Clean up error messages on proxy errors to make them more helpful

[boernsen-development]

Checklist

• I have verified this is the correct repository for opening this issue.
• I have verified no other issues exist related to my request.

Is Your Feature Request Related To A Problem? Please describe.

The output/error message when providing a wrong proxy address looks like this:

rdcman v3.1.0 (forced)
rdcman package files upgrade completed. Performing other installation steps.
Using explicit proxy server 'http://non-existing-proxy:9999'.
Attempt to get headers for https://download.sysinternals.com/files/RDCMan.zip failed.
  The remote file either doesn't exist, is unauthorized, or is forbidden for url 'https://download.sysinternals.com/files/RDCMan.zip'. Exception calling "GetResponse" with "0" argument(s): "Unable to connect to the remote server"
Downloading rdcman
  from 'https://download.sysinternals.com/files/RDCMan.zip'
Using explicit proxy server 'http://non-existing-proxy:9999'.
ERROR: The remote file either doesn't exist, is unauthorized, or is forbidden for url 'https://download.sysinternals.com/files/RDCMan.zip'. Exception calling "GetResponse" with "0" argument(s): "Unable to connect to the remote server"
The upgrade of rdcman was NOT successful.
Error while running 'C:\ProgramData\chocolatey\lib\rdcman\tools\chocolateyInstall.ps1'.
 See log for details.

Chocolatey upgraded 0/1 packages. 1 packages failed.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

Failures
 - rdcman (exited 404) - Error while running 'C:\ProgramData\chocolatey\lib\rdcman\tools\chocolateyInstall.ps1'.
 See log for details.

The output/error message when providing a correct proxy address, but with wrong credentials looks like this:

rdcman v3.1.0 (forced)
rdcman package files upgrade completed. Performing other installation steps.
Using explicit proxy server 'http://some-working-proxy:8080'.
Attempt to get headers for https://download.sysinternals.com/files/RDCMan.zip failed.
  The remote file either doesn't exist, is unauthorized, or is forbidden for url 'https://download.sysinternals.com/files/RDCMan.zip'. Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (407) Proxy Authentication Required."
Downloading rdcman
  from 'https://download.sysinternals.com/files/RDCMan.zip'
Using explicit proxy server 'http://some-working-proxy:8080'.
ERROR: The remote file either doesn't exist, is unauthorized, or is forbidden for url 'https://download.sysinternals.com/files/RDCMan.zip'. Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (407) Proxy Authentication Required."
The upgrade of rdcman was NOT successful.
Error while running 'C:\ProgramData\chocolatey\lib\rdcman\tools\chocolateyInstall.ps1'.
 See log for details.

Chocolatey upgraded 0/1 packages. 1 packages failed.
 See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log).

Failures
 - rdcman (exited 404) - Error while running 'C:\ProgramData\chocolatey\lib\rdcman\tools\chocolateyInstall.ps1'.
 See log for details.

As one can see, they look very similar and the output generally seems polluted by a lot of irrelevant information. For me, it is hard to spot the relevant one, which I think only is

• in the first case:

"Unable to connect to the remote server"

• in the second case:

"The remote server returned an error: (407) Proxy Authentication Required."

Describe The Solution. Why is it needed?

It would be very helpful if

• the actual error is printed without or with less additional information
• the related config is printed (proxy, proxyUser or even the entire choco config), so that one can easily check its validity (apart from the encrypted password of course)
• actions are proposed to solve the issue (e.g. choco config set proxy ... or choco config set proxyPassword ... etc.)
• the entire output is formatted in an easily human-readable way

Ideally, errors would be returned as proper exception in PowerShell. I don't know whether this is possible though without loosing support for cmd.exe.

Especially when automated tasks run the command and the proxy's credentials change (regularly due to expiry), it is hard to analyze the cause quickly. We spend quiet some time puzzling over the cause and the solution (i.e. to just update the proxyPassword) every time this happened, which could be avoided.

Additional Context

Chocolatey v2.5.0

Command used:

choco upgrade rdcman --yes --force

Related Issues

No response

[github-actions]

To vote for this issue, please add a 👍 emoji to the issue description. Votes in comments are not recorded.

[pauby]

The errors that are output are consistent with what Chocolatey CLI is seeing:

"Unable to connect to the remote server"

"The remote server returned an error: (407) Proxy Authentication Required."

As one can see, they look very similar and the output generally seems polluted by a lot of irrelevant information. For me, it is hard to spot the relevant one, which I think only is

The information may be irrrelevant to you, but it's important troubleshooting information.

I wanted to pick up on what you're asking:

It would be very helpful if the actual error is printed without or with less additional information

The information output is output when any error like this occurs to help determine what the issue is. This isn't limited to a proxy issue. Chocolatey CLI tries to get the file and this is what is returned so it tells you.

the related config is printed (proxy, proxyUser or even the entire choco config), so that one can easily check its validity (apart from the encrypted password of course)

We don't print out the config anywhere in Chocolatey CLI when there is an error so we wouldn't be consistent doing that here. It's clear that The error 407 indicates a proxy authentication error (which Chocolatey CLI confirms) and you would then check your config.

actions are proposed to solve the issue (e.g. choco config set proxy ... or choco config set proxyPassword ... etc.)

Every environment is unique so that would be down to you to determine what actions you need to do.

the entire output is formatted in an easily human-readable way

This output is across Chocolatey CLI and is consistent with what we do elsewhere. Chocolatey CLI returns what the error is.

What is it you are specifically looking for Chocolatey CLI to do, show or not show?

