Re: [chromium-dev] Re: gclient sync error

[Primiano Tucci]

Ouch, that sounds like that.

+infra-dev: can somebody please take a look here?

Out of curiosity, why do we have all that boilerplate just to download stuff from GCS. That should be just a curl of

https://storage.googleapis.com/BUCKET_NAME/OBJECT_ID

Why do we need to invoke gsutil at all for the download part?

On Wed, Dec 17, 2014 at 2:43 PM, Raphael Kubo da Costa <raphael.ku...@intel.com> wrote:

Primiano Tucci <prim...@chromium.org> writes:

> Ok I think this is your problem: depot_tools is not in front of your PATH,
> and /usr/bin/gsutil takes precedence.

Actually, I think this is caused by depot_tools r293413, which switched
download_from_google_storage to a vanilla gsutils 4.7.

For people behind corporate proxies, the first thing that needs to be
changed is the usage of urllib instead of urllib2 in gsutils.py (this
has happened before, urllib does not play well with proxies). I have
submitted https://codereview.chromium.org/809053002/ to fix this.

In addition to that, I've also had problems with boto and my proxy: the
Chromium hooks call download_from_google_storage with --no_auth, which
sets BOTO_CONFIG to ''. However, gslib.util.GetNewHttp() uses the boto
configuration to set up the proxy information, so the connections made
by gsutils all time out because the proxy information is not being set.
If setting up boto is now needed, I think we're back to bug 318478.

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
    http://groups.google.com/a/chromium.org/group/chromium-dev

[Aaron Gable]

+infr...@chromium.org​ +Ryan Tseng​

Ryan, can you explain the use of gsutil instead of https for downloading publicly accessible items? My guess is that it just simplifies things to be a single code path -- everything gets downloaded via gsutil -- rather than having to know or check which objects are public and which aren't and go through different paths for each.

Aaron

On Fri Dec 19 2014 at 12:28:25 AM cyan <cyang...@gmail.com> wrote:

Looks this issue still exist from my side, the same behavior as before.

On Thursday, December 18, 2014 7:14:39 PM UTC+8, Primiano Tucci wrote:

I landed https://codereview.chromium.org/809053002/ manually.

It should work now. Let us know if it doesn't.

On Thu, Dec 18, 2014 at 9:05 AM, cyan <cyang...@gmail.com> wrote:

Meet the exact same issue here, please kindly help to give a fix. :)

On Wednesday, December 17, 2014 6:30:11 PM UTC+8, Shreeram Kushwaha wrote:

Hello All,

I am getting below error while I am trying to execute gclient sync on linux

 File gs://chromium-gn/1088992877b3a13f25b61c8fc18e25296d8cab33 for src/buildtools/linux32/gn does not exist.
 0> File gs://chromium-gn/1088992877b3a13f25b61c8fc18e25296d8cab33 for src/buildtools/linux32/gn does not exist, skipping.
> Error: Command download_from_google_storage --no_resume --platform=linux* --no_auth --bucket chromium-gn -s src/buildtools/linux32/gn.sha1 returned non-zero exit status 1 

Can anyone have any leads on this??

Thanks

Shreeram

[Ryan Tseng]

Correct.  Gsutil is used because it takes care of authentication.  Its silly to reimplement gsutil just for public objects (especially since none of the default python libraries actually does https correctly anyways), and it still wouldn't solve the issue for the auth behind a proxy case.

Its unfortunate the gsutil doesn't respect http_proxy, but for the sake of having an update-to-date gsutil we've committed to using a vanilla version instead of forking and being stuck with an ancient version.  This issue probably has to be taken up with the gsutil team, or we have to monkey patch our version (ugh).

[Yuri Wiitala]

Was this ever fixed?  `gclient sync` hangs forever on this step:

________ running 'download_from_google_storage --no_resume --platform=win32 --no_auth --bucket chromium-gn -s src/buildtools/win/gn.exe.sha1' in '/cygdrive/d/src/chromium'

I have no ~/.boto* files.

Please help: I can't do any build/test work on my Windows machine now.

[Ryan Tseng]

Are you behind a proxy?  I just want to know if this is the same issue the intel guys are having

[Yuri Wiitala]

Not that I'm aware of.  Though, this is a machine on the Google corp network.

