package manager woes on Windows 10?

[Shriram Krishnamurthi]

I have a student using Racket 7.8 on Windows 10 (v. 1909) who can't get a package to install that he needs to do homework. Does anyone else recognize this phenomenon? Thanks for any advice — none of us has Windows so we can't even reproduce this. He has restarted DrRacket, confirmed he can connect to the repo via his browser, tried several times (so it's not intermittent network outage), confirmed he's copying-and-pasting the URL.

It's probably something obvious that I'm just not spotting. Extra eyes would be much appreciated given that the clock's ticking on his homework!

The repo in question is

https://github.com/shriram/mystery-languages/

https://github.com/shriram/mystery-languages.git

Thanks!

Shriram

[Philip McGrath]

As a workaround, could he get the repository onto his filesystem, either with Git or by downloading a Zip file (https://github.com/shriram/mystery-languages/archive/master.zip), and install the local directory?

-Philip

--
You received this message because you are subscribed to the Google Groups "Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/9089ae6b-00e7-4620-bee0-eccad655fbf5n%40googlegroups.com.

[George Neuner]

From the error message, it looks like a firewall/proxy issue.

It definitely is not the package itself:  I'm still on Racket 7.7, but
it works for me.  I tried both with 64 and 32 bit BC on Win10 1909 - the
package and its dependencies install for me without errors  [but I don't
know how to test the install  8-)]

George

> Thanks!
> Shriram

[Shriram Krishnamurthi]

Thank you. Can you imagine why the proxy would affect DrRacket but not the Web browser?

[Shriram Krishnamurthi]

For what it's worth, one of my TAs now informs me he got the same error on macOS 11.0 Beta.

He says he just has the standard macOS firewall. He whitelisted DrRacket and it persists.

I asked him to try installing Racket 7.7 and installing the package through that; same issue.

He was only able to get it working from the command-line.

Shriram

[George Neuner]

On 9/9/2020 10:05 PM, Shriram Krishnamurthi wrote:
> Thank you. Can you imagine why the proxy would affect DrRacket but not
> the Web browser?

DrRacket and the browser can be configured independently ... at least
for a known proxy.    DrRacket's setting is in preferences under
"browser".  However, if your student is on campus (or at work?), he/she
may be behind an upstream system-wide firewall or proxy which is unknown.

Commercial firewalls can read request headers and pass/fail based on the
"user agent" string so as to allow known browsers and other vetted
applications to operate while rejecting requests from unvetted applications.

I don't know if DrRacket even sends a "user agent" string.

George

[Hendrik Boom]

On Thu, Sep 10, 2020 at 12:49:25AM -0400, George Neuner wrote:
>
> I don't know if DrRacket even sends a "user agent" string.

If DrRacket can send a user agent string, so can malware.

So it's not really reliable to filter on the user agent string.

-- hendrik

[George Neuner]

Of course ... any HTTP request can forge a user agent string:  most
browsers allow you to change it, and so do some HTTP aware
applications.  E.g., there is a plugin for Firefox that changes it on
the fly based on the URL - use cases involve things like Google image
search behaving differently for Chrome vs non-Chrome users, and
Microsoft sites behaving differently for non-Windows users.

My point is that there may be something unseen - probably a firewall -
blocking the DrRacket request but not blocking requests from the known
browser.  If it isn't some software installed on the machine itself, it
likely is an IT appliance guarding the whole network. Firewall
appliances are NAT routers: they can look inside even encrypted
connections to examine protocols being used and the raw data passing
through.

Based on the error from Shriram's message, it looks like DrRacket is
successfully calling out but doesn't like/understand the response ...
which would tend to eliminate Windows built-in firewall as a suspect [it
doesn't do protocol inspection].  It still could be other AV/firewall
software on the machine, or something upstream in the network that his
student is unaware of.

YMMV,
George

[Shriram Krishnamurthi]

Please note that, per my message last night, this is also happening (my TA claims he saw the identical text: multiple red lines, etc.) on macOS 11. So it's not just for Windows any more.

--
You received this message because you are subscribed to a topic in the Google Groups "Racket Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/racket-users/7rMAEma8Xkg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to racket-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/8a1628af-b647-5272-1c9a-da347b604091%40comcast.net.

