qdrant
[Bug]: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
What happened?
pip install fastembed-gpu Collecting fastembed-gpu Downloading fastembed_gpu-0.3.6-py3-none-any.whl.metadata (7.7 kB) Collecting PyStemmer<3.0.0,>=2.2.0 (from fastembed-gpu) Using cached PyStemmer-2.2.0.1.tar.gz (303 kB) Installing build dependencies ... done Getting requirements to build wheel ... error error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully. │ exit code: 1 ╰─> [72 lines of output] Downloading https://snowballstem.org/dist/libstemmer_c-2.2.0.tar.gz... Traceback (most recent call last): File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 1344, in do_open h.request(req.get_method(), req.selector, req.data, headers, File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1319, in request self._send_request(method, url, body, headers, encode_chunked) File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1365, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1314, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1074, in _send_output self.send(msg) File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1018, in send self.connect() File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/http/client.py", line 1460, in connect self.sock = self._context.wrap_socket(self.sock, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/ssl.py", line 455, in wrap_socket return self.sslsocket_class._create( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/ssl.py", line 1046, in _create self.do_handshake() File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/ssl.py", line 1317, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 335, in main
json_out['return_val'] = hook(**hook_input['kwargs'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 118, in get_requires_for_build_wheel
return hook(config_settings)
^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-hcja1kod/overlay/lib/python3.12/site-packages/setuptools/build_meta.py", line 332, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=[])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-hcja1kod/overlay/lib/python3.12/site-packages/setuptools/build_meta.py", line 302, in _get_build_requires
self.run_setup()
File "/tmp/pip-build-env-hcja1kod/overlay/lib/python3.12/site-packages/setuptools/build_meta.py", line 503, in run_setup
super().run_setup(setup_script=setup_script)
File "/tmp/pip-build-env-hcja1kod/overlay/lib/python3.12/site-packages/setuptools/build_meta.py", line 318, in run_setup
exec(code, locals())
File "<string>", line 126, in <module>
File "<string>", line 110, in download
File "/tmp/pip-install-w3w61mto/pystemmer_03ed16239a18423d99e9a24446133132/tarballfetcher.py", line 40, in download_and_extract_tarball
download_file(tarball_url, tarball_filename)
File "/tmp/pip-install-w3w61mto/pystemmer_03ed16239a18423d99e9a24446133132/tarballfetcher.py", line 17, in download_file
urlretrieve(url, filename)
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 240, in urlretrieve
with contextlib.closing(urlopen(url, data)) as fp:
^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 215, in urlopen
return opener.open(url, data, timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 515, in open
response = self._open(req, data)
^^^^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 532, in _open
result = self._call_chain(self.handle_open, protocol, protocol +
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 492, in _call_chain
result = func(*args)
^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 1392, in https_open
return self.do_open(http.client.HTTPSConnection, req,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/gubert/.pyenv/versions/3.12.0/lib/python3.12/urllib/request.py", line 1347, in do_open
raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)>
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip. error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully. │ exit code: 1 ╰─> See above for output.
What Python version are you on? e.g. python --version
Python 3.12.0
Version
0.2.7 (Latest)
What os are you seeing the problem on?
Linux
Relevant stack traces and/or logs
No response
@joein
already installed... didn't help. tried all versions down to 0.2.7 and this issue started on 0.3.0
I'm running into this on a corporate VPN as well. Normally one of these catches it:
ENV REQUESTS_CA_BUNDLE=/tls/custom-ca-bundle.pem
ENV SSL_CERT_FILE=/tls/custom-ca-bundle.pem
ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/tls/custom-ca-bundle.pem
ENV CURL_CA_BUNDLE=/tls/custom-ca-bundle.pem
but doesn't seem to be working with fastembed. this ca bundle is just certifi with our corporate certs appended to it
from what I can tell code that does the downloading seems to be in huggingface_hub. It also seems to be using requests to actually do the downloading, so not sure why REQUESTS_CA_BUNDLE wouldn't work
Alright well, I figured out the issue for me is due to stricter verifications in urllib3 that were introduced in v2.4.0 in april: https://github.com/urllib3/urllib3/releases/tag/2.4.0
For me that might mean pinning to 2.3.0 until the corporate certificates are updated, but that doesn't help OP (since the issue was created in October of last year, it couldn't be because of the urllib3 changes.
Sorry for all the noise, but maybe it'll help someone who stumbles across this