X.509 certificate of 'crates.io' could not be verified during a recursive import from crates.io

  • Done
  • quality assurance status badge
Details
5 participants
  • Bengt Richter
  • Efraim Flashner
  • Ludovic Courtès
  • Martin Becze
  • Valentin Ignatev
Owner
unassigned
Submitted by
Valentin Ignatev
Severity
normal
Merged with
V
V
Valentin Ignatev wrote on 1 Jan 2020 23:45
(address . bug-guix@gnu.org)
CADXmXkgppDzMfF6YJc0erT1wyWWRoguC3U9FXzeJpfARFfM4NQ@mail.gmail.com
Hi! I'm trying to recursively import a package from crates.io like this:

guix import crate notify@4.0.14 --recursive

It follows redirections for a while untill at some point throws this:

Backtrace:
12 (primitive-load "/home/vj/.config/guix/current/bin/guix")
In guix/ui.scm:
1806:12 11 (run-guix-command _ . _)
In guix/scripts/import.scm:
116:11 10 (guix-import . _)
In guix/scripts/import/crate.scm:
103:16 9 (guix-import-crate . _)
In guix/import/utils.scm:
425:7 8 (recursive-import _ _ #:repo->guix-package _ #:guix-name …)
397:31 7 (topological-sort _ #<procedure 7f9a59729630 at guix/i…> …)
In srfi/srfi-1.scm:
592:17 6 (map1 ("tempfile"))
In guix/import/utils.scm:
421:36 5 (lookup-node "tempfile")
In guix/import/crate.scm:
222:10 4 (crate->guix-package "tempfile" _)
150:15 3 (make-crate-sexp #:name _ #:version _ #:cargo-inputs _ # …)
In guix/http-client.scm:
88:25 2 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
In guix/build/download.scm:
419:4 1 (open-connection-for-uri _ #:timeout _ # _)
306:6 0 (tls-wrap #<closed: file 7f9a564b3a10> _ # _)

guix/build/download.scm:306:6: In procedure tls-wrap:
X.509 certificate of 'crates.io' could not be verified:
signer-not-found
invalid

I suspect that it happens after the importer hits
"wasm-bindgen-webidl" and starts going circles. Maybe there's some
circullar dependencies going on, but I'm not sure. I'm attaching a
full log for convenience.

For additional info: I'm running Guix on Arch Linux. I've also
installed nss-certs package, exported all neeeded variables
(SSL_CERT_DIR, SSL_CERT_FILE and GIT_SSL_CAINFO) before running guix
import and also made sure nscd.service is running.

Regards,
Valentin Ignatev
E
E
Efraim Flashner wrote on 2 Jan 2020 08:12
(name . Valentin Ignatev)(address . valentignatev@gmail.com)(address . 38857@debbugs.gnu.org)
20200102071243.GS23018@E5400
On Thu, Jan 02, 2020 at 01:45:35AM +0300, Valentin Ignatev wrote:
Toggle quote (48 lines)
> Hi! I'm trying to recursively import a package from crates.io like this:
>
> guix import crate notify@4.0.14 --recursive
>
> It follows redirections for a while untill at some point throws this:
>
> Backtrace:
> 12 (primitive-load "/home/vj/.config/guix/current/bin/guix")
> In guix/ui.scm:
> 1806:12 11 (run-guix-command _ . _)
> In guix/scripts/import.scm:
> 116:11 10 (guix-import . _)
> In guix/scripts/import/crate.scm:
> 103:16 9 (guix-import-crate . _)
> In guix/import/utils.scm:
> 425:7 8 (recursive-import _ _ #:repo->guix-package _ #:guix-name …)
> 397:31 7 (topological-sort _ #<procedure 7f9a59729630 at guix/i…> …)
> In srfi/srfi-1.scm:
> 592:17 6 (map1 ("tempfile"))
> In guix/import/utils.scm:
> 421:36 5 (lookup-node "tempfile")
> In guix/import/crate.scm:
> 222:10 4 (crate->guix-package "tempfile" _)
> 150:15 3 (make-crate-sexp #:name _ #:version _ #:cargo-inputs _ # …)
> In guix/http-client.scm:
> 88:25 2 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
> In guix/build/download.scm:
> 419:4 1 (open-connection-for-uri _ #:timeout _ # _)
> 306:6 0 (tls-wrap #<closed: file 7f9a564b3a10> _ # _)
>
> guix/build/download.scm:306:6: In procedure tls-wrap:
> X.509 certificate of 'crates.io' could not be verified:
> signer-not-found
> invalid
>
> I suspect that it happens after the importer hits
> "wasm-bindgen-webidl" and starts going circles. Maybe there's some
> circullar dependencies going on, but I'm not sure. I'm attaching a
> full log for convenience.
>
> For additional info: I'm running Guix on Arch Linux. I've also
> installed nss-certs package, exported all neeeded variables
> (SSL_CERT_DIR, SSL_CERT_FILE and GIT_SSL_CAINFO) before running guix
> import and also made sure nscd.service is running.
>
> Regards,
> Valentin Ignatev