[Philip McGrath]

Also, this is happening over encrypted HTTPS: no one is sniffing the User-Agent header.

My initial attempt to reproduce in the GUI package manager was foiled because I’d first tried installing at the command line, and the package manager used a cached copy of the repository. From Shriram’s update last night, it sounds like the GUI package manager and “raco pkg” are doing something differently.

--

-Philip

[Shriram Krishnamurthi]

The original student (on Windows 10) has confirmed they were able to install with raco on the shell, which further lends credence to the likelihood that the PM and raco are doing something differently.

(I have some other issues w/ the caching and how clearing out the trash doesn't seem to affect the cache, but I'll put that off for another day. <-;)

[George Neuner]

On 9/10/2020 10:06 AM, Philip McGrath wrote:
> Also, this is happening over encrypted HTTPS: no one is sniffing the
> User-Agent header.

While it may not be the issue here, you need to understand that
appliance firewalls CAN and routinely DO examine data inside encrypted
connections.

George

[John Clements]

Shriram, have you ruled out the classic multi-paste prolem? It looks very much like that’s what you’re seeing here.

That is, if you paste a string that ends with a newline into the “do what I mean” box, it will appear still to be blank. So you paste it again. So you paste it again. Eventually you figure it out and paste a string that doesn’t end with a newline, but then it tries to download from a URL that contains about five newlines in it.

Again, to repeat:

1) Highlight a string ending with a newline.
2) Open the Package Manager box
3) Click in the “do what I mean box”.
4) Hit cmd-v. see that the box appears blank
5) Hit it a few more times, then click “install”.

I believe this should be fixed, and it should be an easy fix. I haven’t fixed it myself.

John

> --
> You received this message because you are subscribed to the Google Groups "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAJUf2yQTO5dN7yKjvGu_mR13cD2BdkAHLGj2DU7Xdyeo5Ww-RQ%40mail.gmail.com.

[Shriram Krishnamurthi]

It's not me doing this, it's a student. I agree this is always a possibility. But note that it also happened to a TA. I suppose they could all have been making the same mistake.

[Robby Findler]

I was able to follow John's instructions and I get what Shriram had in the original message, so that seems like it is on the right track.

Confusingly, however, I also seem to be getting this more helpful message:

DrRacket install: invalid package source;
 inferred package name includes disallowed characters
  given: https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git

I can't see how this check gets evaded sometimes (and I cannot seem to get back to the error state that produced the transcript below) so I didn't try to push a fix.

But at least that might help SK's students & TAs for now.

Robby

Querying Git references for mystery-languages at https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
pkg: Git checkout initial protocol failed;
 the given URL might not refer to a Git repository
  given URL: https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
https://github.com/shriram/mystery-languages.git
  context...:
   /Users/robby/git/exp/plt/racket/collects/pkg/private/stage.rkt:762:25
   /Users/robby/git/exp/plt/racket/collects/net/git-checkout.rkt:336:0: parse-initial-refs
   /Users/robby/git/exp/plt/racket/collects/net/git-checkout.rkt:73:8
   dynamic-wind
   call-in-empty-metacontinuation-frame
   /Users/robby/git/exp/plt/racket/collects/net/git-checkout.rkt:54:2: retry-loop
   dynamic-wind
   call-in-empty-metacontinuation-frame
   dynamic-wind
   call-in-empty-metacontinuation-frame
   /Users/robby/git/exp/plt/racket/collects/pkg/private/stage.rkt:59:2: lookup-normally
   /Users/robby/git/exp/plt/racket/collects/pkg/private/stage.rkt:107:0: stage-package/info
   /Users/robby/git/exp/plt/racket/collects/pkg/private/install.rkt:141:0: install-packages
   /Users/robby/git/exp/plt/racket/collects/pkg/private/install.rkt:925:4
   call-in-empty-metacontinuation-frame
   dynamic-wind

On Thu, Sep 10, 2020 at 8:40 PM Shriram Krishnamurthi <s...@cs.brown.edu> wrote:

It's not me doing this, it's a student. I agree this is always a possibility. But note that it also happened to a TA. I suppose they could all have been making the same mistake.

