Auto-update and other GitHub connections not working

[adalast]

Background

CKAN Version:

• 1.24.0-PRE

KSP Version:
1.3.1.1891

Operating System:
Windows 10.1

Have you made any manual changes to your GameData folder (i.e., not via CKAN)?
no, I use CKAN for all of my changes

Problem

What steps did you take in CKAN?
Opened it.

What did you expect to happen?
It to open without error and connect to the repository

What happened instead?
I got the errors below, and no updates.

Screenshots:

CKAN error codes (if applicable):

See the end of this message for details on invoking 
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
CKAN.ModuleNotFoundKraken: Exception of type 'CKAN.ModuleNotFoundKraken' was thrown.
   at CKAN.Registry.AllAvailable(String module)
   at CKAN.MainAllModVersions.set_SelectedModule(GUIMod value)
   at CKAN.Main.ModList_SelectedIndexChanged(Object sender, EventArgs e)
   at System.Windows.Forms.DataGridView.OnSelectionChanged(EventArgs e)
   at System.Windows.Forms.DataGridView.FlushSelectionChanged()
   at System.Windows.Forms.DataGridView.ClearSelection(Int32 columnIndexException, Int32 rowIndexException, Boolean selectExceptionElement)
   at System.Windows.Forms.DataGridView.SetAndSelectCurrentCellAddress(Int32 columnIndex, Int32 rowIndex, Boolean setAnchorCellAddress, Boolean validateCurrentCell, Boolean throughMouseClick, Boolean clearSelection, Boolean forceCurrentCellSelection)
   at System.Windows.Forms.DataGridView.MakeFirstDisplayedCellCurrentCell(Boolean includeNewRow)
   at System.Windows.Forms.DataGridView.OnRowCollectionChanged_PostNotification(Boolean recreateNewRow, Boolean allowSettingCurrentCell, CollectionChangeAction cca, DataGridViewRow dataGridViewRow, Int32 rowIndex)
   at System.Windows.Forms.DataGridViewRowCollection.OnCollectionChanged_PostNotification(CollectionChangeAction cca, Int32 rowIndex, Int32 rowCount, DataGridViewRow dataGridViewRow, Boolean changeIsDeletion, Boolean changeIsInsertion, Boolean recreateNewRow, Point newCurrentCell)
   at System.Windows.Forms.DataGridViewRowCollection.OnCollectionChanged(CollectionChangeEventArgs e, Int32 rowIndex, Int32 rowCount)
   at System.Windows.Forms.DataGridViewRowCollection.AddRange(DataGridViewRow[] dataGridViewRows)
   at CKAN.Main._UpdateFilters()
   at CKAN.Main._UpdateModsList(Boolean repo_updated, List`1 mc)
   at CKAN.Main.CurrentInstanceUpdated()
   at CKAN.Main.OnLoad(EventArgs e)
   at System.Windows.Forms.Form.OnCreateControl()
   at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)
   at System.Windows.Forms.Control.CreateControl()
   at System.Windows.Forms.Control.WmShowWindow(Message& m)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.Form.WmShowWindow(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

[TruePikachu]

This is probably because of TLS v1 and v1.1 depreciation here on Github that was put into effect today.

[HebaruSan]

Odd, it's actually working for me. Maybe my system is able to use later versions of TLS than the ones having issues?

[HebaruSan]

Either way, @TruePikachu, you sound like you're familiar with this. Is there an official announcement that I could read to catch up?

[TruePikachu]

Honestly I only know about this because of a post over in /r/3dshacks (see https://redd.it/7uem9t and sticky comment)

EDIT: And suspected this because of TLS being in the backtrace for one of the errors

[TruePikachu]

Just checked Wireshark, CKAN attempted use of TLSv1 to api.github.com .

[HebaruSan]

Thanks! Those posts have links to the official announcements. I guess their attempt at outreach was not successful in this case. I bet this was the cause of the recent outage reported on the forum:

The plan is to do a 1hr brownout on February 8th, followed by a permanent deployment on February 22nd. We realize that no matter how much notice (announced roughly a year ago), there are bound to be some systems that are both incompatible and unknowingly running on production systems. So, the hope is that a 1hr brownout will help to unearth such systems and give folks time to get them updated.

In retrospect, I'm not sure how we were supposed to figure out this was the cause of people randomly reporting that stuff doesn't work and then it working again.

[HebaruSan]

@TruePikachu, what platform are you using? I'm on Ubuntu and therefore using Mono, so since it's working for me, I'm wondering whether .NET on Windows doesn't support TLS 1.2?

