Provide a setting to allow the language server to be downloaded via HTTP to avoid MitM firewalls

[kvnjcby]

Environment data

• VS Code version: 1.28.0
• Extension version (available under the Extensions sidebar): 2018.9.0
• OS and version: Xubuntu 16.04
• Python version (& distribution if applicable, e.g. Anaconda): 2.7.12
• Type of virtual environment used (N/A | venv | virtualenv | conda | ...): N/A
• Relevant/affected Python packages and their versions: N/A

Actual behavior

When trying to select my Python linter, I get a "command 'python.setLinter' not found" error. After checking the developer tools console, it looks like the Python extension is unable to activate due to a self signed certificate in the certificate chain because I'm on a corporate network. It looks like it's specifically failing to update from the language server. See logs below. I have disabled "proxy strict SSL" in my user settings but this doesn't seem to have an effect on extensions.

Expected behavior

I should be able to ignore this SSL error so that I can use the Python extension.

Steps to reproduce:

1. Install Python VS Code extension
2. Try to "Select Linter"

Logs

Output for Python in the Output panel (View→Output, change the drop-down the upper-right of the Output panel to Python)

Starting Microsoft Python language server.

Output from Console under the Developer Tools panel (toggle Developer Tools on under Help)

console.ts:136 [Extension Host] Python Extension: Listing Nuget Packages, Arg 1: "https://pvsc.blob.core.windows.net", Arg 2: "python-language-server-stable", Arg 3: "Python-Language-Server-linux-x64" Error: self signed certificate in certificate chain
	at TLSSocket.<anonymous> (_tls_wrap.js:1103:38)
	at emitNone (events.js:106:13)
	at TLSSocket.emit (events.js:208:7)
	at TLSSocket._finishInit (_tls_wrap.js:637:8)
	at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:467:38)

console.ts:136 [Extension Host] Python Extension: Get latest language server nuget package version, , Return Value:  Error: self signed certificate in certificate chain
	at TLSSocket.<anonymous> (_tls_wrap.js:1103:38)
	at emitNone (events.js:106:13)
	at TLSSocket.emit (events.js:208:7)
	at TLSSocket._finishInit (_tls_wrap.js:637:8)
	at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:467:38)

console.ts:136 [Extension Host] Python Extension: Get latest version of Language Server, , Return Value:  Error: self signed certificate in certificate chain
	at TLSSocket.<anonymous> (_tls_wrap.js:1103:38)
	at emitNone (events.js:106:13)
	at TLSSocket.emit (events.js:208:7)
	at TLSSocket._finishInit (_tls_wrap.js:637:8)
	at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:467:38)

console.ts:136 [Extension Host] Python Extension: Get language server folder name, , Return Value:  TypeError: Cannot read property 'version' of undefined
	at LanguageServerFolderService.<anonymous> (/home/kjacoby/.vscode/extensions/ms-python.python-2018.9.0/out/client/activation/languageServerFolderService.js:49:61)
	at Generator.next (<anonymous>)
	at fulfilled (/home/kjacoby/.vscode/extensions/ms-python.python-2018.9.0/out/client/activation/languageServerFolderService.js:15:58)
	at <anonymous>
	at process._tickCallback (internal/process/next_tick.js:188:7)

console.ts:136 [Extension Host] Activating extension 'ms-python.python' failed: Cannot read property 'version' of undefined.

console.ts:136 [Extension Host] Activating extension `ms-python.python` failed:  Cannot read property 'version' of undefined

console.ts:136 [Extension Host] Here is the error stack:  TypeError: Cannot read property 'version' of undefined
	at LanguageServerFolderService.<anonymous> (/home/kjacoby/.vscode/extensions/ms-python.python-2018.9.0/out/client/activation/languageServerFolderService.js:49:61)
	at Generator.next (<anonymous>)
	at fulfilled (/home/kjacoby/.vscode/extensions/ms-python.python-2018.9.0/out/client/activation/languageServerFolderService.js:15:58)
	at <anonymous>
	at process._tickCallback (internal/process/next_tick.js:188:7)

extensionService.ts:1006 Activating extension 'ms-python.python' failed: Cannot read property 'version' of undefined.

notificationsAlerts.ts:40 Error: command 'python.setLinter' not found

[aloysbaillet]

Same problem here, we're behind an aggressive firewall and the download of the python language server is not working. Thanks!

[FilipBrinkmann]

Same here. We have a corporate proxy which does SSL inspection and therefore get

console.ts:136 [Extension Host] Python Extension: Listing Nuget Packages, Arg 1: "https://pvsc.blob.core.windows.net", Arg 2: "python-language-server-stable", Arg 3: "Python-Language-Server-win-x64" Error: unable to get local issuer certificate
	at TLSSocket.<anonymous> (_tls_wrap.js:1103:38)
	at emitNone (events.js:106:13)
	at TLSSocket.emit (events.js:208:7)
	at TLSSocket._finishInit (_tls_wrap.js:637:8)
	at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:467:38)

In version 2018.8.0, I could work around by setting strictSSL:false in requestWithProxy.js. However, this file does not exist anymore.

[brettcannon]

First, you can always go back to Jedi with "python.jediEnabled": true so you don't attempt to download the language server.

Second, so you're saying that the domain https://pvsc.blob.windows.net is being blocked?

[aloysbaillet]

Hi Brett,
Many corporate firewalls now do a man in the middle attack on SSL to filter content, adding a self signed certificate as a root certificate on the "protected" machines. Chrome is happy with that as it is configured to accept that certificate but electron is somehow more picky.
The domain is not blocked, but the SSL certificate is not accepted and the download fails.
Jedi kinda works but had issues with namespace packages on python 2.7 and I wanted to evaluate the new shiny language server...
Thanks for your help!
Aloys

[brettcannon]

You can manually download the language server manually via HTTP and unpack it yourself. We could look at providing a setting where you let you explicitly opt into downloading via HTTP (at your own peril since we are explicitly trying to avoid man-in-the-middle attacks 😁 ).

[aloysbaillet]

Ideally if the extension could check for the main strictSSL settings and disable certificate checks that would be ideal!
I managed to manually download the language server file by installing the extension at home and sending the exact url to my work email address as the url cannot be easily guessed, so all good now.

[brettcannon]

Based on this message from vscode we could try and support "http.proxyStrictSSL": false and use HTTP in those instances (or figure out how to make the request over HTTPS w/o validating certs).