git+https package installation on windows fails

[sebastian-goeldi]

I have ported the metaports-info package to use the new git infrastructure.

On linux (debian12, built against the 0.28.13 tag with a modified makedeb.sh file to support debian12) this works flawlessly, but a coworker just wrote me that he gets an error on Windows.

I can recreate the same error when running a fresh klayout installation on a windows (11) VM

I am not sure how to further debug though. I tried running klayout_app.exe from a power shell, but got no errors of info messages (maybe started it wrong though).

I'll happily assist if there is any way I can.

Sebastian

[klayoutmatthias]

Hi @sebastian-goeldi,

thanks for this ticket. I can reproduce the problem too. I'll try to debug the issue. Maybe it is related to a missing DLL or something like this.

Matthias

[klayoutmatthias]

I found some weird behavior: the problem is caused by "libcrypto-3-x64.dll". This library isn't missing, but it appears to be working only when installed in the original MSYS2 location.

I'll keep debugging ...

Matthias

[klayoutmatthias]

It's a certificate issue. I just need to figure out how to include them in the Windows distribution.

[klayoutmatthias]

Got it ... the trusted CA's are not read.

Here is a quick workaround: unzip the attached archive and copy the file cert.pem (taken from MSYS2) to some place and set the 'SSL_CERT_FILE' environment variable to contain the path to this file.

cert.zip

[mzdustpho]

Encountered this issue on Klayout 0.28.17 64bit on windows 11 Pro 23H2. Your suggested work around solved the issue.
Klayout is installed as Admin.
Thank You.

[joamatab]

Can we fix this? we've seen other gdsfactory uers installing packages

[klayoutmatthias]

cert.pem should be included now in the installation (since 0.28.14). I just confirm again, that you can install without admin privileges and installation of packages from http+git works.

So is that a glitch or a real issue?

Matthias

[sebastian-goeldi]

This seems to be a real issue. Joaquin and I saw it with a user. Klayout was on 0.28.17, but still got the ssl error about github. We didn't try to use the workaround though (we just resorted to manually install the package.

Could this be an issue with existing klayout and upgrade vs completely fresh install?

[klayoutmatthias]

I tried a wipe and re-install. I am not sure if the problem can be caused by other certificates present on the system. I understand that OpenSSL uses their own certificate management, but I think you can fool it if you system has SSL_CERT_FILE set to some other place.

I will try another machine without MSYS and no SSL_CERT_FILE environment variable set. But I do not have Windows 11, only 10.

Just to confirm: we're talking about 64bit Windows version, installer.exe taken from the KLayout download site. Right?

[klayoutmatthias]

No success ... klayout-0.28.17-win64-install.exe on Windows 10. Wiped installation & reboot & fresh install. No admin mode. I cleaned the config directory and there is no SSL_CERT_FILE environment variable set. "cert.pem" is installed along with the main binary.

This is a pretty clean and organization-managed system without contamination.

Running KLayout and installing "metainfo_ports 0.0.6" which uses https+git works.

If you encounter the problem, could you check whether "cert.pem" was installed and there is no "SSL_CERT_FILE" environment variable set?

Matthias

[klayoutmatthias]

I just noticed that cert.pem is not included in the .zip file (checked 64bit).

Maybe you installed from there instead from the installer .exe? That might explain the problem.

Matthias

[mzdustpho]

Hi Matthias,

I've used klayout-0.28.17-win64-install.exe for the installation.

[klayoutmatthias]

And cert.pem is there?

[klayoutmatthias]

@mzdustpho You said the workaround solved the problem. So you copied cert.pem? Which means it was not there?

I can't reproduce the problem on my side, so you need to help. My day had 14 hours already, debugging all kind of weird technical issues, and frankly, I am not in a mood for guesswork.

Did you set the SSL_CERT_FILE variable? Does the problem appear again when you remove or rename that variable? Can you check whether you might have two installations - one in your user mode and one in admin mode (search for "klayout_app.exe" on your entire system)? Can the problem be reproduced in a clean Windows installation (i.e. VM)?

Matthias

[sebastian-goeldi]

I also just tried in a completely fresh VM on windows10. I even installed Anaconda because I thought that might be the culprit. Couldn't get the issue to manifest. Our case was on Win10. But I cannot confirm whether another user might not have set the SSL_CERT_FILE variable into windows vars before. The machine was a shared VM afaik.

[klayoutmatthias]

Dear all,

people discovered that the Windows .zip files lacked the cert.pem (https://www.klayout.de/forum/discussion/2484/0-29-0-version-can-not-be-launched#latest). I had a bug in the repackaging script after code signing. Honestly I did not have .zip installation on my radar, but I will add that check to my release checklist.

Maybe one of you installed KLayout through the .zip, not the the .exe installer? This may explain the missing file and the connection issue.

I fixed that for 0.29.0.

Best regards,

Matthias