HTTP error 502 while retrieving a wheel file about devpi

[fschulze]

When you use pip directly with pipy.org, then your client is accessing it and the libraries you have installed are relevant, which are most likely newer than the ones on the server. The problem is most likely outdated libraries/certificates (in for example certifi) on your server.

[fschulze]

• Are you using the latest released version?
  No. We are on devpi-server 5.4.1. We are hosting the internal devpi-server since 2020 and this is the first time we saw this error

This is contradicted by your pip list:

devpi-server 6.3.1

2023-12-13 08:48:00,756 INFO [req193085] GET /root/pypi/+f/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
2023-12-13 08:48:00,808 WARNI Certificate did not match expected hostname: files.pythonhosted.org. Certificate: {'subject': ((('commonName', 'r.shared-319-default.ssl.fastly.net'),),), 'issuer': ((('countryName', 'BE'),), (('organizationName', 'GlobalSign nv-sa'),), (('commonName', 'GlobalSign Atlas R3 DV TLS CA 2023 Q1'),)), 'version': 3, 'serialNumber': '01D06257899F0DD2481ECE65A0533F7E', 'notBefore': 'Apr 10 04:55:11 2023 GMT', 'notAfter': 'May 11 04:55:10 2024 GMT', 'subjectAltName': (('DNS', 'r.shared-319-default.ssl.fastly.net'),), 'OCSP': ('http://ocsp.globalsign.com/ca/gsatlasr3dvtlsca2023q1',), 'caIssuers': ('http://secure.globalsign.com/cacert/gsatlasr3dvtlsca2023q1.crt',), 'crlDistributionPoints': ('http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q1.crl',)}%7D)
2023-12-13 08:48:00,809 WARNI [req193085] [Wtx434618] OS error during httpget of https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl at /usr/lib/python3.7/site-packages/devpi_server/views.py:1338::iter_cache_remote_file
2023-12-13 08:48:00,811 ERROR [req193085] [Wtx434618] error -1 getting https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
2023-12-13 08:48:01,393 INFO [req193086] GET /macaw/qa-rda-dev/pip/
2023-12-13 08:48:01,699 INFO [req193087] GET /macaw/qa-rda-dev/+simple/pip/
2023-12-13 08:50:56,095 INFO [req193088] GET /macaw/qa-rda-dev/confluent-kafka/
2023-12-13 08:50:56,350 INFO [req193089] GET /macaw/qa-rda-dev/+simple/confluent-kafka/
2023-12-13 08:50:57,904 INFO [req193090] GET /root/pypi/+f/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
2023-12-13 08:50:57,960 WARNI Certificate did not match expected hostname: files.pythonhosted.org. Certificate: {'subject': ((('commonName', 'r.shared-319-default.ssl.fastly.net'),),), 'issuer': ((('countryName', 'BE'),), (('organizationName', 'GlobalSign nv-sa'),), (('commonName', 'GlobalSign Atlas R3 DV TLS CA 2023 Q1'),)), 'version': 3, 'serialNumber': '01D06257899F0DD2481ECE65A0533F7E', 'notBefore': 'Apr 10 04:55:11 2023 GMT', 'notAfter': 'May 11 04:55:10 2024 GMT', 'subjectAltName': (('DNS', 'r.shared-319-default.ssl.fastly.net'),), 'OCSP': ('http://ocsp.globalsign.com/ca/gsatlasr3dvtlsca2023q1',), 'caIssuers': ('http://secure.globalsign.com/cacert/gsatlasr3dvtlsca2023q1.crt',), 'crlDistributionPoints': ('http://crl.globalsign.com/ca/gsatlasr3dvtlsca2023q1.crl',)}%7D)
2023-12-13 08:50:57,961 WARNI [req193090] [Wtx434618] OS error during httpget of https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl at /usr/lib/python3.7/site-packages/devpi_server/views.py:1338::iter_cache_remote_file
2023-12-13 08:50:57,963 ERROR [req193090] [Wtx434618] error -1 getting https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
2023-12-13 08:50:58,545 INFO [req193091] GET /macaw/qa-rda-dev/pip/
2023-12-13 08:50:58,858 INFO [req193092] GET /macaw/qa-rda-dev/+simple/pip/

NOTE: I am able to download the wheel file using wget

From where? devpi, or directly from https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl?