[Yuri Wiitala]

I was able to get src/buildtools/win/gn.exe by manually running `gsutil cp gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbff063e1313350 src/buildtools/win/gn.exe`

Then, `gclient sync` halted on the clang-format.exe download.  So, I ran `gsutil cp gs://chromium-clang-format/18d8ed72ad68fadf95b25a720056df018884fa8e src/buildtools/win/clang-format.exe` to get that.

All said, the problem isn't really fixed since I'll probably have to run `gsutil cp` by hand the next time a binary is rolled.  Let me know if I can do something to help you diagnose/RCR the problem.

[Jay]

   I met smililar issue on Windows. Does anyone have solutoins? BTW, I used proxy.

  The workaround does not work for me. When I tired "gsutil cp gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbff063e1313350 src/buildtools/win/gn.exe", I got output: "'gsutil' is not recognized as an internal or external command, operable program or batch file." issue."

  When I tired "native_client\buildbot\gsutil.sh cp gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbff063e1313350 src/buildtools/win/gn.exe", I got output: "Welcome to Git (version 1.9.4-preview20140929)

Run 'git help git' to display the help index.Run 'git help <command>' to display help for specific commands.

+ '[' xmsys = xcygwin ']'
+ gsutil=/b/build/scripts/slave/gsutil
+ /b/build/scripts/slave/gsutil cp gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbf
f063e1313350 src/buildtools/win/gn.exe"

[Shreeram Kushwaha]

Its working fine after merging of https://codereview.chromium.org/809053002/.

Could you please update your depot tools to the latest?

[Feng, Jay]

Thanks. However it still does not work for me.

Just tried to update my depot tools to latest:

”git clone https://chromium.googlesource.com/chromium/tools/depot_tools “

“gclient”

“gclient sync” and I got:

“________ running 'download_from_google_storage --no_resume --platform=win32 --no

_auth --bucket chromium-gn -s src/buildtools/win/gn.exe.sha1' in 'C:\Users\xfeng

10\Perforce\chromium\src'

0> File gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbff063e1313350 for src/buildt

ools/win/gn.exe does not exist, skipping.

File gs://chromium-gn/7a8952c86c3b571246b7dd1dbcbff063e1313350 for src/buildtool

s/win/gn.exe does not exist.

Error: Command download_from_google_storage --no_resume --platform=win32 --no_au

th --bucket chromium-gn -s src/buildtools/win/gn.exe.sha1 returned non-zero exit

status 1 in C:\Users\xfeng10\Perforce\chromium\src

Hook 'download_from_google_storage --no_resume --platform=win32 --no_auth --buck

et chromium-gn -s src/buildtools/win/gn.exe.sha1' took 331.98 secs”

To unsubscribe from this group and stop receiving emails from it, send an email to chromium-dev...@chromium.org.

[Shreeram Kushwaha]

Could you please check whether that patch is present or not?

Anyways this problem came on linux for me. Never faced this on windows.

[Feng, Jay]

Just checked https://codereview.chromium.org/809053002/ . The latest patches for file “gsutil.py” and file “tests/gsutil_test.py” were included.

Did you also use proxy on Linux?

 

Thanks,

Jay

[Shreeram Kushwaha]

Yes. I use proxy on Linux. As I m on my company's network.

 

------- Original Message -------

Sender : Feng, Jay<jay....@intel.com>

Date : Dec 31, 2014 12:09 (GMT+05:30)

Title : RE: [chromium-dev] Re: gclient sync error

Regards,

Shreeram Kushwaha

 

[Feng, Jay]

Then this issue should not be closed since it still happens on Windows.

[Raphael]

On Monday, 29 December 2014 23:36:02 UTC+2, Ryan Tseng wrote:

Correct.  Gsutil is used because it takes care of authentication.  Its silly to reimplement gsutil just for public objects (especially since none of the default python libraries actually does https correctly anyways), and it still wouldn't solve the issue for the auth behind a proxy case.

Its unfortunate the gsutil doesn't respect http_proxy, but for the sake of having an update-to-date gsutil we've committed to using a vanilla version instead of forking and being stuck with an ancient version.  This issue probably has to be taken up with the gsutil team, or we have to monkey patch our version (ugh).

I've sent https://github.com/GoogleCloudPlatform/gsutil/pull/240 to address this in gsutil.

