certificate errors downloading pip or installing pip packages

[Alex Xu]

This patch https://review.openstack.org/#/c/80198/ got -1 from jenkins by download pip from pypi

http://logs.openstack.org/98/80198/4/check/check-tempest-dsvm-neutron/639fcd3/logs/devstacklog.txt.gz

2014-03-28 03:50:47.523 | + cd /opt/stack/new/devstack/files
2014-03-28 03:50:47.524 | + curl -O https://pypi.python.org/packages/source/p/pip/pip-1.4.1.tar.gz
2014-03-28 03:50:47.739 | % Total % Received % Xferd Average Speed Time Time Time Current
2014-03-28 03:50:47.741 | Dload Upload Total Spent Left Speed
2014-03-28 03:50:47.817 |
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (51) SSL peer certificate or SSH remote key was not OK
2014-03-28 03:50:47.818 | ++ err_trap
2014-03-28 03:50:47.820 | ++ local r=1
2014-03-28 03:50:47.822 | stack.sh failed: full log in /opt/stack/new/devstacklog.txt.2014-03-28-035002

[Steven Hardy (shardy)]

Same here:

http://logs.openstack.org/75/82575/5/check/check-tempest-dsvm-neutron-heat-slow/16bf28a/logs/devstacklog.txt.gz

[Sean Dague (sdague)]

Pypi updated the certificate on their CDN last night, however there is a mismatch between that and their DNS TTL, which ends up producing issues like this:

2014-03-28 12:16:47.665 | + curl -O https://pypi.python.org/packages/source/p/pip/pip-1.4.1.tar.gz
2014-03-28 12:16:47.738 | % Total % Received % Xferd Average Speed Time Time Time Current
2014-03-28 12:16:47.740 | Dload Upload Total Spent Left Speed
2014-03-28 12:16:47.761 |
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (51) SSL peer certificate or SSH remote key was not OK
2014-03-28 12:16:47.763 | ++ err_trap
2014-03-28 12:16:47.765 | ++ local r=1
2014-03-28 12:16:47.767 | stack.sh failed: full log in /opt/stack/new/devstacklog.txt.2014-03-28-121614

Logstash query for tracking: http://logstash.openstack.org/#eyJzZWFyY2giOiJcIlNTTCBwZWVyIGNlcnRpZmljYXRlIG9yIFNTSCByZW1vdGUga2V5IHdhcyBub3QgT0tcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiMTcyODAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTM5NjAxMjk5MDYxNX0=

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/83743

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/83743
Committed: https://git.openstack.org/cgit/openstack-infra/elastic-recheck/commit/?id=1a332bf3f99ac034cdc89d9c29930820812aee98
Submitter: Jenkins
Branch: master

commit 1a332bf3f99ac034cdc89d9c29930820812aee98
Author: Sean Dague <email address hidden>
Date: Fri Mar 28 09:29:53 2014 -0400

    added bug for new pypi cert issue

    Change-Id: I527c80d5c670f55c6c960af26009fa261d846d07
    Related-Bug: #1298929

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/83751

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/83751
Committed: https://git.openstack.org/cgit/openstack-infra/elastic-recheck/commit/?id=167b603e062411843697844c9e6913ce854c8618
Submitter: Jenkins
Branch: master

commit 167b603e062411843697844c9e6913ce854c8618
Author: Sean Dague <email address hidden>
Date: Fri Mar 28 09:57:12 2014 -0400

    add a second kind of message that can trigger pypi fail

    the first message caught actually downloading pip failing, this
    catches pip installing packages.

    Change-Id: I4cd3453c333fbccc3e0d922cecc974fbc806bd2b
    Related-Bug: #1298929

[Joe Gordon (jogo)]

.no hits on elastic-recheck in two weeks, closing this bug.