formulae.homebrew.sh - DNS gives conflicting answers, cannot access

[itsayellow]

Output of brew config

HOMEBREW_VERSION: 4.4.7
ORIGIN: https://github.com/Homebrew/brew
HEAD: 4a77cd1e2f7ed058d03a47fe1f18819b246e67f6
Last commit: 7 hours ago
Core tap JSON: 25 Nov 16:03 UTC
Core cask tap JSON: 25 Nov 16:03 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: vim
HOMEBREW_MAKE_JOBS: 10
HOMEBREW_NO_ENV_HINTS: set
Homebrew Ruby: 3.3.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.6/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 16.0.0 build 1600
Git: 2.47.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.1.1-arm64
CLT: 16.1.0.0.1.1729049160
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Warning: Homebrew's "sbin" was not found in your PATH but you have installed
formulae that put executables in /opt/homebrew/sbin.
Consider setting your PATH for example like so:
  echo 'export PATH="/opt/homebrew/sbin:$PATH"' >> ~/.zshrc

Description of issue

Plain network in Brazil doesn't work

Everything used to work perfectly until the last few weeks.

The first problem is that whenever I run brew update from my computer on its network (TIM fiber) in Brazil, it just hangs. brew upgrade seems to fail loading its data files (e.g. formula.jws.json) from formulae.homebrew.sh.

I then went to load formulae.homebrew.sh in my browser. It said there was no https access. I tried continuing with http and received a site trying to convince me to allow it to change my search engine and install malware.

I then checked https://dns.google.com in my browser to resolve formulae.homebrew.sh. It returned the IP address 37.48.65.155

VPN to Brazil works

Then I connected through VPN to a server also in Brazil (in a different city) and flushed my DNS cache. I checked https://dns.google.comin my browser again to resolve formulae.homebrew.sh again. It gave me a different answer. It returned the IP address 199.115.116.216. But now going to https://formulae.homebrew.sh completely works in my browser.

Everything in this situation seems fine, including brew update, brew upgrade.

Back to my plain network

I went back to my plain network on my computer, flushed the DNS cache and ran nslookup homebrew.github.io:

Non-authoritative answer:
formulae.brew.sh	canonical name = homebrew.github.io.
Name:	homebrew.github.io
Address: 185.199.108.153
Name:	homebrew.github.io
Address: 185.199.109.153
Name:	homebrew.github.io
Address: 185.199.111.153
Name:	homebrew.github.io
Address: 185.199.110.153

Yet another DNS answer, this one seems legit, based on the canonical name. But again I can't access formulae.homebrew.sh from my browser, and trying to wget https://formulae.brew.sh/api/formula.jws.json hangs indefinitely. wget https://185.199.108.153/api/formula.jws.json also hangs indefinitely.

If I use the last IP address that worked for me (that DNS reported while on VPN in Brazil), this happens:

newell:~ wget https://199.115.116.216/api/formula.jws.json
--2024-11-25 13:35:42--  https://199.115.116.216/api/formula.jws.json
Connecting to 199.115.116.216:443... connected.
OpenSSL: error:0A000410:SSL routines::ssl/tls alert handshake failure
Unable to establish SSL connection.

WTF

At this point I'm utterly confused about even what the problem is.

It seems like there's some geographical load-sharing scheme going on maybe? Or should there always be the same answer for a DNS lookup of formulae.homebrew.sh?

And why can't I access any bare IP address (including those for homebrew.github.io) from my plain network?

Any help is VERY appreciated. thanks

[SMillerDev]

https://formulae.brew.sh is hosted on GitHub pages, so you might have to check with GitHub support what is going on.

[cho-m]

Given location is Brazil, https://github.com/orgs/community/discussions/143145 may be related.

[itsayellow]

Thanks, that seems very relevant.

[itsayellow]

It is weird that when I VPN to Sao Paolo (another city in Brazil) it all seems to work. If slowly.

[itsayellow]

The summary: There was a legal ruling in Brazil's courts that blocked some github.io IP addresses and other IP addresses for a limited time. It appears that one network operator never reenabled these IP addresses after the limited time was over (V tal). Now things seem to be working again in Brazil. (see https://github.com/orgs/community/discussions/143145)