NACL Python Installation Failure

2370 views
Skip to first unread message

NotNate B.

unread,
Mar 18, 2018, 5:30:45 PM3/18/18
to Native-Client-Discuss
Before we begin: I am not behind a proxy. 

This is the error I get when running naclsdk update or naclsdk list:
C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk>naclsdk list
Traceback (most recent call last):
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 436, in <module>
    sys.exit(main(sys.argv[1:]))
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 427, in main
    return cmd(parser, argv[1:])
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 207, in CMDlist
    options = parser.parse_args(args)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 416, in Parse
    UpdateSDKTools(options, args)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 363, in UpdateSDKTools
    remote_manifest = LoadCombinedRemoteManifest(options.manifest_url, cfg)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 164, in LoadCombinedRemoteManifest
    manifest = LoadRemoteManifest(default_manifest_url)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 146, in LoadRemoteManifest
    url_stream = download.UrlOpen(url)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\download.py", line 25, in UrlOpen
    return url_opener.open(request)
  File "C:\Python27\lib\urllib2.py", line 429, in open
    response = self._open(req, data)
  File "C:\Python27\lib\urllib2.py", line 447, in _open
    '_open', req)
  File "C:\Python27\lib\urllib2.py", line 407, in _call_chain
    result = func(*args)
  File "C:\Python27\lib\urllib2.py", line 1241, in https_open
    context=self._context)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\third_party\fancy_urllib\__init__.py", line 414, in do_open
    url_error.reason.args[1])
third_party.fancy_urllib.InvalidCertificateException: Host storage.googleapis.com returned an invalid certificate ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)):
Traceback (most recent call last):
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 436, in <module>
    sys.exit(main(sys.argv[1:]))
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 427, in main
    return cmd(parser, argv[1:])
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 210, in CMDlist
    remote_manifest = LoadCombinedRemoteManifest(options.manifest_url, cfg)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 164, in LoadCombinedRemoteManifest
    manifest = LoadRemoteManifest(default_manifest_url)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\sdk_update_main.py", line 146, in LoadRemoteManifest
    url_stream = download.UrlOpen(url)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\download.py", line 25, in UrlOpen
    return url_opener.open(request)
  File "C:\Python27\lib\urllib2.py", line 429, in open
    response = self._open(req, data)
  File "C:\Python27\lib\urllib2.py", line 447, in _open
    '_open', req)
  File "C:\Python27\lib\urllib2.py", line 407, in _call_chain
    result = func(*args)
  File "C:\Python27\lib\urllib2.py", line 1241, in https_open
    context=self._context)
  File "C:\Users\NotNate\Downloads\nacl_sdk\nacl_sdk\sdk_tools\third_party\fancy_urllib\__init__.py", line 414, in do_open
    url_error.reason.args[1])
third_party.fancy_urllib.InvalidCertificateException: Host storage.googleapis.com returned an invalid certificate ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)):

Is anyone able to help me solve this issue so I can install Native Client?

Russell Valentine

unread,
Mar 18, 2018, 10:22:55 PM3/18/18
to native-cli...@googlegroups.com, nateb...@gmail.com

Looks like python can't verify the ssl certificate for storage.googleapis.com, maybe doing one of these could help:


* Can try updating python, my python2 on linux does not have a problem.

* Can update certificates, or just add the ones you need. To see where they are: python -c "import ssl; print(ssl.get_default_verify_paths())"

* set PYTHONHTTPSVERIFY=0

--
You received this message because you are subscribed to the Google Groups "Native-Client-Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to native-client-di...@googlegroups.com.
To post to this group, send email to native-cli...@googlegroups.com.
Visit this group at https://groups.google.com/group/native-client-discuss.
For more options, visit https://groups.google.com/d/optout.

Elis Popescu

unread,
Mar 28, 2018, 11:33:54 AM3/28/18
to Native-Client-Discuss
I have the same issue. I'm not behind a proxy either.

If I do a `curl https://storage.googleapis.com/nativeclient-mirror` works fine - so my system certs seem to be good?
Also, if I do this from python: `print requests.get("https://storage.googleapis.com/nativeclient-mirror").text` works as well.

`set PYTHONHTTPSVERIFY=0` - doesn't seem to fix it for me.

Anybody that managed to solve this issue in any way?

Thanks!

Russell Valentine

unread,
Mar 28, 2018, 5:22:57 PM3/28/18
to native-cli...@googlegroups.com, elis...@elisescu.com
It is using it's own ca file. If you comment out two lines in nacl_sdk/sdk_tools/download.py it should work again.

Comment out lines 19 and 20.
  # ca_certs = os.path.join(SCRIPT_DIR, 'cacerts.txt')
  # request.set_ssl_info(ca_certs=ca_certs)
--

Elis Popescu

unread,
Apr 3, 2018, 6:18:00 AM4/3/18
to Native-Client-Discuss
Aah.. it makes sense now. That solved it.
Thanks for your help!
To unsubscribe from this group and stop receiving emails from it, send an email to native-client-discuss+unsub...@googlegroups.com.

Jake Barnes

unread,
Apr 3, 2018, 10:26:08 AM4/3/18
to Native-Client-Discuss
Thanks, also seeing this issue and commenting out those lines fixed it. Also had to manually edit a bunch of scripts to point to python2 specifically, since I'm not on Ubuntu. Finally can actually use the SDK...
To unsubscribe from this group and stop receiving emails from it, send an email to native-client-discuss+unsub...@googlegroups.com.

Rob Nielsen

unread,
Apr 9, 2018, 8:20:06 PM4/9/18
to Native-Client-Discuss

kag...@genshiken.org

unread,
Jul 24, 2018, 9:59:44 AM7/24/18
to Native-Client-Discuss
Commenting out "set_ssl_info" is the same as disabling SSL verification.

I've created github repo with updated cacerts.txt file, you can check it here: https://github.com/Kagami/nacl_sdk/blob/master/sdk_tools/cacerts.txt

Or you can make one by yourself by concatenating 3 certs from:
$ openssl s_client -showcerts -connect storage.googleapis.com:443
$ cat /etc/ssl/certs/GlobalSign_Root_CA_-_R2.pem

Note that if you've just downloaded nacl_sdk.zip from https://developer.chrome.com/native-client/sdk/download
it will overwrite your editings because sdk_tools in that archive is outdated. I.e. you will need to replace cacerts.txt twice.

Or you can download https://github.com/Kagami/nacl_sdk/archive/master.zip which already contains latest sdk_tools (revision 361478).
Reply all
Reply to author
Forward
0 new messages