How to get https download by Drush make or drush_download_file()

Could you run the make command with either -v or --debug and post any relevant errors here?

I have the same problem.

Mac OS X, no wget.

-v gives me:

Executing: git clone --mirror --verbose --progress https://github.com/mattkersley/Responsive-Menu.git /Users/macbookpro/.drush/cache/git/responsive_menu-0fb9ef0200aae85943312a8758648c87
Executing: git clone https://github.com/mattkersley/Responsive-Menu.git /tmp/drush_tmp_1344861400_5028f4d84c5ab/responsive_menu --verbose --progress --reference /Users/macbookpro/.drush/cache/git/responsive_menu-0fb9ef0200aae85943312a8758648c87
Unable to clone responsive_menu from https://github.com/mattkersley/Responsive-Menu.git.                [error]

Funny thing is, copying both commands into a new prompt works...

Tried with sudo as well, thinking it might be a permission issue.

If I replace the https:// part of the url with git:// it works fine.

EDIT: It was a cert issue, but only when drush invoked git. Fixed by making git not validate certificates.

If you want to figure out what is wrong, you have to run wget without the -q flag. I tried the example from #2:

$ wget --timeout=30 -O /tmp/download_filepZyxDV https://github.com/johndyer/mediaelement/zipball/2.8.2 
--17:21:50--  https://github.com/johndyer/mediaelement/zipball/2.8.2
           => `/tmp/download_filepZyxDV'
Resolving github.com... 207.97.227.239
Connecting to github.com|207.97.227.239|:443... connected.
ERROR: Certificate verification error for github.com: unable to get local issuer certificate
To connect to github.com insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.

I think what we want is a way to pass the --no-check-certificate flag to wget.

I am changing the Component tag to "Base system" since this involves drush_download_file(). Maybe "Core commands" or "PM" would be better, but I am pretty sure that "Make" is wrong.

IMHO passing --no-check-certificate is the incorrect approach, as it opens up the downloaded code to man-in-the-middle attacks - the better fix is to update the openssl root certificates on the server (normally via a package update, but can also be done manually). If this is a shared server (and the host refuses to update), I think you may still be able to do this by installing the certificates in a local directory and setting the SSL_CERT_DIR environment variable.

@Owen Barton:

I admire your level of paranoia.

I am writing a drush script that downloads some code from GitHub. I suppose I can download the SSL cert from GitHub, but I am not sure how I can set environment variables in this context. I am willing to risk a man-in-the-middle attack.

I am referring to the root SSL certificate collection normally provided as part of every operating system (including Windows, OS X, Linux), not the certificate for Github (or any specific server). The root certificates are used by clients as the basis for a chain of trust through certificate provider(s) and finally to the server you are trying to communicate with. The error you are getting is because these root certificates are missing/broken on the server you are using - this means that not just that wget for github won't work, but any outbound SSL connection (using OpenSSL) to any server via any means (git/https, wget, curl, php API requests etc) will fail. This seems like the kind of issue that is simply better to be fixed at the server level to me.

Thanks for all the advice so far.

From my Ubuntu web server, I tried

$ wget https://github.com/scrooloose/syntastic/archive/master.zip

and it worked perfectly.

The problem is my Mac. (I have not tried yet from Windows.) I have no trouble with GitHub when using a web browser. I checked the CA using the Mac's GUI tool for managing certificates, and it is there. The problem seems to be that the command-line tools do not hook into the Mac certificates.

A Google search turns up these articles:
http://stackoverflow.com/questions/6565633/installing-curl-with-ssl-so-i...
http://loopkid.net/articles/2011/09/20/ssl-certificate-errors-on-mac-os-x
They suggest that the only way to solve the problem is by passing flags (--ca-certificate for wget or --cacert for curl) or setting environment variables. I still do not know how to do that in the context of a drush-based installation script that I expect other people to use.

This works on my Mac, but still does not address the portability issue I raised in #8.

The versions of curl installed by Apple and included with MAMP do not seem to be compiled with SSL support. The man page mentions the --cacert option, but the executable does not recognize it.

I installed wget a long time ago using Fink, so the executable is /sw/bin/wget. I added

ca-certificate = /sw/etc/ssl/certs/ca-bundle.crt

to /sw/etc/wgetrc. It would probably also work if I added it to ~/.wgetrc.

Maybe this will help someone else with the same setup. Maybe more recent ports of wget are configured better.

On cygwin, I had to install ca-certs and add this to ~/.wgetrc

ca-certificate = /cygdrive/c/cygwin/usr/ssl/certs/ca-bundle.crt

This issue was marked closed (won't fix) because Drush has moved to Github.

If you still need help, please ask your question again on Drupal Answers and then post a link here to the new question. Please also change the status of this issue to closed (duplicate).

Use our Github project for contributing code, or reporting bugs, or requesting features.