pypi import certs issues

pypi import certs issues

[c4droid]

Hi, Guix!

on commit dc5430c9dc20ee53441995d9a89a90b0a86aeed3 pypi import has
issues:

Backtrace:
In ice-9/eval.scm:
    619:8 19 (_ #(#(#<directory (guile-user) 7fb1cb718c80>)))
In guix/ui.scm:
   2300:7 18 (run-guix . _)
  2263:10 17 (run-guix-command _ . _)
In guix/scripts/import.scm:
    89:11 16 (guix-import . _)
In ice-9/boot-9.scm:
  1752:10 15 (with-exception-handler _ _ #:unwind? _ # _)
In guix/scripts/import/pypi.scm:
    97:21 14 (_)
In guix/import/utils.scm:
   638:27 13 (recursive-import "pwntools" #:repo->guix-package _ # . #)
   630:33 12 (lookup-node "pwntools" #f)
In guix/memoization.scm:
     98:0 11 (mproc "pwntools" #:version #f #:repo->guix-package #<…> …)
In unknown file:
          10 (_ #<procedure 7fb1c7d05a20 at guix/memoization.scm:17…> …)
In guix/import/pypi.scm:
   495:21  9 (_ "pwntools" #:version _)
   126:10  8 (pypi-fetch _)
In ice-9/exceptions.scm:
   406:15  7 (json-fetch _ #:http-fetch _ #:headers _)
In ice-9/boot-9.scm:
  1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
In guix/import/json.scm:
    53:19  5 (_)
In guix/http-client.scm:
   107:28  4 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
In guix/build/download.scm:
    468:4  3 (open-connection-for-uri _ #:timeout _ # _)
    360:6  2 (tls-wrap #<closed: file 7fb1c7a3ce00> _ # _)
In ice-9/boot-9.scm:
  1685:16  1 (raise-exception _ #:continuable? _)
  1683:16  0 (raise-exception _ #:continuable? _)

ice-9/boot-9.scm:1683:16: In procedure raise-exception:
X.509 certificate of 'pypi.org' could not be verified:
  revocation-data-superseded
  invalid

I found a old discuss in
https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00247.html,
but set SSL_CERTS_DIR to /etc/ssl/certs don't working.

The environment variable for SSL:
GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt
SSL_CERT_DIR=/run/current-system/profile/etc/ssl/certs
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

Re: pypi import certs issues

[Maxim Cournoyer]

Hi,

c4droid <c4droid@foxmail.com> writes:

> Hi, Guix!
>
> on commit dc5430c9dc20ee53441995d9a89a90b0a86aeed3 pypi import has
> issues:
>
> Backtrace:
> In ice-9/eval.scm:
>     619:8 19 (_ #(#(#<directory (guile-user) 7fb1cb718c80>)))
> In guix/ui.scm:
>    2300:7 18 (run-guix . _)
>   2263:10 17 (run-guix-command _ . _)
> In guix/scripts/import.scm:
>     89:11 16 (guix-import . _)
> In ice-9/boot-9.scm:
>   1752:10 15 (with-exception-handler _ _ #:unwind? _ # _)
> In guix/scripts/import/pypi.scm:
>     97:21 14 (_)
> In guix/import/utils.scm:
>    638:27 13 (recursive-import "pwntools" #:repo->guix-package _ # . #)
>    630:33 12 (lookup-node "pwntools" #f)
> In guix/memoization.scm:
>      98:0 11 (mproc "pwntools" #:version #f #:repo->guix-package #<…> …)
> In unknown file:
>           10 (_ #<procedure 7fb1c7d05a20 at guix/memoization.scm:17…> …)
> In guix/import/pypi.scm:
>    495:21  9 (_ "pwntools" #:version _)
>    126:10  8 (pypi-fetch _)
> In ice-9/exceptions.scm:
>    406:15  7 (json-fetch _ #:http-fetch _ #:headers _)
> In ice-9/boot-9.scm:
>   1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
> In guix/import/json.scm:
>     53:19  5 (_)
> In guix/http-client.scm:
>    107:28  4 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
> In guix/build/download.scm:
>     468:4  3 (open-connection-for-uri _ #:timeout _ # _)
>     360:6  2 (tls-wrap #<closed: file 7fb1c7a3ce00> _ # _)
> In ice-9/boot-9.scm:
>   1685:16  1 (raise-exception _ #:continuable? _)
>   1683:16  0 (raise-exception _ #:continuable? _)
>
> ice-9/boot-9.scm:1683:16: In procedure raise-exception:
> X.509 certificate of 'pypi.org' could not be verified:
>   revocation-data-superseded
>   invalid
>
> I found a old discuss in
> https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00247.html,
> but set SSL_CERTS_DIR to /etc/ssl/certs don't working.