I've had it happen to me also sometimes. It's like it forgets that it
just successfully connected 100+ times and then fails.


--
Efraim Flashner <efraim@flashner.co.il> ????? ?????
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAl4Nl+sACgkQQarn3Mo9
g1GWyw/9GvGpRGBaoQZBLsXszstTSU/k/PoZwnMqj2KPdK5rZ6t4bZXwRMXukkjP
ZT2bxiz9SEk1oh7d0AoUFJdl4KYrrmcG9+toVNQknyOX9FX1ghIml/6ocgTw6er6
h6wO6YCF3vTSqbim0e2wfBkeKpujdCny9wRomC9guO15Z+2IKoy44IpubjEm/CC8
YDUN7KFT9FJSI1dZMdLoW5Bg4oXa2jSNk6hJ6tcu/uLiO8MK50XI++ooxiNAS2IV
zj3Vxdqj/6a4vpSC11MLV/otcwceT1YOqb6QZycuoWlZ63uCJ0lvC+TohQ4Cdp4h
p6TWMEKLypUrI+rDoKautZcF/XMPBXa1FJft9tLmTeuDcOmoYdu2CbkUg3J1f8va
nikzz15f2LGhaAmnQa1HJJ4g3MK+zFk29XkGF5i+uCInoiTKYQkXj1jJimtDggdU
aCjvvai1V6QBCDceb8slGnqgxGpIXckh3wlHWDLaw+DmR1c18jcUgxR7/jbs5h9E
Ncx4EKX27RUD5xootrXE7iZAUUvE3J6YXVEdXnL+UQoLgAxKBiqzOPfXp/Z/0hXD
clpalQgb2dbCXin9DkRys4KvrWAe2Ze5SiN9Sud21mbSIXlmlNcWhtDhfiZlDFz1
JKNxGfLo1rxqfgaY307skCWaiTo7tAO2afsGyoMIrFrXgkbzoZM=
=iVjn
-----END PGP SIGNATURE-----


B
B
Bengt Richter wrote on 2 Jan 2020 20:06
(name . Efraim Flashner)(address . efraim@flashner.co.il)
20200102190625.GA861@Evo25c2ArchGx4.localdomain
Attachment: file
V
V
Valentin Ignatev wrote on 2 Jan 2020 20:20
(name . Bengt Richter)(address . bokr@bokr.com)
CADXmXkgrYiYM1w5CRYRnp2RvRfS5Z+v7vkZd9hM8q6MQZ_3_gw@mail.gmail.com
I don't think that it's related, but who knows. I only have a
certificate issue when I'm using recursive crates import. I am able to
import packages from crates one by one without an issue as well as
doing other tls-sensitive stuff.

