brew install fails downloading from ghcr.io - macOS Mojave

[pierre-rouleau]

On one of the 2 macOS Mojave systems I have, several brew install commands fail downloading files from the https://ghcr.io site, but it works fine on the other computer (same OS version: 10.14.6).

For example, here's an attempt on the computer where it fails:

> brew install rebar3
Updating Homebrew...
==> Auto-updated Homebrew!
Updated 1 tap (homebrew/core).
==> Updated Formulae
Updated 1 formula.

==> Downloading https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k

curl: (7) Couldn't connect to server
Error: Failed to download resource "openssl@1.1_bottle_manifest"
Download failed: https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k
>

Some other brew install commands not reaching to the https://ghcr.io are completing fine, but all the ones that try to download from that site fail.

[pierre-rouleau]

BTW, i had been using home-brew for a while and never ran into that issue before.

[gromgit]

Try your brew install again; perhaps it was a transient issue.

If it still doesn't work, please post the output of brew config and brew doctor.

[carlocab]

That's fine; I wasn't the one asking for one. However, it's strange that brew is trying to download pcre2 again, as earlier you had already downloaded it:

==> Downloading https://ghcr.io/v2/homebrew/core/pcre2/manifests/10.36
Already downloaded: /Users/shirlma2/Library/Caches/Homebrew/downloads/d81af0d789557d99e466c2412b2fedebb877f09343cf3cc849cf8c89ec482f80--pcre2-10.36.bottle_manifest.json

[mdshw5]

I just figured out my issue. Sorry for chiming in to an unrelated thread. I had accidentally set my git proxy to use my work's proxy server. After jumping off their network and with a direct internet connection I can install packages again!

[pierre-rouleau]

Lucky you!!

[mdshw5]

@carlocab I happen to be resolving to 140.82.113.33 now as well.

[mdshw5]

I wasn't the one asking for one.

Sorry missed that. Good luck!

[pierre-rouleau]

ok, i'm back looking at this problem again while I have a little bit of time.

• Rebooting did not fix the issue.
• From bash shell, if I ping ghcr.io it pings 140.82.113.33 which responds the pings.
• I tried macOS Network Utility application, and used the Lookup tab to look up ghcr.io: it returns 140.82.114.34.
• That's a different address! Why would these 2 things not use the same???

[gromgit]

That's a different address! Why would these 2 things not use the same???

It's a well-known (and very old) technique of load-balancing: https://en.wikipedia.org/wiki/Round-robin_DNS

Reviewing your previous posts, it looks like even the IP that worked on your other machine fails on this one, so it seems that something is still interfering with your network access. At this point, I'd suggest to uninstall all the security software on your machine, then reboot and try again.

[pierre-rouleau]

I did that before testing on this machine. The machine that did not have the security update was the machine that had no problem with home-brew. But I have later updated that machine as well and home-brew continues to work on that other machine.

[pierre-rouleau]

BTW, thanks for the DNS info.

[mdshw5]

Do you have a proxy configured in your macOS network settings? This has tripped me up in the past since the proxy settings are different for system vs. shell.

…

On May 7, 2021, at 4:36 PM, Pierre Rouleau ***@***.***> wrote:  ok, i'm back looking at this problem again while I have a little bit of time. Rebooting did not fix the issue. From bash shell, if I ping ghcr.io it pings 140.82.113.33 which responds the pings. I tried macOS Network Utility application, and used the Lookup tab to look up ghcr.io: it returns 140.82.114.34. That's a different address! Why would these 2 things not use the same??? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[pierre-rouleau]

Good idea, but no, I don't have a proxy set.

[carlocab]

What's the output of

curl -LIv -H'Authorization: Bearer QQ==' https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k

?

[pierre-rouleau]

So, in the same physical computer:

• it fails on a bash shell under macOS Mojave
• it works in a bash shell running under Fedora running under a Parallels VM!

That does not solve my problem but it seems to indicate an issue related to the networking infrastructure under macOS Mojave.

Notice that I have updated Mojave recently with the latest updates.

And I have read here that Mojave Security update 2021-003 on April 26 included an update on Safari 14.1. And the first instance of that release had a bug "which made it impossible to access some website". Apparently Apple fixed that bug. But I wonder if they did not fix everything.

[carlocab]

Might be an issue with Mojave curl (though no one else seems to have had problems with it). Your working curl invocation uses a much newer version than your failing one.

[pierre-rouleau]

You are correct, the curl on Mojave is:

> curl --version
curl 7.54.0 (x86_64-apple-darwin18.0) libcurl/7.54.0 LibreSSL/2.6.5 zlib/1.2.11 nghttp2/1.24.1
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy 
>

while the one on Fedora is

> curl --version
curl 7.54.0 (x86_64-apple-darwin18.0) libcurl/7.54.0 LibreSSL/2.6.5 zlib/1.2.11 nghttp2/1.24.1
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy 
>

I would have to install a newer version using Homebrew.... I'll have to look for the project and try to build it from source.
I wonder if a lot of people are still using Mojave and if those that do have installed the latest updates.

