Trouble installing elixir - but I have a PR

[jeffdeville]

I'm trying to set up for my elixir project. It works using the docker run environment, but fails here. It seems like something about the setup trips the code that starts blocking network access.

#!/usr/bin/env bash
###############################################################################
# setup.sh  ──  Codex build-phase: Erlang 27 + Elixir 1.18 via mise, offline
###############################################################################
set -Eeuo pipefail
set -x                                # trace every command for debug
LOG() { printf '\n[%(%F %T)T] %s\n' -1 "$*"; }

###############################################################################
# 0 ▸ Sanity checks & proxy env
###############################################################################
: "${CODEX_PROXY_CERT:?ERROR: \$CODEX_PROXY_CERT is not set}"
export HTTP_PROXY="${http_proxy:-http://proxy:8080}"
export HTTPS_PROXY="${https_proxy:-http://proxy:8080}"

###############################################################################
# 1 ▸ Trust the Codex proxy CA  (system-wide)
###############################################################################
install -Dm644 "$CODEX_PROXY_CERT" \
  /usr/local/share/ca-certificates/codex-proxy.crt
update-ca-certificates --fresh

###############################################################################
# 2 ▸ Teach *APT* about the proxy  (APT ignores env-vars)
###############################################################################
cat >/etc/apt/apt.conf.d/01codex-proxy <<EOF
Acquire::http::Proxy  "${HTTP_PROXY}";
Acquire::https::Proxy "${HTTPS_PROXY}";
EOF

###############################################################################
# 3 ▸ Install build prerequisites
###############################################################################
apt-get update -yqq
DEBIAN_FRONTEND=noninteractive \
apt-get install -y --no-install-recommends \
  curl git ca-certificates \
  build-essential autoconf automake libtool \
  libncurses5-dev libssl-dev libwxgtk3.2-dev \
  openssl tar xz-utils

###############################################################################
# 4 ▸ Install mise (Rust runtime manager)
###############################################################################
curl -fsSL --retry 5 --retry-delay 4 https://mise.run | \
  bash -s -- --yes  # non-interactive

# mise binaries
export PATH="$HOME/.local/share/mise/bin:$HOME/.local/bin:$PATH"
# mise shims (erl, iex, elixir, … will live here)
export PATH="$HOME/.local/share/mise/shims:$PATH"

# load mise hook functions for the current shell
eval "$(mise activate bash)"

mise --version                       # debug print

###############################################################################
# 5 ▸ Build Erlang 27 & Elixir 1.18 with mise
###############################################################################
export KERL_CONFIGURE_OPTIONS="--without-wx --disable-jit --with-ssl=/usr"
export MAKEFLAGS="-j$(nproc)"

mise install erlang@27               # compiles from source, cached by mise
mise install elixir@1.18

mise use erlang@27 elixir@1.18   # make them default for the rest of script
erl -eval 'erlang:display(erlang:system_info(otp_release)),halt().' -noshell
elixir -v

###############################################################################
# 6 ▸ TLS settings for Erlang/Hex/Mix
###############################################################################
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
export HEX_CACERTS_PATH=$SSL_CERT_FILE
export MIX_ENV=prod
export MIX_DEBUG=1

###############################################################################
# 7 ▸ Install Hex, Rebar, deps, compile  (proxy-friendly)
###############################################################################
LOG "Installing Hex…"
if ! mix local.hex --force ; then
  LOG "builds.hex.pm unreachable ⇒ fetching Hex from GitHub…"
  mix archive.install --force \
       github hexpm/hex \
       tag    v2.2.1         # ← keep in sync with latest release as needed
fi
mix hex.info                 # debug: should print “Hex v2.2.1”

LOG "Installing Rebar3…"
if ! mix local.rebar --force ; then
  LOG "builds.hex.pm unreachable ⇒ fetching rebar3 binary from GitHub…"
  REBAR_VER="3.24.0"         # current stable (change when a new one drops)
  curl -fsSL --retry 5 --retry-delay 4 \
       "https://github.com/erlang/rebar3/releases/download/${REBAR_VER}/rebar3" \
       -o "$HOME/.mix/rebar3"
  chmod +x "$HOME/.mix/rebar3"
fi
"$HOME/.mix/rebar3" --version # debug: prints rebar 3.24.0

export HEX_HTTP_CONCURRENCY=1     # ONE connection → HTTP/1.1, no multiplexing
export HEX_HTTP_TIMEOUT=300000    # 5-minute per-request timeout (default 15 s)
export HEX_HTTP_RETRIES=5         # built-in retries for registry & tarballs
LOG "Hex proxy tuning: concurrency=$HEX_HTTP_CONCURRENCY, timeout=$HEX_HTTP_TIMEOUT"

