Unknown CA

[randysecrist]

How do I tell bumblebee to use verify_none when downloading a model? (When sitting behind a corp vpn)

OR

Where should I make sure the cert is added so that erlang picks it up automatically?

HEX_UNSAFE_HTTPS=1 elixir speech_to_text.exs

07:40:08.835 [notice] TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA

** (MatchError) no match of right hand side value: {:error, "failed to make an HTTP request, reason: \"HTTP request failed, reason: {:failed_connect, [{:to_address, {~c\\\"huggingface.co\\\", 443}}, {:inet, [:inet], {:tls_alert, {:unknown_ca, ~c\\\"TLS client: In state wait_cert_cr at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA\\\\n\\\"}}}]}\""}
    speech_to_text.exs:321: (file)
    (elixir 1.15.7) lib/code.ex:1435: Code.require_file/2

[jonatanklosko]

Hey, you can set BUMBLEBEE_CACERTS_PATH with the custom cert. Let us know if that works :)

[randysecrist]

Is this just a directory with the .pem file in it?

sidenote; I can see my cert in the system keychain; but not the system root keychain which is what erl looks for

security export -t certs -f pemseq -k /Library/Keychains/System.keychain

vs

https://github.com/erlang/otp/blob/master/lib/public_key/src/pubkey_os_cacerts.erl#L174

[jonatanklosko]

Is this just a directory with the .pem file in it?

It should be the path of the .pem file itself :)

[randysecrist]

hmmm

I've tried:

BUMBLEBEE_CACERTS_PATH=certs
BUMBLEBEE_CACERTS_PATH=certs/*
BUMBLEBEE_CACERTS_PATH=certs/all.pem

none of them actually work

now i'm wondering if I even have the right cert at all

[jonatanklosko]

Are you using an absolute path?

[randysecrist]

I am ... /Users/rsecrist/Downloads/certs/all.pem I just left that prefix part out above

[jonatanklosko]

To double check, you can run a basic request in IEx and use your certs path:

Application.ensure_all_started([:ssl, :inets])

:httpc.request(
  :get,
  {~c"https://github.com", []},
  [
    ssl: [
      cacertfile: "/etc/ssl/cert.pem",
      verify: :verify_peer,
      customize_hostname_check: [
        match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
      ]
    ]
  ],
  []
)

[jonatanklosko]

If this doesn't work then I suspect the issue is in the cert file itself.

[randysecrist]

yes; that works:

Application.ensure_all_started([:ssl, :inets])

:httpc.request(
  :get,
  {~c"https://github.com", []},
  [
    ssl: [
      cacertfile: "/Users/rsecrist/Downloads/certs/all.pem",
      verify: :verify_peer,
      customize_hostname_check: [
        match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
      ]
    ]
  ],
  []
)

{:ok,
 {{~c"HTTP/1.1", 200, ~c"OK"},
  [...

[jonatanklosko]

Ohh, which Bumblebee version are you using? The support for custom certs is only on main. So you need to install as {:bumblebee, github: "elixir-nx/bumblebee"}. We are waiting for a new Axon release, but that's likely to happen soon.

[randysecrist]

ah yes, looks like @josevalim pushed after i cloned yesterday

commit b01e0da989a39b594990f8023bebb3751663fb19 (HEAD -> main, origin/main, origin/HEAD)
Author: Jonatan Kłosko <jonatanklosko@gmail.com>
Date:   Fri Sep 20 18:49:08 2024 +0700

    Support llama3 checkpoints with tied word embeddings```

[jonatanklosko]

We added support for BUMBLEBEE_CACERTS_PATH earlier, the new commit adds another common env as a fallback.

But looking at the log speech_to_text.exs, are you running the example in this repo? It installs {:bumblebee, "~> 0.5.0"}, unless you changed it to main manually.

[randysecrist]

I'm running from a fresh clone of the bumblebee repo. Thanks for the tip to update that. 👀

[randysecrist]

yep - updating that dep in the local example file worked. Thanks! I've never seen a complete example like that before in elixir that literally does ... everything. Very cool.

[jonatanklosko]

Great!

I've never seen a complete example like that before in elixir that literally does ... everything

You don't even need the repo, that file is standalone, Mix.install brings the dependencies. And a single-file phoenix app is now even easier with playground/phoenix_playground :)