memesuite: distfile mirroring fails

[mascguy (Christopher Nielsen)]

Mirroring of this port's distfiles appear to be failing everywhere, due to SSL cert chain errors.

Here's one example, for the Big Sur ARM mirror job:

​https://build.macports.org/builders/jobs-mirror/builds/339899/steps/mirror/logs/stdio

--->  Attempting to fetch meme-5.4.1.tar.gz from https://meme-suite.org/meme/meme-software/5.4.1
Error: Failed to mirror memesuite: SSL certificate problem: Invalid certificate chain
Error: See /opt/local/var/buildmaster/build/prefix/var/macports/logs/_opt_local_var_buildworker_jobs_jobs-mirror_build_ports_science_memesuite/memesuite/main.log for details.

As a side-effect of the mirror failure, the buildbots attempt to fetch the distfiles from upstream. But this fails on 10.11 and earlier, with the same SSL issue:

​https://build.macports.org/builders/ports-10.11_x86_64-builder/builds/163022/steps/install-port/logs/stdio

--->  Attempting to fetch meme-5.4.1.tar.gz from https://meme-suite.org/meme/meme-software/5.4.1
Error: Failed to fetch memesuite: SSL certificate problem: Invalid certificate chain

​https://ports.macports.org/port/memesuite/builds/

[ryandesign (Ryan Carsten Schmidt)]

Sure. Add a master_sites to the port that has less-restictive SSL settings.

[mascguy (Christopher Nielsen)]

Replying to ryandesign:

Sure. Add a master_sites to the port that has less-restictive SSL settings.

If the SSL on the upstream site is "too restrictive," why do fetches succeed within the build jobs (at least for 10.12 and later), but not for the mirror processes?

[mascguy (Christopher Nielsen)]

Replying to mascguy:

Replying to ryandesign:

Sure. Add a master_sites to the port that has less-restictive SSL settings.

If the SSL on the upstream site is "too restrictive," why do fetches succeed within the build jobs (at least for 10.12 and later), but not for the mirror processes?

FYI, I spent a few minutes looking for mirrors of upstream, without finding any obvious alternatives. But didn't spend much time on it, so there's a good chance that there's something else out there.

But if we ultimately find that there isn't another site, are there any workarounds - even if less-than-ideal - which we might want to employ for this port?

[ryandesign (Ryan Carsten Schmidt)]

Replying to mascguy:

If the SSL on the upstream site is "too restrictive," why do fetches succeed within the build jobs (at least for 10.12 and later), but not for the mirror processes?

Because the mirror process happens on a machine running 10.11.

Replying to mascguy:

But if we ultimately find that there isn't another site, are there any workarounds - even if less-than-ideal - which we might want to employ for this port?

The workaround would be for me to manually fetch the file and put it on the server. I can do that in an emergency but I don't want to sign up for that duty long-term for each port update.

[ryandesign (Ryan Carsten Schmidt)]

I didn't see another source for it either. I mirrored it manually.

[ryandesign (Ryan Carsten Schmidt)]

I mirrored meme-5.5.1.tar.gz manually.

[ryandesign (Ryan Carsten Schmidt)]

I mirrored meme-5.5.2.tar.gz and meme-5.5.3.tar.gz manually.