Subject: bug#54096: 27.2; Error retrieving package descriptions when TLS 1.3 is used (macOS)

From: Sebastian Boehm <[email-masked]>
Date: Mon, 21 Feb 2022 18:12:28 +0000 (UTC)

After upgrading Emacs from 27.1 to 27.2 on my macOS system, I've run into a problem with refreshing my package descriptions when TLS 1.3 is enabled.

When I try to upgrade my package descriptions from the package list, the following error message appears in the minibuffer:

error in process sentinel: Error retrieving: https://elpa.gnu.org/packages/archive-contents (error connection-failed "connect" :host "elpa.gnu.org" :service 443)

The problem goes away if I disable TLS 1.3 by setting gnutls-algorithm-priority:

(setq gnutls-algorithm-priority "NORMAL:-VERS-TLS1.3")

Could this be related to #34341? While #34341 was fixed in Emacs 26.3, the symptoms and workaround are the same.

Steps to reproduce:

1. Add a second archive to the package archive list, display package list, refresh packages.

(setq package-archives
      '(("gnu"   . "https://elpa.gnu.org/packages/")
        ("melpa" . "https://melpa.org/packages/")))
(list-packages)
(package-refresh-contents)

2. Wait for a couple of seconds for the error message to appear.

Additional information:

- I cannot reproduce the problem reliably without following all of the steps above.
- I am using packages downloaded from emacsformacosx.com. The problem can be reproduced by installing Emacs via Homebrew as well via "brew install homebrew/cask/emacs".
- I am not experiencing any intermittent network failures.
- I can reproduce the problem as a different user with an empty .emacs.d and with "emacs -Q".
- The package lists are displayed correctly when using ewww to visit the pages mentioned above.
- Only Emacs 27.2 seems to be affected. I cannot reproduce the problem with Emacs 26.3, Emacs 27.1 or Emacs 28.0.90.
- Affected version: GNU Emacs 27.2 (build 1, x86_64-apple-darwin18.7.0, NS appkit-1671.60 Version 10.14.6 (Build 18G95))
- macOS version: 12.2.1
- Other people seem to be affected by the same issue as well: https://clojurians-log.clojureverse.org/emacs/2021-09-03

If I enable toggle-debug-on-error, I get the backtrace below:

Debugger entered--Lisp error: (error "Error retrieving: https://elpa.gnu.org/packages/archive-contents (error connection-failed \"connect\" :host \"elpa.gnu.org\" :service 443)")
  signal(error ("Error retrieving: https://elpa.gnu.org/packages/archive-contents (error connection-failed \"connect\" :host \"elpa.gnu.org\" :service 443)"))
  #f(compiled-function (status) #<bytecode 0x1ff8e7c2ba21>)((:error (error connection-failed "connect" :host "elpa.gnu.org" :service 443)))
  apply(#f(compiled-function (status) #<bytecode 0x1ff8e7c2ba21>) (:error (error connection-failed "connect" :host "elpa.gnu.org" :service 443)))
  url-http-activate-callback()
  url-http-async-sentinel(#<process elpa.gnu.org> "connect")

As far as I can tell, the debug messages emitted by GnuTLS when gnutls-log-level is set to 1 or 2 are unremarkable, but if there's anything specific that I should look out for, just let me know.

Is there anything I can do to help debug this issue?

Best,
Sebastian