search

dblock / iex-ruby-client

IEX Finance API Ruby Client
MIT License
118 stars 60 forks source link

Workaround for Heroku's 22 stack's `Faraday::SSLError (SSL_CTX_load_verify_file: system lib)` #112

Closed agrberg closed 2 years ago

agrberg commented 2 years ago

It's a little beyond my understanding exactly what's going on but I have a work around for Heroku 22's stack producing a Faraday::SSLError.

tl;dr

Set the client's SSL ca_file config variable to /usr/lib/ssl/certs/ca-certificates.crt* or nil. I do it in my client initializer and a simple one liner is

IEX::Api.config.ca_file = '/usr/lib/ssl/certs/ca-certificates.crt'

* from Faraday's Wiki's SSL entry for Heroku.

What's going on?

The client sets this value to OpenSSL::X509::DEFAULT_CERT_FILE which is /usr/lib/ssl/cert.pem. The file path, nor its lack of existence, does not change between Heroku's 20 and 22 stack, whereas OpenSSL is upgraded from 1.1.1f to 3.0.2 (outlined in Heroku's 22 Stack documentation). My assumption is that OpenSSL previously treated missing files and no file specified the same.

Wrap it up

Ultimately I'm unsure what change to make to the library at this time but wanted to provide some information for the next person having trouble with their Heroku 22 stack update.

dblock commented 2 years ago

Similar to https://github.com/slack-ruby/slack-ruby-client/issues/415 I think we need to default these values to nil. I would take a PR that does that with a major version increment and a section in UPGRADING.

agrberg commented 2 years ago

I can work up a simpler PR that has just that in it.

Unfortunately dependencies have gotten a little out of date making the project a little more difficult to run locally. For example required_ruby_version is set to >= 2.3.0 and transform_values doesn't appear until Ruby 2.4 so the tests are failing on master currently under Ruby 2.3.8 (latest 2.3 release).

What are your thoughts on a dependency upgrade/overhaul? According to the official language page anything below the 2.7 branch is EOL. It would take some time but I think the project would be in a better place on Ruby 3 (3.1.2 current release) and use the latest gems w/ latest version constraints and the latest Rubocop rules in place.

dblock commented 2 years ago

I have no problem removing support for Ruby < 2.7, please do! Bump the major version if needed and make separate PRs from other features.

agrberg commented 2 years ago

Updated PR #113 and created issue #115 and PR #114 to resolve EOL rubies