[Jay]

Hi All,

   I tired all workarounds/fixes and the following  method works for me on windows 8.1 behind proxy. Here it is:

   In folder "depot_tools": 

# git chekout 4fa73b8ca6899bc69577932b80145a6bf07e4424.

# set DEPOT_TOOLS_UPDATE=0

Thanks!

[Xie, William]

Hi,

Any update on this sync issue?

 

William

[Primiano Tucci]

Raphael has a CL under review here which should fix it

https://codereview.chromium.org/841823002

Can you maybe try it locally and give some early feedback ?

--
You received this message because you are subscribed to the Google Groups "infra-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to infra-dev+...@chromium.org.
To post to this group, send email to infr...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/infra-dev/D95B070D38087A47ADCD55E64CDD74BD0E9DE2B7%40SHSMSX101.ccr.corp.intel.com.

[Xie, William]

It works for me.

Thank you for the fix.

 

William

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-dev

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-dev

To unsubscribe from this group and stop receiving emails from it, send an email to chromium-dev...@chromium.org.

[Raphael]

So in case you haven't been following crbug.com/443523, mmoss landed his version of a fix for the gclient sync issue that had been plaguing proxy users since early December.

If you are behind a network proxy, create a Boto file somewhere with the following contents:

[Boto]

proxy = myproxy.example.com

proxy_port = 1234

Optionally, you can also set proxy_user and proxy_pass.

After that, set the NO_AUTH_BOTO_CONFIG environment variable to /path/to/your/boto/file. gclient sync (actually, download_from_google_storage) should work fine after that.

The solution that we've landed in depot_tools is a band-aid one; according to the last posts in https://github.com/GoogleCloudPlatform/gsutil/issues/241, the gsutil people finally decided to implement proper support for proxy environment variables, but we still don't know when version 4.8 will be released -- once that happens, we can switch to it and remove the workaround in depot_tools.

[Meghana Prashanth]

I am seeing this issue only while running the command through Jenkins. Sync proceeds fine when run manually on the machine.Jenkins server connects to the mac/linux slave via SSH.Also, the two hosts are only one hop away from each other and there isn't any firewall/proxy between them. The traffic out to internet takes normal corporate internet path via corporate internet firewall from both the hosts.

Would anyone here help me with understanding why I am seeing this failure only in case of Jenkins.

[Li Yin]

I was trying this workaround, but unfortunately, it still failed with different failed output.

By the way. I am not using http proxy.

The failed information can be found:

________ running 'download_from_google_storage --no_resume --platform=linux* --bucket chromium-gn -s src/buildtools/linux32/gn.sha1' in '/home/liyin/projects/chromium'

Failure: Host storage.googleapis.com returned an invalid certificate (remote hostname "storage.googleapis.com" does not match certificate): {'notAfter': 'Apr 29 00:00:00 2015 GMT', 'subjectAltName': (('DNS', 'www.google.com'),), 'subject': ((('countryName', u'US'),), (('stateOrProvinceName', u'California'),), (('localityName', u'Mountain View'),), (('organizationName', u'Google Inc'),), (('commonName', u'www.google.com'),))}.

在 2015年1月4日星期日 UTC+8上午10:27:08，Jay写道：

[Primiano Tucci]

Hmm it feels like something in your path is mangling the storage.googleapis.com certificate.

Can I ask you what is the output of the following command?

$ openssl s_client -connect storage.googleapis.com:443 < /dev/null

--

You received this message because you are subscribed to the Google Groups "infra-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to infra-dev+...@chromium.org.
To post to this group, send email to infr...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/infra-dev/e37b24e6-05d6-4b90-8aeb-361fc40cceb1%40chromium.org.

[Li Yin]

CONNECTED(00000003)

depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA

verify error:num=20:unable to get local issuer certificate

verify return:0

---

Certificate chain

 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com

   i:/C=US/O=Google Inc/CN=Google Internet Authority G2

 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2

   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

---

Server certificate

-----BEGIN CERTIFICATE-----

*********

-----END CERTIFICATE-----

subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com

issuer=/C=US/O=Google Inc/CN=Google Internet Authority G2

---

No client certificate CA names sent

---

SSL handshake has read 3741 bytes and written 363 bytes

---

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-SHA

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

    Protocol  : TLSv1.1

    Cipher    : ECDHE-RSA-AES128-SHA

*******

Start Time: 1423216860

    Timeout   : 300 (sec)

    Verify return code: 20 (unable to get local issuer certificate)

---

DONE

Is it okay to get the root cause? Thanks in advance.

