'quarto publish confluence' throws 'Failed to add platform cert to root cert store'

[harrylojames]

Bug description

quarto publish confluence confluence-demo.qmd

============================================================
Deno has panicked. This is a bug in Deno. Please report this
at https://github.com/denoland/deno/issues/new.
If you can reliably reproduce this panic, include the
reproduction steps and re-run with the RUST_BACKTRACE=1 env
var set and include the backtrace in your report.

Platform: windows x86_64
Version: 1.33.4
Args: ["C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\tools\\x86_64\\deno", "run", "--unstable", "--no-config", "--cached-only", "--allow-read", "--allow-write", "--allow-run", "--allow-env", "--allow-net", "--allow-ffi", "--importmap", "C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\vendor\\import_map.json", "C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\quarto.js", "publish", "confluence", "confluence-demo.qmd"]

thread 'main' panicked at 'Failed to add platform cert to root cert store: InvalidCertificate(BadEncoding)', cli\args\mod.rs:497:14
stack backtrace:
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

denoland/deno#20709

As suggested in the above issue I can reproduce this bug when not connected to a corporate vpn. I was also able to reproduce this on another computer.

Steps to reproduce

Create a file confluence-demo.qmd with the following.

---
title: Confluence Demo
format: confluence-html
---

## Overview

Managing Confluence content with Quarto allows you to author content in Markdown, manage that content with your usual version control tools like Git and GitHub, and leverage Quarto’s tools for including computational output.

Publish to a confluence space -
quarto publish confluence confluence-demo.qmd

Expected behavior

Publishing with Quarto version 1.3.450 works without errors.

Note, if I set DENO_TLS_CA_STORE to exclusively system rather than including mozilla I see the same error on this version.

Actual behavior

Publishing with Quarto version 1.4.429 throws the following error.

This error happens regardless of the setting of DENO_TLS_CA_STORE.

Your environment

Windows 11

Quarto check output

Quarto 1.4.429
[>] Checking versions of quarto binary dependencies...
      Pandoc version 3.1.8: OK
      Dart Sass version 1.55.0: OK
      Deno version 1.33.4: OK
[>] Checking versions of quarto dependencies......OK
[>] Checking Quarto installation......OK
      Version: 1.4.429
      Path: C:\Users\hj6\scoop\apps\quarto-prerelease\current\bin
      CodePage: 1252

[>] Checking tools....................OK
      TinyTeX: v2023.03.21
      Chromium: (not installed)

[>] Checking LaTeX....................OK
      Using: TinyTex
      Path: C:\Users\hj6\AppData\Roaming\TinyTeX\bin\windows\
      Version: 2023

[>] Checking basic markdown render....OK

[>] Checking Python 3 installation....OK
      Version: 3.9.4
      Path: C:/Users/hj6/AppData/Local/Programs/Python/Python39/python.exe
      Jupyter: 5.0.0

[>] Checking Jupyter engine render....OK

(-) Checking R installation...........R scripting front-end version 4.1.3 (2022-03-10)
[>] Checking R installation...........(None)

      Unable to locate an installed version of R.
      Install R from https://cloud.r-project.org/

[harrylojames]

Sorry to chase, any updates to share?

[mcanouil]

Thank you for your interest!
Issues are there to track updates therefore if there is nothing new in it, it means there is no update yet.

[cderv]

@harrylojames Can you check again with latest Quarto pre-release 1.4 version ?

We are using Deno 1.37.2 now so maybe the issue has evolved - I encountered this in the past and it was related to a Deno dependency on windows.

Did you reproduce with latest version too ?

As suggested in the above issue I can reproduce this bug when not connected to a corporate vpn. I was also able to reproduce this on another computer.

I am not sure to have catch things correctly :

• Is this happening behind a corporate VPN ?
• Or when corporate VPN is deactivated only ?

The deno issue you linked to seems related to proxy settings too - so I am confused...

Thanks

I wonder is this is related to deno directly. Some test that could be run.

• Add this to fetch.ts

const url="https://github.com/quarto-ext/fancy-ext/archive/refs/heads/main.zip"
const fileResponse = await fetch(url)

Then run

quarto run fetch.ts

Or directly deno cli to try directly

C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\tools\\x86_64\\deno run --allow-net fetch.ts

• Does it error ?

This could be also a url from your confluence server. Maybe the confluence serveur you are trying to reach needs specific certificate in the store ?

Thanks for your updates.

[harrylojames]

@cderv Thank you looking at this!

Our confluence is managed using confluence cloud so I've tested this error is reproduceable with and without a VPN.

Using the latest Quarto version (1.4.489) and Deno version (1.38.1) unfortunately gives me the same error.

Running quarto run fetch.ts also errors.

PS C:\Users\hj6\git\quarto-callout> quarto run fetch.ts

============================================================
Deno has panicked. This is a bug in Deno. Please report this
at https://github.com/denoland/deno/issues/new.
If you can reliably reproduce this panic, include the
reproduction steps and re-run with the RUST_BACKTRACE=1 env
var set and include the backtrace in your report.

Platform: windows x86_64
Version: 1.38.1
Args: ["C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\tools\\x86_64\\deno", "run", "--import-map", "C:\\Users\\hj6\\AppData\\Local\\quarto\\deno_std\\run_import_map.json", "--cached-only", "--allow-all", "--unstable", "fetch.ts"]

thread 'main' panicked at cli\args\mod.rs:532:14:
Failed to add platform cert to root cert store: InvalidCertificate(BadEncoding)
stack backtrace:
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

[cderv]

Thanks for the update

Running quarto run fetch.ts also errors.

So this tells us that the issue is with Deno directly. Something is not correctly loading the certificate.

Can you try the following in powershell

$env:DENO_TLS_CA_STORE="system,mozilla"
C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\tools\\x86_64\\deno run --allow-net fetch.ts

$env:DENO_TLS_CA_STORE="mozilla"
C:\\Users\\hj6\\scoop\\apps\\quarto-prerelease\\current\\bin\\tools\\x86_64\\deno run --allow-net fetch.ts

I don't think if we can do something until the issue is solved within Deno. (probably related to denoland/deno#20709 as you mentioned)

[harrylojames]

Interestingly I got an error with "system,mozilla" but not "mozilla"

[cderv]

Ok so that is what I thought - this is related to how deno is loading certificate from the system storage. Something is not working as expected.

The system storage was added in 1.4 (8d1a882) to solve some issues with users having TLS error due to self signed certificates (living in the system storage).

We had an issue on Windows with DENO_TLS_CA_STORE in the past, but not the same one, and it was solved by a new version of Deno.

So at the end, this is a Deno issue regarding certificates reading from system storage.

I don't really know how, but may you could try check the certificates you have, otherwise, I would try to add some information to denoland/deno#20709 to help them solve it maybe

@dragonstyle @cscheid any thoughts on something we can do ?

Maybe allowing DENO_TLS_CA_STORE to be overwritten if not possible already ?