Why am I getting SSL issues inside docker with pip - python

I am facing issues lately with using pip while building a docker image. The base OS is ubuntu 18.04 and the error is as below
python3 -m pip install --upgrade pip
Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:852)'),)': /simple/pip/
Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:852)'),)': /simple/pip/
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:852)'),)': /simple/pip/
Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:852)'),)': /simple/pip/
Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:852)'),)': /simple/pip/
The same works in host OS with out issues. The docker version is Docker version 19.03.3, build a872fc2f86
Some of the troubeshooting I have done currently.
Adding DNS to /etc/docker/daemon.json
Restarting docker engine
Running with pip --trusted-host pypi.org install -U pip
Adding certificate and updating ca
Inspite of all the troubleshooting the issue still persists. Is there anyother way to get this working.
PS : This just started to happen from yesterday and there were no issues earlier.

try to add the cacert for Ubuntu in your Dockerfile:
RUN wget -P /usr/local/share/ca-certificates/cacert.org http://www.cacert.org/certs/root.crt http://www.cacert.org/certs/class3.crt
RUN update-ca-certificates
if that does not help you may see this question

Related

Pypiserver WRONG_VERSION_NUMBER

On windows, I have a simple conda env named pypitester.
On a linux I am hosting a private pypiserver which loads when I call it on http://{IP}:8888/simple/:
I can load the url and see the contents. I was able to upload to my server using twine using:
twine upload --repository-url http://{IP}:8888 {PATH_TO_PROJ}/dist/
On windows, I updated my C:\ProgramData\pip\pip.ini to contain:
[global]
trusted-host = pypi.org files.pythonhosted.org {IP}:8888
extra-index-url = http://{IP}:8888/simple
Within a new conda env, I call:
>set https_proxy=http://{IP}:8888
>set http_proxy=http://{IP}:8888
Followed by:
>pip install MyPrivateLib
I get back:
>pip install MyPrivateLib
Looking in indexes: https://pypi.org/simple, http://{IP}:8888/simple
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)'))': /simple/myprivatelib/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)'))': /simple/myprivatelib/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)'))': /simple/myprivatelib/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)'))': /simple/myprivatelib/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)'))': /simple/myprivatelib/
ERROR: Could not find a version that satisfies the requirement MyPrivateLib (from versions: none)
ERROR: No matching distribution found for MyPrivateLib
When I load http://{IP}:8888/simple/myprivatelib/ in a browser, it loads immediately.
If I specify a version I see listed in simple (eg: 1.0.1) I get:
ERROR: Could not find a version that satisfies the requirement MyPrivateLib==1.0.1 (from versions: none)
ERROR: No matching distribution found for MyPrivateLib==1.0.1
The questions being:
How do I resolve this?
Am I doing something wrong generally speaking?
I want to host private repost internally and be able to install them on the fly in a verion-specificied way.

Cannot pip install via proxy when on Conda env

I have some weird problem with pip install via proxy.
When I'm in the base Conda environment (/conda) pip install works fine (using proxy: HTTPS_PROXY env variable).
But when I'm switching to another Conda environment, I get proxy errors:
$ conda activate /User/bryan_env
$ pip install xmltodict
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError(0, 'Error'))': /simple/xmltodict/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError(0, 'Error'))': /simple/xmltodict/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError(0, 'Error'))': /simple/xmltodict/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError(0, 'Error'))': /simple/xmltodict/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', OSError(0, 'Error'))': /simple/xmltodict/
ERROR: Could not find a version that satisfies the requirement xmltodict
ERROR: No matching distribution found for xmltodict
I've tried to use .condarc as well but had the same errors.
Important to say that this is all in Jupyter shell running in Kuberenetes pod.
Any idea what am I doing wrong here?
I had the same issue and it was solved by reinstalling pip in the environment using:
conda install -c anaconda pip
After that, try your pip install. It worked for me.