在 2015年2月6日星期五 UTC+8下午5:52:58，Primiano Tucci写道：

[Primiano Tucci]

Actually the interesting part was the one you omitted between -----BEGIN CERTIFICATE---- and ---END CERTIFICATE---

Furthermore my command line argument was not correct (didn't think about SNI)

Can you retry with openssl s_client -connect storage.googleapis.com:443 -servername storage.googleapis.com < /dev/null

Also, it is possible that the problem here is not the certificate itself but your version of python (or related libraries) too old.

Can you also tell us what is the output of python --version

Also, can you make sure that depot_tools are in from of your PATH (i.e. what is the output of echo $PATH)?

It is possible that you have an older version of gsutil (or dependent library) in your path which is outdated.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/infra-dev/6b888e2b-2220-4248-a3bb-a6385970cb2f%40chromium.org.

[Li Yin]

CONNECTED(00000003)

depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA

verify error:num=20:unable to get local issuer certificate

verify return:0

---

Certificate chain

 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googleusercontent.com

   i:/C=US/O=Google Inc/CN=Google Internet Authority G2

 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2

   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA

   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIFfjCCBGagAwIBAgIIOyomGdqEokAwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE

BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl

cm5ldCBBdXRob3JpdHkgRzIwHhcNMTUwMTI5MTIyNTQzWhcNMTUwNDI5MDAwMDAw

WjBxMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN

TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEgMB4GA1UEAwwXKi5n

b29nbGV1c2VyY29udGVudC5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARX

/Yr7mwIN342DqBxgrcJKFF4OZeW8C8imgRvTj+gZuoIwzVPMZ6zux/5+Ha8wtJll

CcGHUmjoDOBUOrIUIZV/o4IDCzCCAwcwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG

AQUFBwMCMIIB1AYDVR0RBIIByzCCAceCFyouZ29vZ2xldXNlcmNvbnRlbnQuY29t

gg4qLmJsb2dzcG90LmNvbYIRKi5icC5ibG9nc3BvdC5jb22CIiouY29tbW9uZGF0

YXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb22CHCouZG91YmxlY2xpY2t1c2VyY29udGVu

dC5jb22CCyouZ2dwaHQuY29tghEqLmdvb2dsZWRyaXZlLmNvbYIXKi5nb29nbGVz

eW5kaWNhdGlvbi5jb22CHyouc2FuZGJveC5nb29nbGV1c2VyY29udGVudC5jb22C

GCouc3RvcmFnZS5nb29nbGVhcGlzLmNvbYIMYmxvZ3Nwb3QuY29tgg9icC5ibG9n

c3BvdC5jb22CIGNvbW1vbmRhdGFzdG9yYWdlLmdvb2dsZWFwaXMuY29tghpkb3Vi

bGVjbGlja3VzZXJjb250ZW50LmNvbYIJZ2dwaHQuY29tgg9nb29nbGVkcml2ZS5j

b22CFWdvb2dsZXVzZXJjb250ZW50LmNvbYIrc3RhdGljLnBhbm9yYW1pby5jb20u

c3RvcmFnZS5nb29nbGVhcGlzLmNvbYIWc3RvcmFnZS5nb29nbGVhcGlzLmNvbTAL

BgNVHQ8EBAMCB4AwaAYIKwYBBQUHAQEEXDBaMCsGCCsGAQUFBzAChh9odHRwOi8v

cGtpLmdvb2dsZS5jb20vR0lBRzIuY3J0MCsGCCsGAQUFBzABhh9odHRwOi8vY2xp

ZW50czEuZ29vZ2xlLmNvbS9vY3NwMB0GA1UdDgQWBBTp9FbWQf43gmhFKLgp5SGq

4bitejAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFErdBhYbvPZotXb1gba7Yhq6

