Certificate error on launchpad xmlrpc server with HTTPS_PROXY set

[Soren Hansen]

When using an https proxy (by setting $https_proxy), I get an error:

soren@jenkins:~$ bzr branch lp:reincarnate
bzr: ERROR: Certificate error: hostname 'proxy-sjc-1.cisco.com' doesn't match either of '*.launchpad.net', 'launchpad.net'
soren@jenkins:~$ echo $https_proxy
http://proxy-sjc-1.cisco.com:80/

So, apparently it's comparing the hostname given in the cert against the hostname of the proxy. That will never work :)

FWIW, w3m and wget are perfectly happy talking to launchpad through this proxy. No complaints over anything like this.

[Soren Hansen (soren)]

I replaced the nice raise CertificateError with just a 'raise "blah"' to get a backtrace. This is what I got:

bzr: ERROR: exceptions.TypeError: exceptions must be old-style classes or derived from BaseException, not str

Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/bzrlib/commands.py", line 920, in exception_to_return_code
    return the_callable(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/bzrlib/commands.py", line 1131, in run_bzr
    ret = run(*run_argv)
  File "/usr/lib/python2.7/dist-packages/bzrlib/commands.py", line 673, in run_argv_aliases
    return self.run(**all_cmd_args)
  File "/usr/lib/python2.7/dist-packages/bzrlib/commands.py", line 695, in run
    return self._operation.run_simple(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/bzrlib/cleanup.py", line 136, in run_simple
    self.cleanups, self.func, *args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/bzrlib/cleanup.py", line 166, in _do_with_cleanups
    result = func(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/bzrlib/builtins.py", line 1420, in run
    from_location)
  File "/usr/lib/python2.7/dist-packages/bzrlib/controldir.py", line 778, in open_tree_or_branch
    controldir = klass.open(location)
  File "/usr/lib/python2.7/dist-packages/bzrlib/controldir.py", line 685, in open
    t = _mod_transport.get_transport(base, possible_transports)
  File "/usr/lib/python2.7/dist-packages/bzrlib/transport/__init__.py", line 1679, in get_transport
    return get_transport_from_url(location_to_url(base), possible_transports)
  File "/usr/lib/python2.7/dist-packages/bzrlib/transport/__init__.py", line 1601, in location_to_url
    location = directories.dereference(location)
  File "/usr/lib/python2.7/dist-packages/bzrlib/directory_service.py", line 65, in dereference
    return service().look_up(name, url)
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_directory.py", line 68, in look_up
    return self._resolve(url)
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_directory.py", line 173, in _resolve
    result = self._resolve_via_xmlrpc(path, url, _request_factory)
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_directory.py", line 100, in _resolve_via_xmlrpc
    result = resolve.submit(service)
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_registration.py", line 271, in submit
    self._authenticated)
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_registration.py", line 194, in send_request
    result = method(*method_params)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1224, in __call__
    return self.__send(self.__name, args)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1578, in __request
    verbose=self.__verbose
  File "/usr/lib/python2.7/dist-packages/bzrlib/plugins/launchpad/lp_registration.py", line 72, in request
    response = self._opener.open(request)
  File "/usr/lib/python2.7/urllib2.py", line 400, in open
    response = self._open(req, data)
  File "/usr/lib/python2.7/urllib2.py", line 418, in _open
    '_open', req)
  File "/usr/lib/python2.7/urllib2.py", line 378, in _call_chain
...

[Jelmer Vernooij (jelmer)]

As a workaround you should be able to install pycurl.

This is a regression from our work to always verify certificates. I think this should be Critical?

[siva sandeep (coll-life-rox)]

I got a similar error.

I used the command "bzr branch lp:eucalyptus" and the response was

"bzr: ERROR: Certificate error: hostname '172.16.16.16' doesn't match either of '*.launchpad.net', 'launchpad.net'"

When i tried, " $ echo $https_proxy ", i got this,

"http://it-mml03:sivasandeep@172.16.16.16:3128/"

What am i supposed to do now to get that branch of Eucalyptus?

