OSX Yosemite curl issue - nvm 0.23.3 ls-remote returns N/A

[SBero]

On OSX Yosemite, with a fresh install of nvm, when I run nvm ls-remote it returns N/A.

When I did a manual call of curl $NVM_NODEJS_ORG_MIRROR it returned an SSL Self Signed Certificate in Chain error. Running that same command again with the -k option, showed that it is a 301 redirect, which I assume is correct.

I resolved this bug by adding a -k to the nvm_download function line 35:

  if nvm_has "curl"; then
    curl -k $*

The NVM_NODEJS_ORG_MIRROR variable is set to https://nodejs.org/dist just in case anyone was wondering.

I've verified all of the certificates in my system are good. This issue seems to only be effecting Yosemite, as I've tried it on Mavericks with 0.23.3 without issues.

Other than switching the urls to being both http, not sure if/when this would be resolved in Yosemite.

[ljharb]

Interesting - I have Yosemite and have never run across this issue. Can you provide the full error text of what happens without the -k?

[SBero]

Sure:

# curl $NVM_NODEJS_ORG_MIRROR
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

[ljharb]

Do you have the default curl, or did you perhaps update it from homebrew or something?

-k is not a good idea. I'm pretty confident that your SSL CA's aren't actually up to date if you're getting this error.

[SBero]

What's bizarre though, is going through Safari Browser shows everything fine with the Certs.

I agree, -k is not a good option, obviously http would be the preferred manner to access the dist. lists over -k.

doing brew list doesn't show any

doing curl --version renders:

curl 7.30.0 (x86_64-apple-darwin10.0.0) libcurl/7.30.0 OpenSSL/1.0.1i zlib/1.2.8
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP

I also checked to be sure I had no MacPort of curl installed, and I don't have that installed either...

Is your curl version/details the same as mine?

[ljharb]

Mine is:

$ curl --version
curl 7.37.1 (x86_64-apple-darwin14.0) libcurl/7.37.1 SecureTransport zlib/1.2.5
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp 
Features: AsynchDNS GSS-Negotiate IPv6 Largefile NTLM NTLM_WB SSL libz 

so it looks like you do have an old one. Do you have all the Apple security updates installed? They likely updated curl and openssl post-heartbleed.

[SBero]

So I figured it out. I figured something was overriding it in my .bash_profile. Had to look at every entry in my .bash_profile.

XAMPP includes a copy of curl in its bin directory, which is the old 7.30.0 version. I just renamed the curl binary in the /Applications/XAMPP/xamppfiles/bin directory and it brought me to 7.37.1.

Now nvm ls-remote works properly with the https urls. Thanks for the help!

[ljharb]

ah ha, glad you figured it out :-) Thanks for working through it!