Themekit: theme get command fails with: x509: certificate signed by unknown authority
I tried following the Getting Started documentation but when I run the theme get command it fails with the error message: x509: certificate signed by unknown authority and appears to be referencing the meta.json file
It's worth noting that this is an existing app that I'm taking over from another developer.
My Environment
OS : MacOS High Sierra
Themekit version: v.0.8.0
IOIIOOIO
All 21 comments
If you go to the shops domain in your browser like this: https://[shop-name].myshopify.com/meta.json does that succeed? Or do you get a certificate warning?
tanema
on 22 Aug 2018
Yes it succeeds
IOIIOOIO
on 22 Aug 2018
Hmm okay, it may have something to do with your keychain access settings. I don't know too much about it so I will get back to you when I can investigate it.
tanema
on 22 Aug 2018
By any chance are you using a proxy in your config or in general?
tanema
on 22 Aug 2018
Sorry I'm not sure what config you're referring to?
This is a shop that is halfway through development, and I've taken over. And I've never worked on a Shopify app before. I want to be able to work on it from my local. I saw that they named the app "Theme Kit" so I figured that's what they were using.
IOIIOOIO
on 22 Aug 2018
Oh you need to make sure they are using themekit or Slate they handle your projects in different ways. If your theme looks like this: https://github.com/Shopify/skeleton-theme they were probably using Slate.
If however you are using themekit, then there should be a config.yml in the root directory of your project.
tanema
on 22 Aug 2018
Ok, I don't see any config file. It also doesn't look like it was done with Slate.
What's interesting to note is I don't seem to have any issues when getting it on my Windows machine...
IOIIOOIO
on 22 Aug 2018
Okay did you inherit a repo or just the shopify files? If just from shopify, you are getting files from shopify using theme get -t=[theme_id] -s=[store] -p=[password]?
tanema
on 22 Aug 2018
Yes there's no repo for this. I've just taken over the store in Shopify.
When I run theme get -t=[theme_id] -s=[store] -p=[password] on my MacBook then I get the certificate error.
When I run the same command on my Windows PC everything works fine.
IOIIOOIO
on 22 Aug 2018
When I run the same command on my Windows PC everything works fine.
Okay, that indicate that there is something silly with your KeyChain Access. Okay I will have too look into that. Thank you for you help.
tanema
on 22 Aug 2018
Ok no problem. Look if it's a big mission for you to help me then don't worry about it. I can work from my Windows machine... it's not ideal but it will do fine.
IOIIOOIO
on 22 Aug 2018
Okay it seems like this can happen when there are duplicate and untrusted keys in your keychain access.
You can actually see this play out in an issue with Go https://github.com/golang/go/issues/24147
From that issue, I don't have many ways forward with this. I would recommend opening your keychain access and removing any invalid system and root keys and then trying again.
tanema
on 14 Sep 2018
I have also just migrated to Go 1.11 which it seems the go developers have tried to mitigate issues like yours. Please try it out but running theme update --verison=v.0.8.1-prerelease
tanema
on 14 Sep 2018
I temporarily had this problem which broke all commands that made HTTP requests. I fixed it by opening up a new terminal. I have no idea why that worked.
sdn90
on 4 Oct 2018
@IOIIOOIO Did your problem disappear after a restart as has been reported? Because as far as my research has gotten me, it looks like this would most likely be an operating system issue.
tanema
on 5 Nov 2018
@tanema FWIW, the issue is still happening for me, I am on latest macOS Mojave. Restarting does not help.
I've got 0.8.1 installed. Trying to update to v.0.8.2-prerelease or 1.0.0-pre throws a panic for me (not sure if this is related to the certificate issue).