Using Python pre-commit with a local server

I am using a python package called pre-commit to standardize the git workflow for my team.
I am having some issues setting up a pre-commit hooks with this package https://github.com/pre-commit/mirrors-mypy due to company proxy with github.
I decided to download the package and upload it to our local bitbuket server and setup pre commit for it to use as a local repo.
Here's my .pre-commit-config.yaml file
# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
repos:
- repo: http://localserver/scm/~username/local_mypy.git
rev: '03f936cbf67'
hooks:
- id: mypy
I then ran pre-commit install and in the my git bash I did
git commit -a -m"let's see if pre-commit works"
But the result I get is
[INFO] Installing environment for http://localserver/scm/~username/local_mypy.git.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
An unexpected error has occurred: CalledProcessError: command: ('H:\\.cache\\pre-commit\\repo3yl4ty_p\\py_env-python3.6\\Scripts\\python.EXE', '-mpip', 'install', '.')
return code: 1
expected return code: 0
stdout:
Processing h:\.cache\pre-commit\repo3yl4ty_p
Could not fetch URL https://pypi.org/simple/mypy/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/mypy/ (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)) - skipping
stderr:
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)': /simple/mypy/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)': /simple/mypy/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)': /simple/mypy/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)': /simple/mypy/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:833)'),)': /simple/mypy/
ERROR: Could not find a version that satisfies the requirement mypy==0.800 (from pre-commit-dummy-package)
ERROR: No matching distribution found for mypy==0.800
Check the log at H:\.cache\pre-commit\pre-commit.log

Error while installing matplotlib using pip install

I installed python, jupyter notebook, numpy and pandas using pip instll on the office system without any problem but am unable to install Matplotlib. I get the following error:
pip install matplotlib
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))': /simple/matplotlib/
Could not fetch URL https://pypi.org/simple/matplotlib/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/matplotlib/ (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1123)'))) - skipping
ERROR: Could not find a version that satisfies the requirement matplotlib
ERROR: No matching distribution found for matplotlib
I also tried :
python -m pip install -U pip
python -m pip install -U matplotlib
And:
!{sys.executable} -m pip install matplotlib
raise error:
!{sys.executable} -m pip install matplotlib '!{sys.executable}' is not recognized as an internal or external command, operable program or batch file
I don't know what the problem is or how to fix it, please help me out.
. .

Can't get virtualenv working due to SSL error

I'm trying to use virtualenv on my Mac (El Capitan) but something must have changed recently, as it's no longer working, and complains about SSL problems.
It's the first time I've had to use this project in about 9 months, and in that time, I've not changed anything on my system regarding Python.
In an effort to get it working, over the past day or so I've uninstalled virtualenv, manually deleted some files (I found these instructions in a GitHub issue, but I can't find them again to provide a link, but if I remember correctly, it was just deleting broken symlinks and directories relating to virtualenv,) and then uninstalled Python via Brew, leaving me with a system that had no Python, pip, or virtualenv libraries or executables on it.
Then I ran brew install python2 to get Python installed. Then I ran pip install virtualenv which gave me the same SSL error as before. I manually downloaded virtualenv from the URL pip was trying to download it from, and then pip installed it locally using the downloaded file. This worked. However, when I then run virtualenv venv, I still get the same SSL error.
I've seen issues offering all kinds of advice, from downloading DigiCertHighAssuranceEVRootCA.pem and using it via the --cert option, creating a pip.ini file with trusted-host=files.pythonhosted.org in it, using the --trusted-host option, using a different network that isn't my company's corporate network, but none of it so far has worked for me.
I am consistently getting the following SSL error whenever I try to pip install anything, or, in this specific example, create a new virtualenv:
New python executable in /Users/apl/Projects/fdm/FDM-fordele/venv/bin/python2.7
Also creating executable in /Users/apl/Projects/fdm/FDM-fordele/venv/bin/python
Installing setuptools, pip, wheel...
Complete output from command /Users/apl/Projects/...e/venv/bin/python2.7 - setuptools pip wheel:
Looking in links: /usr/local/lib/python2.7/site-packages, /usr/local/lib/python2.7/site-packages/virtualenv_support, /usr/local/lib/python2.7/site-packages/virtualenv_support
Collecting setuptools
Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org.x.0a895c9402cc904c260a26007e7f555cbe49.9270f445.id.opendns.com', port=443): Max retries exceeded with url: /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_ (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),))
Is there some other way I can get this to work? This project cannot be deployed (using an Ansible role called ansistrano) because of this error.
EDIT:
I just tried uninstalling/removing Virtualenv, Pip and Python again, reinstalling Python, then manually installing pip with https://bootstrap.pypa.io/get-pip.py, which gives:
Collecting pip
Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org.x.0cf307740aff804587084980d2ecedab4cc8.9270f445.id.opendns.com', port=443): Max retries exceeded with url: /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_ (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),))
So it turns out that this is because the company I work for use Cisco's Umbrella DNS security system, that inserts itself in all DNS requests. This breaks SSL in Python, apparently, even though I can successfully manually download the file with curl.
By adding
151.101.1.63 files.pythonhosted.org
to my hosts file, I was able to get a system that behaved exactly as expected. Hope this helps others in the future who also are forced to go through Umbrella.

Categories

Resources