--

You received this message because you are subscribed to the Google Groups "Racket Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAJUf2ySBo9pwA4oyr62%3D-1MxiFLY-F0YL_kA4x-eXXqsbHqQDQ%40mail.gmail.com.

[Shriram Krishnamurthi]

I asked students to go to File | Install Package (not the DWIM box). From there, I too get this "inferred package name includes disallowed characters" message as Robby. But that isn't what my student got… So it seems a bit unlikely this is the issue?

There is the possibility this is somehow different on Windows due to CR+LF issues. Maybe one of the characters is being treated as a line-terminator while the other is getting appended to the repo-name, causing the "might not refer to" error? Perhaps someone with a Windows box could test out John's "multiple paste" conjecture and see whether they get my student's error message (see top posting of this thread) instead?

For what it's worth, I had to try quite hard to copy the newline off github…so it would be impressive if two students in my class did just that. (And it would be a remarkable piece of sleuthing by John!)

[Hendrik Boom]

Using man-in-the-middle attacks?

-- hendrik

[jackh...@gmail.com]

Could we make the "do what I mean" box just automatically strip any newlines pasted into it? It seems sensible to me to require that it only be a single line input.

[Robby Findler]

Yea, I agree. I'd made that change locally but hadn't pushed because I couldn't make the bad behavior happen reliably. Perhaps that lack shouldn't stop us! Pushed now.

Robby

--

You received this message because you are subscribed to the Google Groups "Racket Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/84b16cf0-7837-4d54-9423-c1286f5e2b7an%40googlegroups.com.

[Sorawee Porncharoenwase]

Should the fix apply to all 'single styled text-field% too?

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdON46%3DPR6_-iyppSMLsfEvNEveq3uGu64gQ3Lu1or7QgNw%40mail.gmail.com.

[Sorawee Porncharoenwase]

I meant, wouldn’t it be better to fix text-field% itself, instead of only some instances of it? Sorry if that was confusing.

[Robby Findler]

I'm not sure. I would probably add a 'single-no-return style and then grep the codebase for places that use 'single and change them (as appropriate).

Robby

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CADcuegtFzzeErTTqi3m9Hyr%2Bu1m8YEo0cnAEw2onhKXGnTzHOg%40mail.gmail.com.

[Sorawee Porncharoenwase]

Can you explain why you are not sure? Under what circumstances do you think the current 'single style behavior is useful? 

We can add 'single-no-return (though I dislike it because 'single means no return already!) and change existing places that use 'single. However, without switching the default style from 'single to 'single-no-return, people will make mistakes again in the future. But if we will change the default style to 'single-no-return too, why don't we simply directly change the behavior 'single?

[Robby Findler]

I just worry about backwards compatibility. There are probably places that already do something about this problem woutside of the control-- how will they interact?

Maybe if someone were to audit existing code on the pkg server then we would know that changing the behavior in a certain way would work out. 

Robby 

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CADcuegsBYxxQJgjSz9ohS6fiRHaOXiO_Bx%3D_JoiiAvTQMHWH6A%40mail.gmail.com.

[John Clements]

I have a question about the new behavior.

(ObResearch: actually, I checked the drracket, racket, and gui repos, and I couldn’t find any new push, so I couldn’t check the code myself.)

Does it simply strip newlines, as Jack suggested, or does it signal an error? The latter seems less likely to silently cause weird problems / vulnerabilities / etc.

Also, I notice that the (current) behavior changes when there’s a branch specified explicitly; it seems that in this case, the URL parser happily splits at the hash and dumps the rest (including newlines) into the “branch” without any message about invalid characters. That might be an error in our URL parsing… or maybe URLs are allowed to have newlines in that part? That would be strange. Either way, I suspect that that bug (if it’s a bug) will be hidden by this fix.

Finally, a million thanks for fixing this; I always have students (and it happened again yesterday!) that run into this.

John

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/CAL3TdOPWAYLZFz%3DNcRm-veqLX-mpVp39B8umSmkcy0yQnLN1pQ%40mail.gmail.com.

[Robby Findler]

The change I made is in the gui-pkg-manager repo (well there may be one more word in the name). 

Yes, it does just strip. I didn't see any code that was doing what you describe but I also didn't look for it!

Robby