Regards,
Valentin

On 1/2/20, Bengt Richter <bokr@bokr.com> wrote:
Toggle quote (166 lines)
> Hi Guix,
>
> On +2020-01-02 09:12:43 +0200, Efraim Flashner wrote:
>> On Thu, Jan 02, 2020 at 01:45:35AM +0300, Valentin Ignatev wrote:
>> > Hi! I'm trying to recursively import a package from crates.io like
>> > this:
>> >
>> > guix import crate notify@4.0.14 --recursive
>> >
>> > It follows redirections for a while untill at some point throws this:
>> >
>> > Backtrace:
>> > 12 (primitive-load "/home/vj/.config/guix/current/bin/guix")
>> > In guix/ui.scm:
>> > 1806:12 11 (run-guix-command _ . _)
>> > In guix/scripts/import.scm:
>> > 116:11 10 (guix-import . _)
>> > In guix/scripts/import/crate.scm:
>> > 103:16 9 (guix-import-crate . _)
>> > In guix/import/utils.scm:
>> > 425:7 8 (recursive-import _ _ #:repo->guix-package _ #:guix-name
>> > …)
>> > 397:31 7 (topological-sort _ #<procedure 7f9a59729630 at guix/i…>
>> > …)
>> > In srfi/srfi-1.scm:
>> > 592:17 6 (map1 ("tempfile"))
>> > In guix/import/utils.scm:
>> > 421:36 5 (lookup-node "tempfile")
>> > In guix/import/crate.scm:
>> > 222:10 4 (crate->guix-package "tempfile" _)
>> > 150:15 3 (make-crate-sexp #:name _ #:version _ #:cargo-inputs _ #
>> > …)
>> > In guix/http-client.scm:
>> > 88:25 2 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ #
>> > …)
>> > In guix/build/download.scm:
>> > 419:4 1 (open-connection-for-uri _ #:timeout _ # _)
>> > 306:6 0 (tls-wrap #<closed: file 7f9a564b3a10> _ # _)
>> >
>> > guix/build/download.scm:306:6: In procedure tls-wrap:
>> > X.509 certificate of 'crates.io' could not be verified:
>> > signer-not-found
>> > invalid
>> >
>> > I suspect that it happens after the importer hits
>> > "wasm-bindgen-webidl" and starts going circles. Maybe there's some
>> > circullar dependencies going on, but I'm not sure. I'm attaching a
>> > full log for convenience.
>> >
>> > For additional info: I'm running Guix on Arch Linux. I've also
>> > installed nss-certs package, exported all neeeded variables
>> > (SSL_CERT_DIR, SSL_CERT_FILE and GIT_SSL_CAINFO) before running guix
>> > import and also made sure nscd.service is running.
>> >
>> > Regards,
>> > Valentin Ignatev
>>
>> I've had it happen to me also sometimes. It's like it forgets that it
>> just successfully connected 100+ times and then fails.
>>
>>
>> --
>> Efraim Flashner <efraim@flashner.co.il> ????? ?????
>> GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
>> Confidentiality cannot be guaranteed on emails sent or received
>> unencrypted
>
> I don't know if this could be related, but...
> I am also running guix on Archlinux and experienced a TLS problem
> after doing pacman -Syu.
>
> Mutt got updated and I could no longer get my pop mail.
> I reverted the last mutt update:
>
> --8<---------------cut here---------------start------------->8---
> [2020-01-01T15:53:13-0800] [ALPM] downgraded mutt (1.13.2-1 -> 1.12.2-1)
> --8<---------------cut here---------------end--------------->8---
>
> And am writing this with the reverted verssion.
> (So BTW this may be a heads-up not to package 1.13.2-1 until the problem
> is resolved, to avoid similar breakage for other Arch users, and perhaps
> others?)
>
> BTW2, if you are using pacman on arch, this little snippet is handy to list
> what your last pacman {up,down}grade did:
>
