Can't install any PSGallery modules

[benmishkanian]

Steps to reproduce

docker run -it --rm microsoft/powershell pwsh -Command Install-Module InvokeBuild -Force -Verbose

Expected behavior

Module installs successfully

Actual behavior

VERBOSE: Acquiring providers for assembly: /opt/microsoft/powershell/6/Modules/PackageManagement/coreclr/netcoreapp2.0/Microsoft.PackageManagement.MetaProvider.PowerShell.dll
VERBOSE: Acquiring providers for assembly: /opt/microsoft/powershell/6/Modules/PackageManagement/coreclr/netcoreapp2.0/Microsoft.PackageManagement.ArchiverProviders.dll
VERBOSE: Acquiring providers for assembly: /opt/microsoft/powershell/6/Modules/PackageManagement/coreclr/netcoreapp2.0/Microsoft.PackageManagement.CoreProviders.dll
VERBOSE: Acquiring providers for assembly: /opt/microsoft/powershell/6/Modules/PackageManagement/coreclr/netcoreapp2.0/Microsoft.PackageManagement.NuGetProvider.dll
VERBOSE: Using the provider 'PowerShellGet' for searching packages.
VERBOSE: The -Repository parameter was not specified.  PowerShellGet will use all of the registered repositories.
VERBOSE: Getting the provider object for the PackageManagement Provider 'NuGet'.
VERBOSE: The specified Location is 'https://www.powershellgallery.com/api/v2' and PackageManagementProvider is 'NuGet'.
VERBOSE: Searching repository 'https://www.powershellgallery.com/api/v2/FindPackagesById()?id='InvokeBuild'' for ''.
VERBOSE: Total package yield:'1' for the specified package 'InvokeBuild'.
VERBOSE: Performing the operation "Install-Module" on target "Version '5.4.1' of module 'InvokeBuild'".
VERBOSE: The installation scope is specified to be 'AllUsers'.
VERBOSE: The specified module will be installed in '/usr/local/share/powershell/Modules'.
VERBOSE: The specified Location is 'NuGet' and PackageManagementProvider is 'NuGet'.
VERBOSE: Downloading module 'InvokeBuild' with version '5.4.1' from the repository 'https://www.powershellgallery.com/api/v2'.
VERBOSE: Searching repository 'https://www.powershellgallery.com/api/v2/FindPackagesById()?id='InvokeBuild'' for ''.
VERBOSE: InstallPackage' - name='InvokeBuild', version='5.4.1',destination='/tmp/1647089731'
VERBOSE: DownloadPackage' - name='InvokeBuild', version='5.4.1',destination='/tmp/1647089731/InvokeBuild.5.4.1/InvokeBuild.5.4.1.nupkg', uri='https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1'
VERBOSE: Downloading 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1'.
VERBOSE: The SSL connection could not be established, see inner exception.
VERBOSE: Retry downloading 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' for '2' more times
VERBOSE: The SSL connection could not be established, see inner exception.
VERBOSE: Retry downloading 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' for '1' more times
VERBOSE: The SSL connection could not be established, see inner exception.
VERBOSE: Retry downloading 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' for '0' more times
VERBOSE: Downloading package 'InvokeBuild' failed, please make sure 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' is accessable.
WARNING: Source Location 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' is not valid.
PackageManagement\Install-Package : Package 'InvokeBuild' failed to download.
At /opt/microsoft/powershell/6/Modules/PowerShellGet/PSModule.psm1:9491 char:21
+ ...          $null = PackageManagement\Install-Package @PSBoundParameters
+                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : ResourceUnavailable: (/tmp/1647089731...ild.5.4.1.nupkg:String) [Install-Package], Exception
+ FullyQualifiedErrorId : PackageFailedInstallOrDownload,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Environment data

> docker info
Containers: 54
 Running: 0
 Paused: 0
 Stopped: 54
Images: 72
Server Version: 18.06.1-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 468a545b9edcd5932818eb9de8e72413e616e86e
runc version: 69663f0bd4b60df09991c08812a60108003fa340
init version: fec3683
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.9.93-linuxkit-aufs
Operating System: Docker for Windows
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.934GiB
Name: linuxkit-00155da7f50f
ID: S5MF:PD6Y:BMLE:UW34:PUCA:X7EO:N37P:GFSC:TKJ7:ZFJM:3ZXE:IWO2
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 22
 Goroutines: 47
 System Time: 2018-09-24T23:16:23.6033013Z
 EventsListeners: 1
Registry: https://index.docker.io/v1/
Labels:
Experimental: true
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      5.1.15063.1266
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.15063.1266
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[anmenaga]

powershellgallery had a problem recently; they've fixed it yesterday.
I've just tried your repro - at this moment it works for me.
Please try again.

[benmishkanian]

Thank you for your response. I tried again today and it still gave the same error, but I noticed something odd: Running this Docker command on another machine works fine. Running the powershell command on the original machine outside of Docker also works. I am not sure what could be causing this but it seems like the issue only manifests when running the Docker container on my original machine.

