ssl - buildout/easy_install/setup_tools 是否验证 SSL 证书？

Question

我正在尝试诊断此错误:

Getting distribution for 'zc.buildout<2dev'.
Got zc.buildout 1.7.1.
Generated script '/opt/mytardis/releases/a549cd05272afe8f16c2fe5efe8158490acbde82/bin/buildout'.
Download error on http://pypi.python.org/simple/buildout-versions/: [Errno 104] Connection reset by peer -- Some packages may not be found!
Couldn't find index page for 'buildout-versions' (maybe misspelled?)
Download error on http://pypi.python.org/simple/: [Errno 104] Connection reset by peer -- Some packages may not be found!
Getting distribution for 'buildout-versions'.
STDERR: /usr/lib64/python2.6/distutils/dist.py:266: UserWarning: Unknown distribution option: 'src_root'
  warnings.warn(msg)
While:
  Installing.
  Loading extensions.
  Getting distribution for 'buildout-versions'.
Error: Couldn't find a distribution for 'buildout-versions'.

它发生在 Chef + buildout 安装堆栈的深处。我发现的一件事是，如果我尝试直接访问 buildout-versions 包:

$ wget https://pypi.python.org/packages/source/b/buildout-versions/buildout-versions-1.7.tar.gz#md5=731ecc0c9029f45826fa9f31d44e311d
--2013-07-09 12:50:18--  https://pypi.python.org/packages/source/b/buildout-versions/buildout-versions-1.7.tar.gz
Resolving proxy.redacted.com... 123.45.67.8
Connecting to proxy.redacted.com|123.45.67.8|:8080... connected.
ERROR: certificate common name “*.a.ssl.fastly.net” doesn’t match requested host name “pypi.python.org”.
To connect to pypi.python.org insecurely, use ‘--no-check-certificate’.

我可以从我的桌面上正常访问该文件。所以我怀疑代理(由一所大学提供，并且该服务器必须使用它来访问网络)。它由 https_proxy=... 设置。

这是构建失败的可能原因吗？有什么办法吗？

Answer 1

您的 wget 版本太旧。

wget 仅从 1.14 版开始支持 SNI (Server Name Indication)，并且需要 TLS 扩展才能在 pypi.python.org 上提供正确的证书。