> I do listing variants as ls-whatever -- this one is ls-pacupd:
> --8<---------------cut here---------------start------------->8---
> #!/usr/bin/bash
> # ~/bin/ls-pacupd -- list latest pacman Syu upgrades
> latest="$(stat -c '%y' /var/log/pacman.log|cut -d ' ' -f1)"
> egrep "$latest.* (up|down)graded " /var/log/pacman.log
> --8<---------------cut here---------------end--------------->8---
>
> I found that the guix-installed version of mutt worked for getting mail,
> and saw that it used the prior version.
>
> However, emacs is mutt's configured editor, and after some longish time
> editing
> the entire system would freeze and not respond to ANY key input, and I had
> to
> power down physically (5-sec press of power button).
> So I had to go back to the old Arch version.
>
> I am still mystified by this freeze-up. It's possible that I am typing some
> fatal
> combination of keys on this keyboard or that my migration from a dying
> laptop to
> an SSD in a USB3 cassette booted with UEFI on a Lenovo Swift did not
> entirely succeed.
>
> My context:
>
> I am running on tty1 with guix "disabled" by not setting up its paths etc
> in
> ~/.bash_profile at login, so this is my current boot context here:
> ???????????????????????????????????????????????????????????????????????????????????
> ? Booted at 2020-01-02 08:50 -0800 (PST) and logged in as as
> bokr@Evo25c2ArchGx4 ?
> ???????????????????????????????????????????????????????????????????????????????????
> ? HW host: Acer Swift SF113-31/ASAHI_AP_S, BIOS V1.08 11/22/2017
> ?
> ? MOUNTPOINT KNAME LABEL SIZE FSAVAIL FSUSE%
> ?
> ? /boot sda1 Evo25c2EFI1 1G 461.9M 55%
> ?
> ? / sda4 Evo25c2ArchGx4 167.9G 73.5G 50%
> ?
> ? Kernel: 5.4.6-arch3-1 #1 SMP PREEMPT Tue, 24 Dec 2019 04:36:53 +0000
> ?
> ? CPU: Intel(R) Pentium(R) CPU N4200 @ 1.10GHz
> ?
> ???????????????????????????????????????????????????????????????????????????????????
>
> Whereas on tty4 I logged in with a config value that my ~/.bash_profile
> uses
> to set MY_GUIX_MODE=enabled at the top and do further enabled/disabled
> specializations
> after that, so e.g. guix is found in $PATH and currently that makes
> (captured on tty4 and and retrieved here on tty1)
>
> guix describe:
> --8<---------------cut here---------------start------------->8---
> Generation 27 Dec 29 2019 18:49:23 (current)
> guix 996182a
> repository URL: https://git.savannah.gnu.org/git/guix.git
> branch: master
> commit: 996182a84bafb4c4982dcb36c2c54b350c16629a
> --8<---------------cut here---------------end--------------->8---
>
> Editing context in emacs here and now:
> --8<---------------cut here---------------start------------->8---
> pidparents ? 8747 Ss /usr/bin/bash
> /home/bokr/bin/pidparents
> emacs tty1 2420 Sl+ emacs
> /home/bokr/.mutt/temp/mutt-Evo25c2ArchGx4-1000-861-11810734661506241046
> mutt tty1 861 S mutt
> bash tty1 461 Ss -bash
> login ? 447 Ss login -- bokr
> systemd ? 1 Ss /sbin/init
> \EFI\Evo25c2ArchGx4\vmlinuz-linux
> --8<---------------cut here---------------end--------------->8---
>
> Regards,
> Bengt Richter
>
M
M
Martin Becze wrote on 2 Jan 2020 20:37
(address . bug-guix@gnu.org)
d872d8f2-6274-c93f-c26d-682177faa630@riseup.net
I have had this problem as well. I noticed that the file descriptors
where not being closed when the connections end. I think this is causing

