[ARM] GitError The SSL certificate is invalid from nightlies. #15128

Ismael-VC · 2016-02-18T04:44:29Z

I'm using the default ARM binary from the downloads page, related issues:

Many automated builds/tests are broken with a libgit2 ECERTIFICATE error #13399
Travis error: ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid) #13425

Arch Linux [running on Android via Linux Deploy]
android@localhost ~ % julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+2440 (2016-02-01 02:22 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 2bb94d6 (17 days old master)
|__/                   |  arm-linux-gnueabihf

julia> versioninfo()
Julia Version 0.5.0-dev+2440
Commit 2bb94d6 (2016-02-01 02:22 UTC)
Platform Info:
  System: Linux (arm-linux-gnueabihf)
  CPU: ARMv7 Processor rev 3 (v7l)
  WORD_SIZE: 32
  BLAS: libopenblas (NO_AFFINITY ARMV7)
  LAPACK: libopenblas
  LIBM: libm
  LLVM: libLLVM-3.7.1

julia> Pkg.init()
INFO: Initializing package repository /home/android/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

ViralBShah · 2016-02-18T06:13:55Z

Is this error arm only?

tkelman · 2016-02-18T07:02:40Z

We could add additional default locations to test, ref #13399 (comment) and

julia/Makefile

Lines 458 to 461 in fabec7b

    
           	# We need to bundle ca certs on linux now that we're using libgit2 with ssl 
        
           ifeq ($(shell [ -e $(shell openssl version -d | cut -d '"' -f 2)/cert.pem ] && echo exists),exists) 
        
           	-cp $(shell openssl version -d | cut -d '"' -f 2)/cert.pem $(DESTDIR)$(datarootdir)/julia/ 
        
           endif

and

julia/base/libgit2.jl

Line 515 in fabec7b

    
           cert_file = abspath(ccall(:jl_get_julia_home, Any, ()),Base.DATAROOTDIR,"julia","cert.pem")

Ismael-VC · 2016-02-18T09:07:27Z

Ok I didn't pay attention carefully, this #13399 (comment) fixes this issue:

julia> LibGit2.set_ssl_cert_locations("/etc/ssl/certs/ca-certificates.crt")
0

julia> Pkg.init()
INFO: Initializing package repository /home/android/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

Ismael-VC · 2016-02-18T09:22:51Z

But I need to put it in my .juliarc.jl, after restart:

android@localhost ~ % julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+2440 (2016-02-01 02:22 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 2bb94d6 (17 days old master)
|__/                   |  arm-linux-gnueabihf

julia> Pkg.update()
INFO: Updating METADATA...
WARNING: fetch: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)
INFO: Computing changes...
INFO: No packages to install, update or remove

to use to point libgit2 to specific bundle of trusted CA certificates. Relates to: JuliaLang#13399, JuliaLang#15128

tkelman · 2016-04-21T20:22:04Z

Can someone test with a recent nightly https://status.julialang.org/download/linux-arm and see if #15485 fixed this?

StefanKarpinski · 2016-04-28T15:36:45Z

@Ismael-VC, can you test this out?

Ismael-VC · 2016-04-28T16:45:19Z

Yes, I'm on it.

Ismael-VC · 2016-04-30T07:38:08Z

The issue still persists, tested on a Raspberry Pi2 with the latest available binary:

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+3799 (2016-04-29 17:15 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 1630a3d* (0 days old master)
|__/                   |  arm-linux-gnueabihf

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

julia> LibGit2.set_ssl_cert_locations("/etc/ssl/certs/ca-certificates.crt")
0

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

julia>

Ismael-VC · 2016-04-30T08:09:39Z

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+3799 (2016-04-29 17:15 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 1630a3d* (0 days old master)
|__/                   |  arm-linux-gnueabihf

shell> rm -rf ~/.julia 

shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

Ismael-VC · 2016-04-30T08:23:38Z

shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
# ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"
ENV["SSL_CERT_DIR"] = "/etc/ssl/certs"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

tkelman · 2016-04-30T08:31:09Z

Thanks for testing! So either libgit2 upstream or our bindings aren't reading from the expected env var (or maybe they're doing so but before juliarc runs), but the api in our bindings for setting a location does work. 3 options here:

Document the workaround and call that acceptable for the time being
Reformat or replace the arm buildbot with a centos based setup that matches what we need to do on x86 buildbots.
Find the right additional paths for the currently ubuntu based arm buildbot to bundle its cert files during make binary-dist

Ismael-VC · 2016-04-30T08:39:28Z

~~Using the shell export does work!~~

Sorry, this doesn't work either:

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
# ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"
# ENV["SSL_CERT_DIR"] = "/etc/ssl/certs/"

shell> rm -rf ~/.julia

shell> export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

tkelman · 2016-04-30T09:15:36Z

@wildart any ideas about the environment variable part of this?

@ViralBShah how does scaleway work, what's the oldest possible distro we could provision if we want to do option 2 above?

Ismael-VC · 2016-04-30T21:31:00Z

Ok, I have done more tests and it works using both SSL_CET_* variables, but only if I export them with my shell (zsh), either via the zsh REPL or in the .zshrc config file prior to starting Julia, but it doesn't work if I define the same variables in the .juliarc.jl using ENV or run, even if they do show up as being defined for the Julia process. So I think it's a timing issue?

