…I agree with Andy: This looks like a Java issue. You could try enabling IGNORECERT in your .basex configuration [1] and executing REPO INSTALL to see if that changes anything.

[1] https://docs.basex.org/wiki/Options#IGNORECERT

On Wed, Apr 10, 2024 at 1:57 PM Andy Bunce <bunce.andy@gmail.com> wrote:

Hi Régis,

I am pretty sure your issue comes from the SSL certificates available to your Java VM, and is not a problem with your xar package.

Running Basex with -d shows more information [2]

Something like [1] may fix it for one machine, but it is a slow process and far from ideal.

/Andy

[1] https://stackoverflow.com/questions/21076179/pkix-path-building-failed-and-unable-to-find-valid-certification-path-to-requ/36427118#36427118

[2] basex -d -c "<repo-install path='https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar'/>"

...

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.net.http/jdk.internal.net.http.HttpClientImpl.send(HttpClientImpl.java:578)
at java.net.http/jdk.internal.net.http.HttpClientFacade.send(HttpClientFacade.java:123)
at org.basex.io.IOUrl.response(IOUrl.java:145)
at org.basex.io.IOUrl.inputStream(IOUrl.java:127)
at org.basex.io.in.BufferInput.get(BufferInput.java:49)
at org.basex.io.IOUrl.read(IOUrl.java:112)
at org.basex.query.util.pkg.RepoManager.install(RepoManager.java:64)
at org.basex.core.cmd.RepoInstall.run(RepoInstall.java:36)
at org.basex.core.Command.run(Command.java:233)
at org.basex.core.Command.execute(Command.java:93)
at org.basex.api.client.LocalSession.execute(LocalSession.java:131)
at org.basex.api.client.Session.execute(Session.java:36)
at org.basex.core.CLI.execute(CLI.java:94)
at org.basex.core.CLI.execute(CLI.java:78)
at org.basex.core.CLI.execute(CLI.java:65)
at org.basex.BaseX.<init>(BaseX.java:83)
at org.basex.BaseX.main(BaseX.java:45)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

On Wed, 10 Apr 2024 at 11:16, Régis WITZ <regis.witz@cnrs.fr> wrote:

Hi all,
I'm kind of a XQuery noob, but I'm guilty of the creation of a little
BaseX module, Heimdall (10.5281/zenodo.10638084
<https://zenodo.org/records/10638084>).
It's automatically built, unit tested and documented using GitLab CI.
All build results, including the .xar file, are hosted using GitLab Pages.
Thus, the module .xar archive is available here :
|https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar|
<https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar>.
As you see, all this is hosted in Huma-Num's self-hosted GitLab instance
(Huma-Num is a french research infrastructure).

However, this mail is /not/ (just) a shameless plug.
My issue is that I cannot install my .xar directly with |REPO INSTALL| :

1. I cannot install it with the CLI:

basex -c"<repo-install
path='https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar'/>"
[repo:not-found] Package
'https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar'
not found.

Things are perfectly fine with for example the functx package :
|basex -c"<repo-install
path='https://files.basex.org/modules/expath/functx-1.0.xar'/>"|
2. For gigs, I tried to change the protocol from HTTPS to HTTP, and
here is the error that I get :

basex -c"<repo-install
path='http://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar'/>"
[repo:parse] heimdall.xar: Resource "expath-pkg.xml" not found..

So, maybe there is a problem with my expath-pkg.xml file ?
I didn't find any -but, as I said, I'm no pro. If needed, here is
the file that is wrapped in the .xar :
https://gitlab.huma-num.fr/datasphere/heimdall/xquery/-/raw/main/expath-pkg.xml?ref_type=heads
<https://gitlab.huma-num.fr/datasphere/heimdall/xquery/-/raw/main/expath-pkg.xml?ref_type=heads>
3. However, when I download my .xar file from the URL, and then REPO
INSTALL it using the local path, stuff works fine :
wget --no-check-certificate
https://datasphere.gitpages.huma-num.fr/heimdall/xquery/heimdall.xar
basex -c"<repo-install path='./heimdall.xar'/>"
basex -c"<repo-list />"

Name Version Type Path
---------------------------------------------------------------------------
http://heimdall.huma-num.fr 2.1 EXPath
http-heimdall.huma-num.fr-2.1

1 package(s).

So I suppose the problem /might/ not be within the .xar itself, but the
way it is hosted ?
Maybe REPO INSTALL doesn't like my disturbing lack of SSL certificate ?
I tried to search for some clue, but didn't find any clue in the
documentation <https://docs.basex.org/wiki/Repository>. Maybe I'm blind,
maybe that's not the problem at all.

It's not exactly a blocking issue, but my noobiness regarding the basex
ecosystem (and xquery in general) prevents me to understanding what
happens, my README contains false info, and I'm not at ease with that.
If someone had any intel, I'd be thankful.

If needed, here is the repository :
https://gitlab.huma-num.fr/datasphere/heimdall/xquery/
<https://gitlab.huma-num.fr/datasphere/heimdall/xquery/>
And here is the corresponding issue (in French, sorry) :
https://gitlab.huma-num.fr/datasphere/heimdall/xquery/-/issues/1
<https://gitlab.huma-num.fr/datasphere/heimdall/xquery/-/issues/1>

Have a nice day, sunshine, flowers and all,

Régis