Julia: [ARM] GitError The SSL certificate is invalid from nightlies.

Created on 18 Feb 2016 · 20Comments · Source: JuliaLang/julia

I'm using the default ARM binary from the downloads page, related issues:

Arch Linux [running on Android via Linux Deploy]
android@localhost ~ % julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+2440 (2016-02-01 02:22 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 2bb94d6 (17 days old master)
|__/                   |  arm-linux-gnueabihf

julia> versioninfo()
Julia Version 0.5.0-dev+2440
Commit 2bb94d6 (2016-02-01 02:22 UTC)
Platform Info:
  System: Linux (arm-linux-gnueabihf)
  CPU: ARMv7 Processor rev 3 (v7l)
  WORD_SIZE: 32
  BLAS: libopenblas (NO_AFFINITY ARMV7)
  LAPACK: libopenblas
  LIBM: libm
  LLVM: libLLVM-3.7.1

julia> Pkg.init()
INFO: Initializing package repository /home/android/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

build help wanted packages

Source

SalchiPapa

Most helpful comment

Ok I didn't pay attention carefully, this https://github.com/JuliaLang/julia/issues/13399#issuecomment-182018321 fixes this issue:

julia> LibGit2.set_ssl_cert_locations("/etc/ssl/certs/ca-certificates.crt")
0

julia> Pkg.init()
INFO: Initializing package repository /home/android/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

SalchiPapa on 18 Feb 2016

👍2

All 20 comments

Is this error arm only?

ViralBShah on 18 Feb 2016

We could add additional default locations to test, ref https://github.com/JuliaLang/julia/issues/13399#issuecomment-181739388 and https://github.com/JuliaLang/julia/blob/fabec7b9e07de795969e7b1264017fe23ebe9212/Makefile#L458-L461 and https://github.com/JuliaLang/julia/blob/fabec7b9e07de795969e7b1264017fe23ebe9212/base/libgit2.jl#L515

tkelman on 18 Feb 2016

Ok I didn't pay attention carefully, this https://github.com/JuliaLang/julia/issues/13399#issuecomment-182018321 fixes this issue:

julia> LibGit2.set_ssl_cert_locations("/etc/ssl/certs/ca-certificates.crt")
0

julia> Pkg.init()
INFO: Initializing package repository /home/android/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

SalchiPapa on 18 Feb 2016

👍2

But I need to put it in my .juliarc.jl, after restart:

android@localhost ~ % julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+2440 (2016-02-01 02:22 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 2bb94d6 (17 days old master)
|__/                   |  arm-linux-gnueabihf

julia> Pkg.update()
INFO: Updating METADATA...
WARNING: fetch: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)
INFO: Computing changes...
INFO: No packages to install, update or remove

SalchiPapa on 18 Feb 2016

Can someone test with a recent nightly https://status.julialang.org/download/linux-arm and see if #15485 fixed this?

tkelman on 21 Apr 2016

@Ismael-VC, can you test this out?

StefanKarpinski on 28 Apr 2016

Yes, I'm on it.

SalchiPapa on 28 Apr 2016

👍1

The issue still persists, tested on a Raspberry Pi2 with the latest available binary:

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+3799 (2016-04-29 17:15 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 1630a3d* (0 days old master)
|__/                   |  arm-linux-gnueabihf

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

julia> LibGit2.set_ssl_cert_locations("/etc/ssl/certs/ca-certificates.crt")
0

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

julia>

SalchiPapa on 30 Apr 2016

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia
WARNING: unable to determine host cpu name.
               _
   _       _ _(_)_     |  A fresh approach to technical computing
  (_)     | (_) (_)    |  Documentation: http://docs.julialang.org
   _ _   _| |_  __ _   |  Type "?help" for help.
  | | | | | | |/ _' |  |
  | | |_| | | | (_| |  |  Version 0.5.0-dev+3799 (2016-04-29 17:15 UTC)
 _/ |\__'_|_|_|\__'_|  |  Commit 1630a3d* (0 days old master)
|__/                   |  arm-linux-gnueabihf

shell> rm -rf ~/.julia 

shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

SalchiPapa on 30 Apr 2016

shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
# ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"
ENV["SSL_CERT_DIR"] = "/etc/ssl/certs"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

