distfiles are not being mirrored

[ballapete (Peter "Pete" Dyballa)]

DEBUG: Executing org.macports.fetch (py27-setuptools)
--->  setuptools-3.4.1.tar.gz doesn't seem to exist in /opt/local/var/macports/distfiles/py-setuptools
--->  Attempting to fetch setuptools-3.4.1.tar.gz from https://pypi.python.org/packages/source/s/setuptools/

DEBUG: Fetching distfile failed: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
--->  Attempting to fetch setuptools-3.4.1.tar.gz from http://distfiles.macports.org/py-setuptools

[ballapete (Peter "Pete" Dyballa)]

main.log

[jmroot (Joshua Root)]

We can’t update your certificate store, but the file should be downloaded onto the mirrors.

[ballapete (Peter "Pete" Dyballa)]

Replying to jmr@…:

We can’t update your certificate store, but the file should be downloaded onto the mirrors.

What is my "certificate store"? I know of AppStore…

[jmroot (Joshua Root)]

Replying to Peter_Dyballa@…:

What is my "certificate store”?

That’s a bit of jargon, from the X.509 standard I believe. The short answer is it’s a set of stored certificates. In this case, specifically the set of root certificates that Apple designated as trustworthy and shipped with the OS (you can see them in Keychain Access under “System Roots” or similar name). Since Leopard is no longer getting updates, new root certificates are not being added, and apparently pypi is using a certificate signed by one such newer root certificate.

[spam@…]

I also was having this problem, my workaround was to download ​https://pypi.python.org/packages/source/s/setuptools/setuptools-3.4.1.tar.gz and place it in /opt/local/var/macports/distfiles/py-setuptools/

I did this through another computer, but you could have done it through curl or wget. I think curl may need curl-ca-bundle installed to get the right "certificate store" to be able to be used, and wget may need to reference that ca-bundle.

[potmj (Michael Pot)]

Replying to spam@…:

Thanks for the pointer, spam
"sudo curl -k -O ​https://pypi.python.org/packages/source/s/setuptools/setuptools-3.4.1.tar.gz"
worked for me

[ned-deily (Ned Deily)]

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

Your mileage may vary!

[joaogeada (Joao Geada)]

Thanks, that fixed it for me.

[cooljeanius (Eric Gallager)]

Cc Me!

[ryandesign (Ryan Carsten Schmidt)]

Has duplicate #43307.

We also have #43180 tracking the general distfile mirroring problem.

[cooljeanius (Eric Gallager)]

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

Your mileage may vary!

I was running into this issue on my PureDarwin vm the other day, because PureDarwin is based off of 10.5 Leopard, so it has the same system curl and curl certificate bundle ^{(the bundle may look like it is newer, but that is only because the vm image was built more recently)}, and I can confirm that the fix mentioned here worked on that vm, too.

[petrrr]

Cc Me!

[ballapete (Peter "Pete" Dyballa)]

Replying to egall@…:

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

For me this fixes all reported issues.

What keeps me wondering is why I have a superfluous MacPorts curl installation which does not get used …

[ryandesign (Ryan Carsten Schmidt)]

Replying to Peter_Dyballa@…:

Replying to egall@…:

Replying to nad@…:

On 10.5 Leopard, it looks like MacPorts base uses the system curl to download packages. Its certificate bundle is in /usr/share/curl and was last updated in 2007. What worked for me was to replace it with a copy of the MacPorts one assuming you have the curl port installed:

sudo sh
cd /usr/share/curl
cp -p curl-ca-bundle.crt curl-ca-bundle-out-of-date-system-backup.crt
cp -p /opt/local/share/curl/curl-ca-bundle.crt .
exit

For me this fixes all reported issues.

It doesn't fix the fact that our distfiles mirror hasn't been mirroring our distfiles since March; our server admins need to figure out what's causing that and fix it.

What keeps me wondering is why I have a superfluous MacPorts curl installation which does not get used …

The command "port installed depends:curl" will show which of your installed ports depend on curl. If there aren't any, you can of course uninstall curl.

MacPorts doesn't generally itself use the ports you installed because that can cause problems during upgrades, or if for any other reason that port becomes unusable.

[neverpanic (Clemens Lang)]

It seems distfile mirroring started working again 23-Apr-2014 07:38, e.g. for the wireshark port.