUIwggE+MBMGA1UdJQQMMAoG
CCsGAQUFBwMBMBkGA1UdEQQSMBCCDmltYXAuZ21haWwuY29tMGgGCCsGAQUFBwEB
BFwwWjAtBggrBgEFBQcwAoYhaHR0cDovL3BraS5nb29nL2dzcjIvR1RTR0lBRzMu
Y3J0MCkGCCsGAQUFBzABhh1odHRwOi8vb2NzcC5wa2kuZ29vZy9HVFNHSUFHMzAd
BgNVHQ4EFgQUYTZ9bBKSaGfTadxQm9o+dBrShs4wDAYDVR0TAQH/BAIwADAfBgNV
HSMEGDAWgBR3wrhQmmd2drEtwobQg6B+pn66SzAhBgNVHSAEGjAYMAwGCisGAQQB
1nkCBQMwCAYGZ4EMAQICMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwucGtp
Lmdvb2cvR1RTR0lBRzMuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCC9GrDJDR2Uy/a
QYNFFwl9RLnXTEdRvAzQcVuWWCrgjIgCYG9n9ItLTXd1/LOfE2P9jfIh2P+ZDjna
P8hn96fd2oByZyJU4uMT/gNHXbtEuXeLXo2NXfTn7bNNf8Q3dKuVPZYHt/95UFkz
8RYEFtGZ0I2YqahOmr9M5dTbnMTt/X+u4TVI+MBbBJTlzuH8yvfich5Shp38VMAQ
iYAOubVPnQKONnkzclAb98er5yJQt6H0J83GP/tLoAH1KC1WvQb3j2mJzDoSd9Mi
UryEnqJA7x/jLu/sdQow6FI+EqO1BfjyVvpdAF5CkBRSGoKRjPCFXF3PNzeUJBMn
8Dq0tFrV
-----END CERTIFICATE-----
subject=C = US, ST = California, L = Mounta...

[Geir Isene (qc-e-9h)]

After further research, this seems to actually not be Ruby version specific - because I purged my Ruby 2.5.1 that comes with Ubuntu 18.10 and installed 2.5.3 and 2.4.5 via ([ruby-install](https://github.com/postmodern/ruby-install) and tried both versions - and they both show up with the bug. So, my conclusion must be that there is something else wrong in 18.10, perhaps not Ruby specific at all (but still very odd that it works with Python and openssl directly).