[...]

Do you have nss-certs installed in your operating system declaration (on
Guix System) ?

Not sure if it could help, but I just updated nss-certs to 3.88.1, up
from 3.85, so pulling and reconfiguring your system may help.

-- 
Thanks,
Maxim

Re: pypi import certs issues

[c4droid]

On Sun, May 07, 2023 at 09:18:25PM -0400, Maxim Cournoyer wrote:
Hi, Maxim

> Hi,
> 
> c4droid <c4droid@foxmail.com> writes:
> 
> > Hi, Guix!
> >
> > on commit dc5430c9dc20ee53441995d9a89a90b0a86aeed3 pypi import has
> > issues:
> >
> > Backtrace:
> > In ice-9/eval.scm:
> >     619:8 19 (_ #(#(#<directory (guile-user) 7fb1cb718c80>)))
> > In guix/ui.scm:
> >    2300:7 18 (run-guix . _)
> >   2263:10 17 (run-guix-command _ . _)
> > In guix/scripts/import.scm:
> >     89:11 16 (guix-import . _)
> > In ice-9/boot-9.scm:
> >   1752:10 15 (with-exception-handler _ _ #:unwind? _ # _)
> > In guix/scripts/import/pypi.scm:
> >     97:21 14 (_)
> > In guix/import/utils.scm:
> >    638:27 13 (recursive-import "pwntools" #:repo->guix-package _ # . #)
> >    630:33 12 (lookup-node "pwntools" #f)
> > In guix/memoization.scm:
> >      98:0 11 (mproc "pwntools" #:version #f #:repo->guix-package #<…> …)
> > In unknown file:
> >           10 (_ #<procedure 7fb1c7d05a20 at guix/memoization.scm:17…> …)
> > In guix/import/pypi.scm:
> >    495:21  9 (_ "pwntools" #:version _)
> >    126:10  8 (pypi-fetch _)
> > In ice-9/exceptions.scm:
> >    406:15  7 (json-fetch _ #:http-fetch _ #:headers _)
> > In ice-9/boot-9.scm:
> >   1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
> > In guix/import/json.scm:
> >     53:19  5 (_)
> > In guix/http-client.scm:
> >    107:28  4 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
> > In guix/build/download.scm:
> >     468:4  3 (open-connection-for-uri _ #:timeout _ # _)
> >     360:6  2 (tls-wrap #<closed: file 7fb1c7a3ce00> _ # _)
> > In ice-9/boot-9.scm:
> >   1685:16  1 (raise-exception _ #:continuable? _)
> >   1683:16  0 (raise-exception _ #:continuable? _)
> >
> > ice-9/boot-9.scm:1683:16: In procedure raise-exception:
> > X.509 certificate of 'pypi.org' could not be verified:
> >   revocation-data-superseded
> >   invalid
> >
> > I found a old discuss in
> > https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00247.html,
> > but set SSL_CERTS_DIR to /etc/ssl/certs don't working.
> 
> [...]
> 
> Do you have nss-certs installed in your operating system declaration (on
> Guix System) ?

I installed nss-certs on my operating-system declaration.

> 
> Not sure if it could help, but I just updated nss-certs to 3.88.1, up
> from 3.85, so pulling and reconfiguring your system may help.

Hope it can be use for me, I'll update my guix channel and reconfiguring system then running guix
import pypi again.

