Test-infra: `pull-kubernetes-godeps` fails because SSL problems

Created on 18 Dec 2018 · 11Comments · Source: kubernetes/test-infra

What happened:

Recent pull-kubernetes-godeps fails with this error:

+++ [1218 12:56:44] Downloading dependencies - this might take a while
# cd .; hg clone -U https://bitbucket.org/ww/goautoneg /tmp/gopath.2p4XSF/src/bitbucket.org/ww/goautoneg
abort: error: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:581)
godep: error downloading dep (bitbucket.org/ww/goautoneg): exit status 255
godep: Error downloading some deps. Aborting restore and check.
Removing /tmp/gopath.2p4XSF

See https://prow.k8s.io/?job=pull-kubernetes-godeps.

What you expected to happen:

pull-kubernetes-godeps succeeds.

How to reproduce it (as minimally and precisely as possible):

# docker run -it --entrypoint hg gcr.io/k8s-testimages/kubekins-e2e:v20181205-915278e90-master clone  https://bitbucket.org/ww/goautoneg
abort: error: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:581)

Perhaps because of this: https://bitbucket.org/blog/deprecating-tlsv1-tlsv1-1-2018-12-01.

Anything else we need to know?:

Because highest version in repository is not going to work, how about installing mercurial by pip. I've tested it locally:

$ docker run -i --entrypoint bash gcr.io/k8s-testimages/kubekins-e2e:v20181205-915278e90-master <<EOF
apt-get remove -y mercurial*
pip install mercurial==4.8.1
hg clone https://bitbucket.org/ww/goautoneg
EOF
...
Installing collected packages: mercurial
Successfully installed mercurial-4.8.1
destination directory: goautoneg
requesting all changes
adding changesets
adding manifests
adding file changes
added 5 changesets with 10 changes to 4 files
new changesets 848b35134192:75cd24fc2f2c
updating to branch default
4 files updated, 0 files merged, 0 files removed, 0 files unresolved

/kind bug

kinbug

Source

cofyc

Most helpful comment

Whether we switch to a fork or not, we should update our dependencies so they aren’t using TLSv1 anyways.

cblecker on 18 Dec 2018

👍4

All 11 comments

cc @kubernetes/sig-testing
cc @ixdy @BenTheElder @fejta

cofyc on 18 Dec 2018

Yeah, I think our mercurial package is out of date. I think it's because we're still basing this off of jessie.. we should update this to stretch
https://github.com/kubernetes/test-infra/blob/af41adc38640d4fdf3630a542a1ea65d13f259dd/images/bootstrap/Dockerfile#L17

cc: @krzyzacy

cblecker on 18 Dec 2018

👍1

in general bitbucket + mercurial has been giving us (and everyone else) issues for a while, @dims was going to switch us to a fork of this library I believe.

BenTheElder on 18 Dec 2018

https://github.com/kubernetes/kube-openapi/pull/126 needs to get in first, then https://github.com/kubernetes/kubernetes/pull/72138

dims on 18 Dec 2018

Whether we switch to a fork or not, we should update our dependencies so they aren’t using TLSv1 anyways.

cblecker on 18 Dec 2018

👍4

@cblecker yes, agreed.

I'd also like us to get dims's proposed change in though, as we've had other headaches in the recent past with connectivity to that package.

BenTheElder on 18 Dec 2018

in theory we're generally on stretch now, though maybe not _every_ image.

BenTheElder on 18 Dec 2018

it's our stretch goal for sure.

ixdy on 18 Dec 2018

😄1

/pony stretch

This appears to be fixed.
/close

ixdy on 19 Dec 2018

👍1

@ixdy: Closing this issue.

In response to this:

/pony stretch

This appears to be fixed.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.