Installing aws-sam-cli with homebrew on Mac: This error originates from a subprocess, and is likely not a problem with pip

[TheSoldier103]

brew config output

HOMEBREW_VERSION: 3.5.8
ORIGIN: https://github.com/Homebrew/brew
HEAD: ff9c2500195cc357d4a06f99d462f8d8a5d37892
Last commit: 5 days ago
Core tap ORIGIN: https://github.com/Homebrew/homebrew-core
Core tap HEAD: a1ab82c9fb494f63d2e78a406285603801c24747
Core tap last commit: 4 hours ago
Core tap branch: master
HOMEBREW_PREFIX: /Users/xxxx/homebrew
HOMEBREW_REPOSITORY: /Users/xxxx/homebrew
HOMEBREW_CELLAR: /Users/xxxx/homebrew/Cellar
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 8
Homebrew Ruby: 2.6.8 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 13.1.6 build 1316
Git: 2.32.1 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 7.79.1 => /usr/bin/curl
macOS: 12.5-arm64
CLT: 13.4.0.0.1.1651278267
Xcode: N/A
Rosetta 2: false

brew doctor output

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Your Homebrew's prefix is not /opt/homebrew.
Some of Homebrew's bottles (binary packages) can only be used with the default
prefix (/opt/homebrew).
You will encounter build failures with some formulae.
Please create pull requests instead of asking for help on Homebrew's GitHub,
Twitter or any other official channels. You are responsible for resolving
any issues you experience while you are running this
unsupported configuration.


Warning: /private/tmp is world-writable but does not have the sticky bit set.
To set it, run the following command:
  sudo chmod +t /private/tmp

What were you trying to do (and why)?

I am trying to install aws-sam-cli using homebrew. I don't have access to sudo so I can't install sudo in /opt/homebrew and I can't run sudo chmod +t /private/tmp to make it world-writable. i'm not sure those are the issues, but I'm getting errors with pip.

What happened (include all command output)?

I get the following errors:

 Already downloaded: /Users/xxxx/Library/Caches/Homebrew/downloads/83481a8e9be3330f9960015919f25317b568fa8de7b6356eb075525e3e195f23--aws-aws-sam-cli-v1.53.0-0-gd2ded65.tar.gz
==> Installing aws-sam-cli from aws/tap
==> python3.8 -m venv --system-site-packages /Users/xxxx/homebrew/Cellar/aws-sam-cli/1.53.0/libexec
==> /Users/xxxx`/homebrew/Cellar/aws-sam-cli/1.53.0/libexec/bin/pip install --upgrade pip
==> /Users/xxxx/homebrew/Cellar/aws-sam-cli/1.53.0/libexec/bin/pip install -v --ignore-installed /private/tmp/aws-sam-cli-20220810-13910-1ye8m1/aws-aws-sam-cli-d2ded65
Last 15 lines from /Users/xxxx/Library/Logs/Homebrew/aws-sam-cli/03.pip:
  │ exit code: 1
  ╰─> See above for output.
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
  full command: /Users/xxxx/homebrew/Cellar/aws-sam-cli/1.53.0/libexec/bin/python3.8 /private/tmp/pip-standalone-pip-2la8pnl4/__env_pip__.zip/pip install --ignore-installed --no-user --prefix /private/tmp/pip-build-env-5ds_f846/overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i https://pypi.org/simple -- setuptools wheel
  cwd: [inherit]
  Installing build dependencies: finished with status 'error'
error: subprocess-exited-with-error

× pip subprocess to install build dependencies did not run successfully.
│ exit code: 1
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)'))) - skipping

What did you expect to happen?

I expect aws-sam-cli to be installed

Step-by-step reproduction instructions (by running brew commands)

`brew install aws-sam-cli`

[RockTheRed]

I'm also running into what appears to be a similar issue. I have Zscaler running and have no issues with pip. This has been working in the past, I've installed aws-sam-cli with Zscaler before with no issues.

Here's my error:
/homebrew/Cellar/aws-sam-cli/1.53.0/libexec/bin/pip install -v --ignore-installed /private/tmp/aws-sam-cli-20220812-66258-1bzp5v/aws-aws-sam-cli-d2ded65
Last 15 lines from /Users/xxx/Library/Logs/Homebrew/aws-sam-cli/03.pip:
│ exit code: 1
╰─> See above for output.

If I do a -v though I get:
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)'))': /simple/pip/

I have no issues installing packages with pip though with Zscaler. Here's an example running outside of the virtual environment used with this Homebrew install:

pip install wheeltools
Collecting wheeltools
Downloading wheeltools-0.1.0b1-py2.py3-none-any.whl (9.9 kB)
Requirement already satisfied: wheel in /opt/homebrew/lib/python3.9/site-packages (from wheeltools) (0.37.1)
Installing collected packages: wheeltools
Successfully installed wheeltools-0.1.0b1

My global pip config specifies the Zscaler certificate and also has pypi.org as a trusted-host.

[djfurman]

Found a work around!

Circumstance

If you have to setup a ~/.pip/pip.conf for a proxy, non-PyPI mirror, or other settings; you'll like run into what I did above.

It's like the installer is somehow ignoring my local user settings, my PATH for the system Python I run, and all of my environment variables (which I have set for PIP). I can't explain why this works, but on a suggestion from a colleague I tried this and it was instant resolution.

Implementing the work around

1. Create /Library/Application\ Support/pip/pip.conf (note this is the root (/Library) version without the hidden directory with the contents of pip.conf identical to your local user.
2. Run brew install aws-sam-cli
3. Everything runs and installas as expected!

Hope this helps someone else stuck here where I was!