AIX CI machines cannot access raw.githubusercontent.com

[targos]

This is looking like some sort of infrastructure issue where the AIX CI machine doesn't appear to be able to download https://raw.githubusercontent.com/ URLs.

e.g.

Running AIX CI on v12.x to check if that works: https://ci.nodejs.org/job/node-test-commit-aix/30710/

(Note this build passed)

...
+ curl https://raw.githubusercontent.com/nodejs/build/master/jenkins/scripts/node-test-commit-pre.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0+ bash -xe

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
...
  0     0    0     0    0     0      0      0 --:--:--  0:01:14 --:--:--     0
curl: (28) Failed to connect to raw.githubusercontent.com port 443: A remote host did not respond within the timeout period.
...
if [ -x /home/iojs/build/workspace/node-test-commit-aix/nodes/aix71-ppc64/./node ] && [ -e /home/iojs/build/workspace/node-test-commit-aix/nodes/aix71-ppc64/./node ]; then /home/iojs/build/workspace/node-test-commit-aix/nodes/aix71-ppc64/./node  tools/doc/versions.js out/previous-doc-versions.json; elif [ -x `which node` ] && [ -e `which node` ] && [ `which node` ]; then `which node`  tools/doc/versions.js out/previous-doc-versions.json; else echo "No available node, cannot run \"node  tools/doc/versions.js out/previous-doc-versions.json\""; exit 1; fi;
Unable to retrieve https://raw.githubusercontent.com/nodejs/node/master/CHANGELOG.md. Falling back to /home/iojs/build/workspace/node-test-commit-aix/nodes/aix71-ppc64/CHANGELOG.md.
...

The tools/doc/versions.js tool falls back to the local copy of the CHANGELOG.md for non-release commits (which is why only the release commit build failed) to accommodate users with poor/firewalled Internet connections.

cc @nodejs/platform-aix

Originally posted by @richardlau in nodejs/node#33197 (comment)

[sam-github]

Update: we have reached out internally to the infra providers to ask what's going on, it looks like some kind of off-machine firewall is banning the traffic. Waiting for a response, still.

[sam-github]

We got a response, and unfortunately, its deliberate.

raw.githubusercontent.com is apparently a commonly blacklisted site (I assume because its used sometimes by bad actors as a CDN for malware). Avoiding using it in our CI would be quite onerous to us. The network specialists are in contact with GH to ask their opinion of this.

[mhdawson]

@sam-github I believe this is now resolved right?

[sam-github]

Builds are green now: https://ci.nodejs.org/job/node-test-commit-aix/30771/

The provider sec team resolved something with GH, and unblocked it.

[targos]

This is still happening with today's security releases: https://ci.nodejs.org/job/node-test-commit-aix/30869/nodes=aix71-ppc64/console

[sam-github]

I confirmed with a manual curl https://raw.githubusercontent.com/nodejs/build/master/jenkins/scripts/node-test-commit-pre.sh, and sent an email to the infra provider (CCing @mhdawson @AshCripps @richardlau ).

[sam-github]

At this point, I think we have no choice but to go forward with the releases, and then release AIX afterwards. Agreed @mhdawson ?

[BethGriggs]

Looks like the Release builds worked (assuming they don't depend on that domain) - https://ci-release.nodejs.org/job/iojs+release/nodes=aix71-ppc64/

[targos]

@sam-github this doesn't impact the release build. Only node-test-commit jobs run on release commits.