Pub 'get' always fails with: 'Failed NSS_Init call'

[DartBot]

Originally opened as dart-lang/sdk#15364

This issue was originally filed by [email protected]

---

What steps will reproduce the problem?

1. Download DartEditor x64 for Windows (Win 8)
2. Create new web app project.
3. Run 'pub get' as is or add some dependencies first (result is the same)

What is the expected output? What do you see instead?

Expected 'pub' to install dependencies. Failed and spat out the error: 'Resolving dependencies...Failed NSS_Init call.' See in attached file 'pub_get.txt'.

Ran 'pub get' with the '--trace' flag for more info, see file 'pub_get_trace.txt' for trace log.

What version of the product are you using? On what operating system?

Dart Editor version 1.0.0_r30188 (STABLE)
Dart SDK version 1.0.0.3_r30188

Please provide any additional information below.

Same problem with pre-1.0 DartSDK:
http://stackoverflow.com/questions/19842419/problems-getting-started-with-dart-and-using-dart-editor

---

Attachments:
pub_get.txt (400 Bytes)
pub_get_trace.txt (1.54 KB)

[DartBot]

<img src="https://avatars.githubusercontent.com/u/2156198?v=3" align="left" width="48" height="48"hspace="10"> Comment by kasperl

---

Assigning to Area-Pub, but CC'ing a few dart:io folks. This is probably not a pub issue.

---

cc @whesse.
cc @sgjesse.
Added Area-Pub, Triaged labels.

[DartBot]

This comment was originally written by [email protected]

---

I tested the same DartEditor package on my personal laptop and 'pub' works fine, both from the command line and inside the IDE.

The only difference between the two was that the path where I extracted the archive this time had no accented characters in it.

After moving the DartEditor directory so its path no longer includes accented characters on my work PC (from the original post), everything works as expected.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/1343914?v=3" align="left" width="48" height="48"hspace="10"> Comment by sgjesse

---

Thanks for adding the information on accented characters in the install path. This is related to https://bugzilla.mozilla.org/show_bug.cgi?id=336829.

[DartBot]

This comment was originally written by [email protected]

---

Thanks for the reply. If that bug has been open for the last 6 years I guess nobody at Mozilla is in a big hurry to fix it...

I'll just be sure to avoid non-ASCII characters in the path.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/188?v=3" align="left" width="48" height="48"hspace="10"> Comment by nex3

---

We can probably work around this in pub by copying the certificate file to a temp directory before loading it.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/1343914?v=3" align="left" width="48" height="48"hspace="10"> Comment by sgjesse

---

Small question. Why do you need a certificate database for pub? Are the default root-certificates not sufficient?

[DartBot]

<img src="https://avatars.githubusercontent.com/u/188?v=3" align="left" width="48" height="48"hspace="10"> Comment by nex3

---

The default certificates didn't include many common root certificates, including in particular the one used by pub.dartlang.org. We copied in the one used by Chrome, I believe.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/4905639?v=3" align="left" width="48" height="48"hspace="10"> Comment by whesse

---

It would be quite reasonable to add more root certificates to the default database, at least those included in Chrome. I would have to check to see how Chromium does it, but they could also be patched into our version of the NSS library.

I will file a new issue, to the effect that SecureSocket.initialize does not work with a path with non-ascii characters in it, in area=IO. This issue can then either be solved by a workaround, or marked as blocked on that issue.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/1343914?v=3" align="left" width="48" height="48"hspace="10"> Comment by sgjesse

---

Aligning the root certificate database with Chromium sounds like the right approach. However there will still be the issue that this database will become "stale" over time, and people using older versions of Dart can still get into trouble if just relying on the built-in root-certificates.

Ensuring that the root-certificate used for pub.dartlang.org is included is important.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/1343914?v=3" align="left" width="48" height="48"hspace="10"> Comment by sgjesse

---

Issue #781 has been merged into this issue.

[DartBot]

<img src="https://avatars.githubusercontent.com/u/4905639?v=3" align="left" width="48" height="48"hspace="10"> Comment by whesse

---

The default certificates do include the ones used by pub. The certificate in the private database imported by pub was an expired one, that wasn't being used anymore.
The dart database does include all common root certificates - there are no extra certificates in Chromium or Chrome beyond these, according to the Chrome team, on Linux. And it includes the one necessary for pub (Equifax), that is the root of the chain for "Google Internet Authority G2". The expired one was "Google Internet Authority", which was replaced by G2.

So SecureSocket.initialize does not need to be called explicitly with a path, or at all. Other users of dart:io may have the non-ascii path problem, but that is a separate issue (which should be created if needed).

A CL for the fix has been published as https://codereview.chromium.org/107193006.

---

Added Fixed label.