Uninstalling themekit completely and reinstalling from brew also doesn't allow me to install a pre-release version, always reinstalls 0.8.1
PS: if you're curious about the panic, here's the trace:
_not sure why it's including your machine's dev paths in the built binary_ 🤣
❯❯❯ theme update --version=v.0.8.2-prerelease
Updating from 0.8.1 to v.0.8.2-prerelease
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x135b6d1]
goroutine 1 [running]:
github.com/hashicorp/go-version.(*Version).String(0x0, 0x0, 0x0)
/Users/timanema/workspace/go/pkg/mod/github.com/hashicorp/[email protected]/version.go:326 +0x51
github.com/hashicorp/go-version.(*Version).Compare(0x0, 0xc000232c80, 0xc0004e6550)
/Users/timanema/workspace/go/pkg/mod/github.com/hashicorp/[email protected]/version.go:95 +0x40
github.com/hashicorp/go-version.(*Version).Equal(0x0, 0xc000232c80, 0xc000232c80)
/Users/timanema/workspace/go/pkg/mod/github.com/hashicorp/[email protected]/version.go:260 +0x35
github.com/Shopify/themekit/src/release.releasesList.get(0xc000126000, 0x30, 0x3f, 0x7ffeefbff387, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0)
/Users/timanema/workspace/themekit/src/release/release_list.go:52 +0x329
github.com/Shopify/themekit/src/release.installVersion(0x7ffeefbff387, 0x12, 0x1533ad7, 0x3b, 0x153e028, 0x0, 0x3b)
/Users/timanema/workspace/themekit/src/release/release.go:130 +0x9c
github.com/Shopify/themekit/src/release.Install(0x7ffeefbff387, 0x12, 0x16, 0xc0004c7c60)
/Users/timanema/workspace/themekit/src/release/release.go:90 +0x74
github.com/Shopify/themekit/cmd.glob..func12(0x18e6b00, 0xc0000a9d20, 0x0, 0x1, 0x0, 0x0)
/Users/timanema/workspace/themekit/cmd/theme.go:55 +0x20f
github.com/spf13/cobra.(*Command).execute(0x18e6b00, 0xc0000a9cf0, 0x1, 0x1, 0x18e6b00, 0xc0000a9cf0)
/Users/timanema/workspace/go/pkg/mod/github.com/spf13/[email protected]/command.go:762 +0x473
github.com/spf13/cobra.(*Command).ExecuteC(0x18e68a0, 0x0, 0x0, 0xc0001f5f00)
/Users/timanema/workspace/go/pkg/mod/github.com/spf13/[email protected]/command.go:852 +0x2fd
github.com/spf13/cobra.(*Command).Execute(0x18e68a0, 0x13, 0x0)
/Users/timanema/workspace/go/pkg/mod/github.com/spf13/[email protected]/command.go:800 +0x2b
main.main()
/Users/timanema/workspace/themekit/cmd/theme/main.go:29 +0x6b
Cloning the repository and compiling from source fixed the panic, but still see the x509 cert error.
make test seems to succeed, though I don't see an entry for download command, not sure if that test is just included in test for cmd
Aeon
on 28 Dec 2018
Poking around the repositories, I am pretty sure the issue is https://github.com/golang/go/issues/24652 (resolved in go 1.12) / https://github.com/golang/go/issues/26039 (backport to 1.11, still not released)
As homebrew go version is 1.11, not 1.12, the issue is still present for me...
For now I was able to work around it by doing the following steps:
- run
openssl s_client -connect my-store.myshopify.com:443and see what certs are used. Check Keychain for presence of the certificates listed. DigiCert SHA2 High Assurance Server CA seems to be missing on my machine. - download the DigiCert SHA2 High Assurance Server CA from DigiCert site
- open Keychain Access and drag the downloaded certificate into login keychain
- right-click the certificate, expand "Trust" section, and mark it as "Always Trust"
After that, everything seems to work so far...
Aeon
on 29 Dec 2018
Hey @Aeon thanks for the deep dive!
Regarding the panic, that should be handled better (and my development path in the trace is just a characteristic of Go) but the reason that was happening to you is that you were trying to update to v.0.8.2-prerelease the problem is that you have an extra period between the v and 0. This caused a panic because that is an invalid semver version. I can add an appropriate error for that.
Regarding the certificate issue, thank you for posting a solution that worked for you, thank you for doing the research, I was aware of those issues while looking into this issue but couldn't say for sure if that was the issue. I don't think I know enough about SSL to understand why you would be missing a certificate on your machine. I will try to talk some people will the experience to figure that out, but identifying that you were actually missing a cert could be a critical bit of information, so thank you so much!
If someone else has this issue as well, please try out a version without CGO by running theme update --version=v1.0.0-issue544 and check to see if it was fixed.
tanema
on 2 Jan 2019
Okay I have updated to a fixed version of Go as well as disabled CGO in themekit. This will be fixed in the v1.0.1 release
tanema
on 20 Mar 2019
This should be fixed in 1.0.1 If you still experience it happening please reopen
tanema
on 19 Jun 2019
I have this same issue
theme get --list -p=[password] -s=groven.myshopify.com
_request failed after 5 retries with error: Get https://groven.myshopify.com/meta.json: x509: certificate signed by unknown authority_
openssl s_client -showcerts -connect groven.myshopify.com:443
_Verify return code: 0 (ok)_
theme version
ThemeKit 1.1.4 darwin/amd64
MacOS Big Sur
Version 11.1
MartijnOost
on 2 Jan 2021
Related issues
tbeseda
·
3Comments
raulmontejo
·
4Comments
illia108
·
3Comments
amit0001
·
3Comments
arypbatista
·
9Comments
Most helpful comment
I temporarily had this problem which broke all commands that made HTTP requests. I fixed it by opening up a new terminal. I have no idea why that worked.