[msys2] download components failure: SSL connect error #13286

Christsnatcher · 2020-09-01T20:57:57Z

Host Environment

Windows 8.1 Home x64
MSVC++ 14.27 _MSC_VER == 1927 (Visual Studio 2019 Version 16.7)

To Reproduce
Steps to reproduce the behavior:
vcpkg install [ffmpeg] (no triplet does work, and no additional feature does matter)

Failure logs

D:\Code\Repos\vcpkg>vcpkg install ffmpeg:x86-windows
Computing installation plan...
The following packages will be built and installed:
    ffmpeg[avcodec,avdevice,avfilter,avformat,avresample,core,postproc,swresample,swscale]:x86-windows
Detecting compiler hash for triplet x86-windows...
Starting package 1/1: ffmpeg:x86-windows
Building package ffmpeg[avcodec,avdevice,avfilter,avformat,avresample,core,postproc,swresample,swscale]:x86-windows...
Could not locate cached archive: C:\Users\Daniel\AppData\Local\vcpkg/archives\3f\3f551c8ffdfb689003869e2d0981ea9fa7bc696e.zip
-- Using cached D:/Code/Repos/vcpkg/downloads/ffmpeg-ffmpeg-n4.2.tar.gz
-- Extracting source D:/Code/Repos/vcpkg/downloads/ffmpeg-ffmpeg-n4.2.tar.gz
-- Applying patch 0001-create-lib-libraries.patch
-- Applying patch 0003-fix-windowsinclude.patch
-- Applying patch 0004-fix-debug-build.patch
-- Applying patch 0005-fix-libvpx-linking.patch
-- Applying patch 0006-fix-StaticFeatures.patch
-- Applying patch 0007-fix-lib-naming.patch
-- Applying patch 0008-Fix-wavpack-detection.patch
-- Applying patch 0009-Fix-fdk-detection.patch
-- Applying patch 0010-Fix-x264-detection.patch
-- Applying patch 0011-Fix-x265-detection.patch
-- Applying patch 0012-Fix-ssl-110-detection.patch
-- Using source at D:/Code/Repos/vcpkg/buildtrees/ffmpeg/src/n4.2-2f6d2343f6.clean
-- Downloading https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz...
-- Downloading https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz... Failed. Status: 35;"SSL connect error"
CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:178 (message):

      Failed to download file.
      If you use a proxy, please set the HTTPS_PROXY and HTTP_PROXY environment
      variables to "https://user:password@your-proxy-ip-address:port/".
      Otherwise, please submit an issue at https://github.com/Microsoft/vcpkg/issues

Call Stack (most recent call first):
  scripts/cmake/vcpkg_acquire_msys.cmake:97 (vcpkg_download_distfile)
  scripts/cmake/vcpkg_acquire_msys.cmake:148 (msys_package)
  ports/ffmpeg/portfile.cmake:59 (vcpkg_acquire_msys)
  scripts/ports.cmake:79 (include)


Error: Building package ffmpeg:x86-windows failed with: BUILD_FAILED
Please ensure you're using the latest portfiles with `.\vcpkg update`, then
submit an issue at https://github.com/Microsoft/vcpkg/issues including:
  Package: ffmpeg:x86-windows
  Vcpkg version: 2020.06.15-nohash

Additional context
Hello,

the issue here doesn't really seem to be a "port bug", because it affects all ports which need MSYS2 for building. The problem basically is that https://repo.msys2.org since a few days stricly disallows all other security protocols but TLS 1.3 - which users of other Windows OS but latest Windows 10 (like me) are unable to use for global WinHttp connections as it's simply not implemented in the resp. OS (and obviously never will be).

Since vcpkg apparently tries to acquire the package using PowerShell we are bound to WinHttp limits and the download has to fail, while 3rd-party-programs like e.g. wget, which support TLS 1.3 natively, are able to download from https://repo.msys2.org perfectly fine. So I actually have the package vcpkg tries to download for more than one hour on my HDD already, but fail to figure out where to place it so that vcpkg would pick it up (as quick bypass). Could you please tell me? Thank you.

