"netpbm" certificate expired

[bjmacgreg]

Hi,

I'm trying to (finally) install the new Arb on Mac OS 10.14.6 and got pretty far, but it stopped at this:

svn: E170013: Unable to connect to a repository at URL 'https://svn.code.sf.net/p/netpbm/code/stable' svn: E230001: Server SSL certificate verification failed: certificate has expired Error: arb@7: Failed to download resource "netpbm" Failure while executing; svn checkout https://svn.code.sf.net/p/netpbm/code/stable /Users/bmacgreg/Library/Caches/Homebrew/netpbm--svn --quiet -r 4257 exited with 1. Here's the output: svn: E170013: Unable to connect to a repository at URL 'https://svn.code.sf.net/p/netpbm/code/stable' svn: E230001: Server SSL certificate verification failed: certificate has expired

Thanks for any help...

Barbara

[jgerken]

Hi Barbara,

I am currently at my tablet only, so I can’t check if I can reproduce the problem. But I can access the URL in my browser without problems. I know that SourceForge uses Let’s Encrypt certificates (sf.net is SourceForge) and there is a problem with some of the Let‘s Encrypt certificates that require website owners to re-new them on short term. During this renewal process an intermediate certificate is used. You might just have been unfortunate trying to connect exactly in that moment. Could you please try again? If that does not solve the problem, I‘ll have a look tomorrow.

Best, Jan

[bjmacgreg]

Hi,

Thanks, I’ll try later and let you know. Hoping the new version solves an arb data-import problem (“symbol not found”), but since it might not, I don’t want to take the time this minute.

Barbara

On Jan 26, 2022, at 15:44, Jan @.***> wrote:

 Hi Barbara,

I am currently at my tablet only, so I can’t check if I can reproduce the problem. But I can access the URL in my browser without problems. I know that SourceForge uses Let’s Encrypt certificates (sf.net is SourceForge) and there is a problem with some of the Let‘s Encrypt certificates that require website owners to re-new them on short term. During this renewal process an intermediate certificate is used. You might just have been unfortunate trying to connect exactly in that moment. Could you please try again? If that does not solve the problem, I‘ll have a look tomorrow.

Best, Jan

— Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you authored the thread.

[bjmacgreg]

Hi Jan,

Tried again just now and got the same error. (Sorry.)

Barbara

On Jan 26, 2022, at 15:44, Jan @.***> wrote:

 Hi Barbara,

I am currently at my tablet only, so I can’t check if I can reproduce the problem. But I can access the URL in my browser without problems. I know that SourceForge uses Let’s Encrypt certificates (sf.net is SourceForge) and there is a problem with some of the Let‘s Encrypt certificates that require website owners to re-new them on short term. During this renewal process an intermediate certificate is used. You might just have been unfortunate trying to connect exactly in that moment. Could you please try again? If that does not solve the problem, I‘ll have a look tomorrow.

Best, Jan

— Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you authored the thread.

[jgerken]

Hi Barbara,

your macOS very is very old (officially not supported by Homebrew anymore) and it is very likely that some certificates on your system are outdated / missing to successfully validate the SSL certificate from https://svn.code.sf.net. But I think we can make it work. Can you please run the following commands:

brew install ca-certificates
export HOMEBREW_FORCE_BREWED_CA_CERTIFICATES=1
brew install arb-project/arb/arb@7

The first command is not necessary if brew list shows that ca-certificates is installed. If you run it anyway, Homebrew will complain that it is already installed but that error message can be ignored.

The oldest macOS I have available is 10.15. Here, I ran way earlier into SSL problems and forcing Homebrew to use the ca-certificates did the trick for me. I only tested installing of netpbm though (don't need ARB on that Mac). So, there might be additional problems on your path. But I hope the commands from above will resolve the netpbm issue for you, too.

Best Jan

[bjmacgreg]

Hi Jan,

Alas, no, same error. Any other ideas? It's not critical, but it would be nice to see what's new.

This is a mid-2010 MacPro, which can't officially run anything above 10.14. I did find a fairly well-reviewed workaround from dosdude1, but am a little nervous about trying it. Any advice? Probably has to be done eventually, a new (or used) computer isn't really in the budget.

Thanks,

Barbara

[jgerken]

Hi Barbara,

if you should try to upgrade the macOS, I would recommend that you create a bootable one-to-one copy of the hard drive (e.g. via Carbon Copy Cloner https://bombich.com for the 10.14 you probably need to download an old version - 3 or 4 if I remember correctly). This gives you the option to not only restore your MacBook to the pre-update state but also boot from the backup and continue to work (with a performance penalty for having all data on USB drive, though).

I found this information on Subversion and SSL certificates. If I understand it correctly, you should be able to execute

svn list http://svn.code.sf.net/p/netpbm/code

be presented with an error message and be able to accept the offending certificate permanently by pressing p (maybe followed by enter can remember if that is necessary in Subversion or not). This should configure SVN globally to accept the certificate.

brew install netpbm

should succeed afterwards (hopefully).

Have a nice weekend, Jan

[bjmacgreg]

Hi Jan,

Hmm, no, it doesn’t show me a certificate - just the same notice that the certificate has expired. Time for a little stackoverflow expedition I suppose. Let me know if you have any other thoughts.

It’s a MacPro actually (cheese grater style). I do have a CCC backup, but still. Official upgrades already tend to cause stupid problems (or problems I am too stupid to fix), can I trust random internet people? Probably.

Thanks again,

Barbara

Email: @., @. Cell: +1 (919) 260-6038

On Jan 28, 2022, at 2:11 PM, Jan @.***> wrote:

svn list http://svn.code.sf.net/p/netpbm/code http://svn.code.sf.net/p/netpbm/code

[jgerken]

Hi Barbara,

I did some more research and found the information that the macOS version you are using should already trust the certificate. So, my assumption that the expiration error was caused by the missing root certificate was wrong. I have no other idea at the moment except that it may be related to your system time settings. Is your Mac set to the correct date?

I could also not find anything to make Homebrew force svn to accept all certificates. There is a runtime argument for svn to do so but since Homebrew does the call we can't add the argument :-(

Best, Jan

[bjmacgreg]

Hi Jan,

Thanks for trying! I’ll give it one more shot in a day or two.

The clock is set right, as far as I can tell (Happy Groundhog Day, it’s an American thing).

To be fancy, I could try the newer OS on a spare drive that I have. But only once current projects are caught up…

Barbara

On Feb 2, 2022, at 08:40, Jan @.***> wrote:

 Hi Barbara,

I did some more research and found the information that the macOS version you are using should already trust the certificate. So, my assumption that the expiration error was caused by the missing root certificate was wrong. I have no other idea at the moment except that it may be related to your system time settings. Is your Mac set to the correct date?

I could also not find anything to make Homebrew force svn to accept all certificates. There is a runtime argument for svn to do so but since Homebrew does the call we can't add the argument :-(

Best, Jan

— Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you authored the thread.