[TravisEz13]

Running latest linux image with the same command I get

VERBOSE: Module 'InvokeBuild' was installed successfully to path '/usr/local/share/powershell/Modules/InvokeBuild/5.4.1'.

[benmishkanian]

Thanks. It seems it works on most machines except this one I have. But I'm not sure what is causing this since the Docker container should behave similarly regardless of the host machine. Any idea how to troubleshoot it?

[edyoung]

Try docker -it and see if you can repro the issue manually. Try to see if you can reach any web site, etc

[TravisEz13]

Yeah, looking at the logs it looks like there is a networking issue:

VERBOSE: The SSL connection could not be established, see inner exception.
VERBOSE: Retry downloading 'https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1' for '2' more times

[benmishkanian]

It seems there is some kind of SSL certificate issue:

PS C:\> docker run -it --rm microsoft/powershell pwsh
PowerShell 6.1.0
Copyright (c) Microsoft Corporation. All rights reserved.

https://aka.ms/pscore6-docs
Type 'help' to get help.

PS /> curl -O -L https://www.powershellgallery.com/api/v2/package/InvokeBuild/5.4.1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   200  100   200    0     0    430      0 --:--:-- --:--:-- --:--:--   430
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
PS />

curl is able to download the package if --insecure is passed. However, on the machine that does not have problems, the above curl command works without giving any warning.

I believe the CAs used to validate the certificate are part of the Docker image, so I am not sure how this is breaking.

[rjmholt]

Could it be a time setting? If the clock in the container is set wrong, you might see a failure like this.

[benmishkanian]

The clock in the container appears to be correct.

PS /> date
Mon Oct  8 20:27:37 UTC 2018

[TravisEz13]

Can you run the following on the affected machine?

docker run -it microsoft/powershell /bin/bash
openssl s_client -showcerts -connect www.powershellgallery.com:443 </dev/null 2>/dev/null |openssl x509 -outform PEM >mycertfile.pem
cat mycertfile.pem

And send the results?

I'm going to examine the pem file with openssl x509 -noout -text -in <file> .

[TravisEz13]

BTW, mcr.microsoft.com/powershell is where we host the images now, only some images are then replicated to docker hub.

[benmishkanian]

