(ExCoveralls.ReportUploadError) Failed to upload the report to 'https://coveralls.io', reason: tls_alert

[sobolevn]

Hi! I have got a CI fail recently:

Run mix coveralls.github
........................................................................................................................

Finished in 0.6 seconds
35 doctests, 85 tests, 0 failures

Randomized with seed 44094

05:52:09.001 [info]  TLS :client: In state :wait_cert_cr at ssl_handshake.erl:1887 generated CLIENT ALERT: Fatal - Unknown CA

** (ExCoveralls.ReportUploadError) Failed to upload the report to 'https://coveralls.io' (reason: {:tls_alert, {:unknown_ca, 'TLS client: In state wait_cert_cr at ssl_handshake.erl:1887 generated CLIENT ALERT: Fatal - Unknown CA\n'}}).
    (excoveralls 0.14.0) lib/excoveralls/poster.ex:21: ExCoveralls.Poster.execute/2
    (mix 1.11.4) lib/mix/tasks/test.ex:373: Mix.Tasks.Test.do_run/3
    (mix 1.11.4) lib/mix/task.ex:394: Mix.Task.run_task/3
    (excoveralls 0.14.0) lib/mix/tasks.ex:54: Mix.Tasks.Coveralls.do_run/2
    (mix 1.11.4) lib/mix/task.ex:394: Mix.Task.run_task/3
    (mix 1.11.4) lib/mix/cli.ex:84: Mix.CLI.run_task/2
    (elixir 1.11.4) lib/code.ex:931: Code.require_file/2

Versions:

• [email protected]
• elixir: 1.11
• beam: 23
• ubuntu-20.04

CI job: https://github.com/sobolevn/recase/pull/119/checks?check_run_id=2128079815

[sobolevn]

The same happens for another repo: https://github.com/petrovich/petrovich_elixir/runs/2137664773?check_suite_focus=true

[bmquinn]

I'm seeing the same error as well, running elixir 1.11 and erlang 23.1:

Finished in 46.0 seconds
41 doctests, 557 tests, 0 failures

Randomized with seed 318874
16:21:58.889 [info]  TLS :client: In state :wait_cert_cr at ssl_handshake.erl:1887 generated CLIENT ALERT: Fatal - Unknown CA

** (ExCoveralls.ReportUploadError) Failed to upload the report to 'https://coveralls.io' (reason: {:tls_alert, {:unknown_ca, 'TLS client: In state wait_cert_cr at ssl_handshake.erl:1887 generated CLIENT ALERT: Fatal - Unknown CA\n'}}).
    (excoveralls 0.14.0) lib/excoveralls/poster.ex:21: ExCoveralls.Poster.execute/2
    (mix 1.11.4) lib/mix/tasks/test.ex:373: Mix.Tasks.Test.do_run/3
    (mix 1.11.4) lib/mix/task.ex:394: Mix.Task.run_task/3
    (mix 1.11.4) lib/mix/task.ex:439: Mix.Task.run_alias/5
    (excoveralls 0.14.0) lib/mix/tasks.ex:54: Mix.Tasks.Coveralls.do_run/2
    (mix 1.11.4) lib/mix/task.ex:394: Mix.Task.run_task/3
    (mix 1.11.4) lib/mix/cli.ex:84: Mix.CLI.run_task/2
    (elixir 1.11.4) lib/code.ex:931: Code.require_file/2

I think the fix could be bumping to Hackney 1.17.0 (https://github.com/benoitc/hackney/releases/tag/v1.17.0), which adds SSL compatibility with erlang OTP 23

[ajvondrak]

Same issue on Elixir 1.11 (earlier versions are fine), and on both OTP 21 and 23: https://github.com/ajvondrak/remote_ip/actions/runs/665483059

Note that Elixir 1.10 works fine on OTP 21, so I'm not sure it's purely an OTP/Hackney issue.

[ajvondrak]

These errors seem to coincide with the latest patch version of Elixir 1.11: https://github.com/elixir-lang/elixir/releases/tag/v1.11.4

[ajvondrak]

Yeah, Elixir v1.11.3 works fine: https://github.com/ajvondrak/remote_ip/runs/2142427054?check_suite_focus=true

The suspicious thing in the v1.11.4 release notes is that rebar was bumped to v3.14.4: https://github.com/erlang/rebar3/releases/tag/3.14.4 But it looks like rebar3 had a lot of changes for that version, so I'm not sure where to begin sifting through those.

[bmquinn]

Thanks @ajvondrak, digging into those rebar3 release notes it looks like https://github.com/certifi/erlang-certifi/issues/46 is the likely culprit here

[xinz]

Thanks all, same issue with Elixir 1.11.4, after run mix deps.update certifi resolve this issue for me, hope it is helpful for your reference.

[rlopzc]

@xinz comment fixed it for me!! I spent a lot trying to find the answer

[christhekeele]

I had the same issue, and @xinz 's note to run mix deps.update certifi worked perfectly too, thanks!

[ajvondrak]

Heads up that I was getting this error again circa excoveralls 0.18.1. Since #311 moved from hackney to httpc, the certifi update mentioned above wouldn't make a difference AFAICT. However, I noticed that I was only seeing the issue using OTP 22 in my build matrix, so I tried out OTP 23 and that seems to work (even on the same Elixir versions, 1.12 & 1.13).

Before: https://github.com/ajvondrak/remote_ip/actions/runs/9440358658/job/25999841516#step:8:19

After: https://github.com/ajvondrak/remote_ip/actions/runs/9440538202/job/25999999662#step:8:16