Error after Upgrading to Gleam 1.1.0 -> Invalid Peer Certificate: UknownIssuer

[RNGKing]

I'm submitting this report from my home computer so there isn't a log I can pull from.

My work computer is a virtual desktop with Windows 10 that routes its connections through a corporate proxy. Installed gleam via Scoop.

When attempting to use "gleam build" after updating from 1.0 the system gave me the error as shown in the title.

I have set the $env:http_proxy and $env:https_proxy in my environment to their correct values, as I'm able to update rust and install various things through the cargo utility.

[lpil]

Hello! We don't have any special support for proxies etc so this is not a bug.

What would you need for us to be able to support you?

[kitoid]

Hi Louis!

I'm having the same issue as well. Our corporate firewall acts as a transparent proxy and decrypts all traffic for security inspection, replacing the certificate chain with its own root certificates in order to be able to perform decryption.

In my environment, I installed gleam using scoop, and when I run any gleam command, I get the following error:

> gleam update
  Resolving versions
error: Dependency resolution failed

An error occurred while determining what dependency packages and
versions should be downloaded.
The error from the version resolver library was:

Unable to determine package versions: error sending request for url
(https://repo.hex.pm/packages/gleeunit): error trying to connect: invalid
peer certificate: UnknownIssuer

To be fair, I agree this is not a bug, but probably should be considered as a feature request (to be able to ignore certificate errors, or to add the possibility to specify the location of trusted certificates).

I was experiencing the same issue with git command, and in git they offer the possibility to use the Windows certificate storage mechanism:
https://stackoverflow.com/questions/16668508/how-do-i-configure-git-to-trust-certificates-from-the-windows-certificate-store

Thanks for your help!

[lpil]

What is it that is required to support your needs here? We currently will not be able to use any Windows specific APIs, but perhaps a cert could be provided in some other way.

[kitoid]

Maybe we can draw inspiration from git and add a "gleam config" command to allow for these tooling customization use cases.

For the specific issue at hand, here is a reference on how git solves this issue:
https://stackoverflow.com/questions/9072376/configure-git-to-accept-a-particular-self-signed-server-certificate-for-a-partic

In a nutshell, it allows to configure trusted certificates:
git config --global http.sslCAInfo /path/to/my/trusted/cert.pem

And list any configuration settings (including trusted certificates) you may already have:
git config --global --list

Of course, adding a "gleam config" option would open a can of worms for bug reporting, since then we would add a local config state to the list of things that can change your gleam behavior, which right now includes gleam version, code base, underlying BEAM version, etc.

[chvish]

I am interested in this as well. Rebar for example provides an option to override the certificate path using the 'ssl_cacerts_path' config. Would be very useful to have an option to either override the certificate path.

[MrDwarf7]

This issue is something I'm also directly experiencing.
I write a lot of Rust code for work and wanted to try out Gleam for certain conditions due to the potential in development speed and ergonomics and this is a complete blocker for me as I'm unable to even run a gleam test due to being unable to resolve any dependencies.

I believe if there's any application with corporate space then this will be important to address.

[kitoid]

In Elixir I was experiencing a similar issue when using mix, when retrieving Hex dependencies. The way I solved it was by using the HEX_CACERTS_PATH environment variable to point to the custom certificate store, or using "mix hex.config cacerts_path /your/certificate/store.pem".

See more here:
https://hexdocs.pm/hex/Mix.Tasks.Hex.Config.html

As I was mentioning in a previous comment, that would likely require a "gleam config" command to be added.

[lpil]

Fab, let's support an environment variable for this. Would you mind making an issue please @kitoid ?

[kitoid]

Done, the issue is available here: #3246 😄