The problem I mention here is a pretty huge one given that it effectively excludes all non-Win 10 users from the possibility to build MSYS2-dependent ports (which are not just a few as you surely know). I strongly recommend to add alternate download urls in addition to https://repo.msys2.org as soon as possible, thank you very much.

ffmpeg.zip

The text was updated successfully, but these errors were encountered:

JackBoosY · 2020-09-02T02:57:05Z

See #13217 (comment) for workaround.

MVoz · 2020-09-02T03:41:07Z

?
powershell "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz')"

powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz -OutFile bash-4.4.023-2-x86_64.pkg.tar.xz"

NET40-Enable-TLS-12

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001

Christsnatcher · 2020-09-02T04:28:23Z

@JackBoosY : Thank you very much for linking me to this workaround!

@voskrese Both commands fails in PS for me (see output below), also I explicitly mentioned that ONLY TLS 1.3 would work, NOT 1.2.

S E:\downloads\1> powershell "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz')"
powershell : Cannot find an overload for "DownloadFile" and the argument count: "1".
At line:1 char:1
+ powershell "[Net.ServicePointManager]::SecurityProtocol = [Net.Securi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Cannot find an ...ent count: "1".:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
At line:1 char:82
+ ... pe]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://r ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest
 

PS E:\downloads\1> powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz -OutFile bash-4.4.023-2-x86_64.pkg.tar.xz"
powershell : Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure 
At line:1 char:1
+ powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [N ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Invoke-WebReque...SSL/TLS secure :String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
channel.
At line:1 char:82
+ ... pe]::Tls12; Invoke-WebRequest https://repo.msys2.org/msys/x86_64/bash ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:Htt 
   pWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe 
   ll.Commands.InvokeWebRequestCommand

MVoz · 2020-09-02T04:35:46Z

TLS 1.2 work

alternative
powershell -Command "[Net.ServicePointManager]::SecurityProtocol::3072; Invoke-WebRequest https://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz -OutFile bash-4.4.023-2-x86_64.pkg.tar.xz"

and in general of course in vain removed PACMAN

linquize · 2020-09-02T04:38:49Z

if https:// fail, use http:// as fallback. Since we verify file hash, transport layer security is less important.

JackBoosY · 2020-09-02T06:11:14Z

Hi guys, can you test if #13298 works?

Christsnatcher · 2020-09-02T08:43:44Z

@JackBoosY : I messed up in my previous test (see my post history), your fix is working perfectly fine!

@voskrese : You appaarently don't understand. TLS v1.2 does NOT work, just read the explanations on the site itself, ONLY TLS 1.3 does. Your Windows 10 PowerShell just adapts to this scenario and uses TLS 1.3 without telling you about it, that's why the command works for you - for me it obviously doesn't. You might want to explicitly DISABLE TLS 1.3 in Control Panel and try again afterwards, you'll be surprised.

EDIT:

Ah, and btw, downloading the packages directly without using pacman will of course only resolve this particular issue if you don't do it from https://repo.msys2.org any longer but from one of the quite few alternative sites. As not pacman or any other MSYS2 component enforces TLS 1.3, the site / domain does.

JackBoosY · 2020-09-02T09:21:37Z

@Christsnatcher Sorry, please pull the latest and try again, I forgot to modify some places.

Christsnatcher · 2020-09-02T09:23:53Z

Ah, no problem. We wrote at the same time, I edited my previous post to reflect that your fix is working perfectly fine, thank you so much- now on to merging! ;)

Look at this drastical cmd output change, impressive:

-- Downloading http://repo.msys2.org/msys/x86_64/bash-4.4.023-2-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/diffutils-3.7-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/coreutils-8.32-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/grep-3.0-2-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/sed-4.8-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/libpcre-8.44-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/gawk-5.1.0-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/mpfr-4.1.0-1-x86_64.pkg.tar.zst...
-- Downloading http://repo.msys2.org/msys/x86_64/gmp-6.2.0-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/libreadline-8.0.004-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/ncurses-6.2-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/pkg-config-0.29.2-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/make-4.3-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/libintl-0.19.8.1-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/libiconv-1.16-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/gcc-libs-9.3.0-1-x86_64.pkg.tar.xz...
-- Downloading http://repo.msys2.org/msys/x86_64/msys2-runtime-3.1.6-3-x86_64.pkg.tar.xz...

