NACL Python Installation Failure

[NotNate B.]

Before we begin: I am not behind a proxy. 

This is the error I get when running naclsdk update or naclsdk list:

C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk>naclsdk list

Traceback (most recent call last):

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 436, in <module>

    sys.exit(main(sys.argv[1:]))

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 427, in main

    return cmd(parser, argv[1:])

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 207, in CMDlist

    options = parser.parse_args(args)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 416, in Parse

    UpdateSDKTools(options, args)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 363, in UpdateSDKTools

    remote_manifest = LoadCombinedRemoteManifest(options.manifest_url, cfg)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 164, in LoadCombinedRemoteManifest

    manifest = LoadRemoteManifest(default_manifest_url)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 146, in LoadRemoteManifest

    url_stream = download.UrlOpen(url)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\download.py", line 25, in UrlOpen

    return url_opener.open(request)

  File "C:\Python27\lib\urllib2.py", line 429, in open

    response = self._open(req, data)

  File "C:\Python27\lib\urllib2.py", line 447, in _open

    '_open', req)

  File "C:\Python27\lib\urllib2.py", line 407, in _call_chain

    result = func(*args)

  File "C:\Python27\lib\urllib2.py", line 1241, in https_open

    context=self._context)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\third_party\fancy_urllib\__init__.py", line 414, in do_open

    url_error.reason.args[1])

third_party.fancy_urllib.InvalidCertificateException: Host storage.googleapis.com returned an invalid certificate ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)):

To learn more, see http://code.google.com/appengine/kb/general.html#rpcssl

Traceback (most recent call last):

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 436, in <module>

    sys.exit(main(sys.argv[1:]))

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 427, in main

    return cmd(parser, argv[1:])

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 210, in CMDlist

    remote_manifest = LoadCombinedRemoteManifest(options.manifest_url, cfg)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 164, in LoadCombinedRemoteManifest

    manifest = LoadRemoteManifest(default_manifest_url)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 146, in LoadRemoteManifest

    url_stream = download.UrlOpen(url)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\download.py", line 25, in UrlOpen

    return url_opener.open(request)

  File "C:\Python27\lib\urllib2.py", line 429, in open

    response = self._open(req, data)

  File "C:\Python27\lib\urllib2.py", line 447, in _open

    '_open', req)

  File "C:\Python27\lib\urllib2.py", line 407, in _call_chain

    result = func(*args)

  File "C:\Python27\lib\urllib2.py", line 1241, in https_open

    context=self._context)

  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\third_party\fancy_urllib\__init__.py", line 414, in do_open

    url_error.reason.args[1])

third_party.fancy_urllib.InvalidCertificateException: Host storage.googleapis.com returned an invalid certificate ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)):

To learn more, see http://code.google.com/appengine/kb/general.html#rpcssl

Is anyone able to help me solve this issue so I can install Native Client?

[Russell Valentine]

Looks like python can't verify the ssl certificate for storage.googleapis.com, maybe doing one of these could help:

* Can try updating python, my python2 on linux does not have a problem.

* Can update certificates, or just add the ones you need. To see where they are: python -c "import ssl; print(ssl.get_default_verify_paths())"

* set PYTHONHTTPSVERIFY=0

--
You received this message because you are subscribed to the Google Groups "Native-Client-Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to native-client-di...@googlegroups.com.
To post to this group, send email to native-cli...@googlegroups.com.
Visit this group at https://groups.google.com/group/native-client-discuss.
For more options, visit https://groups.google.com/d/optout.

[Elis Popescu]

I have the same issue. I'm not behind a proxy either.

If I do a `curl https://storage.googleapis.com/nativeclient-mirror` works fine - so my system certs seem to be good?

Also, if I do this from python: `print requests.get("https://storage.googleapis.com/nativeclient-mirror").text` works as well.

`set PYTHONHTTPSVERIFY=0` - doesn't seem to fix it for me.

Anybody that managed to solve this issue in any way?

Thanks!

[Russell Valentine]

It is using it's own ca file. If you comment out two lines in nacl_sdk/sdk_tools/download.py it should work again.

Comment out lines 19 and 20.
  # ca_certs = os.path.join(SCRIPT_DIR, 'cacerts.txt')
  # request.set_ssl_info(ca_certs=ca_certs)

--

[Elis Popescu]

Aah.. it makes sense now. That solved it.

Thanks for your help!

To unsubscribe from this group and stop receiving emails from it, send an email to native-client-discuss+unsub...@googlegroups.com.

[Jake Barnes]

Thanks, also seeing this issue and commenting out those lines fixed it. Also had to manually edit a bunch of scripts to point to python2 specifically, since I'm not on Ubuntu. Finally can actually use the SDK...

To unsubscribe from this group and stop receiving emails from it, send an email to native-client-discuss+unsub...@googlegroups.com.

[Rob Nielsen]

There's a crbug for this at https://bugs.chromium.org/p/chromium/issues/detail?id=830895

[kag...@genshiken.org]

Commenting out "set_ssl_info" is the same as disabling SSL verification.

I've created github repo with updated cacerts.txt file, you can check it here: https://github.com/Kagami/nacl_sdk/blob/master/sdk_tools/cacerts.txt

Or you can make one by yourself by concatenating 3 certs from:

$ openssl s_client -showcerts -connect storage.googleapis.com:443

$ cat /etc/ssl/certs/GlobalSign_Root_CA_-_R2.pem

Note that if you've just downloaded nacl_sdk.zip from https://developer.chrome.com/native-client/sdk/download

it will overwrite your editings because sdk_tools in that archive is outdated. I.e. you will need to replace cacerts.txt twice.

Or you can download https://github.com/Kagami/nacl_sdk/archive/master.zip which already contains latest sdk_tools (revision 361478).