cloning ssl error

[kghenderson]

Describe the bug
Attempting to clone the Bikes Tutorial DB from TerminusHub using the Terminus desktop app on Fedora 33 Linux.

Repository fails to clone with error:

Error: ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed') [46] throw(error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),_12004)) [44] catch(http:http_protocol_hook(https,...,<stream>(0x7f8110010150,0x7f81100106a0),_12064,...),error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),_12072),http_open:(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:531 [43] http_open:try_http_proxy(direct,[uri('https://hub.terminusdb.com/api/pack/kevin/bikes'),...|...],_12134,'<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/library/http/http_open.pl:448 [41] http_client:http_get('https://hub.terminusdb.com/api/pack/kevin/bikes',_12190,[post(...),...|...]) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/library/http/http_client.pl:139 [39] db_fetch:authorized_fetch('Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InhrMEZTOTdVWVFvbHB4ODREeFlpeCJ9.eyJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSNhZ2VudF9uYW1lIjoia2doZW5kZXJzb24iLCJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSN1c2VyX2lkZW50aWZpZXIiOiJrZXZpbkBrZ2hlbmRlcnNvbi5jb20iLCJpc3MiOiJodHRwczovL3Rlcm1pbnVzZGIuZXUuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVmZWRmZTIwMzkxOWJjMDA3NmE2Y2U2OSIsImF1ZCI6WyJodHRwczovL3Rlcm1pbnVzZGIuY29tL2h1YnNlcnZpY2VzIiwiaHR0cHM6Ly90ZXJtaW51c2RiLmV1LmF1dGgwLmNvbS91c2VyaW5mbyJdLCJpYXQiOjE2MTEyNDcxMDksImV4cCI6MTYxMTI4MzEwOSwiYXpwIjoiNEVZSUhRYVZMZ3dpNVY1bTJnUk5ZZHRwWlpmYnd0RHoiLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIn0.hD6DoOAMj790oN3yzcXWatGR7mbn3oto_vd7kmWy_mobmXwNTQVmOUwNr2Ha-Yd1r6ysqfwipl7aNR-FG3GbmwNyVOleZL8THoiF8jp1p6jKsanzhGUw4Q_EDPNWv7brcdkoWtcKZqEg1ZshE7AZhaOZUoLYMX64Cq_uKe6Y7tcKmGf34CoD-pBu6I56s9OGMdk8gS0CWm4FwJYVfYppUjvdbnrW0mY_tW3644OWwOI_N_V_X3-_wqrxj7TfHKhlvzXdcKUId3Pa9RldKF7Mn-pqJAJVkNDybvEl423kxJ73lT01i46ovoBq60-picfQLJCC0_RfqNctONg8siFpkw','<garbage_collected>',none,_12250) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_fetch.pl:75 [38] '<meta-call>'('<garbage_collected>') <foreign> [37] database:with_transaction_(query_context{all_witnesses:false,authorization:'terminusdb:///system/data/admin',bindings:[],default_collection:database_descriptor{database_name:"bikes",organization_name:"admin"},files:[],filter:type_filter{types: ...},prefixes:_12392{api:'http://terminusdb.com/schema/api#',doc:'terminusdb:///repository/data/',layer:'http://terminusdb.com/schema/layer#',owl:'http://www.w3.org/2002/07/owl#',rdf:'http://www.w3.org/1999/02/22-rdf-syntax-ns#',rdfs:'http://www.w3.org/2000/01/rdf-schema#',ref:'http://terminusdb.com/schema/ref#',repo:'http://terminusdb.com/schema/repository#',system:'http://terminusdb.com/schema/system#',terminus:'http://terminusdb.com/schema/system#',vio:'http://terminusdb.com/schema/vio#',woql:'http://terminusdb.com/schema/woql#',xdd:'http://terminusdb.com/schema/xdd#',xsd:'http://www.w3.org/2001/XMLSchema#'},selected:[],system:system_descriptor{},transaction_objects:[...],update_guard:_12366,write_graph:repo_graph{database_name:"bikes",name:"main",organization_name:"admin",type:instance}},db_fetch:(...,...),_12324) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/transaction/database.pl:213 [36] setup_call_catcher_cleanup(database:true,database:with_transaction_(...,...,_12554),_12532,database:(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:612 [32] db_clone:clone_('<garbage_collected>','terminusdb:///system/data/admin',admin,bikes,'<garbage_collected>','<garbage_collected>',false,'<garbage_collected>','<garbage_collected>',_12620) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_clone.pl:55 [31] setup_call_catcher_cleanup(db_clone:true,db_clone:clone_(...,'terminusdb:///system/data/admin',admin,bikes,"TerminusDB Bikes Tutorial","This is the knowledge graph produced by the TerminusDB Bikes Tutorial which is commonly used as an introduction to TerminusDB. This database contains the final results in a format that you can clone complete with all of the data and structure intact so that you don't have to do it yourself. ",false,"https://hub.terminusdb.com/kevin/bikes",...,_12690),exception(_12694),db_clone:(...;true)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:612 [30] db_clone:clone('<garbage_collected>','terminusdb:///system/data/admin',admin,bikes,'<garbage_collected>','<garbage_collected>',false,'<garbage_collected>','<garbage_collected>','<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_clone.pl:17 [29] '<meta-call>'('<garbage_collected>') <foreign> [28] catch(routes:(...,...),error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),context(_12860,_12862)),routes:do_or_die(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:530 [27] catch_with_backtrace('<garbage_collected>','<garbage_collected>','<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:580 Note: some frames are missing due to last-call optimization. Re-run your program in debug mode (:- debug.) to get more detail.less
{
  "data": {
