[Bug]: Smallstep CLI not working in arm64 (android, Termux)

[edwinclement08]

Steps to Reproduce

Get the latest binary for linux from github releases(doesn't work both on stable and Release candidates)

Try to bootstrap with CA

Your Environment

• OS - Termux Android Linux Shell
• step CLI Version - Smallstep CLI/0.23.0-rc.1 (linux/arm64)

Expected Behavior

Step Cli bootstraps successfully

Actual Behavior

Get this error instead

error downloading root certificate: client.Root; client GET https://ca.example.com:8443/root/43193c1a62bb72666d0c2e602a3f9eec7b0a97d699b4057d4483d204a0278bf9 failed: Get "https://ca.example.com:8443/root/43193c1a62bb72666d0c2e602a3f9eec7b0a97d699b4057d4483d204a0278bf9": dial tcp: lookup ca.example.com on [::1]:53: read udp [::1]:43512->[::1]:53: read: connection refused

Attaching a full log file with STEPDEBUG=1 active
smallstep-debug.log

Additional Context

I also tried the armv7 binary with similar parameters and got the same result.

I verified that the bootstrapping works on other x86 machines. I also checked if the CA health check URL is accessible from the android device.
Also verified that the URL https://ca.example.com:8443/root/43193c1a62bb72666d0c2e602a3f9eec7b0a97d699b4057d4483d204a0278bf9 is accessible, though, we do get the untrusted warning error.

I am not trying to use Step CA as a TLS/SSL CA, but as an SSH CA. I don't care if the --install option does not work through the Termux environ. I desire to be able to ssh into my machines from my android device and run some scripts.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[hslatman]

Hey @edwinclement08,

The CLI tries to resolve the ca.example.com domain (you may have changed that for this issue?) by connecting to a DNS server on the Android device ([::1]:53). I think this is due to the binary not being compiled for Android (GOOS=android) specifically, resulting in the the DNS falling back to localhost. Also see these similar issues with Terraform and 1Password with Termux:

• Terraform: DNS issues with terraform termux/termux-app#869
• 1Password: https://1password.community/discussion/103919/cli-sign-in-fails-on-termux-android-localhost-dns-request-issue

I think there are two solutions we can choose from:

• Add an option to the CLI to make it use a different DNS resolver.
• Create a release of step with GOOS=android. This probably is the better solution, as there may be more things that are Android specific.

We'll discuss this in our open source triage meeting today.

Until we have a solution, you could try an GOOS=android build yourself to check if it works.

[edwinclement08]

Thanks for the idea. Will try that. On a side note, i have tried curl and nslookup for those domains and those worked.
Yep, anonymized the domain for the issue.
Thanks for the quick response

[dopey]

Hey @edwinclement08 👋 just following up. did @hslatman's recommendation work for you?

[edwinclement08]

Got the same error as before when I tried GOOS=android in the makefile.
I tried the suggestion from termux/termux-app#869 (comment) and that worked

Paraphrasing the solution here

1. Install necessary packages:

pkg install proot resolv-conf

2. Bind resolv.conf file to right place when executing binary:

proot -b $PREFIX/etc/resolv.conf:/etc/resolv.conf ~/bin/step

3. The above will run the step binary, but is long and unwieldy. You can add a bash function to make it cleaner

step() {
   proot -b $PREFIX/etc/resolv.conf:/etc/resolv.conf ~/bin/step $@
}

[maraino]

@edwinclement08 The makefile will disable CGO by default, perhaps allowing it will work without using chroot.

CGO_ENABLED="1" GOOS=android GOARCH=arm64 go build -o step github.com/smallstep/cli/cmd/step

Using the makefile is a little bit more confusing to me, the command would be:

make build V=1 GOOS_OVERRIDE="GOOS=android GOARCH=arm64" CGO_OVERRIDE="CGO_ENABLED=1"

Just make sure to use the appropriate GOARCH for your device. With CGO, the OS resolver will be used instead of reading /etc/resolv.conf

[virtualdxs]

Building with CGO_ENABLED=1 fixed it for me. Would it be possible to get this as an official build?

[maraino]

Building with CGO_ENABLED=1 fixed it for me. Would it be possible to get this as an official build?

Cross-compiling with CGO enabled can get a little bit trickier. You need the toolchain for the targetted architecture and OS version to make it work. For your case, it will probably be libc, but which version? Without going into Android, for example, Ubuntu 20.04 and 22.04 use different versions. If you compile on an Ubuntu 22.04, it won't work on 20.04, if you do it the other way around, it might.

For special cases like yours, you will get better results compiling it yourself. But at the same time, we're also looking into building some build CGO dependant, as the net resolver works better with it. We can add android to the list.