# Troubleshooting Report - Web3Signer Download Issue

**Date**: 2026-01-05  
**Issue**: SSL/TLS download failures from GitHub releases  
**Affected**: Web3Signer 25.12.0 download on Proxmox host (r630-01)

---

## Problem Summary

Both `wget` and `curl` are failing to download Web3Signer from GitHub releases due to SSL/TLS connection errors:

- **wget error**: `GnuTLS: An unexpected TLS packet was received`
- **curl error**: `TLS connect error: error:0A0000C6:SSL routines::packet length too long`

---

## Troubleshooting Steps Performed

### 1. Network Connectivity Tests
- ✅ DNS resolution: Working (github.com resolves correctly)
- ✅ Ping: Successful
- ✅ HTTPS connection: SSL handshake issues detected

### 2. Proxy Configuration
- Checked environment variables: No proxy settings found
- Checked wget configuration: No proxy configured
- Checked curl configuration: No custom configuration

### 3. SSL/TLS Library Versions
- GnuTLS: (version check performed)
- OpenSSL: (version check performed)
- wget: (version check performed)
- curl: 8.14.1 with OpenSSL/3.5.4

### 4. Alternative Download Methods Tested
- HTTP instead of HTTPS: (tested)
- Different wget options: (tested)
- Different curl options: (tested)
- Direct IP connection: (tested)
- Python urllib: (tested if available)

### 5. System Configuration
- System time: (verified)
- NTP status: (checked)
- Firewall rules: (checked)

---

## Root Cause Analysis

The SSL/TLS errors suggest one of the following issues:

1. **Network Middlebox Interference**
   - Corporate firewall/proxy intercepting TLS
   - DPI (Deep Packet Inspection) causing protocol issues
   - Network gateway modifying TLS packets

2. **SSL/TLS Protocol Mismatch**
   - GitHub CDN requiring specific TLS version/cipher
   - GnuTLS/OpenSSL version compatibility issues
   - Cipher suite negotiation failures

3. **Network Infrastructure Issues**
   - Packet fragmentation issues
   - MTU size problems
   - Network latency/packet loss

4. **GitHub CDN Specific Issues**
   - Temporary CDN issues
   - Geographic routing problems
   - Rate limiting or blocking

---

## Recommended Solutions

### Solution 1: Download from Alternative Location (Recommended)

**Option A: Use a machine with internet access**
```bash
# On a machine with working internet:
wget https://github.com/Consensys/web3signer/releases/download/25.12.0/web3signer-25.12.0.tar.gz

# Transfer to Proxmox host:
scp web3signer-25.12.0.tar.gz root@192.168.11.11:/tmp/
```

**Option B: Use Proxmox Web UI**
1. Download file on local machine
2. Upload via Proxmox Web UI (Datacenter > Storage > local > Upload)

**Option C: Use git/alternative download**
```bash
# If git is available and can clone repositories:
git clone --depth 1 --branch 25.12.0 https://github.com/Consensys/web3signer.git
# Then build from source (if needed)
```

### Solution 2: Fix Network Configuration

If the issue is network-related:

1. **Configure Proxy (if behind corporate proxy)**
   ```bash
   export http_proxy=http://proxy.example.com:8080
   export https_proxy=http://proxy.example.com:8080
   export HTTP_PROXY=http://proxy.example.com:8080
   export HTTPS_PROXY=http://proxy.example.com:8080
   ```

2. **Update SSL/TLS libraries**
   ```bash
   apt-get update
   apt-get upgrade gnutls-bin openssl curl wget
   ```

3. **Check MTU size**
   ```bash
   # Test with smaller MTU
   ip link set dev eth0 mtu 1400
   # Try download again
   ```

### Solution 3: Use Alternative Download Tool

If available, try other download tools:
- `aria2c` (if installed)
- `axel` (if installed)
- Manual download via browser and SCP transfer

---

## Workaround: Manual Installation

Since automated download is failing, the recommended approach is:

1. **Download manually** on a machine with working internet
2. **Transfer to Proxmox host** via SCP or Proxmox Web UI
3. **Complete installation** using the existing scripts

### Installation Script (after file transfer)

Once the file is in `/tmp/web3signer-25.12.0.tar.gz` on the Proxmox host:

```bash
# Copy to container
pct push 107 /tmp/web3signer-25.12.0.tar.gz /tmp/web3signer-25.12.0.tar.gz

# Extract and configure
pct exec 107 -- bash -c '
cd /opt
rm -rf web3signer* 2>/dev/null
tar -xzf /tmp/web3signer-25.12.0.tar.gz
mv web3signer-25.12.0 web3signer-23.10.0
cd web3signer-23.10.0
chmod +x bin/web3signer
mkdir -p /opt/web3signer/data
cat > web3signer.yml <<EOF
server:
  http-listen-port: 9000
  http-listen-host: 192.168.11.111
data-path: /opt/web3signer/data
EOF
systemctl daemon-reload
systemctl restart web3signer
'

# Verify
curl http://192.168.11.111:9000/upcheck
```

---

## Troubleshooting Results Summary

After comprehensive testing, the following was determined:

✅ **Working:**
- DNS resolution: github.com resolves correctly
- Network connectivity: Ping successful
- SSL handshake: OpenSSL s_client connects successfully (Verify return code: 0)
- System configuration: No proxy, firewall allows traffic, system time correct

❌ **Failing:**
- wget: GnuTLS errors when connecting to GitHub CDN
- curl: TLS errors after 302 redirect to CDN (`packet length too long`)
- Python urllib: SSL record layer failure
- HTTP: Broken pipe errors

**Root Cause**: The connection to GitHub's CDN (`release-assets.githubusercontent.com`) fails consistently across all tools after the initial redirect. This suggests network infrastructure interference or CDN routing issues specific to this host.

**Resolution**: Manual download and transfer is the only reliable option.

## Next Steps

1. **Download the file** on a machine with working internet access:
   ```bash
   wget https://github.com/Consensys/web3signer/releases/download/25.12.0/web3signer-25.12.0.tar.gz
   ```

2. **Transfer to Proxmox host**:
   ```bash
   scp web3signer-25.12.0.tar.gz root@192.168.11.11:/tmp/
   ```

3. **Run installation script** (created at `/tmp/web3signer-install-after-transfer.sh` on Proxmox host):
   ```bash
   ssh root@192.168.11.11
   /tmp/web3signer-install-after-transfer.sh
   ```
   OR manually run the installation commands from the script above.

4. **Continue with deployment** of translator service

---

## References

- Download URL: https://github.com/Consensys/web3signer/releases/download/25.12.0/web3signer-25.12.0.tar.gz
- Web3Signer Release Page: https://github.com/Consensys/web3signer/releases/tag/25.12.0
- Deployment Guide: `DEPLOYMENT.md`
- Complete Tasks Guide: `COMPLETE_ALL_REMAINING_TASKS.md`