Christsnatcher · 2020-09-07T20:02:47Z

I see that commit 46e25a1 has substituted downloads via pacman with direct downloads, but unfortunately not resolved this issue. Well, the magic word is patience I guess (though it's hard given a proper fix is available for more than one week already). Cheers!

JackBoosY · 2020-09-08T01:56:39Z

@Christsnatcher We are looking for a solution to enable TLS>1.2 in Windows 7.

linquize · 2020-09-08T05:59:08Z

@Christsnatcher what is your error message?

Christsnatcher · 2020-09-08T11:01:36Z

@JackBoosY: I honestly think this will be impossible if MS does not actively supports backporting. And I would still have the same issue on Windows 8.1, right?

@linquize: Please check the first post.

aowji · 2020-10-03T06:33:10Z

i add one line at scripts\cmake\vcpkg_download_distfile.cmake:161, then download ok

string(REGEX REPLACE "^https://repo\.msys2\.org" "http://mirrors.ustc.edu.cn/msys2" url ${url})

BillyONeal · 2020-10-03T19:25:51Z

@allenchou13 That's an OK temporary fix but it wouldn't be appropriate to replace the primary mirror with one of the replicas permanently,

Christsnatcher · 2020-10-04T00:15:43Z

@BillyONeal : There are abviously dozens of potential "workarounds" available, but an issue as severe as this one simply has to to be resolved a proper way.
-- edit --

Also, a regular MSYS2 installation comes with a preconfigured list of mirrors in "msys64\etc\pacman.d", the current one lists these servers:

Server = https://www2.futureware.at/~nickoe/msys2-mirror/msys/$arch/
Server = https://mirror.yandex.ru/mirrors/msys2/msys/$arch/
Server = https://mirrors.tuna.tsinghua.edu.cn/msys2/msys/$arch/
Server = http://mirrors.ustc.edu.cn/msys2/msys/$arch/
Server = http://mirror.bit.edu.cn/msys2/msys/$arch/
Server = https://mirror.selfnet.de/msys2/msys/$arch/
Server = http://repo.msys2.org/msys/$arch/
Server = https://sourceforge.net/projects/msys2/files/REPOS/MSYS2/$arch/

So there should be enough options to get the packages from I guess.

-- edit --

I just noticed that even MSYS2 itself uses the "http form" of the repo.msys2.org domain to retrieve content, funny somehow. So why not simply implement fallback urls the very same way or just replace the TLS 1.3 https links with their resp. http counterparts? In which way would doing what MSYS2 does itself be "inappropriate" if I might ask? The current situation is "intolerable", that's my opinion.

This is required because of microsoft/vcpkg#13286

pkgw · 2020-11-02T20:02:57Z

It looks to me like this issue has been fixed by msys2.org starting to allow TLS1.2 again?

Christsnatcher · 2020-11-03T06:31:17Z

@pkgw : You're actually right, wondering what has been their reasoning behind this decision.

https://i.gyazo.com/b2a1d6d44ad623115154de56de7c649c.png

JackBoosY · 2020-11-03T06:55:21Z

Fixed by msys upstream.

Bit-Dong · 2022-10-09T14:14:41Z

good

NancyLi1013 assigned JackBoosY Sep 2, 2020

JackBoosY added the category:vcpkg-bug The issue is with the vcpkg system (including helper scripts in `scripts/cmake/`) label Sep 2, 2020

