FHIR Chat · IG 1.1.43 errors

Stream: IG creation

Topic: IG 1.1.43 errors

Elliot Silver (Nov 27 2020 at 23:31):

(This is carried over from https://chat.fhir.org/#narrow/stream/179166-implementers/topic/Validate.20against.20R5.20Preview.203/near/218135809).

The new release of the IG publisher seems to be throwing errors in the output. It doesn't affect a build completing though (perhaps because the resources are in my cache?).

Error connecting to build server - running without build (PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed)

Also, the new POST attempt <1> to url -> http://tx.fhir.org/r4/ messages are a little disconcerting -- I expect these are searches, but my first reaction was "why is it modifying anything on the terminology server‽"

Grahame Grieve (Nov 28 2020 at 04:32):

@Mark Iantorno it didn't take very long at all.

Grahame Grieve (Nov 28 2020 at 12:29):

@Josh Mandel this is actually because the certificate on build.fhir.org has expired. It's urgent to fix this ASAP. @Mark Iantorno can we work around this in the Java client?

Mark Iantorno (Nov 28 2020 at 12:31):

Let me take a look at it later today.

Grahame Grieve (Nov 28 2020 at 12:45):

it looks like it'll be my monday morning before I can sort out an issue with a certificate replacement

Mark Iantorno (Nov 28 2020 at 13:01):

Looking into it right now, just needed to get out of bed

Mark Iantorno (Nov 28 2020 at 13:02):

let me see if I can do a workaround

Mark Iantorno (Nov 28 2020 at 13:03):

I will also remove the logging

Mark Iantorno (Nov 28 2020 at 13:03):

for the rest requests

Mark Iantorno (Nov 28 2020 at 14:02):

Alright, I think i have fixed the issue

Mark Iantorno (Nov 28 2020 at 14:02):

I'm just going to run the build pipelines and produce new releases for the core, then the publisher

Mark Iantorno (Nov 28 2020 at 14:02):

should take 2ish hours tops

Josh Mandel (Nov 28 2020 at 14:03):

I'm awake now. @Grahame Grieve do I remember correctly that we're using a wildcard certificate that you supplied? Do you have a replacement ready to substitute in?

Mark Iantorno (Nov 28 2020 at 14:04):

Well, I'll publish the releases anyway to get a working copy out to everyone (there were two other small issues that needed to be fixed anyway), and then on Monday I can roll back the change to blindly trust the build server

Josh Mandel (Nov 28 2020 at 14:05):

Oh, reading earlier in the thread I see that you don't have a new one available. we could probably issue a LetsEncrypt certificate before then... though there's no drop-in approach in the current infrastructure

Josh Mandel (Nov 28 2020 at 14:06):

and that would only work for the one domain where the web server hosted. I'm not sure what other things are broken right now if any.

Mark Iantorno (Nov 28 2020 at 14:08):

if there are any other issues with the core or publisher, I can fix them for you. I have some temporary code in there that handles the expired cert

Mark Iantorno (Nov 28 2020 at 14:08):

I can just apply it to where we need

Josh Mandel (Nov 28 2020 at 14:10):

Or better: somebody who controls DNS for fhir.org actually can get a wildcard certificate for 90 days from LetsEncrypt -- https://www.goodmoneysense.com/creating-letsencrypt-free-wildcard-ssl-certificates-tutorial/ has a tutorial.

Josh Mandel (Nov 28 2020 at 14:10):

(I do not have access to the DNS for this domain.)

Mark Iantorno (Nov 28 2020 at 18:06):

Core has been changed to include a temporary fix for this, and published (5.2.4), IG Publisher is currently building with the new core fixes and should be public within 30 min (v1.1.44)