[pierre-rouleau]

Sorry, copy paste error. The Fedore curl is:

[parallels@localhost ~]$ curl --version
curl 7.69.1 (x86_64-redhat-linux-gnu) libcurl/7.69.1 OpenSSL/1.1.1g-fips zlib/1.2.11 brotli/1.0.7 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh/0.9.4/openssl/zlib nghttp2/1.41.0
Release-Date: 2020-03-11
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz Metalink NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets
[parallels@localhost ~]$

[pierre-rouleau]

I have installed the Mojave upgrade on the computer that had no homebrew problem. And after the upgrade it still works.

So the issue is not really related to the security upgrade.

[pierre-rouleau]

OK, I built curl from source, using Microsoft vcpkg using the info here

I now have:

> curl --version
curl 7.74.0-DEV (Darwin) libcurl/7.74.0-DEV SecureTransport zlib/1.2.11
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher http https imap imaps ldap mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: alt-svc AsynchDNS IPv6 Largefile libz NTLM SSL TrackMemory UnixSockets
>

However that does not change anything for home-brew: I still have the same failure:

> brew install rebar3
==> Downloading https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k

curl: (7) Couldn't connect to server
Error: Failed to download resource "openssl@1.1_bottle_manifest"
Download failed: https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k
>

However, If i try the curl -Liv -H.... I get:

> curl -LIv -H'Authorization: Bearer QQ==' https://ghcr.io/v2/homebrew/core/openssl/1.1/manifests/1.1.1k
*   Trying 140.82.112.34:443...
* Connected to ghcr.io (140.82.112.34) port 443 (#0)
* ALPN, offering http/1.1
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate: *.ghcr.io
* Server certificate: DigiCert SHA2 High Assurance Server CA
* Server certificate: DigiCert High Assurance EV Root CA
> HEAD /v2/homebrew/core/openssl/1.1/manifests/1.1.1k HTTP/1.1
> Host: ghcr.io
> User-Agent: curl/7.74.0-DEV
> Accept: */*
> Authorization: Bearer QQ==
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
< Content-Type: application/json
Content-Type: application/json
< docker-distribution-api-version: registry/2.0
docker-distribution-api-version: registry/2.0
< Date: Sat, 08 May 2021 03:44:16 GMT
Date: Sat, 08 May 2021 03:44:16 GMT
< Content-Length: 117
Content-Length: 117
< X-GitHub-Request-Id: C321:36D2:91A92:23CF93:6096090F
X-GitHub-Request-Id: C321:36D2:91A92:23CF93:6096090F

< 
* Connection #0 to host ghcr.io left intact
>

[pierre-rouleau]

Now I have to figure out what is the problem with my system curl.

[hermitmaster]

If it's a curl problem, it's widespread. Both of my Macs started getting the same error about an hour ago.

[pierre-rouleau]

@hermitmaster Have you been able to fix them? And did you determined the reason why your system curl started failing?

[hermitmaster]

It turns out there was a GitHub package outage. All is well now.

[pierre-rouleau]

OK. Thanks

[pierre-rouleau]

In the end my problem was caused by my system curl.

• I built curl from source to get a working one,
• Used:

export HOMEBREW_DEVELOPER=1
export HOMEBREW_CURL_PATH=/path/to/new/curl

and my new curl to use brew install curl to get curl from Homebrew.

Then added:
export HOMEBREW_FORCE_BREWED_CURL=1 in my environment setup to force Hombrew to use that new curl.

And now Homebrew is working again. I still don't know why my system curl does not work, but at least I can now use Homebrew.

Thanks to everyone that answered!!

[dennisdebel]

how to build curl from source? I am getting ssl errors when configuring:

./configure --with-openssl
configure: error: --with-openssl was given but OpenSSL could not be detected

[bhyde]

Well, happened to me. I think it started around the upgrade to 15.3.1 (24D70) sequoia.

You can find a prebuilt binary for curl here https://github.com/stunnel/static-curl/releases/tag/8.12.1

Other options are enumerated on the curl website - https://curl.se/download.html#MacOSX

Then you can do the brew install curl as described above. I set HOMEBREW_CURL_PATH in ~/Library/Preferences/homebrew/brew.env
until such time as the system curl is upgraded.

[dennisdebel]

~/Library/Preferences/homebrew/brew.env is empty here

[SMillerDev]

If that happens on a modern macOS there is something seriously broken in your system

[adarhef]

It started happening for me as well, macOS 15.3.2.
I don't know how I can know when the system curl is fixed or Homebrew or whatever, but for now I used the workaround above. Now Homebrew uses its own installation of curl and I'm able to install things again.