JackBoosY assigned BillyONeal Sep 2, 2020

JackBoosY changed the title ~~[ffmpeg] build failure~~ [msys2] download components failure: SSL connect error Sep 2, 2020

linquize mentioned this issue Sep 2, 2020

[vcpkg] Replace uses of msys pacman.exe with direct package downloads #13019

Merged

JackBoosY mentioned this issue Sep 2, 2020

[msys2] Automatically detect SSL #13298

Closed

bialasjaroslaw mentioned this issue Sep 8, 2020

protobuf:x86-windows build failure #13410

Closed

GiulioRomualdi mentioned this issue Oct 6, 2020

General improvements of the TimeVarying DCM planner ami-iit/bipedal-locomotion-framework#127

Merged

zpostfacto mentioned this issue Oct 6, 2020

compilation fails with WebRTC on windows using vcpkg ValveSoftware/GameNetworkingSockets#140

Closed

GiulioRomualdi added a commit to GiulioRomualdi/bipedal-locomotion-controllers that referenced this issue Oct 7, 2020

Bump vcpkg tag in GitHubCI

e82a5e3

This is required because of microsoft/vcpkg#13286

JackBoosY mentioned this issue Oct 9, 2020

Downloads from https://repo.msys2.org/ fail with "SSL connect error" #13217

Closed

This was referenced Oct 24, 2020

Catch the engine(s) up to TeXLive 2020.0 tectonic-typesetting/tectonic#666

Merged

Re-enable Windows/vcpkg build (once vcpkg/MSYS2 is straightened out) tectonic-typesetting/tectonic#668

Closed

JackBoosY closed this as completed Nov 3, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[msys2] download components failure: SSL connect error #13286

[msys2] download components failure: SSL connect error #13286

Christsnatcher commented Sep 1, 2020

JackBoosY commented Sep 2, 2020

MVoz commented Sep 2, 2020 •

edited

Loading

Christsnatcher commented Sep 2, 2020

MVoz commented Sep 2, 2020 •

edited

Loading

linquize commented Sep 2, 2020

JackBoosY commented Sep 2, 2020

Christsnatcher commented Sep 2, 2020 •

edited

Loading

JackBoosY commented Sep 2, 2020

Christsnatcher commented Sep 2, 2020 •

edited

Loading

Christsnatcher commented Sep 7, 2020

JackBoosY commented Sep 8, 2020

linquize commented Sep 8, 2020

Christsnatcher commented Sep 8, 2020

aowji commented Oct 3, 2020

BillyONeal commented Oct 3, 2020

Christsnatcher commented Oct 4, 2020 •

edited

Loading

pkgw commented Nov 2, 2020 •

edited

Loading

Christsnatcher commented Nov 3, 2020

JackBoosY commented Nov 3, 2020

Bit-Dong commented Oct 9, 2022

[msys2] download components failure: SSL connect error #13286

[msys2] download components failure: SSL connect error #13286

Comments

Christsnatcher commented Sep 1, 2020

JackBoosY commented Sep 2, 2020

MVoz commented Sep 2, 2020 • edited Loading

Christsnatcher commented Sep 2, 2020

MVoz commented Sep 2, 2020 • edited Loading

linquize commented Sep 2, 2020

JackBoosY commented Sep 2, 2020

Christsnatcher commented Sep 2, 2020 • edited Loading

JackBoosY commented Sep 2, 2020

Christsnatcher commented Sep 2, 2020 • edited Loading

Christsnatcher commented Sep 7, 2020

JackBoosY commented Sep 8, 2020

linquize commented Sep 8, 2020

Christsnatcher commented Sep 8, 2020

aowji commented Oct 3, 2020

BillyONeal commented Oct 3, 2020

Christsnatcher commented Oct 4, 2020 • edited Loading

pkgw commented Nov 2, 2020 • edited Loading

Christsnatcher commented Nov 3, 2020

JackBoosY commented Nov 3, 2020

Bit-Dong commented Oct 9, 2022

MVoz commented Sep 2, 2020 •

edited

Loading

MVoz commented Sep 2, 2020 •

edited

Loading

Christsnatcher commented Sep 2, 2020 •

edited

Loading

Christsnatcher commented Sep 2, 2020 •

edited

Loading

Christsnatcher commented Oct 4, 2020 •

edited

Loading

pkgw commented Nov 2, 2020 •

edited

Loading