formulae.homebrew.sh - DNS gives conflicting answers, cannot access

[itsayellow]

Output of brew config

HOMEBREW_VERSION: 4.4.7
ORIGIN: https://github.com/Homebrew/brew
HEAD: 4a77cd1e2f7ed058d03a47fe1f18819b246e67f6
Last commit: 7 hours ago
Core tap JSON: 25 Nov 16:03 UTC
Core cask tap JSON: 25 Nov 16:03 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: vim
HOMEBREW_MAKE_JOBS: 10
HOMEBREW_NO_ENV_HINTS: set
Homebrew Ruby: 3.3.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.6/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 16.0.0 build 1600
Git: 2.47.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.1.1-arm64
CLT: 16.1.0.0.1.1729049160
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /opt/homebrew/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/opt/homebrew/sbin:$PATH"' >> ~/.zshrc

Description of issue

Plain network in Brazil doesn't work

Everything used to work perfectly until the last few weeks.

The first problem is that whenever I run brew update from my computer on its network (TIM fiber) in Brazil, it just hangs. brew upgrade seems to fail loading its data files (e.g. formula.jws.json) from formulae.homebrew.sh.

I then went to load formulae.homebrew.sh in my browser. It said there was no https access. I tried continuing with http and received a site trying to convince me to allow it to change my search engine and install malware.

I then checked https://dns.google.com in my browser to resolve formulae.homebrew.sh. It returned the IP address 37.48.65.155

VPN to Brazil works

Then I connected through VPN to a server also in Brazil (in a different city) and flushed my DNS cache. I checked https://dns.google.comin my browser again to resolve formulae.homebrew.sh again. It gave me a different answer. It returned the IP address 199.115.116.216. But now going to https://formulae.homebrew.sh completely works in my browser.

Everything in this situation seems fine, including brew update, brew upgrade.

Back to my plain network

I went back to my plain network on my computer, flushed the DNS cache and ran nslookup homebrew.github.io:

Non-authoritative answer:
formulae.brew.sh	canonical name = homebrew.github.io.
Name:	homebrew.github.io
Address: 185.199.108.153
Name:	homebrew.github.io
Address: 185.199.109.153
Name:	homebrew.github.io
Address: 185.199.111.153
Name:	homebrew.github.io
Address: 185.199.110.153

Yet another DNS answer, this one seems legit, based on the canonical name. But again I can't access formulae.homebrew.sh from my browser, and trying to wget https://formulae.brew.sh/api/formula.jws.json hangs indefinitely. wget https://185.199.108.153/api/formula.jws.json also hangs indefinitely.

If I use the last IP address that worked for me (that DNS reported while on VPN in Brazil), this happens:

newell:~ wget https://199.115.116.216/api/formula.jws.json
--2024-11-25 13:35:42--  https://199.115.116.216/api/formula.jws.json
Connecting to 199.115.116.216:443... connected.
OpenSSL: error:0A000410:SSL routines::ssl/tls alert handshake failure
Unable to establish SSL connection.

WTF

At this point I'm utterly confused about even what the problem is.

It seems like there's some geographical load-sharing scheme going on maybe? Or should there always be the same answer for a DNS lookup of formulae.homebrew.sh?

And why can't I access any bare IP address (including those for homebrew.github.io) from my plain network?

Any help is VERY appreciated. thanks

[SMillerDev]

https://formulae.brew.sh is hosted on GitHub pages, so you might have to check with GitHub support what is going on.

[cho-m]

Given location is Brazil, https://github.com/orgs/community/discussions/143145 may be related.

[itsayellow]

Thanks, that seems very relevant.

[itsayellow]

It is weird that when I VPN to Sao Paolo (another city in Brazil) it all seems to work. If slowly.