LUCI Windows bots "Got TLS error" talking to pub.dev

[zanderso]

Many builds across engine and framework CI are failing to access pub. For example:

https://ci.chromium.org/ui/p/flutter/builders/prod/Windows%20Android%20AOT%20Engine/9925/overview

Resolving dependencies...
It looks like pub.dartlang.org is having some trouble.
Pub will wait for a while before trying to connect again.
Got TLS error trying to find package package_config at https://pub.dartlang.org.
Traceback (most recent call last):
  File "src/flutter/tools/run_third_party_dart.py", line 13, in <module>
    subprocess.check_call([os.path.join(leading, pub), "global", "activate", "-spath", "./src/flutter/tools/generate_package_config"])
  File "C:\b\s\w\ir\cipd_bin_packages\cpython\bin\Lib\subprocess.py", line 190, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['src\\third_party\\dart\\tools\\sdks\\dart-sdk\\bin\\pub.bat', 'global', 'activate', '-spath', './src/flutter/tools/generate_package_config']' returned non-zero exit status 69

[christopherfujino]

This started mid-way through an un-related commit, and then on the latest commit ALL the windows bots have failed. Given the git log, pretty sure this isn't due to a recipe change.

[cbracken]

Any updates on the investigation here?

[christopherfujino]

Possibly related to #81486

Still investigating whether this is a dart/pub client issue.

[tvolkert]

There's an active chat between the Flutter & Dart teams trying to get to the bottom of this.

[tvolkert]

@godofredoc is putting together a temporary workaround that will install the missing certificate: https://flutter-review.googlesource.com/c/recipes/+/13180

[godofredoc]

More updates:

The workaround will land in three different steps:

• A change to the recipes adding the certs dependency(running presubmits) https://flutter-review.googlesource.com/c/recipes/+/13180
• A change in the configurations that will enable certs dependency in the framework(approved but will need to land after recipes change) https://github.com/flutter/infra/pull/433
• A change in the engine recipe to enable the certs dependency(will start working on it in a few mins).

[stuartmorgan-g]

This has been breaking flutter/plugins as well due to the Windows plugin LUCI test there. Does that need another change, or will one of the above cover that?

[godofredoc]

@stuartmorgan plugins will require two changes one in the recipe to process the dependency and one in the configurations use the dependency.

[godofredoc]

First set of changes landed

• https://flutter-review.googlesource.com/c/recipes/+/13180
• https://github.com/flutter/infra/pull/433

Waiting for configs to propagate to retry framework builds