Bug#735366: libnet-twitter-perl: 403 Forbidden or certificate error due to SSL/TLS traffic restriction

[Vincent Lefevre]

Package: libnet-twitter-perl
Version: 4.01000-1
Severity: grave
Justification: renders package unusable

The Net::Twitter module suddenly stopped working on 2014-01-14 at
about 19:30 UTC. I now also get 403 Forbidden errors. The cause is
a change in the Twitter API:

  https://dev.twitter.com/discussions/24239

In the discussion:

@newsytweets News As It Happens

  I am positive that I am using the https endpoint, but still getting
  403 error code. Anyone else seeing the same problem? I am using
  Net::Twitter perl module. I checked the source code and it is indeed
  using https.

@Cornel74 Cornel van Mastrigt

  I had a similar problem you could try the apiurl parameter to supply
  an alternative API url. It seems to be defaulting to
  http://api.twitter.com/1

  I fixed my 403 errors by adding: apiurl => 'https://api.twitter.com/1.1'

@newsytweets News As It Happens

  @cornel74 you are a lifesaver! Thanks. 

I've tried the

  apiurl => 'https://api.twitter.com/1.1'

solution (I'm wondering why it wasn't done by default before!) but
I still get an error:

  500 Can't connect to api.twitter.com:443 (certificate verify failed)

So, there are 2 problems:

1. The default apiurl that is now broken (it was insecure before).

2. The certificate error (for this one, I don't know which package
is in fault).

This bug report might be cloned after identifying the exact problem
for (2), if not in libnet-twitter-perl.

-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.12-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages libnet-twitter-perl depends on:
ii  libcarp-clan-perl                  6.04-1
ii  libclass-load-perl                 0.20-1
ii  libcrypt-ssleay-perl               0.58-1+b1
ii  libdata-visitor-perl               0.30-1
ii  libdatetime-format-strptime-perl   1.5400-1
ii  libdatetime-perl                   2:1.06-1
ii  libdevel-stacktrace-perl           1.3000-1
ii  libdigest-hmac-perl                1.03+dfsg-1
ii  libhtml-parser-perl                3.71-1+b1
ii  libjson-perl                       2.61-1
ii  liblwp-protocol-https-perl         6.04-2
ii  libmoose-perl                      2.1005-1+b1
ii  libmoosex-role-parameterized-perl  1.02-1
ii  libnamespace-autoclean-perl        0.15-1
ii  libnet-http-perl                   6.06-1
ii  libnet-oauth-perl                  0.28-1
ii  libtry-tiny-perl                   0.18-1
ii  liburi-perl                        1.60-1
ii  libwww-perl                        6.05-2
ii  perl                               5.18.1-5

libnet-twitter-perl recommends no packages.

libnet-twitter-perl suggests no packages.

-- no debconf information