    "api:message": "Error: ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed')\n  [46] throw(error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),_12004))\n  [44] catch(http:http_protocol_hook(https,...,<stream>(0x7f8110010150,0x7f81100106a0),_12064,...),error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),_12072),http_open:(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:531\n  [43] http_open:try_http_proxy(direct,[uri('https://hub.terminusdb.com/api/pack/kevin/bikes'),...|...],_12134,'<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/library/http/http_open.pl:448\n  [41] http_client:http_get('https://hub.terminusdb.com/api/pack/kevin/bikes',_12190,[post(...),...|...]) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/library/http/http_client.pl:139\n  [39] db_fetch:authorized_fetch('Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InhrMEZTOTdVWVFvbHB4ODREeFlpeCJ9.eyJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSNhZ2VudF9uYW1lIjoia2doZW5kZXJzb24iLCJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSN1c2VyX2lkZW50aWZpZXIiOiJrZXZpbkBrZ2hlbmRlcnNvbi5jb20iLCJpc3MiOiJodHRwczovL3Rlcm1pbnVzZGIuZXUuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVmZWRmZTIwMzkxOWJjMDA3NmE2Y2U2OSIsImF1ZCI6WyJodHRwczovL3Rlcm1pbnVzZGIuY29tL2h1YnNlcnZpY2VzIiwiaHR0cHM6Ly90ZXJtaW51c2RiLmV1LmF1dGgwLmNvbS91c2VyaW5mbyJdLCJpYXQiOjE2MTEyNDcxMDksImV4cCI6MTYxMTI4MzEwOSwiYXpwIjoiNEVZSUhRYVZMZ3dpNVY1bTJnUk5ZZHRwWlpmYnd0RHoiLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIn0.hD6DoOAMj790oN3yzcXWatGR7mbn3oto_vd7kmWy_mobmXwNTQVmOUwNr2Ha-Yd1r6ysqfwipl7aNR-FG3GbmwNyVOleZL8THoiF8jp1p6jKsanzhGUw4Q_EDPNWv7brcdkoWtcKZqEg1ZshE7AZhaOZUoLYMX64Cq_uKe6Y7tcKmGf34CoD-pBu6I56s9OGMdk8gS0CWm4FwJYVfYppUjvdbnrW0mY_tW3644OWwOI_N_V_X3-_wqrxj7TfHKhlvzXdcKUId3Pa9RldKF7Mn-pqJAJVkNDybvEl423kxJ73lT01i46ovoBq60-picfQLJCC0_RfqNctONg8siFpkw','<garbage_collected>',none,_12250) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_fetch.pl:75\n  [38] '<meta-call>'('<garbage_collected>') <foreign>\n  [37] database:with_transaction_(query_context{all_witnesses:false,authorization:'terminusdb:///system/data/admin',bindings:[],default_collection:database_descriptor{database_name:\"bikes\",organization_name:\"admin\"},files:[],filter:type_filter{types: ...},prefixes:_12392{api:'http://terminusdb.com/schema/api#',doc:'terminusdb:///repository/data/',layer:'http://terminusdb.com/schema/layer#',owl:'http://www.w3.org/2002/07/owl#',rdf:'http://www.w3.org/1999/02/22-rdf-syntax-ns#',rdfs:'http://www.w3.org/2000/01/rdf-schema#',ref:'http://terminusdb.com/schema/ref#',repo:'http://terminusdb.com/schema/repository#',system:'http://terminusdb.com/schema/system#',terminus:'http://terminusdb.com/schema/system#',vio:'http://terminusdb.com/schema/vio#',woql:'http://terminusdb.com/schema/woql#',xdd:'http://terminusdb.com/schema/xdd#',xsd:'http://www.w3.org/2001/XMLSchema#'},selected:[],system:system_descriptor{},transaction_objects:[...],update_guard:_12366,write_graph:repo_graph{database_name:\"bikes\",name:\"main\",organization_name:\"admin\",type:instance}},db_fetch:(...,...),_12324) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/transaction/database.pl:213\n  [36] setup_call_catcher_cleanup(database:true,database:with_transaction_(...,...,_12554),_12532,database:(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:612\n  [32] db_clone:clone_('<garbage_collected>','terminusdb:///system/data/admin',admin,bikes,'<garbage_collected>','<garbage_collected>',false,'<garbage_collected>','<garbage_collected>',_12620) at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_clone.pl:55\n  [31] setup_call_catcher_cleanup(db_clone:true,db_clone:clone_(...,'terminusdb:///system/data/admin',admin,bikes,\"TerminusDB Bikes Tutorial\",\"This is the knowledge graph produced by the TerminusDB Bikes Tutorial which is commonly used as an introduction to TerminusDB. This database contains the final results in a format that you can clone complete with all of the data and structure intact so that you don't have to do it yourself. \",false,\"https://hub.terminusdb.com/kevin/bikes\",...,_12690),exception(_12694),db_clone:(...;true)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:612\n  [30] db_clone:clone('<garbage_collected>','terminusdb:///system/data/admin',admin,bikes,'<garbage_collected>','<garbage_collected>',false,'<garbage_collected>','<garbage_collected>','<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/share/terminusdb/core/api/db_clone.pl:17\n  [29] '<meta-call>'('<garbage_collected>') <foreign>\n  [28] catch(routes:(...,...),error(ssl_error('1416F086','SSL routines',tls_process_server_certificate,'certificate verify failed'),context(_12860,_12862)),routes:do_or_die(...,...)) at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:530\n  [27] catch_with_backtrace('<garbage_collected>','<garbage_collected>','<garbage_collected>') at /tmp/.mount_.org.cdCakCk/usr/lib/swi-prolog/boot/init.pl:580\n\nNote: some frames are missing due to last-call optimization.\nRe-run your program in debug mode (:- debug.) to get more detail.\n\n",
    "api:status": "api:server_error",
    "end": "2021-01-21T16:40:32.348Z",
    "start": "2021-01-21T16:40:32.348Z",
    "duration": "2021-01-21T16:40:32.348Z"
  }
}

[rrooij]

Thanks for your bug report! Which version of terminusdb-desktop are you running? The latest 4.1.0 release?

[kghenderson]

I downloaded it today, so yes, console version 4.1.1 & server version 4.1.0
I repeated the test with the bank balance example db but same error.
When I restart the application I see both of those db's on the dashboard but they are empty,
When I attempt to do the pull from the 'synchronize' tab, I also get the same error (below):
Not sure if I can run in debug mode seeing as it's an AppImage

Failed to pull updates from origin main to local main (0.065 seconds)
Error: instantiation_error [34] query_context{}:<_21174 [33] ask:create_context(_21214,_21216) at /tmp/.mount_.org.cojBlTI/usr/share/terminusdb/core/query/ask.pl:96 [32] ask:ask(_21252,t(_21260,ref:branch_name,"main"^^ ...),[compress_prefixes(true)]) at /tmp/.mount_.org.cojBlTI/usr/share/terminusdb/core/query/ask.pl:223 [30] descriptor:open_descriptor(branch_descriptor{branch_name:"main",repository_descriptor:repository_descriptor{database_descriptor: ...,repository_name:"origin"}},commit_info{},_21326,[],'<garbage_collected>') at /tmp/.mount_.org.cojBlTI/usr/share/terminusdb/core/transaction/descriptor.pl:508 [27] utils:do_or_die('<garbage_collected>',error(not_a_valid_remote_branch(...),_21402)) at /tmp/.mount_.org.cojBlTI/usr/share/terminusdb/core/util/utils.pl:98 [26] db_pull:pull(transaction_object{descriptor:system_descriptor{},inference_objects:[...],instance_objects:[...],schema_objects:[...]},'terminusdb:///system/data/admin','admin/bikes/local/branch/main','<garbage_collected>','<garbage_collected>',routes:authorized_fetch('Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InhrMEZTOTdVWVFvbHB4ODREeFlpeCJ9.eyJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSNhZ2VudF9uYW1lIjoia2doZW5kZXJzb24iLCJodHRwOi8vdGVybWludXNkYi5jb20vc2NoZW1hL3N5c3RlbSN1c2VyX2lkZW50aWZpZXIiOiJrZXZpbkBrZ2hlbmRlcnNvbi5jb20iLCJpc3MiOiJodHRwczovL3Rlcm1pbnVzZGIuZXUuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVmZWRmZTIwMzkxOWJjMDA3NmE2Y2U2OSIsImF1ZCI6WyJodHRwczovL3Rlcm1pbnVzZGIuY29tL2h1YnNlcnZpY2VzIiwiaHR0cHM6Ly90ZXJtaW51c2RiLmV1LmF1dGgwLmNvbS91c2VyaW5mbyJdLCJpYXQiOjE2MTEyNjQ4MDYsImV4cCI6MTYxMTMwMDgwNiwiYXpwIjoiNEVZSUhRYVZMZ3dpNVY1bTJnUk5ZZHRwWlpmYnd0RHoiLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIn0.xRz6xbmrh_Wku-gSsn22tRJKvtHxKaUAXaVYzNd5xLrAhoI5oCUg8JV8aspJlGP0NQ9LRvPN78ESh9Bce556o9CNiyiFPdj88YFRwhIzgjh6JFUIL8GL1InrqxAxCDiP9UmeieebIV48otAmkk9W0gGM5ko0vNFQyjitGBl9MFcm7i4z_ASqhAQQpQsAqlX3KIJltlzVGP9UTHMG8XkgPBIvdi62j87gXSXpMVWh_B5y_j0S0LTEQgMB2zv5rgMLLBatpzXTrHd65hUpRAOWV-FHoKYSb7QJ-69kiRh6NBXR0Rpn0bv9DsKKIU15wnUQX2p8l0SocSPcrk_EhfsIuA'),_21454) at /tmp/.mount_.org.cojBlTI/usr/share/terminusdb/core/api/db_pull.pl:35 [25] '<meta-call>'('<garbage_collected>') <foreign> [24] catch(routes:(...,...),error(instantiation_error,context(...,_21598)),routes:do_or_die(...,...)) at /tmp/.mount_.org.cojBlTI/usr/lib/swi-prolog/boot/init.pl:530 [23] catch_with_backtrace('<garbage_collected>','<garbage_collected>','<garbage_collected>') at /tmp/.mount_.org.cojBlTI/usr/lib/swi-prolog/boot/init.pl:580 Note: some frames are missing due to last-call optimization. Re-run your program in debug mode (:- debug.) to get more detail.

[kevinchekovfeeney]

Can you try logging out and in again - there was a problem with a certificate on the hub server earlier on and it may have cached a bad jwt configuration if you logged in during the issue

[kghenderson]

Through the desktop app I signed out, closed & reopened the app (for good measure), and signed back in - but still the same error. Just for fun I tried to clone another db and that's still giving me the error as well.

[kghenderson]

Not sure if it matters, but just for fun I logged in to my profile settings on terminusdb.com from both firefox & chromium but didn't get any certificate errors - is there perhaps anything baked into the appimage?

[kghenderson]

I opened localhost connection from an external browser, i.e. not using the app, and am receiving an error - not sure if this is expected, but it might be the cause and/or be related.

[kevinchekovfeeney]

This is a chrome issue - it refuses to accept https connection to 127.0.0.1 - you have to accept the risks.

[kghenderson]

OK, thanks - but to be clear, my issue that that the TerminusDB AppImage won't clone or sync with TerminusHub - I was just trying to explore it a bit further :-)

[luke-feeney]

Are you still having that issue? We saw some problems over the last while, but seem to be resolved (at least on windows and bootstrap!)

[kghenderson]

I tried it again this morning and yes I am.

[kghenderson]

ok, probably not relevant, but when launching the appimage i'm getting an stderr that a port is in use [6363] and another "error" that a database is already initialized in the storage directory. I checked the ports with ss -tl and it wasn't in use. Thinking this could have something to do with the storage directory. I copied the AppImage to another directory and started it from there. This time it starts without the port usage or storage errors, but has the same SSL cloning issue. I was still signed in though, so something is being cached somewhere. I'm not sure where that is yet, but I'll keep plugging.

Here's a screenshot and a clean log for you :-)

httpd.log

[rrooij]

I am able to reproduce your problem in a Fedora Docker container. The problem is specifically caused because the AppImage contains a version of SWI Prolog which uses a Debian base. The Debian SWI Prolog points to a non existing trusted certificates directory.

On Debian:

?- system_root_certificates(X).
X = [<ssl_certificate>(0x561a3dda5180), <ssl_certificate>(0x561a3dce1d90), <ssl_certificate>(0x561a3dce1800), <ssl_certificate>(0x561a3dda8620), <ssl_certificate>(0x561a3ddaa4a0), <ssl_certificate>(0x561a3ddabb40), <ssl_certificate>(0x561a3ddab7f0), <ssl_certificate>(0x561a3ddaedb0), <ssl_certificate>(0x561a3ddaffe0)|...].

?- current_prolog_flag(system_cacert_filename, X).
X = '/etc/ssl/certs/ca-certificates.crt'.

On Fedora:

?- system_root_certificates(X).
X = [].

?- current_prolog_flag(system_cacert_filename, X).
X = '/etc/ssl/certs/ca-certificates.crt'.

[kghenderson]

Nice find 👍

[rrooij]

We fixed the issue on dev. Eventually it should be included in the release.

[luke-feeney]

this is fixed! will be in the next release!