On 1/2/20 2:20 PM, Valentin Ignatev wrote:
Toggle quote (175 lines)
> I don't think that it's related, but who knows. I only have a
> certificate issue when I'm using recursive crates import. I am able to
> import packages from crates one by one without an issue as well as
> doing other tls-sensitive stuff.
>
> Regards,
> Valentin
>
> On 1/2/20, Bengt Richter <bokr@bokr.com> wrote:
>> Hi Guix,
>>
>> On +2020-01-02 09:12:43 +0200, Efraim Flashner wrote:
>>> On Thu, Jan 02, 2020 at 01:45:35AM +0300, Valentin Ignatev wrote:
>>>> Hi! I'm trying to recursively import a package from crates.io like
>>>> this:
>>>>
>>>> guix import crate notify@4.0.14 --recursive
>>>>
>>>> It follows redirections for a while untill at some point throws this:
>>>>
>>>> Backtrace:
>>>> 12 (primitive-load "/home/vj/.config/guix/current/bin/guix")
>>>> In guix/ui.scm:
>>>> 1806:12 11 (run-guix-command _ . _)
>>>> In guix/scripts/import.scm:
>>>> 116:11 10 (guix-import . _)
>>>> In guix/scripts/import/crate.scm:
>>>> 103:16 9 (guix-import-crate . _)
>>>> In guix/import/utils.scm:
>>>> 425:7 8 (recursive-import _ _ #:repo->guix-package _ #:guix-name
>>>> …)
>>>> 397:31 7 (topological-sort _ #<procedure 7f9a59729630 at guix/i…>
>>>> …)
>>>> In srfi/srfi-1.scm:
>>>> 592:17 6 (map1 ("tempfile"))
>>>> In guix/import/utils.scm:
>>>> 421:36 5 (lookup-node "tempfile")
>>>> In guix/import/crate.scm:
>>>> 222:10 4 (crate->guix-package "tempfile" _)
>>>> 150:15 3 (make-crate-sexp #:name _ #:version _ #:cargo-inputs _ #
>>>> …)
>>>> In guix/http-client.scm:
>>>> 88:25 2 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ #
>>>> …)
>>>> In guix/build/download.scm:
>>>> 419:4 1 (open-connection-for-uri _ #:timeout _ # _)
>>>> 306:6 0 (tls-wrap #<closed: file 7f9a564b3a10> _ # _)
>>>>
>>>> guix/build/download.scm:306:6: In procedure tls-wrap:
>>>> X.509 certificate of 'crates.io' could not be verified:
>>>> signer-not-found
>>>> invalid
>>>>
>>>> I suspect that it happens after the importer hits
>>>> "wasm-bindgen-webidl" and starts going circles. Maybe there's some
>>>> circullar dependencies going on, but I'm not sure. I'm attaching a
>>>> full log for convenience.
>>>>
>>>> For additional info: I'm running Guix on Arch Linux. I've also
>>>> installed nss-certs package, exported all neeeded variables
>>>> (SSL_CERT_DIR, SSL_CERT_FILE and GIT_SSL_CAINFO) before running guix
>>>> import and also made sure nscd.service is running.
>>>>
>>>> Regards,
>>>> Valentin Ignatev
>>> I've had it happen to me also sometimes. It's like it forgets that it
>>> just successfully connected 100+ times and then fails.
>>>
>>>
>>> --
>>> Efraim Flashner <efraim@flashner.co.il> ????? ?????
>>> GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
>>> Confidentiality cannot be guaranteed on emails sent or received
>>> unencrypted
>> I don't know if this could be related, but...
>> I am also running guix on Archlinux and experienced a TLS problem
>> after doing pacman -Syu.
>>
>> Mutt got updated and I could no longer get my pop mail.
>> I reverted the last mutt update:
>>
>> --8<---------------cut here---------------start------------->8---
>> [2020-01-01T15:53:13-0800] [ALPM] downgraded mutt (1.13.2-1 -> 1.12.2-1)
>> --8<---------------cut here---------------end--------------->8---
>>
>> And am writing this with the reverted verssion.
>> (So BTW this may be a heads-up not to package 1.13.2-1 until the problem
>> is resolved, to avoid similar breakage for other Arch users, and perhaps
>> others?)
>>
>> BTW2, if you are using pacman on arch, this little snippet is handy to list
>> what your last pacman {up,down}grade did:
>>
