[Bioc-devel] nebbiolo SSL-related build error

[Hervé Pagès]

Hi Karl,

Unfortunately this Ensembl SSL certificate problem is not specific to 
our Linux builder nebbiolo1 but it affects Ubuntu users in general. I 
can reproduce it on my laptop (Ubuntu 21.10):

     library(biomaRt)
     mart <- biomaRt::useMart("ENSEMBL_MART_ENSEMBL", 
host="https://www.ensembl.org")
     # Ensembl site unresponsive, trying asia mirror
     # Error in curl::curl_fetch_memory(url, handle = handle) :
     #   SSL certificate problem: unable to get local issuer certificate

and on our Docker image (Ubuntu 20.04):

     library(biomaRt)
     mart <-  biomaRt::useMart("ENSEMBL_MART_ENSEMBL", 
host="https://www.ensembl.org")
     # Ensembl site unresponsive, trying uswest mirror
     # Error in curl::curl_fetch_memory(url, handle = handle) :
     #   server certificate verification failed. CAfile: none CRLfile: none

For some reason the error is not exactly the same on the two systems. 
Also note that the error is intermittent: sometimes the call to 
biomaRt::useMart() succeeds and sometimes it doesn't, so you might need 
to call biomaRt::useMart() several times before you actually get the error.

Here is my understanding of this situation and how it can be mitigated 
(others on this list more familiar with this issue please correct me if 
I'm wrong):

   - This issue has been around for a while and discussed in various places.

   - IIRC the problem really is on Ensembl's side but we only see the 
biomaRt::useMart() error on Ubuntu >= 20.04 because this OS has 
increased security settings by default.

   - I also believe that the Ensembl folks have been aware of the 
situation for a while but AFAICT not much has changed.

   - IIRC a workaround is to lower the security settings on the system. 
However this is not a totally satisfying solution because Ubuntu users 
wouldn't necessarily know how to do that or have the permission to do it 
(e.g. if they are on a cluster).

   - In January Mike Smith modified biomaRt::useEnsembl() so that the 
function should be able to use its own SSL settings to better handle the 
SSL certificate situation on Ubuntu. So using biomaRt::useEnsembl() 
instead of biomaRt::useMart() should help.

   - Regardless of Mike's recent improvement to biomaRt::useEnsembl(), 
it's probably a good idea to use this function instead of 
biomaRt::useMart() when accessing the Ensembl Mart.

   - The sad reality is that Ensembl Mart has always been a flaky 
service. So no matter how we access it, we sometimes get errors like 
this one:

     mart <- useEnsembl("genes")
     # Ensembl site unresponsive, trying asia mirror
     # Error: Unexpected format to the list of available marts.
     # Please check the following URL manually, and try ?listMarts for 
advice.
     # 
https://www.ensembl.org:443/biomart/martservice?type=registry&requestid=biomaRt

Hope this helps,

H.

On 30/03/2022 13:11, Karl Stamm wrote:
> I have a new build error that is somewhat environment specific;
> failing only on nebbiolo and not for Windows nor Mac.
>
> The error message states only " SSL certificate problem: unable to get
> local issuer certificate "
>
> My package, during a rather long process, includes a call to biomart with
> biomaRt::useMart("ENSEMBL_MART_ENSEMBL", host="https://www.ensembl.org")
>
> In a previous version I did not specify "https" but simply 'www', and
> we did not have any build errors, but Ensembl was throwing warnings
> (recently?) that an https specification will become mandatory.
> I guess nebbiolo has some SSL inability, which puts me in a bind, to
> either use a deprecated interface and hope Ensembl keeps working, or
> seek whatever problem we're having during the builds.
>
> Thanks for your insight.
>
> _______________________________________________
> Bioc-devel using r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/bioc-devel

-- 
Hervé Pagès

Bioconductor Core Team
hpages.on.github using gmail.com