search

sqitchers / homebrew-sqitch

Homebrew Formulas for Sqitch
22 stars 10 forks source link

brew install fails due to cpantesters.org being blocked by OpenDNS #41

Closed mcallaway closed 5 years ago

mcallaway commented 5 years ago

Trying to brew install sqitch I see:

> brew install sqitch --with-sqlite-support
==> Installing sqitch from sqitchers/sqitch
==> Downloading http://cpan.cpantesters.org/authors/id/D/DW/DWHEELER/App-Sqitch-0.9998.tar.gz

curl: (22) The requested URL returned error: 403 Forbidden
Error: An exception occurred within a child process:
  DownloadError: Failed to download resource "sqitch"
Download failed: http://cpan.cpantesters.org/authors/id/D/DW/DWHEELER/App-Sqitch-0.9998.tar.gz

Visiting http://cpan.cpantesters.org fails as OpenDNS flags it as possible malware.

Visiting https://cpan.cpantesters.org reveals an invalid SSL certificate.

I am able to download App-Sqitch via cpan.org. Perhaps that site should be used instead of cpantesters.org?

mcallaway commented 5 years ago 
> brew edit sqitch
Editing /usr/local/Homebrew/Library/Taps/sqitchers/homebrew-sqitch/Formula/sqitch.rb

Change the URL to http://cpan.org/... and it proceeds.

theory commented 5 years ago

And now port 443 doesn't respond at all. @preaction, did something change?

preaction commented 5 years ago

We haven't had an SSL cert on the CPAN Testers CPAN mirrors in a few years, and have not responded to port 443 in all that time. My guess as to what happened is OpenDNS decided stupidly to start responding to port 443 when it added CPAN Testers to "suspected malware" sites, which gave the behavior that the OP saw.

theory commented 5 years ago

Why not add TLS support?

preaction commented 5 years ago

I surely could, using Fastly as the rest of CPAN Testers is doing for SSL. I'm not sure if Fastly wants to host yet another CPAN mirror, since it already is the main CPAN mirror at cpan.org. I'm mostly here saying "CPAN Testers CPAN mirror SSL cert is broken" is incorrect.

I do still need to go around and beg for CPAN Testers to be delisted from malware tracking sites, which apparently means convincing hackers to stop using specifically my server's CPAN mirror to download CPAN modules? But, either way, using the primary fanout site is the best option for sqitch.

theory commented 5 years ago

Thanks @preaction. Assuming that www.cpan.org is the "primary fanout site", I think we're good here.