>> I do listing variants as ls-whatever -- this one is ls-pacupd:
>> --8<---------------cut here---------------start------------->8---
>> #!/usr/bin/bash
>> # ~/bin/ls-pacupd -- list latest pacman Syu upgrades
>> latest="$(stat -c '%y' /var/log/pacman.log|cut -d ' ' -f1)"
>> egrep "$latest.* (up|down)graded " /var/log/pacman.log
>> --8<---------------cut here---------------end--------------->8---
>>
>> I found that the guix-installed version of mutt worked for getting mail,
>> and saw that it used the prior version.
>>
>> However, emacs is mutt's configured editor, and after some longish time
>> editing
>> the entire system would freeze and not respond to ANY key input, and I had
>> to
>> power down physically (5-sec press of power button).
>> So I had to go back to the old Arch version.
>>
>> I am still mystified by this freeze-up. It's possible that I am typing some
>> fatal
>> combination of keys on this keyboard or that my migration from a dying
>> laptop to
>> an SSD in a USB3 cassette booted with UEFI on a Lenovo Swift did not
>> entirely succeed.
>>
>> My context:
>>
>> I am running on tty1 with guix "disabled" by not setting up its paths etc
>> in
>> ~/.bash_profile at login, so this is my current boot context here:
>> ???????????????????????????????????????????????????????????????????????????????????
>> ? Booted at 2020-01-02 08:50 -0800 (PST) and logged in as as
>> bokr@Evo25c2ArchGx4 ?
>> ???????????????????????????????????????????????????????????????????????????????????
>> ? HW host: Acer Swift SF113-31/ASAHI_AP_S, BIOS V1.08 11/22/2017
>> ?
>> ? MOUNTPOINT KNAME LABEL SIZE FSAVAIL FSUSE%
>> ?
>> ? /boot sda1 Evo25c2EFI1 1G 461.9M 55%
>> ?
>> ? / sda4 Evo25c2ArchGx4 167.9G 73.5G 50%
>> ?
>> ? Kernel: 5.4.6-arch3-1 #1 SMP PREEMPT Tue, 24 Dec 2019 04:36:53 +0000
>> ?
>> ? CPU: Intel(R) Pentium(R) CPU N4200 @ 1.10GHz
>> ?
>> ???????????????????????????????????????????????????????????????????????????????????
>>
>> Whereas on tty4 I logged in with a config value that my ~/.bash_profile
>> uses
>> to set MY_GUIX_MODE=enabled at the top and do further enabled/disabled
>> specializations
>> after that, so e.g. guix is found in $PATH and currently that makes
>> (captured on tty4 and and retrieved here on tty1)
>>
>> guix describe:
>> --8<---------------cut here---------------start------------->8---
>> Generation 27 Dec 29 2019 18:49:23 (current)
>> guix 996182a
>> repository URL: https://git.savannah.gnu.org/git/guix.git
>> branch: master
>> commit: 996182a84bafb4c4982dcb36c2c54b350c16629a
>> --8<---------------cut here---------------end--------------->8---
>>
>> Editing context in emacs here and now:
>> --8<---------------cut here---------------start------------->8---
>> pidparents ? 8747 Ss /usr/bin/bash
>> /home/bokr/bin/pidparents
>> emacs tty1 2420 Sl+ emacs
>> /home/bokr/.mutt/temp/mutt-Evo25c2ArchGx4-1000-861-11810734661506241046
>> mutt tty1 861 S mutt
>> bash tty1 461 Ss -bash
>> login ? 447 Ss login -- bokr
>> systemd ? 1 Ss /sbin/init
>> \EFI\Evo25c2ArchGx4\vmlinuz-linux
>> --8<---------------cut here---------------end--------------->8---
>>
>> Regards,
>> Bengt Richter
>>
>
>
L
L
Ludovic Courtès wrote on 3 Jan 2020 00:06
control message for bug #38836
(address . control@debbugs.gnu.org)
87woa9qx07.fsf@gnu.org
merge 38836 38857
quit
L
L
Ludovic Courtès wrote on 3 Jan 2020 00:08
control message for bug #20145
(address . control@debbugs.gnu.org)
87v9ptqwxa.fsf@gnu.org
merge 20145 38836
quit
?
Your comment

This issue is archived.

To comment on this conversation send an email to 38857@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 38857
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch