install errors on Centos-7.2 Linux

[fredex]

Downloading tarball signature securely...
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "<string>", line 670, in main
File "<string>", line 655, in run_installer
File "<string>", line 627, in download_and_extract
File "<string>", line 619, in get_tarball_info
File "<string>", line 578, in get_https_resource_securely
File "<string>", line 487, in __init__
File "/usr/lib64/python2.7/httplib.py", line 1182, in __init__
context.load_cert_chain(cert_file, key_file)
ssl.SSLError: [SSL] PEM lib (_ssl.c:2757)

is there a known solution? All advice welcome!

thanks in advance.

[gbm]

Originally Posted by fredex

Downloading tarball signature securely...
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "<string>", line 670, in main
File "<string>", line 655, in run_installer
File "<string>", line 627, in download_and_extract
File "<string>", line 619, in get_tarball_info
File "<string>", line 578, in get_https_resource_securely
File "<string>", line 487, in __init__
File "/usr/lib64/python2.7/httplib.py", line 1182, in __init__
context.load_cert_chain(cert_file, key_file)
ssl.SSLError: [SSL] PEM lib (_ssl.c:2757)\


is there a known solution? All advice welcome!

thanks in advance.

From the release notes for CentOS-7

NSS no longer accepts DH key parameters < 768 nor RSA/DSA  certificates with key sizes < 1024 bits, NSS also now enables  TLS1.1/1.2 by default

You will have to do the manual install.

bernie

[kovidgoyal]

Originally Posted by gbm

From the release notes for CentOS-7

NSS no longer accepts DH key parameters < 768 nor RSA/DSA  certificates with key sizes < 1024 bits, NSS also now enables  TLS1.1/1.2 by default

None of those apply here. The key is 4096 bytes long. The server uses DH size of 2048 and the server most definitely supports TLS 1.1 and 1.2.

More likely that the ssl python module provided by the distro is broken. But yes, the easiest fix is to just download the tarball manually and install it, as is described on the download page.

[kovidgoyal]

And to prove what I said in the previous post:

https://www.ssllabs.com/ssltest/anal...ibre-ebook.com

which confirms everything.

I'd guess the problem is either

1) Broken ssl module

2) The private CA certificate is signed with SHA1

[kovidgoyal]

This https://github.com/kovidgoyal/calibr...ed34c1be6df481

updates the CA certificate to use a SHA256 signature. So if you still experience the issue, the remaining possibility is a broken ssl module.

[fredex]

Someone on the Centos users mailing list replied that he believes there has been an API change in Python 2.7, although he didn't give specifics.

If that's true, then it's not so much a python/packaging bug, but a "feature" that Calibre may need to accommodate.

Sorry, I'd gladly provide details if I had 'em.

I did the manual install and it did the job, so I'm all set for now.

thanks, Kovid!

[kovidgoyal]

The API change was in python 2.7.9 and calibre has supported it since before 2.7.9 was released, which was years ago.

[eschwartz]

calibre does of course support the actual python releases.

IIRC, there are also, workarounds for debian's "brilliant decision to partially backport patches" from 2.7.9 --> 2.7.8
Maybe this is more of the same? So the question would be, what stupid thing has CentOS done to the SSL module?

...

See, this is why I love Arch Linux. They may sometimes play games, but they usually manage to avoid pratfalls like this.

[fredex]

Looks like Centos-7 has Python 2.7.5. But given that it's a RedHat rebuild, and has all the same files/patches, Red Hat, in their wisdom, has probably backported the patch(es) involved here. In most cases when they do that it's not a usability issue, but this one is.

Sigh.

At least it is installed and apparently working now. Might there be other circumstances where this issue causes trouble in Calibre usage, as time goes by??

Thanks!

[eschwartz]

calibre includes its own unpatched bundled copy of python 2.7.9, it only relies on the system python for the one-line installer.

You can of course use "calibre-debug" instead of "python2" in the one-line install command.