Running into timeout issues when downloading Serverless cli

[ogii]

Orb Version
1.0.1

Describe the bug
The following curl command to install the Serverless cli in the setup command occasionally results in a timeout:

curl -o- -L https://slss.io/install | bash

To Reproduce
Use the circleci/serverless-framework orb in a build, and run the setup command.

Expected behavior
The Serverless cli should be installed after running the setup command.

Additional context
This is an intermittent issue, but I noticed it happened around 10%~15% of the time.
Adding a retry to the curl command on timeout might address the issue.

[nshgraph]

For me this timeout is 80%+ of the time and means this orb doesn't work.

The issue seems to be that CircleCI is appearing to be in china to the serverless install script. The timed out log entry is:
Connection reset by peer in connection to sls-standalone-1300963013.cos.ap-shanghai.myqcloud.com

From the orb source:
curl -o- -L https://slss.io/install | bash

This bash script seems to use myqcloud.com only if it is detected that the caller is in China. And that URL is definitely trying to download from China.

Because the only part of the script that I need is the actual serverless install I have resolved this issue by adding the following to replace -serverless/setup

curl -o- -L https://slss.io/install | SLS_GEO_LOCATION=us bash 
echo "export PATH=$HOME/.serverless/bin:$PATH" >> "$BASH_ENV"
source "$BASH_ENV"

This forces it to use the US source and voila... no timeout.

If CircleCI only builds in the US, then adding this to the orb would probably fix the issue.

[jp172]

was happy to have found this workaround a few days ago, but it seems to be timing out for SLS_GEO_LOCATION=us as well

[nshgraph]

Sorry I should have updated. It turned out to be two things: the first is that IFF it gets the script, the script was downloading from China. But also the script itself is being hosted in china (wtf serverless?)

curl -I -L  https://slss.io/install
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 29 Sep 2021 19:47:23 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://tinycc.com/tiny/custom_domain_redirect/slss.io/install

HTTP/1.1 303 See Other
Server: nginx
Date: Wed, 29 Sep 2021 20:21:17 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.0.33
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block
X-Robots-Tag: nofollow, noindex
Location: https://sls-standalone-1300963013.cos.ap-shanghai.myqcloud.com/install.sh
Strict-Transport-Security: max-age=31536000;
Content-Security-Policy-Report-Only: default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report

HTTP/1.1 200 OK
Content-Type: application/x-sh
Content-Length: 3897
Connection: keep-alive
Date: Wed, 29 Sep 2021 20:20:45 GMT
ETag: "d97c0ea9754ead9a0e98f3066793f590"
Last-Modified: Mon, 08 Feb 2021 10:39:46 GMT
Server: tencent-cos
x-cos-hash-crc64ecma: 6200904514863612494
x-cos-request-id: NjE1NGNhOWRfZDU0MTIyMDlfNWMyNl83OTQ5MTA=

So we can see it is being pulled from https://sls-standalone-1300963013.cos.ap-shanghai.myqcloud.com/install.sh which can time out because it is in China.

Serverless mirrors its files in the US too so replacing the URL with https://sls-standalone-sv-1300963013.cos.na-siliconvalley.myqcloud.com/install.sh means china doesn't get included.

[KyleTryon]

@nshgraph thank you for providing this info. It seems like maybe something we might be looking to serverless to correct but I wanted to know if you ended up finding a proper solution that worked for you long time. I am in a maintenance sprint for this orb, but this is very difficult for me to reproduce. I will add SLS_GEO_LOCATION=us as mentioned above but as you also pointed out, this may not be enough.

We can pull from that second URL but I have concerns this will be difficult to keep up to date and based on the age of this issue, likely already is.

Edit: locally the geolocation is not having an effect for me so far. While i wasnt able to replicate this on CircleCI.com, it is happening locally. Installing even with the geolocation i seem to be getting the CN mirror.

I am attempting to get a look at the install script but also considering what if we installed with NPM, I believe the serverless bin requires Node anyway but I am trying to confirm that. If we do not need node to run the bin then I would not want to add that dependency.

Edit 2:
ahh ok, so:

1. In the US, the bin is just downloaded via GitHub, and in China it is downloaded via a CDN.
2. Yes, the binary is an executable, so node should not be a requirement. We will not be using NPM/YARN or other JS CDNs.

I am doing more debugging now from within CircleCI SSH to see if we could get this operating normally because there is a chance someone will need/want the china CDN if the user is not on CircleCI Cloud.

[KyleTryon]

Hello,
Thank you all for reporting this issue. We have just released version 2.0.0 which should resolve this problem. Please try the latest version of the orb and let us know if you experience any issues.

https://github.com/CircleCI-Public/serverless-framework-orb/releases/tag/v2.0.0
https://circleci.com/developer/orbs/orb/circleci/serverless-framework