Mercurial https clone: "abort: error: (...) wrong version number"

Question

I have problem with mercurial on OS X 10.9.1 I have a repository on bitbucket with couple files, when I'm trying to clone it I'm getting an error:

mac-mini-jakub:testrepo kubeczek$ hg clone https://[email protected]/kubecz3k/test 
abort: error: _ssl.c:507: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

I have installed Mercurial 2.8.2 for MacOS X 10.9 from https://www.mercurial-scm.org/downloads/

I'm pretty sure that on the side of the bitbucket everything is ok, because I have no problem on linux machine.

here is the full traceback:

mac-mini-jakub:testrepo kubeczek$ hg clone https://[email protected]/kubecz3k/test --traceback
Traceback (most recent call last):
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 133, in _runcatch
    return _dispatch(req)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 806, in _dispatch
    cmdpats, cmdoptions)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 585, in runcommand
    ret = _runcommand(ui, options, cmd, d)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 897, in _runcommand
    return checkargs()
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 868, in checkargs
    return cmdfunc()
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/dispatch.py", line 803, in <lambda>
    d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/util.py", line 512, in check
    return func(*args, **kwargs)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/commands.py", line 1286, in clone
    branch=opts.get('branch'))
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/hg.py", line 268, in clone
    srcpeer = peer(ui, peeropts, source)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/hg.py", line 122, in peer
    return _peerorrepo(rui, path, create).peer()
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/hg.py", line 102, in _peerorrepo
    obj = _peerlookup(path).instance(ui, path, create)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/httppeer.py", line 238, in instance
    inst._fetchcaps()
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/httppeer.py", line 57, in _fetchcaps
    self.caps = set(self._call('capabilities').split())
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/httppeer.py", line 171, in _call
    fp = self._callstream(cmd, **args)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/httppeer.py", line 118, in _callstream
    resp = self.urlopener.open(req)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 404, in open
    response = self._open(req, data)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 422, in _open
    '_open', req)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/url.py", line 368, in https_open
    return self.do_open(self._makeconnection, req)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/mercurial/keepalive.py", line 257, in do_open
    raise urllib2.URLError(err)
URLError: <urlopen error [Errno 1] _ssl.c:507: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number>
abort: error: _ssl.c:507: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

My Python version is:

mac-mini-jakub:~ kubeczek$ python -V
Python 2.7.6

And SSL:

>>> print _ssl.OPENSSL_VERSION
OpenSSL 0.9.8y 5 Feb 2013

I will appreciate every help, thanks!

Extenuate

Post the exact Python version and SSL version (import _ssl and print _ssl.OPENSSL_VERSION) – Esquiline

@Esquiline thanks for reply, the SSL version is: "OpenSSL 0.9.8y 5 Feb 2013", and python version is: Python 2.7.6 – Extenuate

From Mercurial 2.7 sslutils forces SSLv3 on Python 2.6 and later, bitbucket uses an V3 so maybe the problem is related to OpenSSL, try updating OpenSSL (#18752909) or disable the Mercurial certificate check (#5367369) – Esquiline

Thanks for suggestions @Esquiline unfortunately they don't work in my case. Disabling certificate check don't change anything and for some reason I can't update ssl fully: in the terminal I now have version "OpenSSL 1.0.1f 6 Jan 2014" but in python there still is version "OpenSSL 0.9.8y". – Extenuate

@Esquiline thanks to your strong suggestion that problem is in ssl I decided to try with ssh and now everything works like a charm. I'm unsure if I should post an official answer, but for me the problem is solved now. – Extenuate

That was the other solution. Glad to have helped. To upgrade the python ssl libraries you may try "pip install ssl" or else you can download python and compile it indicating the location of the SSL development libraries. Anyway, you already have the solution, do not complicate :) – Esquiline

Answer 1

Not exactly a direct solution but good workaround: With strong suggestion that the problem lies is ssl I have switched to ssh(https://confluence.atlassian.com/pages/viewpage.action?pageId=270827678) and now everything works. So from a practical point of view for me this problem is solved.

Extenuate

Answer 2

You probably have to disable TLS, read this

To do so, add this to ~/.hgrc

[ui]
tls = False

more information about SSL and TLS here

Toler

This is THE correct solution. (At some point, the Mercurial had dropped support for SSLv2; At a later point they added this configuration option, which defaults to true) – Distinctly

not working for me, still tries to connect using TLS 1.0 – Ashram

ah, you have to add it to the [ui] section. now it doesn't complain about using TLS1.0, but the SSL3_GET_RECORD:wrong version number still happens. Think it's to do with Python being < 2.7.9 mercurial-scm.org/wiki/… – Ashram

Suddently had the error with bitbucket today. This answer fixed the issue. – Greg

Bitbucket may have changed something this month. Same here. – Chartier

That fixed it "abort: error: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:590)" – Boyett

I am having the problem with bitbucket too. This solution fixed the problem! Thanks – Abby

Answer 3

There is another cause. It might not have been your problem, but it should be listed here as well, for the case others encounter this problem:

If you are behind a proxy and your proxy settings are incorrect, this error message appears as well. God knows why...

Example: you have the following config

[http_proxy]
no = localhost,127.0.0.1
host = 1.2.3.4:8080
user = myusername
passwd = oldpassword

The oldpassword might be obsolet (you have forgotten to change it). Then the very same SSL wrong version error appears. It does absolutly make no sense at all (at least to me), but I reproduced this issue with mercurial 3.6.2. Correcting the proxy settings fixes everything.

Leggat

YES! this, thank you. Eventually figured out it was because bitbucket was pointing me to a bundle hosted at media-api.atlassian.io, and that last wasn't on the squid proxy whitelist. phew. thanks! – Ashram

Answer 4

I had this problem for some bitbucket repositories (but not all). I found that, as per the traceback, setting --config ui.clonebundles=false worked.

hg clone --config ui.clonebundles=false  https://bitbucket.org/me/myrepo

made the clone much slower mind you.

[edit] -- Although, see my comment on @UniversE's answer above, the actual problem was to do with an atlassian subdomain not being on my squid proxy's whitelist. phew, that was hard to debug.

Ashram

Answer 5

As one of the question's comments suggested, switching from https to ssh fixed it for me

Numismatics

Answer 6

You have to disable clonebundle from system wide mercurial config file or own config file.

To do, add following lines to /etc/mercurial/hgrc or ~/.hgrc

# system-wide mercurial configuration file
# See hgrc(5) for more information
[ui]
clonebundles = False

Verrucose