###############################################################################
# 8 ▸ Fetch deps with retry wrapper
###############################################################################
for ATTEMPT in {1..5}; do
  LOG "mix deps.get attempt $ATTEMPT …"
  if mix deps.get --verbose ; then
    break
  fi
  LOG "mix deps.get failed – sleeping 10 s and retrying"
  sleep 10
done

LOG "mix compile …"
mix compile --warnings-as-errors

#####################################################################
# 8 ▸ Smoke test TLS through the proxy (repo.hex.pm)
###############################################################################
erl -noshell -eval '
ssl:start(),
case ssl:connect("repo.hex.pm",443,[],5000) of
  {ok,S} -> io:format("TLS OK (~p)~n",[ssl:negotiated_protocol(S)]), ssl:close(S), halt(0);
  E      -> io:format("TLS FAILED: ~p~n",[E]), halt(1)
end.'

LOG "✅  setup.sh finished – fully offline runtime ready."

The errors:

Could not install Rebar because Mix could not download metadata at https://builds.hex.pm/installs/rebar.csv.

This one there's a workaround for - I can pull it from github

But this is a killer, near as I can tell:

<- Ran mix archive.check in 0ms
upstream connect error or disconnect/reset before headers. reset reason: connection termination
Failed to fetch record for mint from registry (using cache instead)
** (Mix.Error) Unknown package mint in lockfile
(mix 1.18.4) lib/mix.ex:618: Mix.raise/2
(elixir 1.18.4) lib/enum.ex:992: anonymous fn/3 in Enum.each/2
(stdlib 6.2.2) maps.erl:860: :maps.fold_1/4
(elixir 1.18.4) lib/enum.ex:2558: Enum.each/2
(hex 2.2.1) lib/hex/remote_converger.ex:49: Hex.RemoteConverger.converge/2
(mix 1.18.4) lib/mix/dep/converger.ex:133: Mix.Dep.Converger.all/4
(mix 1.18.4) lib/mix/dep/converger.ex:89: Mix.Dep.Converger.converge/4
(mix 1.18.4) lib/mix/dep/fetcher.ex:16: Mix.Dep.Fetcher.all/3

It seems the proxy just won't allow downloads from https://hex.pm/

[jeffdeville]

I've taken a stab at a PR:
#32

[zekus]

I am using a workaround for this problem, but we should not use workarounds. The codex proxy should be updated to allow hex repositories to work (and, frankly, private repositories too).
It is not an internet problem, but rather a rule in Envoy (the proxy) that prevents mix deps.get from downloading the dependencies. I'm able to download packages via curl, so the issue should be related to the protocol and handshake used by mix, but I'm unable to pinpoint exactly what. The issue is also not related to SSL.

If you are eager to solve it, just parse mix.lock, use curl to download the tarballs, and extract them into deps/. Then run mix deps.compile. This method works for me.

[claytongentry]

I am using a workaround for this problem, but we should not use workarounds. The codex proxy should be updated to allow hex repositories to work (and, frankly, private repositories too). It is not an internet problem, but rather a rule in Envoy (the proxy) that prevents mix deps.get from downloading the dependencies. I'm able to download packages via curl, so the issue should be related to the protocol and handshake used by mix, but I'm unable to pinpoint exactly what. The issue is also not related to SSL.

If you are eager to solve it, just parse mix.lock, use curl to download the tarballs, and extract them into deps/. Then run mix deps.compile. This method works for me.

@zekus do you mind sharing your solution?

[venkatd]

Would love to see a fix for this, I lost a few hours trying to debug SSL cert issues until I came up on this thread.

[marot]

+1 I also struggled way too long with this issue before finding this issue :)

[zwippie]

+1 Would love to have a working Elixir setup for codex.

I think the hex.pm domain should be added to a preset domain list, but it's not in this repo.

[vkryukov]

After spending a few hours with o3, the following incantation works for me. Note that I'm using a different hex mirror, and compiling Erlang with the right CA certificate (just installing the binary doesn't seem to work): https://gist.github.com/vkryukov/8be13dac77e9fbdaeb8b139d462cb704