[Bioc-devel] nebbiolo SSL-related build error

[Mike Smith]

Hi Karl,

Hervé's done a good job of summarising the situation.

My current recommendation is to make sure you're using useEnsembl() when
constructing the Mart object.  This function is aware of the
incompatibilities between recent Ubuntu versions and then Ensembl SSL
certificates.  It should make the appropriate changes in the background for
a user and allow the connection to proceed.

I believe the error is inconsistent because there are actually different
certificates on the mirrors vs the main Ensembl site.  Ideally this should
be seamless (and indeed seems to be when using a web browser), but when
using curl, as biomaRt does, whether a query gets redirected on not can
influence what response comes back.

The switch at Ensembl to only HTTPS was supposed to happen at the end of
last year, but AFAIK it's still not been enforced.  Nonetheless I recommend
making that protocol explicit, as you've done, because at some point it
will become mandatory.

Best,
Mike

On Thu, 31 Mar 2022 at 10:09, Hervé Pagès <hpages.on.github using gmail.com>
wrote:

> Hi Karl,
>
> Unfortunately this Ensembl SSL certificate problem is not specific to
> our Linux builder nebbiolo1 but it affects Ubuntu users in general. I
> can reproduce it on my laptop (Ubuntu 21.10):
>
>      library(biomaRt)
>      mart <- biomaRt::useMart("ENSEMBL_MART_ENSEMBL",
> host="https://www.ensembl.org")
>      # Ensembl site unresponsive, trying asia mirror
>      # Error in curl::curl_fetch_memory(url, handle = handle) :
>      #   SSL certificate problem: unable to get local issuer certificate
>
> and on our Docker image (Ubuntu 20.04):
>
>      library(biomaRt)
>      mart <-  biomaRt::useMart("ENSEMBL_MART_ENSEMBL",
> host="https://www.ensembl.org")
>      # Ensembl site unresponsive, trying uswest mirror
>      # Error in curl::curl_fetch_memory(url, handle = handle) :
>      #   server certificate verification failed. CAfile: none CRLfile: none
>
> For some reason the error is not exactly the same on the two systems.
> Also note that the error is intermittent: sometimes the call to
> biomaRt::useMart() succeeds and sometimes it doesn't, so you might need
> to call biomaRt::useMart() several times before you actually get the error.
>
> Here is my understanding of this situation and how it can be mitigated
> (others on this list more familiar with this issue please correct me if
> I'm wrong):
>
>    - This issue has been around for a while and discussed in various
> places.
>
>    - IIRC the problem really is on Ensembl's side but we only see the
> biomaRt::useMart() error on Ubuntu >= 20.04 because this OS has
> increased security settings by default.
>
>    - I also believe that the Ensembl folks have been aware of the
> situation for a while but AFAICT not much has changed.
>
>    - IIRC a workaround is to lower the security settings on the system.
> However this is not a totally satisfying solution because Ubuntu users
> wouldn't necessarily know how to do that or have the permission to do it
> (e.g. if they are on a cluster).
>
>    - In January Mike Smith modified biomaRt::useEnsembl() so that the
> function should be able to use its own SSL settings to better handle the
> SSL certificate situation on Ubuntu. So using biomaRt::useEnsembl()
> instead of biomaRt::useMart() should help.
>
>    - Regardless of Mike's recent improvement to biomaRt::useEnsembl(),
> it's probably a good idea to use this function instead of
> biomaRt::useMart() when accessing the Ensembl Mart.
>
>    - The sad reality is that Ensembl Mart has always been a flaky
> service. So no matter how we access it, we sometimes get errors like
> this one:
>
>      mart <- useEnsembl("genes")
>      # Ensembl site unresponsive, trying asia mirror
>      # Error: Unexpected format to the list of available marts.
>      # Please check the following URL manually, and try ?listMarts for
> advice.
>      #
>
> https://www.ensembl.org:443/biomart/martservice?type=registry&requestid=biomaRt
>
> Hope this helps,
>
> H.
>
> On 30/03/2022 13:11, Karl Stamm wrote:
> > I have a new build error that is somewhat environment specific;
> > failing only on nebbiolo and not for Windows nor Mac.
> >
> > The error message states only " SSL certificate problem: unable to get
> > local issuer certificate "
> >
> > My package, during a rather long process, includes a call to biomart with
> > biomaRt::useMart("ENSEMBL_MART_ENSEMBL", host="https://www.ensembl.org")
> >
> > In a previous version I did not specify "https" but simply 'www', and
> > we did not have any build errors, but Ensembl was throwing warnings
> > (recently?) that an https specification will become mandatory.
> > I guess nebbiolo has some SSL inability, which puts me in a bind, to
> > either use a deprecated interface and hope Ensembl keeps working, or
> > seek whatever problem we're having during the builds.
> >
> > Thanks for your insight.
> >
> > _______________________________________________
> > Bioc-devel using r-project.org mailing list
> > https://stat.ethz.ch/mailman/listinfo/bioc-devel
>
> --
> Hervé Pagès
>
> Bioconductor Core Team
> hpages.on.github using gmail.com
>
> _______________________________________________
> Bioc-devel using r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/bioc-devel
>

	[[alternative HTML version deleted]]