Works:

ismaelvc@toybox ~ % rm -rf ~/.julia
ismaelvc@toybox ~ % export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt              
ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
julia> ENV["SSL_CERT_FILE"]
"/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

julia>

Doesn't:

ismaelvc@toybox ~ % rm -rf ~/.julia
ismaelvc@toybox ~ % echo 'ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"'           
ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
julia> ENV["SSL_CERT_FILE"]
"/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

julia>

wildart · 2016-05-01T05:14:40Z

Setting SSL_CERT_ variables in .juliarc.jl does not work because libgit2 initialized prior to evaluating this file. I am quite surprised that setting shell environmental variable does not work.

@Ismael-VC Can you look at strace output if certificate file is loaded or referenced?

Ismael-VC · 2016-05-01T13:51:34Z

@wildart I will test with strace and also I'll ask others to test on their Pis just in case.

Ismael-VC · 2016-05-01T13:54:04Z

I am quite surprised that setting shell environmental variable does not work.

Just to be clear, this works, but only if I set the env variable with zsh (in my case), be it via an export or adding the export to my .zshrc and sourcing the file, prior to starting up Julia.

But not when setting he variable from within Julia, even if I use run(export .....).

wildart · 2016-05-01T14:54:47Z

If you want to use .juliarc.jl, the only choice is LibGit2.set_ssl_cert_locations.

PallHaraldsson · 2016-09-01T11:41:14Z

"vtjnash removed the arm label", remove then also from issue title (or close if no longer an issue..?)

tkelman · 2016-09-01T11:53:20Z

@PallHaraldsson that type of comment on a dormant issue doesn't help anything.

This is a consequence of how binaries are built. You need a particular setup to actually get binaries that work across multiple distributions. Our arm (and now power) buildbots are not set up in this way.

ViralBShah added packages Package management and loading system:arm ARMv7 and AArch64 labels Feb 18, 2016

vtjnash removed the system:arm ARMv7 and AArch64 label Mar 8, 2016

vtjnash added this to the 0.5.0 milestone Mar 8, 2016

tkelman added the building Build system, or building Julia or its dependencies label Mar 8, 2016

wildart mentioned this issue Mar 13, 2016

Support SSL_CERT_FILE and SSL_CERT_DIR env vars #15485

Merged

wildart added a commit to wildart/julia that referenced this issue Mar 13, 2016

Use OpenSSL environment variables SSL_CERT_FILE and SSL_CERT_DIR

2a59c5f

to use to point libgit2 to specific bundle of trusted CA certificates. Relates to: JuliaLang#13399, JuliaLang#15128

JeffBezanson assigned tkelman Mar 30, 2016

StefanKarpinski modified the milestones: 0.5.x, 0.5.0 Apr 28, 2016

andreasnoack mentioned this issue Aug 3, 2016

LibGit2.set_ssl_cert_locations segfaults on a cluster #17789

Open

tkelman added system:arm ARMv7 and AArch64 and removed system:arm ARMv7 and AArch64 labels Oct 7, 2016

StefanKarpinski added help wanted Indicates that a maintainer wants help on an issue or pull request and removed help wanted Indicates that a maintainer wants help on an issue or pull request labels Oct 27, 2016

pol31 mentioned this issue Dec 22, 2017

Initialize Julia v0.6.2 behind a proxy #25245

Closed

Ismael-VC closed this as completed Dec 27, 2017

dfornika mentioned this issue Feb 8, 2018

Build failures due to libgit2/SSL error conda-forge/julia-feedstock#45

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ARM] GitError The SSL certificate is invalid from nightlies. #15128

[ARM] GitError The SSL certificate is invalid from nightlies. #15128

Ismael-VC commented Feb 18, 2016

ViralBShah commented Feb 18, 2016

tkelman commented Feb 18, 2016

Ismael-VC commented Feb 18, 2016

Ismael-VC commented Feb 18, 2016

tkelman commented Apr 21, 2016

StefanKarpinski commented Apr 28, 2016

Ismael-VC commented Apr 28, 2016

Ismael-VC commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

tkelman commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

tkelman commented Apr 30, 2016

Ismael-VC commented Apr 30, 2016 •

edited

Loading

wildart commented May 1, 2016

Ismael-VC commented May 1, 2016

Ismael-VC commented May 1, 2016

wildart commented May 1, 2016

PallHaraldsson commented Sep 1, 2016

tkelman commented Sep 1, 2016

[ARM] GitError The SSL certificate is invalid from nightlies. #15128

[ARM] GitError The SSL certificate is invalid from nightlies. #15128

Comments

Ismael-VC commented Feb 18, 2016

ViralBShah commented Feb 18, 2016

tkelman commented Feb 18, 2016

Ismael-VC commented Feb 18, 2016

Ismael-VC commented Feb 18, 2016

tkelman commented Apr 21, 2016

StefanKarpinski commented Apr 28, 2016

Ismael-VC commented Apr 28, 2016

Ismael-VC commented Apr 30, 2016 • edited Loading

Ismael-VC commented Apr 30, 2016 • edited Loading

Ismael-VC commented Apr 30, 2016 • edited Loading

tkelman commented Apr 30, 2016 • edited Loading

Ismael-VC commented Apr 30, 2016 • edited Loading

tkelman commented Apr 30, 2016

Ismael-VC commented Apr 30, 2016 • edited Loading

wildart commented May 1, 2016

Ismael-VC commented May 1, 2016

Ismael-VC commented May 1, 2016

wildart commented May 1, 2016

PallHaraldsson commented Sep 1, 2016

tkelman commented Sep 1, 2016

Ismael-VC commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

tkelman commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading

Ismael-VC commented Apr 30, 2016 •

edited

Loading