[boernsen-development]

The errors that are output are consistent with what Chocolatey CLI is seeing:

"Unable to connect to the remote server"

"The remote server returned an error: (407) Proxy Authentication Required."

These short-line messages would be sufficient to me.

The information may be irrrelevant to you, but it's important troubleshooting information.

What I'm used to is that output is reduced to a minimum by default and can be made more verbose by a verbose flag if I need to troubleshoot.

The information output is output when any error like this occurs to help determine what the issue is. This isn't limited to a proxy issue. Chocolatey CLI tries to get the file and this is what is returned so it tells you.

I see. So the posted long-line error messages are actually not Chocolatey's responsibility, but some other command's? Which?

We don't print out the config anywhere in Chocolatey CLI when there is an error so we wouldn't be consistent doing that here. It's clear that The error 407 indicates a proxy authentication error (which Chocolatey CLI confirms) and you would then check your config.

The exitcode of the entire command is 404 on my system, so I'm not able to react correctly without parsing the entire error message. This means a script would have the same issue as I have as a human: I cannot find the relevant information in an easy way.

Every environment is unique so that would be down to you to determine what actions you need to do.

I agree. I personally still would consider some proposed actions as usability improvement, but that's a matter of personal preference. This would not be too important to me considering the additional effort required to implement this.

What is it you are specifically looking for Chocolatey CLI to do or show?

I'm just looking for increased usability when such errors occur. Imagine the described use-case:
Chocolatey is configured with a proxy including credentials. Every year the credentials change and Chocolatey prints the error forcing me to react to solve the issue. From a user perspective, the only things I want to know are:

• What is the exact error cause? (as specific as possible)
• How can I solve it?

Usually, I don't want to know any more information except if errors are too unspecific to point to the solution or if I'm debugging the application itself. In these cases, I would normally use verbose or debug flags.

[pauby]

What is the exact error cause? (as specific as possible)

Chocolatey CLI provided what it knows about the cause of the error in both of the messages and provided specific details.

How can I solve it?

An environment with a proxy is usually tightly controlled by a network / security team. If Chocolatey CLI makes the wrong suggestion, and perhaps a very wrong suggestion that could cause damage, then people will complain about that.

Chocolatey CLI is a package manager for Windows. We don't build it to determine your proxy environment and make suggestions. We, rightly I would argue, leave that to you as you are the best person to determine what needs to be done to use the proxy effectively. The right course of action here is to leave these things to the user to decide.

Usually, I don't want to know any more information except if errors are too unspecific to point to the solution or if I'm debugging the application itself. In these cases, I would normally use verbose or debug flags.

Chocolatey CLI provides that too. But as this is an error that stops Chocolatey CLI from continuing, everything it knows about the problem it has encountered is shown. This is an intentional decision.

[boernsen-development]

As far as I understood, Chocolatey is just forwarding an error message from an (external?) command in this case, correct? In that case I would agree that it's not Chocolatey's responsibility to change that output and I would rather raise an issue at the command's source repo. Do you know by heart which command it is or how I could figure that out? (maybe with some verbose/debug flag?)

[pauby]

Chocolatey CLI is written in C# and the responses will be from the C# methods

The Chocolatey package functions are written in PowerShell. Depending on which function you are using you will be able to trace the code through in this repository but it will still likely be to C# methods (which PowerShell uses too). The Chocolatey function is likely to be Get-WebFile.

[boernsen-development]

I think I found the related code:

choco/src/chocolatey.resources/helpers/functions/Get-WebFile.ps1

Lines 336 to 353 in 84d7e9d

	catch {
	if ($null -ne $req) {
	$req.ServicePoint.MaxIdleTime = 0
	$req.Abort();
	# ruthlessly remove $req to ensure it isn't reused
	Remove-Variable req
	Start-Sleep 1
	[GC]::Collect()
	}
	Set-PowerShellExitCode 404
	if ($env:DownloadCacheAvailable -eq 'true') {
	throw "The remote file either doesn't exist, is unauthorized, or is forbidden for url '$url'. $($_.Exception.Message) `nThis package is likely not broken for licensed users - see https://docs.chocolatey.org/en-us/features/private-cdn."
	}
	else {
	throw "The remote file either doesn't exist, is unauthorized, or is forbidden for url '$url'. $($_.Exception.Message)"
	}
	}

choco/src/chocolatey.resources/helpers/functions/Get-WebHeaders.ps1

Lines 159 to 170 in 84d7e9d

	catch {
	if ($request -ne $null) {
	$request.ServicePoint.MaxIdleTime = 0
	$request.Abort();
	# ruthlessly remove $request to ensure it isn't reused
	Remove-Variable request
	Start-Sleep 1
	[GC]::Collect()
	}
	throw "The remote file either doesn't exist, is unauthorized, or is forbidden for url '$url'. $($_.Exception.Message)"
	}

I can see that Chocolatey's part of the error message is:

The remote file either doesn't exist, is unauthorized, or is forbidden for url 'https://download.sysinternals.com/files/RDCMan.zip'.

which then is appended by another part generated by PowerShell or DotNet (not sure):

Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (407) Proxy Authentication Required."

I consider Chocolatey's part as generic/unspecific and I would suggest to either remove it, move it to another line or move it to the end of the line or make it output only with debug/verbose flags, so that the actual (specific) error message is right at the beginning of the line. This would improve things a lot for me already.

What do you think about it?

[pauby]

This would improve things a lot for me already.

As I mentioned above, the messages are intentional, and it's not something we would consider changing at this time.

[boernsen-development]

I see, it probably is a trade-off (as always). I don't know what the other reasons were regarding this decision, but please consider that it might decrease usability for users.