> 
> -- 
> Thanks,
> Maxim
\0

Re: pypi import certs issues

[c4droid]

Hi, Maxim

On Sun, May 07, 2023 at 09:18:25PM -0400, Maxim Cournoyer wrote:
> Hi,
> 
> c4droid <c4droid@foxmail.com> writes:
> 
> > Hi, Guix!
> >
> > on commit dc5430c9dc20ee53441995d9a89a90b0a86aeed3 pypi import has
> > issues:
> >
> > Backtrace:
> > In ice-9/eval.scm:
> >     619:8 19 (_ #(#(#<directory (guile-user) 7fb1cb718c80>)))
> > In guix/ui.scm:
> >    2300:7 18 (run-guix . _)
> >   2263:10 17 (run-guix-command _ . _)
> > In guix/scripts/import.scm:
> >     89:11 16 (guix-import . _)
> > In ice-9/boot-9.scm:
> >   1752:10 15 (with-exception-handler _ _ #:unwind? _ # _)
> > In guix/scripts/import/pypi.scm:
> >     97:21 14 (_)
> > In guix/import/utils.scm:
> >    638:27 13 (recursive-import "pwntools" #:repo->guix-package _ # . #)
> >    630:33 12 (lookup-node "pwntools" #f)
> > In guix/memoization.scm:
> >      98:0 11 (mproc "pwntools" #:version #f #:repo->guix-package #<…> …)
> > In unknown file:
> >           10 (_ #<procedure 7fb1c7d05a20 at guix/memoization.scm:17…> …)
> > In guix/import/pypi.scm:
> >    495:21  9 (_ "pwntools" #:version _)
> >    126:10  8 (pypi-fetch _)
> > In ice-9/exceptions.scm:
> >    406:15  7 (json-fetch _ #:http-fetch _ #:headers _)
> > In ice-9/boot-9.scm:
> >   1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
> > In guix/import/json.scm:
> >     53:19  5 (_)
> > In guix/http-client.scm:
> >    107:28  4 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
> > In guix/build/download.scm:
> >     468:4  3 (open-connection-for-uri _ #:timeout _ # _)
> >     360:6  2 (tls-wrap #<closed: file 7fb1c7a3ce00> _ # _)
> > In ice-9/boot-9.scm:
> >   1685:16  1 (raise-exception _ #:continuable? _)
> >   1683:16  0 (raise-exception _ #:continuable? _)
> >
> > ice-9/boot-9.scm:1683:16: In procedure raise-exception:
> > X.509 certificate of 'pypi.org' could not be verified:
> >   revocation-data-superseded
> >   invalid
> >
> > I found a old discuss in
> > https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00247.html,
> > but set SSL_CERTS_DIR to /etc/ssl/certs don't working.
> 
> [...]
> 
> Do you have nss-certs installed in your operating system declaration (on
> Guix System) ?
> 
> Not sure if it could help, but I just updated nss-certs to 3.88.1, up
> from 3.85, so pulling and reconfiguring your system may help.

I tried to update nss-certs, after reconfiguring system still report this.

> 
> -- 
> Thanks,
> Maxim

Re: pypi import certs issues

[James R. Haigh (+ML.GNU.Guix subaddress)]

Hi c4droid,

At Z+0800=2023-05-08Mon23:55:06, c4droid sent:
> […]

You appear to have sent an email from the future.  That time is currently over 4 hours into the future.  Note that certificate validation relies upon correct clock synchronisation, so without even looking into the details of what is going on with Guix, simply correcting your system clock time may in fact resolve your issue afterall.

	Looking at the Received headers on your email, I notice that your email was in fact sent a few hours in the past:–

Mon, 08 May 2023 15:55:05 +0800
Mon, 08 May 2023 03:55:26 -0400
Mon, 08 May 2023 03:55:29 -0400
Mon, 08 May 2023 03:55:31 -0400
Mon, 08 May 2023 09:55:59 +0200
Mon, 08 May 2023 09:56:02 +0200

These are all broadly the same time: UTC+0=07:55.  Therefore, at the time of sending, the timestamp in the Date header of your email was precisely 8 hours into the future.  Its timezone is also UTC+8, which indicates that you may have actually confused local time with system time when setting the time.  If you set your system time to UTC+8 and then on top of that your local time adds another 8 hours, at UTC+0=07:55, UTC+8+8=23:55.  That seems like a plausible explanation.

