Hi guys I am using pants behind a firewall and ` pants packa

Question

Hi guys I am using pants behind a firewall and ` pants package` fails with following error ```15 55 08 93 ERROR 1 Exception encountered Exception Error downloading file error sending request for url <https github com pantsbuild pex releases download v2 1 90 pex> error trying to connect invalid peer certificate contents invalid peer certificate UnknownIssuer``` Is there a proxy setting that can be configured in Pants

enough-analyst-54434 · Answer

See here and speak up if you run into problems <https www pantsbuild org docs restricted internet access setting http proxy and https proxy|https www pantsbuild org docs restricted internet access setting http proxy and https proxy>

bored-glass-58755 · Answer

I have added below ` subprocess environment ` `env vars add = http proxy=<http myproxy> https proxy ` But it doesn t work The error remains According to the page it should take the values from the current shell environment if no values are mentioned

hundreds-father-404 · Answer

is `echo $https proxy` defined in your shell Note that sometimes it is all caps

bored-glass-58755 · Answer

Yes it is And yes I have both uppercase and lowercase defined in my shell and used both of them in `pants toml`

bored-glass-58755 · Answer

The error seems more like some certificate error rather a proxy error Trying to figure out the certi settings

hundreds-father-404 · Answer

I wonder if the section above on `ca certs path` may be relevant

enough-analyst-54434 · Answer

Stepping away from Pants does `curl O <https github com pantsbuild pex releases download v2 1 90 pex>` work

enough-analyst-54434 · Answer

Yeah Eric is right The wonder should be more strong since connect invalid peer certificate contents invalid peer certificate UnknownIssuer

bored-glass-58755 · Answer

The curl failed with ``` Total Received Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0 00 20 0curl 56 Proxy CONNECT aborted```

enough-analyst-54434 · Answer

Ok getting `curl cacert ` working 1st may provide a quicker feedback loop

enough-analyst-54434 · Answer

Then that setting once working should also work for Pants

bored-glass-58755 · Answer

Can I have the file downloaded somehow and keep it with my source or wherever and use it from there every time I execute a goal

enough-analyst-54434 · Answer

You can but this will get painful fast There are many many more files Pants will try to download

enough-analyst-54434 · Answer

If you can get your proxy configured and working that should solve them all in one effort

bored-glass-58755 · Answer

It will get difficult even if I stick to the same version

enough-analyst-54434 · Answer

Yes Typically you have 100s of dependencies

enough-analyst-54434 · Answer

Taking a step back how do you configure you current tooling that needs artifacts from the internet

bored-glass-58755 · Answer

We onboard and host the artifacts internally

enough-analyst-54434 · Answer

Ok so then it sounds like the proxy thing is a non starter anyway Is that right In other words no other build tool you have actually uses the proxy

enough-analyst-54434 · Answer

If so then downloading the Pex PEX and configuring ` python repos indexes repos` to your internal artifact repository should cover most things See here for more detail on everything needed <https github com pantsbuild pants issues 16328>

bored-glass-58755 · Answer

I think so but I am surprised how Pants bootstrapped in the first place ```Downloading the Pex PEX SHA256 fingerprint of <https github com pantsbuild pex releases download v2 1 62 pex> verified ```

enough-analyst-54434 · Answer

Hmm Well that download is via curl <https github com pantsbuild setup blob eb887ad5fd80766214e8c38102a5bc92d1342beb pants L253 L268>

enough-analyst-54434 · Answer

So it seems like curl works sometimes in your environment I E it can pick up the proxy in some cases

bored-glass-58755 · Answer

It seems so I am not very much aware of how things are working

enough-analyst-54434 · Answer

Ok Well the pants script I just linked uses location L which says follow re directs

enough-analyst-54434 · Answer

I did not explicitly say for you to do that in your test earlier probably that is the difference

enough-analyst-54434 · Answer

So does `curl L O <https github com pantsbuild pex releases download v2 1 90 pex>` work then

enough-analyst-54434 · Answer

It really should if Pants bootstrapped

bored-glass-58755 · Answer

I was able to download the pex from `` thru my browser

enough-analyst-54434 · Answer

Yeah you could look at where your browser has its certs configured Presumably there is some internal documentation about this

bored-glass-58755 · Answer

Yup

bored-glass-58755 · Answer

Thanks a lot

enough-analyst-54434 · Answer

```$ curl vvv O <https github com pantsbuild pex releases download v2 1 90 pex> 2 gt amp 1 | grep CAfile CAfile etc ssl certs ca certificates crt```

enough-analyst-54434 · Answer

That shows me what my curl uses

bored-glass-58755 · Answer

Added the certs path to `pants toml` and package worked

enough-analyst-54434 · Answer

Excellent