WoEvMBcGA1UdIAQQMA4wDAYKKwYBBAHWeQIFATAwBgNVHR8EKTAnMCWgI6Ahhh9o

dHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBBQUAA4IB

AQBhAZR8oiOV8rvxKueC/ycfHUitSjhlMiPV4zFvWHOh0DcoqLqvJgVHvm4xzPiT

Zey3xG6cunWVF4F5FQw4WFGPB4MRoWBJAuy7Mj+OrR+FiFtyHOwdg+x1dGcfVXOE

YAw7hLNj7v0ISxa5xLIHZdeOkb46xhLhMd/yF9sJRWpmr6CNFGRDH3Q6SJ8g6zRQ

Wgg8N+Y4UHYCKu+yAskzFbnSaR1nh+lHi5zrnTuaZNfc6QLrE0lApQffGyq1QUDr

3BRcAAMWODdZVwPjKTvrunZ/FovlKwCvbqwisZo6SkGrY0PHeHy3vp5bprWZ9CT/

w+JdjOcdb25dDp7St2kEHvc/

-----END CERTIFICATE-----

subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.googleusercontent.com

issuer=/C=US/O=Google Inc/CN=Google Internet Authority G2

---

No client certificate CA names sent

---

SSL handshake has read 3840 bytes and written 394 bytes

---

New, TLSv1/SSLv3, Cipher is ECDHE-ECDSA-AES128-SHA

Server public key is 256 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

    Protocol  : TLSv1.1

    Cipher    : ECDHE-ECDSA-AES128-SHA

    Session-ID: 66E6B2C483BDBBCAA9F1F078F2960C020D8ACDA86722497F7B9D8099ED3A4864

    Session-ID-ctx: 

    Master-Key: 10828DB303B43998028B0220A38B493C827970542CCE1D33E3B01EE05C26877880C98A7978D0D0E2AFEA8AB3E718000F

    Key-Arg   : None

    PSK identity: None

    PSK identity hint: None

    SRP username: None

    TLS session ticket lifetime hint: 100800 (seconds)

    TLS session ticket:

    0000 - f3 dc 33 1b bb 96 a2 f1-24 5c 79 e6 a1 0f d2 1a   ..3.....$\y.....

    0010 - 68 7a 36 b8 e7 d3 9d cc-98 8e 22 ae 1a b8 56 90   hz6......."...V.

    0020 - 0d 8a 85 5e c2 79 0b 26-4d 32 54 57 4d 4a 1b ef   ...^.y.&M2TWMJ..

    0030 - b4 57 88 51 a2 f7 94 76-2b fb e3 58 f1 28 c9 1f   .W.Q...v+..X.(..

    0040 - 67 3c 03 f4 da 2a 73 82-99 7a 0c 0f bb 9f 78 89   g<...*s..z....x.

    0050 - 5d 34 45 95 93 bc 87 ae-d4 f1 4b 1a f1 0a cb be   ]4E.......K.....

    0060 - 66 23 80 cf 27 88 ba fe-6d 31 86 0a 85 90 73 ab   f#..'...m1....s.

    0070 - 76 33 09 4f ea ce 26 b5-d9 a3 97 f9 10 48 d0 eb   v3.O..&......H..

    0080 - eb b6 02 ab 04 9c db ee-7a ed 6f c9 e1 b7 18 b6   ........z.o.....

    0090 - d5 77 b8 67 dd 0c 11 d3-39 41 47 c8 48 d9 08 3c   .w.g....9AG.H..<

    00a0 - 74 d7 57 f8 cb eb 19 05-cf 76 4f 97 af 73 6f 15   t.W......vO..so.

    00b0 - 9b ac c3 9e                                       ....

    Start Time: 1423221043

    Timeout   : 300 (sec)

    Verify return code: 20 (unable to get local issuer certificate)

---

DONE

Yes, the depot_tools is at the front of PATH. 

/home/liyin/projects/chromium/depot_tools:/home/liyin/projects/chromium/src/third_party/android_tools/sdk/tools:....

The version of python is Python 2.7.3

About gsutil library, the gsutil under depot_tools directory should be used. The output of "gsutil.py version" command:

gsutil version 3.25

checksum 3145f0d493fab7b140f4010874409273 (!= c9cffb512f467c0aa54880788b9ee6ca)

boto version 2.8.0-dev

python version 2.7.3 (default, Feb 27 2014, 19:58:35) 

[GCC 4.6.3]

config path: no config found

gsutil path: /home/liyin/projects/chromium/depot_tools/third_party/gsutil/gsutil

Thanks.