SalchiPapa on 30 Apr 2016

Thanks for testing! So either libgit2 upstream or our bindings aren't reading from the expected env var (or maybe they're doing so but before juliarc runs), but the api in our bindings for setting a location does work. 3 options here:

Document the workaround and call that acceptable for the time being
Reformat or replace the arm buildbot with a centos based setup that matches what we need to do on x86 buildbots.
Find the right additional paths for the currently ubuntu based arm buildbot to bundle its cert files during make binary-dist

tkelman on 30 Apr 2016

~~Using the shell export does work!~~

Sorry, this doesn't work either:

ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
shell> cat ~/.juliarc.jl
ENV["PYTHON"] = ""
# ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"
# ENV["SSL_CERT_DIR"] = "/etc/ssl/certs/"

shell> rm -rf ~/.julia

shell> export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

SalchiPapa on 30 Apr 2016

@wildart any ideas about the environment variable part of this?

@ViralBShah how does scaleway work, what's the oldest possible distro we could provision if we want to do option 2 above?

tkelman on 30 Apr 2016

Ok, I have done more tests and it works using both SSL_CET_* variables, but only if I export them with my shell (zsh), either via the zsh REPL or in the .zshrc config file prior to starting Julia, but it doesn't work if I define the same variables in the .juliarc.jl using ENV or run, even if they do show up as being defined for the Julia process. So I think it's a timing issue?

Works:

ismaelvc@toybox ~ % rm -rf ~/.julia
ismaelvc@toybox ~ % export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt              
ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
julia> ENV["SSL_CERT_FILE"]
"/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl

julia>

Doesn't:

ismaelvc@toybox ~ % rm -rf ~/.julia
ismaelvc@toybox ~ % echo 'ENV["SSL_CERT_FILE"] = "/etc/ssl/certs/ca-certificates.crt"'           
ismaelvc@toybox ~ % julia-1630a3d430/bin/julia -q
WARNING: unable to determine host cpu name.
julia> ENV["SSL_CERT_FILE"]
"/etc/ssl/certs/ca-certificates.crt"

julia> Pkg.init()
INFO: Initializing package repository /home/ismaelvc/.julia/v0.5
INFO: Cloning METADATA from https://github.com/JuliaLang/METADATA.jl
ERROR: GitError(Code:ECERTIFICATE, Class:SSL, The SSL certificate is invalid)

julia>

SalchiPapa on 30 Apr 2016

Setting SSL_CERT_ variables in .juliarc.jl does not work because libgit2 initialized prior to evaluating this file. I am quite surprised that setting shell environmental variable does not work.

@Ismael-VC Can you look at strace output if certificate file is loaded or referenced?

wildart on 1 May 2016

@wildart I will test with strace and also I'll ask others to test on their Pis just in case.

SalchiPapa on 1 May 2016

I am quite surprised that setting shell environmental variable does not work.

Just to be clear, this works, but only if I set the env variable with zsh (in my case), be it via an export or adding the export to my .zshrc and sourcing the file, prior to starting up Julia.

But not when setting he variable from within Julia, even if I use run(export .....).

SalchiPapa on 1 May 2016

If you want to use .juliarc.jl, the only choice is LibGit2.set_ssl_cert_locations.

wildart on 1 May 2016

"vtjnash removed the arm label", remove then also from issue title (or close if no longer an issue..?)

PallHaraldsson on 1 Sep 2016

@PallHaraldsson that type of comment on a dormant issue doesn't help anything.

This is a consequence of how binaries are built. You need a particular setup to actually get binaries that work across multiple distributions. Our arm (and now power) buildbots are not set up in this way.

tkelman on 1 Sep 2016

Was this page helpful?

0 / 5 - 0 ratings