Apm: UNABLE_TO_VERIFY_LEAF_SIGNATURE

[yodasw16]

I am behind a work proxy which causes me to get this error when I try to view packages. I've had the same error in the past when using npm or Bower. For npm I am able to do npm config set strict-ssl false on the command line to make it stop checking ssl certs. Similarly for Bower I can set strict-ssl to false in a bower.rc file. It would be cool if there were a way to disable checking ssl certs in Atom so us corporate stooges can use it :)

[kevinsawicki]

Just pushed a change that adds support for a ~/.atom/.apmrc file. You will be able to change the strict-ssl setting there to disable it.

There is no apm config command support yet though, you just have to edit the file manually. The file at this path is specified as the --userconfig argument to spawned npm commands.

[yodasw16]

Excellent, thank you! I'll try this out today.

[kevinsawicki]

Any updates on if this works for you now?

[yodasw16]

I created the file and added strict-ssl = false to it. Atom is all updated to 0.96.0. Not sure what else I would have to do to get it to work. Currently still having the problem.

[kevinsawicki]

Can you run apm -v and paste the output here?

[yodasw16]

apm 0.54.0
npm 1.4.4
node 0.10.26

[kevinsawicki]

Can you paste the entire error that displays when this occurs?

[yodasw16]

Request for package information failed: UNABLE_TO_VERIFY_LEAF_SIGNATURE

[kevinsawicki]

Oh okay, sorry, that means it failing on a GitHub API request, not an npm request, I'll update apm to check the ssl setting for https requests it itself makes.

[kevinsawicki]

Okay, I just pushed a fix for this, so if you build from master on atom/atom this should hopefully work now for you, or else you will have to wait for the next release 0.97.0 for the fix, thanks again for all the details surrounding this.

[yodasw16]

Thanks for doing this. I'm going to have to wait for the release to try it out. Being behind this proxy is real annoying. The build script is also being blocked with the same error that this issue is referencing. The corporate struggle is real! Is there a release schedule or any idea when the next release might happen?

[kevinsawicki]

I'll try and push one out in the next couple hours, thanks for your patience, I really hope this fixes it for you.

[kevinsawicki]

Just deployed 0.97.0, should update over the next couple hours, let me know how it goes.

[yodasw16]

Well, this did work. I was able to view packages. Unfortunately, when I try to install I get this (basically the same) error:

gyp info it worked if it ends with ok
gyp info using [email protected]
gyp info using [email protected] | darwin | x64
gyp http GET https://gh-contractor-zcbenz.s3.amazonaws.com/atom-shell/dist/v0.11.10/node-v0.11.10.tar.gz
gyp WARN install got an error, rolling back install
gyp ERR! install error 
gyp ERR! stack Error: UNABLE_TO_VERIFY_LEAF_SIGNATURE
gyp ERR! stack     at SecurePair.<anonymous> (tls.js:1370:32)
gyp ERR! stack     at SecurePair.EventEmitter.emit (events.js:92:17)
gyp ERR! stack     at SecurePair.maybeInitFinished (tls.js:982:10)
gyp ERR! stack     at CleartextStream.read [as _read] (tls.js:469:13)
gyp ERR! stack     at CleartextStream.Readable.read (_stream_readable.js:320:10)
gyp ERR! stack     at EncryptedStream.write [as _write] (tls.js:366:25)
gyp ERR! stack     at doWrite (_stream_writable.js:226:10)
gyp ERR! stack     at writeOrBuffer (_stream_writable.js:216:5)
gyp ERR! stack     at EncryptedStream.Writable.write (_stream_writable.js:183:11)
gyp ERR! stack     at write (_stream_readable.js:583:24)
gyp ERR! System Darwin 13.1.0
gyp ERR! command "/Users/dgillhespy/Applications/Atom.app/Contents/Resources/app/apm/node_modules/atom-package-manager/bin/node" "/Users/dgillhespy/Applications/Atom.app/Contents/Resources/app/apm/node_modules/atom-package-manager/node_modules/node-gyp/bin/node-gyp.js" "install" "--target=0.11.10" "--dist-url=https://gh-contractor-zcbenz.s3.amazonaws.com/atom-shell/dist" "--arch=x64"
gyp ERR! cwd /Users/dgillhespy/.atom
gyp ERR! node -v v0.10.26
gyp ERR! node-gyp -v v0.12.2
gyp ERR! not ok 

[kevinsawicki]

Damn, forgot to tweak the proxy settings when installing node itself

[kevinsawicki]

Looks like node-gyp doesn't support a no strict SSL setting, I opened https://github.com/TooTallNate/node-gyp/issues/448 about it, if it doesn't get traction we may have to consider forking node-gyp to add this option.

Basically node-gyp install is used to download the custom version of node to build native Atom packages against, and this download request doesn't currently support a no strict ssl setting as far as I can tell, it only supports a proxy setting.

[kevinsawicki]

@yodasw16 Based on a suggestion in the linked node-gyp issue, would you mind running apm with the NODE_TLS_REJECT_UNAUTHORIZED=0 environment variable and see if that fixes things?

[yodasw16]

YES! This works perfectly.

[kevinsawicki]

The next release of Atom 0.100.0 will set this environment variable automatically when installing node based on the strict-ssl setting in your ~/.atom/.apmrc file. Therefore you shouldn't have to set it explicitly anymore after upgrading, thanks for working though this.

[yodasw16]

Just wanted to confirm that after updating to 0.100.0 the problem is fixed. Thanks for your work on this!

[ashjas]

How to do this on windows?

[Energy1011]

@ashjas You only need to put this line in the file ~/.atom./apmrc :
strict-ssl = false
On windows this path is like C:Users.atom also you can copy the file from
C:Users.atom.apm to the parent folder in your file explorer because windows explorer doesn't give permission to create hidden-unix-style files easily in windows explorer, you can get an error like "You need to write a name for file".

I tried it at work behind a firewall and it works .

[ChavahJ]

Thanks! That really helped me.

[GenweiWu]

saved my day