Updating registry or instantiating project environment fails with SSL/ca-certificate issue

General Usage
, , ,
1

I’m faced with a weird issue since updating to v1.10.1:

(@v1.10) pkg> instantiate
┌ Warning: could not download https://pkg.julialang.org/registries
│   exception = RequestError: Error reading ca cert file /etc/ssl/certs/ca-certificates.crt - mbedTLS: (-0x3E00) PK - Read/write of file failed while requesting https://pkg.julialang.org/registries
└ @ Pkg.Registry ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Registry/Registry.jl:69
    Updating registry at `~/.julia/registries/vepabm-registry`
ERROR: GitError(Code:ERROR, Class:SSL, failed to load CA certificates: 0xffffc200 - PK - Read/write of file failed)
Stacktrace:
  [1] set_ssl_cert_locations(cert_loc::String)
    @ LibGit2 ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/LibGit2/src/LibGit2.jl:1014
  [2] initialize()
    @ LibGit2 ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/LibGit2/src/LibGit2.jl:991
  [3] (::LibGit2.var"#161#162")()
    @ LibGit2 ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/LibGit2/src/LibGit2.jl:977
  [4] lock(f::LibGit2.var"#161#162", l::ReentrantLock)
    @ Base ./lock.jl:229
  [5] ensure_initialized
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/LibGit2/src/LibGit2.jl:973 [inlined]
  [6] LibGit2.GitRepo(path::String)
    @ LibGit2 ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/LibGit2/src/repository.jl:9
  [7] (::Pkg.Registry.var"#73#78"{Base.TTY, Dates.Second, Dict{String, Any}, String, Vector{Pkg.Registry.RegistryInstance}})()
    @ Pkg.Registry ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Registry/Registry.jl:449
  [8] mkpidlock(f::Pkg.Registry.var"#73#78"{Base.TTY, Dates.Second, Dict{String, Any}, String, Vector{Pkg.Registry.RegistryInstance}}, at::String, pid::Int32; kwopts::@Kwargs{stale_age::Int64})
    @ FileWatching.Pidfile ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/FileWatching/src/pidfile.jl:93
  [9] mkpidlock
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/FileWatching/src/pidfile.jl:88 [inlined]
 [10] update(regs::Vector{Pkg.Registry.RegistrySpec}; io::Base.TTY, force::Bool, depots::Vector{String}, update_cooldown::Dates.Second)
    @ Pkg.Registry ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Registry/Registry.jl:379
 [11] update
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Registry/Registry.jl:372 [inlined]
 [12] update_registries(ctx::Pkg.Types.Context; force::Bool, kwargs::@Kwargs{})
    @ Pkg.Operations ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Operations.jl:1269
 [13] update_registries
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/Operations.jl:1266 [inlined]
 [14] up(ctx::Pkg.Types.Context, pkgs::Vector{Pkg.Types.PackageSpec}; level::Pkg.Types.UpgradeLevel, mode::Pkg.Types.PackageMode, preserve::Nothing, update_registry::Bool, skip_writing_project::Bool, kwargs::@Kwargs{})
    @ Pkg.API ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:339
 [15] up
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:326 [inlined]
 [16] up
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:164 [inlined]
 [17] instantiate(ctx::Pkg.Types.Context; manifest::Nothing, update_registry::Bool, verbose::Bool, platform::Base.BinaryPlatforms.Platform, allow_build::Bool, allow_autoprecomp::Bool, kwargs::@Kwargs{})
    @ Pkg.API ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:1797
 [18] instantiate
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:1773 [inlined]
 [19] instantiate(; kwargs::@Kwargs{})
    @ Pkg.API ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/API.jl:1772
 [20] do_cmd!(command::Pkg.REPLMode.Command, repl::REPL.LineEditREPL)
    @ Pkg.REPLMode ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/REPLMode/REPLMode.jl:409
 [21] do_cmd(repl::REPL.LineEditREPL, input::String; do_rethrow::Bool)
    @ Pkg.REPLMode ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/REPLMode/REPLMode.jl:390
 [22] do_cmd
    @ ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/REPLMode/REPLMode.jl:380 [inlined]
 [23] (::Pkg.REPLMode.var"#24#27"{REPL.LineEditREPL, REPL.LineEdit.Prompt})(s::REPL.LineEdit.MIState, buf::IOBuffer, ok::Bool)
    @ Pkg.REPLMode ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/Pkg/src/REPLMode/REPLMode.jl:557
 [24] #invokelatest#2
    @ ./essentials.jl:892 [inlined]
 [25] invokelatest
    @ ./essentials.jl:889 [inlined]
 [26] run_interface(terminal::REPL.Terminals.TextTerminal, m::REPL.LineEdit.ModalInterface, s::REPL.LineEdit.MIState)
    @ REPL.LineEdit ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/REPL/src/LineEdit.jl:2656
 [27] run_frontend(repl::REPL.LineEditREPL, backend::REPL.REPLBackendRef)
    @ REPL ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/REPL/src/REPL.jl:1312
 [28] (::REPL.var"#62#68"{REPL.LineEditREPL, REPL.REPLBackendRef})()
    @ REPL ~/.julia/juliaup/julia-1.10.1+0.x64.linux.gnu/share/julia/stdlib/v1.10/REPL/src/REPL.jl:386

Visiting https://pkg.julialang.org/registries seems to work fine, so it doesn’t seem to be down. From what I gather from the stacktrace, there seems to be some problem with the CA certificates that git is trying to use (could very well be wrong)? This worked with v1.10 without any problems.

Has anyone else come across something like this before? I’ve never seen it in all my years of Julia usage and can’t find any bug report like that on here. Any pointers are much appreciated.

(System is OpenSuse Tumbleweed with today’s snapshot. I have the general registry in my julia path as well as one custom registry.)

2

Check issue: download ca cert error on Linux on Julia 1.10.1 · Issue #53339 · JuliaLang/julia · GitHub

Possible workaround: add in startup.jl

ENV["JULIA_SSL_CA_ROOTS_PATH"] = "/etc/ssl/ca-bundle.pem"
2 Likes
3

Thanks, missed that issue. Definitely the problem that I’m facing as well.

The suggested workaround works like a charm. I’ve added a conditional to it in my startup.jl file to avoid overwriting something after updating to v1.10.2 and upwards.

# Workaround for v1.10.1 until this issue is fixed:
# https://github.com/JuliaLang/julia/issues/53339
if VERSION == v"1.10.1"
    ENV["JULIA_SSL_CA_ROOTS_PATH"] = "/etc/ssl/ca-bundle.pem"
end
1 Like