PURL setup link has expired SSL certificate

[ghost]

Technically not a bug in tectonic, but thought I should let you know.

note: indexing https://purl.org/net/pkgwpub/tectonic-default
error: The OpenSSL library reported an error: The OpenSSL library reported an error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:s3_clnt.c:1264:

[ghost]

Never mind. Fixed on their end.

[demurgos]

I still get a security error when navigating to the URL https://purl.org/net/pkgwpub/tectonic-default

Tectonic fails, I also checked with Firefox (using Linux if it matters).

$ tectonic code.tex 
note: this is a BETA release; ask questions and report bugs at https://tectonic.newton.cx/
Running TeX ...
note: indexing https://purl.org/net/pkgwpub/tectonic-default
warning: open of input xltxtra.sty failed
caused by: The OpenSSL library reported an error: The OpenSSL library reported an error: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1230:
caused by: The OpenSSL library reported an error: The OpenSSL library reported an error: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1230:
caused by: The OpenSSL library reported an error: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1230:
caused by: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1230:
error: something bad happened inside TeX; its output follows:

===============================================================================
(code.tex
LaTeX2e <2016/03/31>
Babel <3.9r> and hyphenation patterns for 83 language(s) loaded.
(article.cls
Document Class: article 2014/09/29 v1.4h Standard LaTeX document class
(size10.clo)) (geometry.sty (keyval.sty) (ifpdf.sty) (ifvtex.sty) (ifxetex.sty)
) (parskip.sty) (inputenc.sty

Package inputenc Warning: inputenc package ignored with utf8 based engines.

)

! LaTeX Error: File `xltxtra.sty' not found.

Type X to quit or <RETURN> to proceed,
or enter new name. (Default extension: sty)

Enter file name: ===============================================================================

error: terminal input forbidden

[demurgos]

I just retried: it seems fine for me. I believe that it was due to cache.

[pkgw]

Thanks for pursuing this. If the SSL cert is working again for multiple people I think it's likely that PURL has fixed their problem, so I think this can be closed again.

[pkgw]

Nope, now I'm seeing this. Grr.

[demurgos]

I can confirm I get this error too (even if it was solved previously). The certificate I get expired on 2017-11-05.

[pkgw]

I've created a forum thread pointing to a workaround.

[ilovezfs]

@pkgw this is happening again. Cert expired 4 Jan 2018

[pkgw]

Seems to be fixed again, so I guess I'll close this again ... if this problem persists we'll need to switch to another URL-redirection service, though.

[Arvedui]

The certificate expired on November 1, 2018, 11:55:08 PM GMT+0.

It is happening again …

[pkgw]

ARGH. Thanks for the heads-up.

[PHPirates]

The bintray link from the workaround you linked to seems not valid anymore, any new workaround link and does it still work?

[pkgw]

The suggested workaround link is: https://tectonic.newton.cx/bundles/tlextras-2018.1r0/bundle.tar (We were having problems with Bintray too — fun!)

OK, does anyone know of a redirection service that we could switch to instead of purl.org? Requirements:

• Reliable, long-lived service
• SSL
• Can redirect via status code 302
• The redirect destination can be updated over time

[pkgw]

Well, here's a list of PURL services: https://sites.google.com/site/persistenturls/purls-in-the-wild

[pkgw]

Although, I think this is fixed again. @Arvedui @PHPirates do you agree?

[PHPirates]

@pkgw Thanks, if the issue persists I'll try the workaround unless you have it fixed soon. I just tried and I still have the same problem, see https://travis-ci.org/PHPirates/travis-ci-latex-pdf/jobs/449807724

[pkgw]

@PHPirates Yes, you're right. Depending on what URL you type into a browser, it can sometimes work, but this consistently fails for me:

$ wget https://purl.org/net/pkgwpub/tectonic-default
--2018-11-02 10:03:38--  https://purl.org/net/pkgwpub/tectonic-default
Resolving purl.org (purl.org)... 207.241.224.2
Connecting to purl.org (purl.org)|207.241.224.2|:443... connected.
ERROR: The certificate of ‘purl.org’ is not trusted.
ERROR: The certificate of ‘purl.org’ has expired.
The certificate has expired

I did manage to get in direct contact with some people at archive.org last time, so I've reached out again. Hopefully they'll straighten it out quickly.

[rodluger]

As a temporary workaround I found that switching from https to http by setting the config.toml file to

[[default_bundles]]
url = "http://purl.org/net/pkgwpub/tectonic-default"

according to the workaround did the trick. But probably not a good long-term solution.

[Arvedui]

@pkgw
I still get the expired certificate.

[Arvedui]

@rodluger
switching to http might not be acceptable for everyone

[rodluger]

@Arvedui For sure. Just a thought for people in need of an immediate hacky workaround.

[PHPirates]

Since I still had the problem, I tested that the workaround works for me:

sudo mkdir -p ~/.config/Tectonic/
echo "[[default_bundles]]" | sudo tee --append ~/.config/Tectonic/config.toml
sudo echo "url = \"https://tectonic.newton.cx/bundles/tlextras-2018.1r0/bundle.tar\"" | sudo tee --append ~/.config/Tectonic/config.toml

Or, as I just found through cruizh's commit linked above, adding --web-bundle "https://tectonic.newton.cx/bundles/tlextras-2018.1r0/bundle.tar" works as well.

@pkgw I see you merged a fix, are you going to release a new Tectonic soon? If not I would copy this workaround to my build setups everywhere.

[WtfJoke]

Would be great if you could release a bugfix-release for this.
Something like 0.1.10.1 or 0.1.11

[pkgw]

PR in flight — lucky #256.

[pkgw]

OK, version 0.1.11 is out in the world. Hopefully I have updated the Arch Linux package right such that it will magically update when the master-branch CI finishes, too!