[Martin Packman (gz)]

So, the only thing as far as launchpad is concerned that uses https is the resolution of lp: urls via the xmlrpc server. Giving launchpad your ssh public key and setting your launchpad username in bzr avoids the issue as bzr+ssh is used instead of http. Passing '-Ossl.cert_reqs=none' just for the initial branch operation also works, as bzr remembers the resolved http url for future operations.

Steps to reproduce:

* Install tinyproxy, which comes up on localhost:8888 in default configuration

* Run a command through the proxy with no launchpad_username set, against a lp: branch:

    $ BZR_HOME=/tmp HTTPS_PROXY=http://localhost:8888 bzr info lp:bzr
    bzr: ERROR: Certificate error: hostname 'localhost' doesn't match either of '*.launchpad.net', 'launchpad.net'

* The safe effect can be had with other hosts and protocols, so it seems to be general issue with proxying:

    $ HTTPS_PROXY=http://localhost:8888 bzr info https://github.com/paramiko/paramiko.git
    bzr: ERROR: Certificate error: hostname 'localhost' doesn't match either of 'github.com', 'www.github.com'

[Eduard Gotwig (gotwig)]

still not fixed for me:

example:

bzr branch lp:~frederik-elwert/lens-cooking/chefkoch-scope
bzr: ERROR: Certificate error: hostname 'proxy.bg.bib.de' doesn't match either of '*.launchpad.net', 'launchpad.net'

[Clint Byrum (clint-fewbar)]

Hi Jelmer. The upload of bzr to precise-proposed has one issue. It is versioned as

2.5.1-0ubuntu1

But the version in quantal is

2.5.0-2ubuntu2

Please upload a higher upstream version to quantal first, then we can accept this upload to precise-proposed. Until then we need to keep it out.

Also please make sure this is actually fixed in Quantal... since it seems like something that is part of the 2.5.1 release, not 2.5.0

[Chris Halse Rogers (raof)]

Hello Soren, or anyone else affected,

Accepted bzr into precise-proposed. The package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Yuriy Voziy (yuretsz)]

Is there any workaround for this? I have to work through corporate proxy and don't know what to do now.

[Jasper Aikema (jasper-aikema)]

I did install the proposed update (bzr 2.5.1-0ubuntu1) , and it worked for me.

[Andrew Starr-Bochicchio (andrewsomething)]

I can confirm this is resolved with the version in precise-proposed:

$ BZR_HOME=/tmp HTTPS_PROXY=http://localhost:8888 bzr info lp:bzr
You have not informed bzr of your Launchpad ID, and you must do this to
write to Launchpad or access private data. See "bzr help launchpad-login".
Repository branch (format: 2a)
Location:
  shared repository: http://bazaar.launchpad.net/~bzr-pqm/bzr/bzr.dev/
  repository branch: http://bazaar.launchpad.net/~bzr-pqm/bzr/bzr.dev/

Related branches:
  parent branch: sftp://robertc@escudero/srv/www.bazaar-ng.org/rsync/bzr/bzr.pqm/

[Launchpad Janitor (janitor)]

This bug was fixed in the package bzr - 2.5.1-0ubuntu1

---------------
bzr (2.5.1-0ubuntu1) precise-proposed; urgency=low

  * New upstream release.
   + Fixes handling of colocated branches in `bzr rmbranch`. LP: #920653
   + rmbranch now refuses to remove active branch. LP: #922953
   + Connecting with HTTPS via HTTP correctly uses host name of destination
     rather than that of proxy. LP: #944696
   + No longer requires tty when GPG signing commits. LP: #847388
   + Fixes unicode erorrs when translated progress task messages
     contain non-ascii text. LP: #966934
   + Fixes display of help for configuration options that overlap
     with other topics. LP: #941672
  * Drop 06_spurious_test_failure: applied upstream.
 -- Jelmer Vernooij <email address hidden> Mon, 28 May 2012 13:36:02 +0200