Mapbox-gl-native: mbgl-offline stalls with SSL CA cert issue on fresh Ubuntu install

[andrewharvey]

Following the installation instructions at https://github.com/mapbox/mapbox-gl-native/blob/master/platform/linux/README.md on a fresh Ubuntu 18.10.

sudo apt-get install curl git build-essential zlib1g-dev automake \
                     libtool xutils-dev make cmake pkg-config python-pip \
                     libcurl4-openssl-dev libpng-dev libsqlite3-dev \
                     libllvm3.9

sudo apt-get install cmake cmake-data

sudo apt-get install libxi-dev libglu1-mesa-dev x11proto-randr-dev \
                     x11proto-xext-dev libxrandr-dev \
                     x11proto-xf86vidmode-dev libxxf86vm-dev \
                     libxcursor-dev libxinerama-dev

Install Node LTS per https://github.com/nodesource/distributions/blob/master/README.md#deb

curl -sL https://deb.nodesource.com/setup_10.x | sudo -E bash -
sudo apt-get install -y nodejs
sudo apt-get install ccache

git clone https://github.com/mapbox/mapbox-gl-native.git
cd mapbox-gl-native
git submodule update

Following the offline cli instructions at https://docs.mapbox.com/android/maps/overview/offline/#cli-build-instructions

make offline

./build/linux-x86_64/Debug/mbgl-offline --token "$MAPBOX_ACCESS_TOKEN" --style mapbox://styles/mapbox/streets-v11 --output offline.db --north -33.829713404472386 --south -33.84757198774455 --east 151.29315376281735 --west 151.27021551132202 --minZoom 0 --maxZoom 16

The download seems to be stalled:

0 / 1 resources (indeterminate); 0 bytes downloaded (- bytes/sec)
Response::Error::Reason::Other downloading resource: Problem with the SSL CA cert (path? access rights?): error setting certificate verify locations:
  CAfile: ca-bundle.crt
  CApath: /etc/ssl/certs

Granted ca-bundle.crt doesn't exist so I symlinked it:

ln -s -T /etc/ssl/certs/ca-certificates.crt ca-bundle.crt

but still no luck.

I know this might not be a mapbox-gl-native issue, but I tried searching online without much luck.

[andrewharvey]

I managed to find a "workaround", replace

https://github.com/mapbox/mapbox-gl-native/blob/e800f3754758489e09c55e38bebd00c2203e4886/platform/default/src/mbgl/storage/http_file_source.cpp#L328

with

handleError(curl::easy_setopt(handle, CURLOPT_SSL_VERIFYPEER, false));

to avoid verifying ssl certs all together.

[andrewharvey]

...actually just removing the line https://github.com/mapbox/mapbox-gl-native/blob/e800f3754758489e09c55e38bebd00c2203e4886/platform/default/src/mbgl/storage/http_file_source.cpp#L328 fixed the issue for me. @kkaefer any reason why that value is set instead of relying on however curl or the os are set up?

[kkaefer]

@andrewharvey I think we added this (and shipping our own ca bundle) to avoid SSL errors due to expired root certs in the system store on old/unpatched systems. However, it's probably a better strategy to rely on the system's CA information. In any case, we don't provide an SDK for Linux, so we're only using this on development machines.

[andrewharvey]

In any case, we don't provide an SDK for Linux, so we're only using this on development machines.

However this code is used to generate the offline sideload packs for the supported iOS and Android SDKs according to the documentation at https://docs.mapbox.com/android/maps/overview/offline/#offline-sideloading. And currently following that documentation leads to this error here (I tested on both stock Ubuntu and Debian). The only way I was able to get things working was to drop the CURLOPT_CAINFO line.

[rhalff]

I'm not sure if this is related, but I'm trying to get offline loading working with flutter on android and get a similar error:

13:28:17.382 41 info flutter.tools V/Mbgl-ConnectivityReceiver(13104): connected - true
13:28:18.782 43 info flutter.tools I/Mbgl-HttpRequest(13104): Request failed due to a connection error: Chain validation failed 
13:28:20.865 44 info flutter.tools I/Mbgl-HttpRequest(13104): Request failed due to a connection error: Chain validation failed 

I'm currently not setup to also debug the mapbox-gl-native code, so I cannot confirm this boils down to the same problem.

For an android project using mapbox-gl-native as a dependency, where could I place a custom ca-bundle.crt so it will be found?

Update: Nevermind, this seems to have something to do with the emulator I'm using, when I test on a real device there is no Chain Validation error.

[kkaefer]

@rhalff your problem is probably different; Android (including Flutter) doesn't use cURL.

[LukasPaczos]

@rhalff ensure that the date and time on your emulator are set correctly.

[stale[bot]]

This issue has been automatically detected as stale because it has not had recent activity and will be archived. Thank you for your contributions.