	Furthermore, a common cause for system time being set to local time is if you dual-boot with another operating system that does not respect the system time being independent of local time.  I have heard that this is a common problem for those who dual-boot with Microsoft Windows – at least it was in the days of XP.  I don't know whether it is still a common issue in newer versions, but if you have such a dual-boot and this keeps happening, that would be a good first place to investigate to try to fix the issue.

Kind regards,
James.
-- 
Wealth doesn't bring happiness, but poverty brings sadness.
Sent from Debian with Claws Mail, using email subaddressing as an alternative to error-prone heuristical spam filtering.

Re: pypi import certs issues

[c4droid]

Hi, James.

On Mon, May 08, 2023 at 12:55:57PM +0100, James R. Haigh (+ML.GNU.Guix subaddress) wrote:
> Hi c4droid,
> 
> At Z+0800=2023-05-08Mon23:55:06, c4droid sent:
> > […]
> 

Thanks for the hint, I just checked my system services noticed the ntp is not install on my system,
after set it up, everything is normal.

> You appear to have sent an email from the future.  That time is currently over 4 hours into the future.  Note that certificate validation relies upon correct clock synchronisation, so without even looking into the details of what is going on with Guix, simply correcting your system clock time may in fact resolve your issue afterall.
> 
> 	Looking at the Received headers on your email, I notice that your email was in fact sent a few hours in the past:–
> 
> Mon, 08 May 2023 15:55:05 +0800
> Mon, 08 May 2023 03:55:26 -0400
> Mon, 08 May 2023 03:55:29 -0400
> Mon, 08 May 2023 03:55:31 -0400
> Mon, 08 May 2023 09:55:59 +0200
> Mon, 08 May 2023 09:56:02 +0200
> 
> These are all broadly the same time: UTC+0=07:55.  Therefore, at the time of sending, the timestamp in the Date header of your email was precisely 8 hours into the future.  Its timezone is also UTC+8, which indicates that you may have actually confused local time with system time when setting the time.  If you set your system time to UTC+8 and then on top of that your local time adds another 8 hours, at UTC+0=07:55, UTC+8+8=23:55.  That seems like a plausible explanation.
> 
> 	Furthermore, a common cause for system time being set to local time is if you dual-boot with another operating system that does not respect the system time being independent of local time.  I have heard that this is a common problem for those who dual-boot with Microsoft Windows – at least it was in the days of XP.  I don't know whether it is still a common issue in newer versions, but if you have such a dual-boot and this keeps happening, that would be a good first place to investigate to try to fix the issue.

BTW, thanks for the answer. :)

> 
> Kind regards,
> James.
> -- 
> Wealth doesn't bring happiness, but poverty brings sadness.
> Sent from Debian with Claws Mail, using email subaddressing as an alternative to error-prone heuristical spam filtering.

Re: pypi import certs issues caused by clock synchronisation issue [fixed]

[James R. Haigh (+ML.GNU.Guix subaddress)]

Hi c4droid,

At Z+0800=2023-05-09Tue08:55:12, c4droid sent:
> Thanks for the hint, I just checked my system services noticed the ntp is not install on my system, after set it up, everything is normal.

Everything being normal, I guess that that means that your cert problems also went away. :-)

Kind regards,
James.
-- 
Wealth doesn't bring happiness, but poverty brings sadness.
Sent from Debian with Claws Mail, using email subaddressing as an alternative to error-prone heuristical spam filtering.

