search

luarocks / hererocks

Python script for installing Lua/LuaJIT and LuaRocks into a local directory
MIT License
71 stars 12 forks source link

Certificate verification failed for downloading from https://www.lua.org #20

Open osch opened 2 years ago

osch commented 2 years ago

I'm getting CERTIFICATE_VERIFY_FAILED when using Python Version 3.8. 

hererocks c:\hererocks --%LUA% --target %HR_TARGET% -rlatest
Fetching Lua 5.1.5 (target: vs_64) from https://www.lua.org/ftp/lua-5.1.5.tar.gz
Download failed: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1108)
Fetching Lua 5.1.5 (target: vs_64) from https://webserver2.tecgraf.puc-rio.br/lua/mirror/ftp/lua-5.1.5.tar.gz
Verifying SHA256 checksum
Error: SHA256 checksum mismatch for C:\Users\appveyor\AppData\Local\HereRocks\Cache\lua-5.1.5.tar.gz
Expected: 2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333
Observed: 2598647a7dd012b6c346023638258509103d36dd3f15941aebc31c009e6a80ab

With Python 3.9 the download from https://www.lua.org works but unfortunately: Python 3.9 is not available in an Appveyor image together with Visual Studio 2015, see https://www.appveyor.com/docs/windows-images-software/

It seems that Visual Studio 2015 is the latest version supported by hererocks:

hererocks.py: error: argument --target: invalid choice: 'vs19_64' (choose from 'linux', 'macosx', 'freebsd', 
'mingw', 'posix', 'generic', 'mingw', 'vs', 'vs_32', 'vs_64', 'vs08_32', 'vs08_64', 'vs10_32', 'vs10_64', 
'vs12_32', 'vs12_64', 'vs13_32', 'vs13_64', 'vs15_32', 'vs15_64')

As a workaround I got it working by using:

hishamhm commented 2 years ago

Thanks for the report! I am unfamiliar with Visual Studio — could you send a PR adding support for more recent MSVC versions? I think that would be the best way to deal with this Appveyor incompatibility. Thank you!

osch commented 2 years ago

I'm also unfamiliar with Visual Studio and also with Python. It took me a lot of try and error to figure out that certificate verification from https://lua.org in Python (for Windows) 2.7, 3.8 und 3.10 did not work (P.S. see below). So I would like to suggest to revert #14 or at least to implement an option to disable https. The checksums of the downloads are verified, so using https does not give extra security, but as shown it increases complexity by providing an additional point of possible failure.

P.S.: I re-checked Python 3.10 on my virtual box windows and now it works. Last time I checked it didn't work. So the problem seems to be related to the Windows certificate store, which could have been updated after latest Windows updates I guess. It also didn't work on the AppVeyor build server, could be that there the certificate store was/is not up to date too. Anyway I still would like to have an option to disable https for the mentioned reasons just to be able to prevent any problems without the need to check out an old version of Hererocks.

hishamhm commented 2 years ago

I just remembered I went through a similar issue in the LuaRocks repository with Appveyor+Hererocks+Python (d'oh!)

This is how I solved it, forcing Python to fetch and use updated certificates:

https://github.com/luarocks/luarocks/blob/master/appveyor.yml#L53-L58

osch commented 2 years ago

This is how I solved it

Ah OK thanks for pointing this out, I'll try it the next time I'm running into these problems.