pygit2 fallback uses hardcoded base snap location

Metadata

Project: craft-application
Number: #679
Type: issue
State: closed
Author: bboozzoo
Labels: —
Created: 2025-03-12 07:50 AM UTC
Updated: 2025-04-14 05:55 PM UTC
Closed: 2025-04-14 05:55 PM UTC

Current evaluation

Fixed in PR #729 (commit 40e4317e): snap-based SSL certificate discovery now uses the consuming app's base from meta/snap.yaml, retaining core22 only as a non-snap fallback.

Resolution: closed resolved

Reason: PR #729 was merged as commit 40e4317e and explicitly closed #679. It derives the certificate path from the snap's declared base instead of assuming core22 is installed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

### Bug Description Identified as direct cause of https://github.com/canonical/snapcraft/issues/5321. This piece of code https://github.com/canonical/craft-application/blob/251a48a31b8d52bfc5f43b159a993acf25737ab5/craft_application/git/_git_repo.py#L36-L50 implements a fallback mechanism for a case when snapcraft (or craft-application consumer) is installed on a non-Ubuntu/non-Debian system. However, the fallback path hardcodes core22, which is not necessarily available. What is guaranteed to be available though, is the base snap used by the application which uses craft-application as its dependency. Originally identifies as an issue in snapd PR https://github.com/canonical/snapd/pull/14852 ### To Reproduce Install snapcraft 8.x on Arch/Fedora without having core22 around. ### part yaml ```shell ``` ### Relevant log output ```shell google-distro-2:arch-linux-64 .../tests/main/snapd-snap# snap install snapcraft --channel="${SNAPCRAFT_SNAP_CHANNEL}" --classic error: cannot perform the following tasks: - Run configure hook of "snapcraft" snap if present (run hook "configure": ----- tool_linux.go:69: DEBUG: re-exec not supported on distro "arch" yet logger.go:273: DEBUG: -- snap startup {"stage":"start", "time":"1741764871.648129"} apparmor.go:908: DEBUG: checking distro apparmor_parser at /usr/sbin/apparmor_parser apparmor.go:917: DEBUG: apparmor 4.0 ABI detected but ignored cmd_run.go:1268: DEBUG: executing snap-confine from /usr/lib/snapd/snap-confine cmd_run.go:439: DEBUG: SELinux not enabled tracking.go:48: DEBUG: creating transient scope snap.snapcraft.hook.configure tracking.go:350: DEBUG: create transient scope job: /org/freedesktop/systemd1/job/3878 tracking.go:450: DEBUG: job result is "done" tracking.go:457: DEBUG: transient scope snap.snapcraft.hook.configure-6c5047e7-f8ca-414a-b718-9a10acc8a9a6.scope created tracking.go:153: DEBUG: waited 7.922558ms for tracking logger.go:273: DEBUG: -- snap startup {"stage":"snap to snap-confine", "time":"1741764871.668471"} DEBUG: -- snap startup {"stage":"snap-confine enter", "time":"1741764871.670692"} DEBUG: SNAP_MOUNT_DIR (probed): /var/lib/snapd/snap DEBUG: umask reset, old umask was 022 DEBUG: security tag: snap.snapcraft.hook.configure DEBUG: executable: /usr/lib/snapd/snap-exec DEBUG: confinement: classic DEBUG: base snap: core24 DEBUG: ruid: 0, euid: 0, suid: 0 DEBUG: rgid: 0, egid: 0, sgid: 0 DEBUG: apparmor label on snap-confine is: /usr/lib/snapd/snap-confine DEBUG: apparmor mode is: enforce DEBUG: -- snap startup {"stage":"snap-confine mount namespace start", "time":"1741764871.672124"} DEBUG: preparing classic execution environment DEBUG: -- snap startup {"stage":"snap-confine mount namespace finish", "time":"1741764871.672234"} DEBUG: set_effective_identity uid:0 (change: yes), gid:0 (change: yes) DEBUG: creating user data directory: /root/snap/snapcraft/13860 DEBUG: requesting changing of apparmor profile on next exec to snap.snapcraft.hook.configure DEBUG: ruid: 0, euid: 0, suid: 0 DEBUG: loading bpf program for security tag snap.snapcraft.hook.configure DEBUG: execv(/usr/lib/snapd/snap-exec, /usr/lib/snapd/snap-exec...) DEBUG: argv[1] = --hook=configure DEBUG: argv[2] = snapcraft DEBUG: umask restored to 022 DEBUG: working directory restored to / DEBUG: -- snap startup {"stage":"snap-confine to snap-exec", "time":"1741764871.672595"} Traceback (most recent call last): File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/_git_repo.py", line 37, in <module> import pygit2 # type: ignore[import-untyped] ^^^^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/__init__.py", line 275, in <module> settings = Settings() ^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 55, in __init__ self._initialize_tls_certificate_locations() File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations self.set_ssl_cert_locations( File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir) _pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/var/lib/snapd/snap/snapcraft/13860/meta/hooks/configure", line 7, in <module> from snapcraft.snap_config import SnapConfig File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft/__init__.py", line 20, in <module> import snapcraft.sources # noqa: F401 ^^^^^^^^^^^^^^^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft/sources.py", line 22, in <module> from snapcraft_legacy.sources import get File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/__init__.py", line 340, in <module> from snapcraft_legacy.internal import repo # noqa ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/repo/__init__.py", line 22, in <module> from ._base import BaseRepo # noqa ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/repo/_base.py", line 30, in <module> from snapcraft_legacy.internal import mangling, xattrs File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/xattrs.py", line 21, in <module> from craft_application.util import strtobool File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/__init__.py", line 18, in <module> from craft_application.application import ( File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/application.py", line 40, in <module> from craft_application import _config, commands, errors, grammar, models, secrets, util File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/commands/__init__.py", line 18, in <module> from .base import AppCommand, ExtensibleCommand File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/commands/base.py", line 29, in <module> from craft_application.services import service_factory File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/services/__init__.py", line 22, in <module> from craft_application.services.init import InitService File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/services/init.py", line 32, in <module> from craft_application.git import GitError, GitRepo, is_repo, parse_describe File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/__init__.py", line 27, in <module> from ._git_repo import ( File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/_git_repo.py", line 43, in <module> import pygit2 # type: ignore[import-untyped] ^^^^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/__init__.py", line 275, in <module> settings = Settings() ^^^^^^^^^^ File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 55, in __init__ self._initialize_tls_certificate_locations() File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations self.set_ssl_cert_locations( File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir) _pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0) -----) ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-03 07:42 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Fixed in PR #729 (commit 40e4317e): snap-based SSL certificate discovery now uses the consuming app's base from meta/snap.yaml, retaining core22 only as a non-snap fallback.
2026-10-03 07:42 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Fixed by merged PR canonical/craft-application#729 (commit 40e4317e), which discovers the running snap's base certificate path instead of assuming core22.
2026-10-03 07:41 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Fixed by PR #729 (commit 40e4317e): new craft_application/git/_utils.py find_ssl_cert_dir() reads the snap's meta/snap.yaml base and points SSL_CERT_DIR there, keeping core22 as non-snap fallback.
2026-09-25 04:37 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Merged in craft-application PR #729 (40e4317e): snap runs now derive SSL certificate paths from meta/snap.yaml's base, while retaining core22 for non-snap fallback.
2026-09-09 03:17 AM UTC	qwen/qwen3.6-35b-a3b	—	—	Closed without implementation. A dynamic base detection workaround was proposed to replace the hardcoded core22 fallback. Tracked internally as CRAFT-4321.
2026-07-23 02:55 PM UTC	qwen/qwen3.6-35b-a3b	—	—	Closed and tracked internally as CRAFT-4321. The hardcoded core22 fallback was identified as problematic. A dynamic snap.yaml resolution was proposed but not merged, leaving the issue pending internal resolution.
2026-07-22 01:57 PM UTC	qwen/qwen3.6-35b-a3b	—	—	Closed without resolution. Comments suggested dynamically detecting the base snap from meta/snap.yaml instead of hardcoding core22, but no fix or pull request was implemented.

Update history

No update history recorded yet.

Related work

Likely Fixed By: canonical/craft-application#729 (confidence 100%)
Merged fix for dynamic SSL certificate path discovery.
Related To: canonical/snapcraft#5321 (confidence 100%)
Downstream Snapcraft failure cited as the direct cause.
Related To: snapd#14852 (confidence 100%)
Snapd PR cited as the context where the problem was identified.

Related issues

No related issues found above the similarity threshold.