在 2015年2月6日星期五 UTC+8下午6:35:04，Primiano Tucci写道：

[Primiano Tucci]

The certificate seems right (I get the same one).

The version of gsutil / boto also (same here).

At this point it sounds like your system configuration doesn't support SNI (SSL server-name indication) and you receive the wrong cert form gsutil.

Which version of Linux are you running? What is the version of openssl?

If you run directly gsutil (From the same path), e.g.,

gsutil cp gs://chromium-gn/f62a6b6e14c39aa4e4bc2a19a2184877c9488e1e /tmp/test

does it suceed?

Any gsutil / python expert here? Does python 2.7 dynamically link openssl? 

It might be that your version of python / openssl doesn't support SNI and you fail to get the propert certificate through python)

Not sure if this helps, might be worth taking a look

https://stackoverflow.com/questions/18578439/using-requests-with-tls-doesnt-give-sni-support/18579484#18579484

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/infra-dev/698fe7ba-5cf2-47b5-b73c-7ed84a219dc6%40chromium.org.

[Li Yin]

I am using Ubuntu 12.04 64-bit. What about the chromium official building OS? Ubuntu 14?

The command "gsutil cp gs://chromium-gn/f62a6b6e14c39aa4e4bc2a19a2184877c9488e1e /tmp/test" got failed.

Failure: Host storage.googleapis.com returned an invalid certificate (remote hostname "storage.googleapis.com" does not match certificate): {'notAfter': 'Apr 29 00:00:00 2015 GMT', 'subjectAltName': (('DNS', 'www.google.com'),), 'subject': ((('countryName', u'US'),), (('stateOrProvinceName', u'California'),), (('localityName', u'Mountain View'),), (('organizationName', u'Google Inc'),), (('commonName', u'www.google.com'),))}.

Thanks.

在 2015年2月6日星期五 UTC+8下午7:31:50，Primiano Tucci写道：

The certificate seems right (I get the same one).

The version of gsutil / boto also (same here).

At this point it sounds like your system configuration doesn't support SNI (SSL server-name indication) and you receive the wrong cert form gsutil.

Which version of Linux are you running? What is the version of openssl?

If you run directly gsutil (From the same path), e.g.,

gsutil cp gs://chromium-gn/f62a6b6e14c39aa4e4bc2a19a2184877c9488e1e /tmp/test

does it suceed?

Any gsutil / python expert here? Does python 2.7 dynamically link openssl? 

It might be that your version of python / openssl doesn't support SNI and you fail to get the propert certificate through python)

Not sure if this helps, might be worth taking a look

https://stackoverflow.com/questions/18578439/using-requests-with-tls-doesnt-give-sni-support/18579484#18579484

You received this message because you are subscribed to the Google Groups "infra-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to infra-dev+...@chromium.org.
To post to this group, send email to infr...@chromium.org.

[Li Yin]

OpenSSL version: OpenSSL 1.0.1 14 Mar 2012

在 2015年2月6日星期五 UTC+8下午7:48:22，Li Yin写道：

[Primiano Tucci]

Hmm looking at [1] your problem might be just the version of python too old and not having the proper ca certs (or you / something you installed messed around with them).

Try to upgrade to a more recent version of python (2.7.6 here) or restore the original cacerts.txt.

[1] http://stackoverflow.com/questions/13899530/gae-sdk-1-7-4-and-invalidcertificateexception

--

You received this message because you are subscribed to the Google Groups "infra-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to infra-dev+...@chromium.org.
To post to this group, send email to infr...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/infra-dev/8769fa5a-2650-4229-a63a-dfd5bbed7eb1%40chromium.org.

[Adnan Ahmed]

Hello,

I am facing the same issue when trying to fetch on Emulab 

________ running 'download_from_google_storage --no_resume --platform=linux* --no_auth --bucket chromium-gn -s src/buildtools/linux32/gn.sha1' in '/users/lums204/quic/chr'

File gs://chromium-gn/2e23cfba3baf503b9f81d3365c4f09770ff48a9a for src/buildtools/linux32/gn does not exist.

0> File gs://chromium-gn/2e23cfba3baf503b9f81d3365c4f09770ff48a9a for src/buildtools/linux32/gn does not exist, skipping.