emscripten SSL: CERTIFICATE_VERIFY_FAILED

[auntieNeo]

Issue description

Many of the emscripten ports will not build because they fail to verify github's SSL certificate, in particular the emscripten port of zlib. The URL in question, https://github.com/emscripten-ports/zlib/archive/version_1.zip, works perfectly with curl, wget, or chorme; I don't think it's a problem with github's certificate.

Somehow python's liburl2 isn't configured to use the correct certificates anymore. This used to work a few months ago but I'm not sure exactly when it stopped working.

As a workaround, I was able to get some emscripten ports (such as Freetype) to build using the EMCC_LOCAL_PORTS environment variable, which is documented in the emscripten source code. I have not been able to do the same for zlib, however.

Steps to reproduce

[nix-shell:~/code/libmc]$ touch test.c

[nix-shell:~/code/libmc]$ emcc -s USE_ZLIB=1 test.c
WARNING:root:retrieving port: zlib from https://github.com/emscripten-ports/zlib/archive/version_1.zip
Traceback (most recent call last):
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/bin/emcc", line 13, in <module>
    emcc.run()
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/emcc.py", line 1260, in run
    compile_source_file(i, input_file)
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/emcc.py", line 1249, in compile_source_file
    args = get_bitcode_args([input_file]) + ['-emit-llvm', '-c', '-o', output_file]
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/emcc.py", line 1232, in get_bitcode_args
    args = system_libs.process_args(args, shared.Settings)
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/tools/system_libs.py", line 608, in process_args
    args = port.process_args(Ports, args, settings, shared)
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/tools/ports/zlib.py", line 51, in process_args
    get(ports, settings, shared)
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/tools/ports/zlib.py", line 17, in get
    ports.fetch_project('zlib', 'https://github.com/emscripten-ports/zlib/archive/' + TAG + '.zip', 'zlib-' + TAG)
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/tools/system_libs.py", line 523, in fetch_project
    retrieve()
  File "/nix/store/7ylnq0jfda19r3624c1z24vdzflrxwa4-emscripten-1.36.4/share/emscripten/tools/system_libs.py", line 495, in retrieve
    f = urllib2.urlopen(url)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 154, in urlopen
    return opener.open(url, data, timeout)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 1240, in https_open
    context=self._context)
  File "/nix/store/ng7iajdrlpa2v0wic6qdaknkrmqn9gli-python-2.7.11/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)>

Technical details

• System: 16.09pre84211.d231cdf (Flounder)
• Nix version: nix-env (Nix) 1.10
• Nixpkgs version: 16.09pre84513.2661511

[auntieNeo]

Update

I don't think this is a bug at all. The emcc command works just fine outside of my --pure nix shell environment. Does anyone know which package I need in my environment for the certs in urllib2 to work? The nixos.cacert package doesn't seem to work.

Sorry for the bunk bug report. Maybe the emscripten package just needs another propagated build input.

[FRidh]

This indeed stopped working some time ago. Relevant issue #13744

[FRidh]

Closing this because the issue is essentially a duplicate of #13744.