libman: library could not be resolved by 'cdnjs' provider AGAIN

[LLIAMAH]

Describe the bug

Some time ago I got the problem: #699
After some actions I received required libs and all was OK, but - in one time I have to add NEW one lib and was surprised that received same error.

I'll checked another libs:

1. Some libs - could not be resolved by message
2. Some libs - does not show any autocomplete list during typing the name of lib.
3. Some libs - libman shows lib folder and files, but cannot download FULL array of files (start download, but breaks on some file and fail the process of installation whole lib)

To Reproduce

Steps to reproduce the behavior:

1. I'm using Visual Studio 2022 latest RELEASED version Win10 Pro latest updates and TLS settings:

2. libman --version: 2.1.175+29a28921bd.RR
3. totally clean cache of the libman
4. Create new Asp.net project and try to get some libs - for me it is enough to reproduce problem.

Expected behavior

1. Would be nice to have valid behavior, when all libs/.autocompletes are shown and libs successfully installs
2. Would be nice to have VALID message error - which exists in InternalException: "SSL/TLS problem" instead of general "cdnjs could not resolve..." or "lib load failed.."
3. Would be nice to have combobox in this dialog or command parameter, which allows to set TLS 1.2 via command line parameters.

Additional context

I started to investigate and TADAM! Problem in security certificates AGAIN! So it is from minor-middle bug, should increase priority and fixed in result, I guess.
I don't know why forced set options to TLS 1.2 doesn't work anymore (this helped in past) - may be after installing latest Win10 updates. But in current moment I could take NEW libs ONLY via libman Debug + dependent VS opened solution with this row.

I downloaded libman codes, started it and found that:

1. Error raises in the Row#49 - GetStreamAsync - failed.
2. Process works fine if Row#59 is added (whole row is added by me).

I UNDERLINE: that ALL 3 problems of the

• not showing libs,
• autocomplete missed
• unsuccessful downloading of the lib files set

are WORKED FINE for me if Row#59 exists. So would be nice to have option to force switching it on.

[gaelj]

Hi @jimmylewis ! Is there any chance of seeing this bug fixed ? It impacts all people who are forced to use old TLS version for various reasons. Unfortunately in some work environments, software upgrades are not easily done.
Thanks 👍

[LLIAMAH]

Hi @jimmylewis ! Is there any chance of seeing this bug fixed ? It impacts all people who are forced to use old TLS version for various reasons. Unfortunately in some work environments, software upgrades are not easily done. Thanks 👍

FYI: I've created my own libman visual studio extension package and replaced it on mine system ;). Hardcoded required TLS and got the result.

[gaelj]

@LLIAMAH great job ! Why don't you submit it in a pull request 😊

[LLIAMAH]

@LLIAMAH great job ! Why don't you submit it in a pull request 😊

Cause it has hardcoded inset for few private cases only.
It would be nice to have something like select list to choose required TLS cert in the GUI menu or CLI command, but GUI part didn't loaded properly in my designer view :(.

[jimmylewis]

I'm thinking that this could be done as a setting e.g. do something like libman config --set forcetls12=true. This way it would only apply to users that need it, and it's an explicit step to configure (it wouldn't happen by accident).

One issue however is that using ServicePointManager.SecurityProtocol configures the setting for the current application - meaning it could be the libman CLI, or msbuild, or Visual Studio. The latter two make this a non-starter; we can't (shouldn't) just change the security settings for those processes.

@LLIAMAH does it work if you add

            httpMessageHandler.SslProtocols = System.Security.Authentication.SslProtocols.Tls12;

after line 61 instead? Since I can't reproduce the problem, I can't tell if this would resolve it, but I'm trying to limit the impact to only the libman web requests.

[jimmylewis]

@LLIAMAH I made a draft PR that I think implements this so it addresses my concerns. Can you give it a try and see if it solves the problem for you?

To force TLS 1.2, you need to use the libman CLI to do libman config --set forcetls12=true. It should then work in any host (CLI/msbuild/VS) with a private build from my PR branch. You can turn it off (revert to default behavior) by doing libman config --set forcetls12=

[LLIAMAH]

@LLIAMAH does it work if you add

            httpMessageHandler.SslProtocols = System.Security.Authentication.SslProtocols.Tls12;

after line 61 instead? Since I can't reproduce the problem, I can't tell if this would resolve it, but I'm trying to limit the impact to only the libman web requests.

Yes. Exactly this one line.
But please don't forget to reflect same option in GUI part, too.

[jimmylewis]

The GUI will respect the setting, but the only way to configure libman settings like this for now is to use the CLI to set or unset the value. Implementing a GUI for editing settings would need to be a separate feature.

[carloswm85]

I've checked these options:

And the problem still persist.

Do you know if this problem has been solved for VS22 latest version? I have Microsoft Visual Studio Community 2022 (64-bit) - Current Version 17.12.3 and libman 2.1.175+29a28921bd.RR

I really don't know what's the best way for quickly bypassing this problem.

Even the CLI seems not to work:

..\EmployeeManagement $ libman install jquery --provider cdnjs --destination wwwroot/lib/jquery
[LIB002]: The "jquery" library could not be resolved by the "cdnjs" provider

[LLIAMAH]

@carloswm85 yes they fixed it - I saw commit in which been defined some TLS as by default, but I don't know - is it in release build or not.
Cause my fix been applied locally and it is working :)
Didn't check version changed or not.

Did you tried this one comand? To define libman config option?
libman config --set forcetls12=true

And don't forget to restart VS after config changed.