It seems like something has trouble resolving the certificate. Judging from your pip list you use a version which uses aiohttp. Could you try with the following release candidate for devpi-server 6.10.0 which uses httpx instead?

https://m.devpi.net/fschulze/dev/devpi-server/6.10.0.dev0
https://m.devpi.net/fschulze/dev/+f/0d1/fc7a6efaaec94/devpi_server-6.10.0.dev0-py3-none-any.whl

[pchatterjee-cfx]

This is contradicted by your pip list:

    devpi-server 6.3.1

This is not the deployed version but the version on my laptop. My apologies. I sent the pip list from client's perspecrtive. The deployed server servion is 5.4.1

pip list from server

Package Version

---

apipkg 1.5
appdirs 1.4.4
argon2-cffi 20.1.0
attrs 19.3.0
certifi 2020.6.20
cffi 1.14.0
chardet 3.0.4
check-manifest 0.42
devpi-client 5.2.2
devpi-common 3.6.0
devpi-plumber 0.5.1
devpi-server 5.4.1
distlib 0.3.1
execnet 1.7.1
filelock 3.0.12
hupper 1.10.2
idna 2.10
importlib-metadata 1.7.0
itsdangerous 1.1.0
lazy 1.4
packaging 20.4
passlib 1.7.2
PasteDeploy 2.1.0
pep517 0.8.2
pip 20.1.1
pkginfo 1.5.0.1
plaster 1.0
plaster-pastedeploy 0.7
pluggy 0.13.1
py 1.9.0
pycparser 2.20
pyparsing 2.4.7
pyramid 1.10.4
python-dateutil 2.8.1
repoze.lru 0.7
requests 2.24.0
ruamel.yaml 0.16.10
ruamel.yaml.clib 0.2.0
setuptools 42.0.2
six 1.15.0
strictyaml 1.0.6
supervisor 4.1.0
toml 0.10.1
tox 3.17.1
translationstring 1.4
twitter.common.contextutil 0.3.11
twitter.common.dirutil 0.3.11
twitter.common.lang 0.3.11
urllib3 1.25.9
venusian 3.0.0
virtualenv 20.0.27
waitress 1.4.4
WebOb 1.8.6
wheel 0.34.2
zipp 3.1.0
zope.deprecation 4.4.0
zope.interface 5.1.0

From where? devpi, or directly from https://files.pythonhosted.org/packages/44/2b/c84376dcdfea3cb2e5c4223d3683751e3ed142481103447cc2d4169c2520/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl?

Directly from the URL

[fschulze]

You might have to update the certifi package, but I'm not sure what requests is using. This is not directly a devpi-server bug, but somewhere in the requests dependencies. If you install the same packages in a virtual environment, then it is likely that a plain requests.get("...") will also fail. You can then test in the virtualenv what you have to update.

[pchatterjee-cfx]

One observation is that I don't run into this issue if I install directly from pypi. Only when I use any of the other indices that I encounter this issue.

(PYTHON37) $ pip uninstall confluent-kafka && pip install confluent-kafka==2.3.0 -i http://10.95.159.86:3141/macaw/qa-rda-dev/ --trusted-host 10.95.159.86 --no-cache-dir
WARNING: Skipping confluent-kafka as it is not installed.
Looking in indexes: http://10.95.159.86:3141/macaw/qa-rda-dev/
Collecting confluent-kafka==2.3.0
ERROR: HTTP error 502 while getting http://10.95.159.86:3141/root/pypi/%2Bf/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=cec97f8c6564b16504d30fe42c22fd4a86c406dbcd45c337b93c21e876e20628 (from http://10.95.159.86:3141/macaw/qa-rda-dev/+simple/confluent-kafka/)
ERROR: Could not install requirement confluent-kafka==2.3.0 from http://10.95.159.86:3141/root/pypi/%2Bf/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=cec97f8c6564b16504d30fe42c22fd4a86c406dbcd45c337b93c21e876e20628 because of HTTP error 502 Server Error: Bad Gateway for url: http://10.95.159.86:3141/root/pypi/%2Bf/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl for URL http://10.95.159.86:3141/root/pypi/%2Bf/cec/97f8c6564b165/confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=cec97f8c6564b16504d30fe42c22fd4a86c406dbcd45c337b93c21e876e20628 (from http://10.95.159.86:3141/macaw/qa-rda-dev/+simple/confluent-kafka/)

[notice] A new release of pip available: 22.2.2 -> 23.3.1
[notice] To update, run: pip install --upgrade pip
(PYTHON37) $ pip uninstall confluent-kafka && pip install confluent-kafka==2.3.0 --no-cache-dir
WARNING: Skipping confluent-kafka as it is not installed.
Collecting confluent-kafka==2.3.0
Downloading confluent_kafka-2.3.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (4.0 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.0/4.0 MB 18.2 MB/s eta 0:00:00
Installing collected packages: confluent-kafka
Successfully installed confluent-kafka-2.3.0

[pchatterjee-cfx]

The issue is resolved by switching to the latest version of devpi-server. We were due for an upgrade for some time. I used the opportunity to move to the latest version.
Thank you Florian.