[Bioc-devel] nebbiolo SSL-related build error

Hi Karl,

Unfortunately this Ensembl SSL certificate problem is not specific to
our Linux builder nebbiolo1 but it affects Ubuntu users in general. I
can reproduce it on my laptop (Ubuntu 21.10):

     library(biomaRt)
     mart <- biomaRt::useMart("ENSEMBL_MART_ENSEMBL",
host="https://www.ensembl.org")
     # Ensembl site unresponsive, trying asia mirror
     # Error in curl::curl_fetch_memory(url, handle = handle) :
     #   SSL certificate problem: unable to get local issuer certificate

and on our Docker image (Ubuntu 20.04):

     library(biomaRt)
     mart <-  biomaRt::useMart("ENSEMBL_MART_ENSEMBL",
host="https://www.ensembl.org")
     # Ensembl site unresponsive, trying uswest mirror
     # Error in curl::curl_fetch_memory(url, handle = handle) :
     #   server certificate verification failed. CAfile: none CRLfile: none

For some reason the error is not exactly the same on the two systems.
Also note that the error is intermittent: sometimes the call to
biomaRt::useMart() succeeds and sometimes it doesn't, so you might need
to call biomaRt::useMart() several times before you actually get the error.

Here is my understanding of this situation and how it can be mitigated
(others on this list more familiar with this issue please correct me if
I'm wrong):

   - This issue has been around for a while and discussed in various places.

   - IIRC the problem really is on Ensembl's side but we only see the
biomaRt::useMart() error on Ubuntu >= 20.04 because this OS has
increased security settings by default.

   - I also believe that the Ensembl folks have been aware of the
situation for a while but AFAICT not much has changed.

   - IIRC a workaround is to lower the security settings on the system.
However this is not a totally satisfying solution because Ubuntu users
wouldn't necessarily know how to do that or have the permission to do it
(e.g. if they are on a cluster).

   - In January Mike Smith modified biomaRt::useEnsembl() so that the
function should be able to use its own SSL settings to better handle the
SSL certificate situation on Ubuntu. So using biomaRt::useEnsembl()
instead of biomaRt::useMart() should help.

   - Regardless of Mike's recent improvement to biomaRt::useEnsembl(),
it's probably a good idea to use this function instead of
biomaRt::useMart() when accessing the Ensembl Mart.

   - The sad reality is that Ensembl Mart has always been a flaky
service. So no matter how we access it, we sometimes get errors like
this one:

     mart <- useEnsembl("genes")
     # Ensembl site unresponsive, trying asia mirror
     # Error: Unexpected format to the list of available marts.
     # Please check the following URL manually, and try ?listMarts for
advice.
     #
https://www.ensembl.org:443/biomart/martservice?type=registry&requestid=biomaRt

Hope this helps,

H.

On 30/03/2022 13:11, Karl Stamm wrote:

I have a new build error that is somewhat environment specific;
failing only on nebbiolo and not for Windows nor Mac.

The error message states only " SSL certificate problem: unable to get
local issuer certificate "

My package, during a rather long process, includes a call to biomart with
biomaRt::useMart("ENSEMBL_MART_ENSEMBL", host="https://www.ensembl.org")

In a previous version I did not specify "https" but simply 'www', and
we did not have any build errors, but Ensembl was throwing warnings
(recently?) that an https specification will become mandatory.
I guess nebbiolo has some SSL inability, which puts me in a bind, to
either use a deprecated interface and hope Ensembl keeps working, or
seek whatever problem we're having during the builds.

Thanks for your insight.

--
Herv? Pag?s

Bioconductor Core Team
hpages.on.github at gmail.com