search

sass / dart-sass

The reference implementation of Sass, written in Dart.
https://sass-lang.com/dart-sass
MIT License
3.87k stars 350 forks source link

Fix windows-arm64 release #2274

Closed ntkme closed 1 month ago

ntkme commented 1 month ago

This PR attempts to fix the release failure in https://github.com/sass/dart-sass/actions/runs/9864595353/job/27240444712

nex3 commented 1 month ago

Can you add a comment here indicating that we can't use the shared workflow and linking to the GitHub discussion?

ntkme commented 1 month ago

https://github.com/sass/dart-sass/actions/workflows/build-windows.yml

@nex3 By the way, there should be a "run workflow" button on page the linked above. After we merge this PR, you can use the "run workflow" button to test it out, that it will build the windows artifacts without an actual release. I cannot personally try it as I do not have access to see the button, so it would be very helpful if you can trigger a run after merging to see if there is any other issue or not.

ntkme commented 1 month ago

It looks like dart-sdk on windows 11 for arm might be missing CA certs like this issue: https://github.com/dart-lang/pub/issues/1882

ntkme commented 1 month ago

@nex3 Can we try change the command to dart pub get --verbose so that we can see what exactly failed?

nex3 commented 1 month ago

Rerunning with --verbose now.

nex3 commented 1 month ago

Here's the result, although I'm not sure how much more information it gives us. I think it may be better at this point to just resurrect https://github.com/sass/dart-sass/pull/2275 to get releases back on track.

ntkme commented 1 month ago 
FINE: Wrapped exception: HandshakeException: Handshake error in client (OS Error: 
    |   CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate(../../third_party/boringssl/src/ssl/handshake.cc:393))

It looks indeed like missing ca certs. I think unable to get local issuer means unable to get parent certificate for the server certificate. This parent is either an intermediate certificate (usually served by server) or a root ca (need to be trusted locally).

So most likely there is an issue with the default root CA config.

ntkme commented 1 month ago

@nex3 If you want to do #2275, you have to just switch the runner to windows-latest to build a kernel snapshot. Disabling it will cause release failure in embedded-host-node.