Update the ocssw processors failed

[oo_processing]

Where / when will the announcement be posted?

[OB.DAAC - SeanBailey]

Where: On this forum and via the mailing list.
When: When its ready to be announced...

Sean

[ryan458]

Hi,

I'm trying the manual install method:

"So, you will need to manually pull down the install_ocssw.py script follow the
manual install/update process (scroll down the page about halfway)"

In the instructions it says:

  $ ./install_ocssw.py --install-dir=$HOME/ocssw --git-branch=<version> --aqua --seawifs
Replace <version> in the --git-branch option with the desired branch. (e.g.--git-branch=v7.2)

I've tried v7.3 and v7.3.2 here as the git=branch. v7.3 works but v7.3.2 does not. If I do v7.3 am I downloading the latest version of SeaDAS or is this older? If older, what do I put here to download the latest version?

Thanks,
Ryan

[OB.DAAC - SeanBailey]

Yes.  The git repo version only goes to the first "dot",  v7.3 is the latest.

Sean

[ryan458]

Ok - great! Thanks for the fast response.

Ryan

[woodbri]

I'm have the following problem and can not get the update the ocssw processors or install a clean copy of them.

[] ~/work/oceandata$ wget -N https://oceandata.sci.gsfc.nasa.gov/ocssw/install_ocssw.py
--2017-01-10 13:37:12--  https://oceandata.sci.gsfc.nasa.gov/ocssw/install_ocssw.py
Resolving oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)... xx.xxx.xx.xx, 2001:4d0:2418:128::84
Connecting to oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)|xx.xxx.xx.xx|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 25424 (25K) [text/plain]
Saving to: ‘install_ocssw.py’

100%[======================================>] 25,424      --.-K/s   in 0.001s

2017-01-10 13:37:12 (47.5 MB/s) - ‘install_ocssw.py’ saved [25424/25424]

[] ~/work/oceandata$ chmod +x install_ocssw.py
[] ~/work/oceandata$ ./install_ocssw.py -v -i . -g https://oceandata.sci.gsfc.nasa.gov/ocssw/ -b v7.2 -a linux_64 -s --aqua

gitBase     = https://oceandata.sci.gsfc.nasa.gov/ocssw/
gitBranch   = v7.2
install dir = /home/woodbri/work/oceandata
arch        = linux_64

git user.name = "*************"
git user.email = "*****************"
Installing bundles.sha256sum (1 of 14)
Downloading bundles.sha256sum
--2017-01-10 13:38:40--  https://oceandata.sci.gsfc.nasa.gov/ocssw/bundles.sha256sum
Resolving oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)... xx.xxx.xx.xx, 2001:4d0:2418:128::84
Connecting to oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)|xx.xxx.xx.xx|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2578 (2.5K) [text/plain]
Saving to: ‘bundles.sha256sum’

100%[======================================>] 2,578       --.-K/s   in 0s

2017-01-10 13:38:40 (276 MB/s) - ‘bundles.sha256sum’ saved [2578/2578]

Loading checksum file.
Installing common (2 of 14)
Downloading new directory -  /home/woodbri/work/oceandata/run/data/common
Downloading common.bundle
--2017-01-10 13:38:40--  https://oceandata.sci.gsfc.nasa.gov/ocssw/common.bundle
Resolving oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)... xx.xxx.xx.xx, 2001:4d0:2418:128::84
Connecting to oceandata.sci.gsfc.nasa.gov (oceandata.sci.gsfc.nasa.gov)|xx.xxx.xx.xx|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1270770080 (1.2G) [text/plain]
Saving to: ‘common.bundle’

100%[====================================>] 1,270,770,080 7.09MB/s   in 2m 41s

2017-01-10 13:41:21 (7.55 MB/s) - ‘common.bundle’ saved [1270770080/1270770080]

comparing checksum for common.bundle
Cloning into '/home/woodbri/work/oceandata/run/data/common'...
Receiving objects: 100% (182/182), 1.18 GiB | 35.40 MiB/s, done.
Resolving deltas: 100% (60/60), done.
Checking connectivity... done.
Checking out files: 100% (112/112), done.
Updating (fetch) existing repository - /home/woodbri/work/oceandata/run/data/common
fatal: unable to access 'https://oceandata.sci.gsfc.nasa.gov/ocssw/common.git/': gnutls_handshake() failed: Handshake failed
Error - Could not run "cd /home/woodbri/work/oceandata/run/data/common; git fetch"
[] ~/work/oceandata$ ls
install_ocssw.py  run

[gnwiii]

You have:
./install_ocssw.py -v -i . -g https://oceandata.sci.gsfc.nasa.gov/ocssw/ -b v7.2 -a linux_64 -s --aqua