Re: pypi import certs issues caused by clock synchronisation issue [fixed]

[c4droid]

Yep, problems resolved. :)

On Tue, May 09, 2023 at 02:51:53PM +0100, James R. Haigh (+ML.GNU.Guix subaddress) wrote:
> Hi c4droid,
> 
> At Z+0800=2023-05-09Tue08:55:12, c4droid sent:
> > Thanks for the hint, I just checked my system services noticed the ntp is not install on my system, after set it up, everything is normal.
> 
> Everything being normal, I guess that that means that your cert problems also went away. :-)
> 
> Kind regards,
> James.
> -- 
> Wealth doesn't bring happiness, but poverty brings sadness.
> Sent from Debian with Claws Mail, using email subaddressing as an alternative to error-prone heuristical spam filtering.

Re: pypi import certs issues

[Maxim Cournoyer]

Hi,

c4droid <c4droid@foxmail.com> writes:

> Hi, Maxim
>
> On Sun, May 07, 2023 at 09:18:25PM -0400, Maxim Cournoyer wrote:
>> Hi,
>> 
>> c4droid <c4droid@foxmail.com> writes:
>> 
>> > Hi, Guix!
>> >
>> > on commit dc5430c9dc20ee53441995d9a89a90b0a86aeed3 pypi import has
>> > issues:
>> >
>> > Backtrace:
>> > In ice-9/eval.scm:
>> >     619:8 19 (_ #(#(#<directory (guile-user) 7fb1cb718c80>)))
>> > In guix/ui.scm:
>> >    2300:7 18 (run-guix . _)
>> >   2263:10 17 (run-guix-command _ . _)
>> > In guix/scripts/import.scm:
>> >     89:11 16 (guix-import . _)
>> > In ice-9/boot-9.scm:
>> >   1752:10 15 (with-exception-handler _ _ #:unwind? _ # _)
>> > In guix/scripts/import/pypi.scm:
>> >     97:21 14 (_)
>> > In guix/import/utils.scm:
>> >    638:27 13 (recursive-import "pwntools" #:repo->guix-package _ # . #)
>> >    630:33 12 (lookup-node "pwntools" #f)
>> > In guix/memoization.scm:
>> >      98:0 11 (mproc "pwntools" #:version #f #:repo->guix-package #<…> …)
>> > In unknown file:
>> >           10 (_ #<procedure 7fb1c7d05a20 at guix/memoization.scm:17…> …)
>> > In guix/import/pypi.scm:
>> >    495:21  9 (_ "pwntools" #:version _)
>> >    126:10  8 (pypi-fetch _)
>> > In ice-9/exceptions.scm:
>> >    406:15  7 (json-fetch _ #:http-fetch _ #:headers _)
>> > In ice-9/boot-9.scm:
>> >   1752:10  6 (with-exception-handler _ _ #:unwind? _ # _)
>> > In guix/import/json.scm:
>> >     53:19  5 (_)
>> > In guix/http-client.scm:
>> >    107:28  4 (http-fetch _ #:port _ #:text? _ #:buffered? _ # _ # _ # …)
>> > In guix/build/download.scm:
>> >     468:4  3 (open-connection-for-uri _ #:timeout _ # _)
>> >     360:6  2 (tls-wrap #<closed: file 7fb1c7a3ce00> _ # _)
>> > In ice-9/boot-9.scm:
>> >   1685:16  1 (raise-exception _ #:continuable? _)
>> >   1683:16  0 (raise-exception _ #:continuable? _)
>> >
>> > ice-9/boot-9.scm:1683:16: In procedure raise-exception:
>> > X.509 certificate of 'pypi.org' could not be verified:
>> >   revocation-data-superseded
>> >   invalid
>> >
>> > I found a old discuss in
>> > https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00247.html,
>> > but set SSL_CERTS_DIR to /etc/ssl/certs don't working.
>> 
>> [...]
>> 
>> Do you have nss-certs installed in your operating system declaration (on
>> Guix System) ?
>> 
>> Not sure if it could help, but I just updated nss-certs to 3.88.1, up
>> from 3.85, so pulling and reconfiguring your system may help.
>
> I tried to update nss-certs, after reconfiguring system still report this.

At least we've ironed out that.  I'm out of ideas for now :-/.
Hopefully a TLS certs expert jumps in.

-- 
Thanks,
Maxim