[TruePikachu]

Windows 7, just did a quick search, .NET 4.5 is when 1.2 support was added, and 4.6 is when it was made the default.

[HebaruSan]

Boom:

https://blogs.perficient.com/microsoft/2016/04/tsl-1-2-and-net-support/

So, why didn’t .NET framework support TLS 1.2 in my case? Well, that was because my application was using .NET 4.0. In .NET 4.0 default transport level security standard is TLS 1.1. The solution for my problem was to upgrade my application to the latest .NET framework: 4.6.1. In this framework version TLS 1.2 is a default cryptographic standard.

... NINJA'd.

Can you try 4.6?

[TruePikachu]

Problem is, I don't have a way to compile right now.

I do have .NET 4.6.1 installed, however.

[HebaruSan]

ckan.exe is compiled against many versions of Mono by default, and the latest one is used for release:

https://travis-ci.org/KSP-CKAN/CKAN/builds/343973360

I think you should be able to use the existing EXE as long as you have the right version of .NET installed.

[TruePikachu]

Except I can't find where to actually get the builds from Travis.

[HebaruSan]

You should be able to use any released version.

https://github.com/KSP-CKAN/CKAN/releases/tag/v1.22.6

[sergivonavi]

I have the same issue and same software versions as described.
Ckan worked a few hours ago and then I opened it and got errors.

[TruePikachu]

I'm already on 1.22.6

EDIT: 1.24.0-PRE-1 also has the issue

EDIT2: Also still using TLSv1

EDIT3: I can confirm that it is built for 4.5, though, so it just doesn't know to escalate to TLSv1.2 when the TLSv1 fails.

[TTAK]

Confirmed here too

Error in autoupdate: 
	La demande a été abandonnée : Impossible de créer un canal sécurisé SSL/TLS.

I am also unable to update CKAN repository

Connection to https://github.com/KSP-CKAN/CKAN-meta/archive/master.tar.gz could not be established.
Repository successfully updated

[fobok1]

I'm having the issue in Windows 10, using .NET 4.7, and, like TTAK mentioned, 'ckan update' isn't working either, unable to connect.

PS D:\ckan> ./ckan update
Downloading updates...
Connection to https://github.com/KSP-CKAN/CKAN-meta/archive/master.tar.gz could not be established.
Updated information on 0 available modules

[TruePikachu]

My best suggestion for now is to force CKAN to use TLSv1.2, since it apparently can't escalate to there automatically. Under 4.5, run the following code before any SSL connections are established:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

Under 4.6, it should already be the default.

EDIT: It's entirely possible that Mono under Linux already was smart enough to default to TLSv1.2, which would be why you didn't experience the issue.

[HebaruSan]

@politas, @techman83, @Olympic1, @pjf, anyone, we kind of need an all-hands-on-deck on this. CKAN is no longer able to access GitHub on Windows at all, despite indications that it should be fine on .NET 4.6 and later, and we have no known workarounds.

[HebaruSan]

@TruePikachu, I think you may be right about compilation. The ckan.exe that I was trying was one that I built locally. I'll retry with the actual download version...

[TruePikachu]

Compile it for .NET 4.6 or later, and it should be golden.

[HebaruSan]

... nope, the 1.22.6 download works fine on my system! The difference must be in the runtime environment somewhere.

[adalast]

I run ckan update and it crashes for me.

[sundhaug92]

@adalast Update manually, then refresh

[adalast]

@sundhaug92 I thought using the command prompt to run the ckan update command was updating manually? Do you mean download a fresh .exe file?

[HebaruSan]

ckan update will only work if you have version 1.24.0.

[sundhaug92]

@adalast ckan update refreshes the package-list. Normally ckan upgrade ckan would upgrade ckan however since the version of ckan you're using no longer works with github you have to download the newest version (as linked by @HebaruSan).

[adalast]

Ok, so I downloaded the 1.24.0 zip file and extracted it... but there is no exe or msi file... how do I run?

what am I missing?

[HebaruSan]

Sorry, @politas messed up the download link, get the EXE from here:

• https://github.com/KSP-CKAN/CKAN/releases/latest

[adalast]

@HebaruSan And we're off to the races... thank you so much for figuring this out. I'm still getting the other error, but it's at least working again.

[DistracticusPrime]

Still not working for me. I've tried CKAN 1.24 and 1.25. I have .NET 4.5.2. Could it be because (OMG) Vista?