Opened 7 years ago

Closed 7 years ago

#43172 closed defect (fixed)

distfiles are not being mirrored

Reported by: ballapete (Peter Dyballa) Owned by: skarulkar@…
Priority: High Milestone:
Component: server/hosting Version:
Keywords: Cc: jmroot (Joshua Root), wsiegrist@…, cooljeanius (Eric Gallager), GregoryEAllen (Greg Allen), ryandesign (Ryan Schmidt), mojca (Mojca Miklavec), rico.nitrate@…, edwardsmoon@…, MarcusCalhoun-Lopez (Marcus Calhoun-Lopez), petrrr
Port:

Description

DEBUG: Executing org.macports.fetch (py27-setuptools)
--->  setuptools-3.4.1.tar.gz doesn't seem to exist in /opt/local/var/macports/distfiles/py-setuptools
--->  Attempting to fetch setuptools-3.4.1.tar.gz from https://pypi.python.org/packages/source/s/setuptools/

DEBUG: Fetching distfile failed: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
--->  Attempting to fetch setuptools-3.4.1.tar.gz from http://distfiles.macports.org/py-setuptools

Attachments (1)

main.log (5.4 KB) - added by ballapete (Peter Dyballa) 7 years ago.
main.log

Download all attachments as: .zip

Change History (20)

Changed 7 years ago by ballapete (Peter Dyballa)

Attachment: main.log added

main.log

comment:1 Changed 7 years ago by mf2k (Frank Schima)

Cc: jmr@… removed
Owner: changed from macports-tickets@… to jmr@…

comment:2 Changed 7 years ago by jmroot (Joshua Root)

Component: portsserver/hosting
Summary: Build of py27-setuptools fails on PPC Mac OS X 10.5.8 because of "certificate verify failed"py-setuptools distfiles are not being mirrored
Version: 2.2.1

We can’t update your certificate store, but the file should be downloaded onto the mirrors.

comment:3 Changed 7 years ago by jmroot (Joshua Root)

Cc: jmr@… wsiegrist@… added
Owner: changed from jmr@… to skarulkar@…

comment:4 in reply to:  2 ; Changed 7 years ago by ballapete (Peter Dyballa)

Replying to jmr@…:

We can’t update your certificate store, but the file should be downloaded onto the mirrors.

What is my "certificate store"? I know of AppStore…

comment:5 in reply to:  4 Changed 7 years ago by jmroot (Joshua Root)

Replying to Peter_Dyballa@…:

What is my "certificate store”?

That’s a bit of jargon, from the X.509 standard I believe. The short answer is it’s a set of stored certificates. In this case, specifically the set of root certificates that Apple designated as trustworthy and shipped with the OS (you can see them in Keychain Access under “System Roots” or similar name). Since Leopard is no longer getting updates, new root certificates are not being added, and apparently pypi is using a certificate signed by one such newer root certificate.

Last edited 7 years ago by jmroot (Joshua Root) (previous) (diff)

comment:6 Changed 7 years ago by spam@…

I also was having this problem, my workaround was to download https://pypi.python.org/packages/source/s/setuptools/setuptools-3.4.1.tar.gz and place it in /opt/local/var/macports/distfiles/py-setuptools/

I did this through another computer, but you could have done it through curl or wget. I think curl may need curl-ca-bundle installed to get the right "certificate store" to be able to be used, and wget may need to reference that ca-bundle.

comment:7 in reply to:  6 Changed 7 years ago by potmj

Replying to spam@…:

Thanks for the pointer, spam
"sudo curl -k -O https://pypi.python.org/packages/source/s/setuptools/setuptools-3.4.1.tar.gz"
worked for me

comment:8 Changed 7 years ago by ned-deily (Ned Deily)

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

Your mileage may vary!

comment:9 in reply to:  8 Changed 7 years ago by joaogeada (Joao Geada)

Thanks, that fixed it for me.

comment:10 Changed 7 years ago by cooljeanius (Eric Gallager)

Cc: egall@… added

Cc Me!

comment:11 Changed 7 years ago by ryandesign (Ryan Schmidt)

Has duplicate #43307.

We also have #43180 tracking the general distfile mirroring problem.

comment:12 Changed 7 years ago by jmroot (Joshua Root)

Summary: py-setuptools distfiles are not being mirroreddistfiles are not being mirrored

comment:13 Changed 7 years ago by jmroot (Joshua Root)

Cc: GregoryEAllen@… ryandesign@… mojca@… rico.nitrate@… edwardsmoon@… mcalhoun@… added
Port: py-setuptools removed

comment:14 in reply to:  8 ; Changed 7 years ago by cooljeanius (Eric Gallager)

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

Your mileage may vary!

I was running into this issue on my PureDarwin vm the other day, because PureDarwin is based off of 10.5 Leopard, so it has the same system curl and curl certificate bundle (the bundle may look like it is newer, but that is only because the vm image was built more recently), and I can confirm that the fix mentioned here worked on that vm, too.

comment:15 Changed 7 years ago by petrrr

Cc: Peter.Danecek@… added

Cc Me!

comment:16 Changed 7 years ago by ryandesign (Ryan Schmidt)

Priority: NormalHigh

comment:17 in reply to:  14 ; Changed 7 years ago by ballapete (Peter Dyballa)

Replying to egall@…:

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

For me this fixes all reported issues.

What keeps me wondering is why I have a superfluous MacPorts curl installation which does not get used …

comment:18 in reply to:  17 Changed 7 years ago by ryandesign (Ryan Schmidt)

Replying to Peter_Dyballa@…:

Replying to egall@…:

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

For me this fixes all reported issues.

It doesn't fix the fact that our distfiles mirror hasn't been mirroring our distfiles since March; our server admins need to figure out what's causing that and fix it.

What keeps me wondering is why I have a superfluous MacPorts curl installation which does not get used …

The command "port installed depends:curl" will show which of your installed ports depend on curl. If there aren't any, you can of course uninstall curl.

MacPorts doesn't generally itself use the ports you installed because that can cause problems during upgrades, or if for any other reason that port becomes unusable.

comment:19 Changed 7 years ago by neverpanic (Clemens Lang)

Resolution: fixed
Status: newclosed

It seems distfile mirroring started working again 23-Apr-2014 07:38, e.g. for the wireshark port.

Note: See TracTickets for help on using tickets.