2

I have an issue installing mongodb via homebrew (new MacBook Pro, OS X 10.10.2, fresh installation). Apperantly, every other package that I try to install (for example wget) is throwing this errors, but the packages are correctly installed. Unfortunately, the installation of brew install mongodb fails with the following error:

==> Downloading https://downloads.sf.net/project/machomebrew/Bottles/mongodb-2.6.7.yosemite.bottle.tar.gz

curl: (60) SSL certificate problem: Invalid certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
Error: Failed to download resource "mongodb"
Download failed: https://downloads.sf.net/project/machomebrew/Bottles/mongodb-2.6.7.yosemite.bottle.tar.gz
Warning: Bottle installation failed: building from source.
==> Installing mongodb dependency: scons
==> Downloading https://downloads.sf.net/project/machomebrew/Bottles/scons-2.3.4.yosemite.bottle.1.tar.gz

curl: (60) SSL certificate problem: Invalid certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
Error: Failed to download resource "scons"
Download failed: https://downloads.sf.net/project/machomebrew/Bottles/scons-2.3.4.yosemite.bottle.1.tar.gz
Warning: Bottle installation failed: building from source.
==> Downloading https://downloads.sourceforge.net/scons/scons-2.3.4.tar.gz

curl: (60) SSL certificate problem: Invalid certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
Error: Failed to download resource "scons"
Download failed: https://downloads.sourceforge.net/scons/scons-2.3.4.tar.gz

I also found this thread How to fix curl: (60) SSL certificate: Invalid certificate chain, where I added the certificate for downloads.sf.net and downloads.sourceforge.net (both use *.cloudfront.net as its certificate, and therefore, you get a domain missmatch) via Safari to "Always trust". After this, the installation fails with a SHA1 missmatch (and I also ran brew cleanup -s to cleanup the old cached packages):

==> Downloading https://downloads.sf.net/project/machomebrew/Bottles/mongodb-2.6.7.yosemite.bottle.tar.gz
######################################################################## 100.0%
Error: SHA1 mismatch
Expected: 4b1749b645a744b38b4959daac46bf80353e3b32
Actual: a2fd3379ea944f6b2f97fb0f79b7b85cb3e14d0b
Archive: /Library/Caches/Homebrew/mongodb-2.6.7.yosemite.bottle.tar.gz
To retry an incomplete download, remove the file above.
Warning: Bottle installation failed: building from source.
==> Installing mongodb dependency: scons
==> Downloading https://downloads.sf.net/project/machomebrew/Bottles/scons-2.3.4.yosemite.bottle.1.tar.gz
######################################################################## 100.0%
Error: SHA1 mismatch
Expected: 819d08b7e8c1ba2451db6d7d848f689b108b40aa
Actual: a2fd3379ea944f6b2f97fb0f79b7b85cb3e14d0b
Archive: /Library/Caches/Homebrew/scons-2.3.4.yosemite.bottle.1.tar.gz
To retry an incomplete download, remove the file above.
Warning: Bottle installation failed: building from source.
==> Downloading https://downloads.sourceforge.net/scons/scons-2.3.4.tar.gz
######################################################################## 100.0%
Error: SHA1 mismatch
Expected: 8c55f8c15221c1b3536a041d46056ddd7fa2d23a
Actual: a2fd3379ea944f6b2f97fb0f79b7b85cb3e14d0b
Archive: /Library/Caches/Homebrew/scons-2.3.4.tar.gz
To retry an incomplete download, remove the file above.

I also found this github issue https://github.com/Homebrew/homebrew/issues/28844, but I don't have any expired certificates in my keychain. Any help is appreciated!

Community
  • 1
  • 1
23tux
  • 14,104
  • 15
  • 88
  • 187
  • I've updated my question, by also adding `downloads.sourceforge.net` as a trusted certificate – 23tux Feb 18 '15 at 12:07

1 Answers1

2

I've just had the same issue. It appears to be temporary, as the SourceForge website is partially down.

The sourceforge.net website is temporarily in static offline mode. Only a very limited set of project pages are available until the main website returns to service.

I imagine the issue will be resolved shortly and you will be able to retry in a couple of hours. There may be updates posted to https://twitter.com/sfnet_ops although there isn't currently any information on this particular outage.

Michael Mason
  • 932
  • 5
  • 15
  • Hmmm, I don't see any warnings at the SourceForge site, hopefully its a temporarly problem. But I also had this warnings yesterday, so maybe it's not temporarly. – 23tux Feb 18 '15 at 11:21
  • Hmmmm, it seems that the problem is gone. At least I can install mongodb now without any errors (and without changing anything at my configuration / installation) – 23tux Feb 18 '15 at 14:06
  • 2
    Hi! I'm a Homebrew maintainer and this is the cause. Sourceforge's downtime has been really hairy lately and we're in the process of moving to a new host for bottles right now. Sorry for the lousy experience! – Tim Smith Feb 18 '15 at 21:29
  • @tim glad to hear it, SourceForge is definitely not what it once was :( – Michael Mason Feb 19 '15 at 09:59
  • But for example, github also had a lot of trouble when they forced everything to https (which is a good thing, but as we experienced, caused a lot of trouble) – 23tux Feb 19 '15 at 10:56