PS C:\> docker run -it microsoft/powershell /bin/bash
root@5d8e0e53b824:/# openssl s_client -showcerts -connect www.powershellgallery.com:443 </dev/null 2>/dev/null |openssl x509 -outform PEM >mycertfile.pem
root@5d8e0e53b824:/# cat mycertfile.pem
-----BEGIN CERTIFICATE-----
MIIJlzCCB3+gAwIBAgITewACwf4qfxOIsjFRJAAAAALB/jANBgkqhkiG9w0BAQsF
ADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT
B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UE
CxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEw
HhcNMTgwOTA1MjM0NTM4WhcNMjAwOTA1MjM0NTM4WjAkMSIwIAYDVQQDExl3d3cu
cG93ZXJzaGVsbGdhbGxlcnkuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAwxqMleiwp+uho3PvWuRwg2cQxIL/nLRzrcbUHlGoBgQPaOiIpJgn6w7y
c7i0IFljrrptBZ4+SB23QpVShjplF1JhpIlXD0fdP0PRKWaBzndgtUZuAxe3n3hJ
1r0bl1Prz7UVYtBc3ct2s59e6UTWHiBwLjQhfhIMJxTbxo8xhv9vXp6cFFQczm2s
kzMRqf/APAATNVrJzybH7Bz/q8qVfgC2FkJ3n/j29YZy6tgeK+uN5Wnfa3b6mvdC
WyQeVPko0u4kRHH4cUBB/onvvdYOa8dFp/e0+qLlhWbjPGptItkrQPwufSO0nZSa
cnwIrc835lqsLbKSEi1pvQpvE6KjYQIDAQABo4IFWDCCBVQwggH3BgorBgEEAdZ5
AgQCBIIB5wSCAeMB4QB2AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3L
AAABZawpxiUAAAQDAEcwRQIgFxZmw3IlfYtaD0Us4itsBF3UP4tnLM3LajZ/JEVc
li8CIQD00H+c4JR+uIkgM8uJZZAXz3QKyxON4yMzBq93Ea533QB3ALvZ37wfinG1
k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABZawpxbAAAAQDAEgwRgIhANcrta/M
9A72JO0u+5T/K5gZeBgayr/3cdVjA2gEjjMTAiEAwNRUlfRrS4i7MooRIy77veY2
CNXyW1Yh+enEi2NvzbsAdgCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3c
EAAAAWWsKcYOAAAEAwBHMEUCIFpz7rD0uyI66ia+5dAIObBt/mjRAJ5wuI6nVQq7
yQo3AiEAnskHnzwYuza+QZ9RNqP8LE93SURybhChFxWQjt19tW0AdgDwlaRZ8gDR
gkAQLS+TiI6tS/4dR+OZ4dA0prCoqo6ycwAAAWWsKcYHAAAEAwBHMEUCIQCoXwpv
V6BwEQb6Ac3Y/O9L73FTM455l+XPcGQnWuaQOgIgUpIkRxpW4v/AZUBVmo32WGXG
vEE6RkVVV4gqkckjsrYwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggr
BgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuB
tZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEF
BQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9z
b2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8v
b2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBS/uqvbnvOtGW02MBwull2+vhh6YTAL
BgNVHQ8EBAMCBLAwgfsGA1UdEQSB8zCB8IIdcHJldmlldy5wb3dlcnNoZWxsZ2Fs
bGVyeS5jb22CH3BzZy1wcm9kLWNlbnRyYWx1cy5jbG91ZGFwcC5uZXSCHHBzZy1w
cm9kLWVhc3R1cy5jbG91ZGFwcC5uZXSCIXd3dy5wcmV2aWV3LnBvd2Vyc2hlbGxn
YWxsZXJ5LmNvbYIcbXNjb25maWdnYWxsZXJ5LmNsb3VkYXBwLm5ldIIdbXNjb25m
aWdnYWxsZXJ5Mi5jbG91ZGFwcC5uZXSCFXBvd2Vyc2hlbGxnYWxsZXJ5LmNvbYIZ
d3d3LnBvd2Vyc2hlbGxnYWxsZXJ5LmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGY
hktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNy
b3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9z
b2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENB
JTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYn
aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQY
MBaAFFiIn9bcnEgitxQ+/4SI6OaF//p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggr
BgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAWI/uANYMYQTyOpLWVp7svNFyGrR3
qjC4ym6vEm8S/d0IV+TfycsUg1L75bM1/g7xqKHxAzmyI2kaJwt1NOoyVGXjQh12
owU880V2Hx+L+K0CQCBUBNghppgRSfjzvv1PFmc8U3e7eCgBP0Z5bK4xHeQtYnvw
uzhxdz8y87dAWyN2qP7d29Jq01rNv5oDvmk8EvlIHAXdgD/N2OfCAIch4IveVozS
QDqlCrwLrC3h3lLeXzWfvgG0QYEG4XoUYGCBLneQNnJlruIccb+Nsh6z9cFxSn9Q
vGhbE3C8SGWuBdQq5lvt/uTK2FuBINpE4XPIXvJpeALE5B/mqhHPQjzy6xDnUwOU
RFVCZLQ4RoHjA/AT8PsQuCZYqHR3jX0GQtRpdirnI3QBaBKb1fnOR0uDTXynC5ap
mzeS4w+I0hu/yIX5Fe03cqVXJ4CncP0h1Lrke3h0i9vywT9fFRCnmpgId5QY13ZY
XSKBpMfwnRwXJCs2KZpnENtXneOIpYC1I28pLJYolRgU0taY5rGqyVxu4Rpc9m8j
/38pOU76qrwnG/rtmU5zVWuSG033Kagwu2uIWsk1cit1b7AP+svEn08zsPC374cn
eFXZoXW3HxhrXyJJu8hn0EAV16r1GY99+LTbC8ReKkFW2P0ks/fVRYAmCx//6tYT
j0VADbSUDY/QvWs=
-----END CERTIFICATE-----

[TravisEz13]

That is the correct cert. Let's make sure you are running the correct container.

Can your run the following in PowerShell on your host and send the output?

docker inspect microsoft/powershell | sls '"Id"'
docker inspect microsoft/powershell | sls 'org\.label-schema\.[vd]'

The id will give me the hash of the image you are running. Hopefully, I will be able to repro the issue just with this information.

org.label-schema.vcs-ref will tell me the commit hash used to build the image.
org.label-schema.docker.cmd will verify you are running the image I think you are running.

[benmishkanian]

PS C:\> docker inspect microsoft/powershell | sls '"Id"'

        "Id": "sha256:91e5725258dc0d7c22f558f887b39c3bcddcf2731ab57eb79623916dabaff2f0",


PS C:\> docker inspect microsoft/powershell | sls 'org\.label-schema\.[vd]'

                "org.label-schema.docker.cmd": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c ''",
                "org.label-schema.docker.cmd.devel": "docker run mcr.microsoft.com/powershell:ubuntu16.04",
                "org.label-schema.docker.cmd.help": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c Get-Help",
                "org.label-schema.docker.cmd.test": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c Invoke-Pester",
                "org.label-schema.vcs-ref": "1aeb06f",
                "org.label-schema.vcs-url": "https://github.com/PowerShell/PowerShell-Docker",
                "org.label-schema.vendor": "PowerShell",
                "org.label-schema.version": "6.1.0",
                "org.label-schema.docker.cmd": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c ''",
                "org.label-schema.docker.cmd.devel": "docker run mcr.microsoft.com/powershell:ubuntu16.04",
                "org.label-schema.docker.cmd.help": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c Get-Help",
                "org.label-schema.docker.cmd.test": "docker run mcr.microsoft.com/powershell:ubuntu16.04 pwsh -c Invoke-Pester",
                "org.label-schema.vcs-ref": "1aeb06f",
                "org.label-schema.vcs-url": "https://github.com/PowerShell/PowerShell-Docker",
                "org.label-schema.vendor": "PowerShell",
                "org.label-schema.version": "6.1.0",