stage-packages with deb packages create /etc/ssl/certs/ca-certificates.crt file in final rock
Metadata
Current evaluation
Bug where stage-packages creates /etc/ssl/certs/ca-certificates.crt from build machine, breaking 12-factor extensions. Fixed by PR #1264.
Suggested action: close stale
Reason: The issue has been resolved by PR #1264 which excludes the conflicting /etc/ssl/certs/ca-certificates.crt file when both ca-certificates_data and deb ca-certificates are staged. The original problem is no longer reproducible in the current codebase.
Impact:
80
Quick Win:
40.0
Staleness:
60
Complexity:
50
Confidence:
85
Support Request:
10
Issue body
### Check existing issues
- [x] I've verified that this bug isn't described by any existing issues.
### Bug description
When a part like the following
```
parts:
fastapi-framework/dependencies:
plugin: nil
stage-packages:
- python3-venv
```
is added to a `rockcraft.yaml` file with at least base `ubuntu@24.04`, it creates a `/etc/ssl/certs/ca-certificates.crt` that is copied from the building machine.
This is incorrect, as the scripts for the `ca-certificates` package should not run, and so that file should not be in the final rock because of that part.
That is currently breaking several 12-factor extensions when not using base bare.
### Steps to reproduce
Follow the tutorial in https://documentation.ubuntu.com/rockcraft/latest/tutorial/fastapi/ and update the base to ubuntu@24.04.
### Environment
Reproducible when building with lxd with rockcraft as of today, for example v1.19.0 with revision 4543.
### rockcraft.yaml
```yaml
If the issue is specific to a project, share its `rockcraft.yaml`. This field automatically renders as YAML, so you don't need to add special formatting.
```
### Log output
```shell
Provide any relevant logging. This field automatically renders as a log, so you don't need to add special formatting.
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
80
Quick Win:
40.0
Staleness:
60
Complexity:
50
Confidence:
85
Support Request:
10
|
close stale | Bug where stage-packages creates /etc/ssl/certs/ca-certificates.crt from build machine, breaking 12-factor extensions. Fixed by PR #1264. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
10
Complexity:
65
Confidence:
90
Support Request:
5
|
keep open | Bug where stage-packages causes /etc/ssl/certs/ca-certificates.crt to be copied from the build machine, breaking extensions. Maintainers are actively investigating the root cause related to cert file ordering and image generation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
75
Confidence:
85
Support Request:
10
|
keep open | Conflict in /etc/ssl/certs/ca-certificates.crt when using stage-packages with openssl on Ubuntu 24.04. Actively investigated by maintainers; narrowed to file ordering differences between build environment and base image overlay. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
5
Complexity:
70
Confidence:
85
Support Request:
5
|
keep open | Bug where stage-packages with deb packages copies build machine's ca-certificates.crt into the final rock, breaking 12-factor extensions. Actively investigated by maintainers. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
rockcraft#1264
(confidence 95%)
PR #1264 explicitly fixes the ca-certificates.crt conflict by excluding the file from deb package parts when ca-certificates_data is also staged, as shown in the merged commit 72162264.
Related issues
No related issues found above the similarity threshold.