I think you need the v7.3 branch for the https changes, but you also have a problem with git:
Updating (fetch) existing repository - /home/woodbri/work/oceandata/run/data/common
fatal: unable to access 'https://oceandata.sci.gsfc.nasa.gov/ocssw/common.git/': gnutls_handshake() failed: Handshake failed
Error - Could not run "cd /home/woodbri/work/oceandata/run/data/common; git fetch"

To get more details, try running:
cd /home/woodbri/work/oceandata/run/data/common
git fetch -v
Git uses libcurl, so it is possible that your supporting libraries (libcurl and the TLS library used by libcurl) are too old for NASA's https servers.  See using curl with new https server.

[woodbri]

Thank you for your response and suggestions.

I have tried to install v7.2 and v7.3 with the same results.
As for curl and TLS, I have the following:

[] ~/work/oceandata$ openssl ciphers -tls -v 'HIGH:!ADH:!MD5:@STRENGTH' | egrep "ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES256-GCM-SHA384|ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-AES256-SHA384|ECDHE-ECDSA-AES128-SHA256"
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256

[] ~/work/oceandata$ /usr/bin/python -c 'import ssl ; print ssl.OPENSSL_VERSION'
OpenSSL 1.0.1f 6 Jan 2014

[] ~/work/oceandata$ gnutls-cli -l | grep TLS1.2
TLS_ANON_DH_AES_128_CBC_SHA256                          0x00, 0x6c      TLS1.2
TLS_ANON_DH_AES_256_CBC_SHA256                          0x00, 0x6d      TLS1.2
TLS_DHE_DSS_AES_128_CBC_SHA256                          0x00, 0x40      TLS1.2
TLS_DHE_DSS_AES_256_CBC_SHA256                          0x00, 0x6a      TLS1.2
TLS_DHE_RSA_AES_128_CBC_SHA256                          0x00, 0x67      TLS1.2
TLS_DHE_RSA_AES_256_CBC_SHA256                          0x00, 0x6b      TLS1.2
TLS_RSA_NULL_SHA256                                     0x00, 0x3b      TLS1.2
TLS_RSA_AES_128_CBC_SHA256                              0x00, 0x3c      TLS1.2
TLS_RSA_AES_256_CBC_SHA256                              0x00, 0x3d      TLS1.2
Protocols: VERS-SSL3.0, VERS-TLS1.0, VERS-TLS1.1, VERS-TLS1.2

[] ~/work/oceandata$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.5 LTS
Release:        14.04
Codename:       trusty

[gnwiii]

Ubuntu 14.04 $ gnutls-cli -l | grep TLS1.2 is missing the required ciphers.    For this reason, I upgraded my home systems to Linux Mint 18 (based on Ubuntu 16.04) and get
$ cat /etc/os-release
NAME="Linux Mint"
VERSION="18.1 (Serena)"
ID=linuxmint
ID_LIKE=ubuntu
PRETTY_NAME="Linux Mint 18.1"
VERSION_ID="18.1"
HOME_URL="http://www.linuxmint.com/"
SUPPORT_URL="http://forums.linuxmint.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/linuxmint/"
VERSION_CODENAME=serena
UBUNTU_CODENAME=xenial
$ gnutls-cli --version
gnutls-cli 3.4.10
$ gnutls-cli -l  | egrep "ECDHE_ECDSA_CHACHA20_POLY1305|ECDHE_ECDSA_AES_256_GCM_SHA384|ECDHE_ECDSA_AES_128_GCM_SHA256|ECDHE_ECDSA_AES_256-SHA384|ECDHE_ECDSA_AES_128_SHA256"
TLS_ECDHE_ECDSA_AES_128_GCM_SHA256                  0xc0, 0x2b  TLS1.2
TLS_ECDHE_ECDSA_AES_256_GCM_SHA384                  0xc0, 0x2c  TLS1.2
TLS_ECDHE_ECDSA_CHACHA20_POLY1305                   0xcc, 0xa9  TLS1.2

At work there is a Linux Mint 17.3 system that appears to have working git, but it has been heavily tweaked by someone else so I have no idea how it compares with a "stock" Ubuntu 14.04.  On closer investigation, the report that git was workiong was from Dec. 20th.  The Mint 17.3 system now has the same issue.

[woodbri]

@SeanBailey This requirement seems a little severe We are not in a position to upgrade our servers to Ubuntu 16.04 and I have to believe that this impacts a lot of other users also. It looks like this issue is being tracked at https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/1444656 but who knows when or if any action will be taken on it since it has been open since 2015-04-15. Is it possible to add any of the chipers supported above to your servers so these older clients can connect?