← Back to issue list

stage-packages with deb packages create /etc/ssl/certs/ca-certificates.crt file in final rock

View original Github issue

Metadata

Project
rockcraft
Number
#1261
Type
issue
State
open
Author
javierdelapuente
Labels
—
Created
Updated
Closed
—

Current evaluation

stage-packages deb pulls a host-generated /etc/ssl/certs/ca-certificates.crt that conflicts with the base/chisel copy, breaking 12-factor extensions on non-bare bases; root cause still under investigation

Suggested action: keep open

Reason: Multiple maintainers engaged (tigarmo, cjdcordeiro, upils) with confirmed reproducers including a minimal spec that fails with "Part 'my-part' and the overlay of part 'my-part' list the following files, but with different contents or permissions: etc/ssl/certs/ca-certificates.crt". Diagnosis has shifted twice — from a stale chisel slice, to chisel mutations, to the conclusion in upils' last comment that "I don't think Chisel is the problem nor the solution here" since both files contain the same certs but in different order — so it is a confirmed, valid bug breaking framework extensions, but the fix is not yet pinpointed and may need base image/build-environment changes rather than rockcraft code. Note: no repository tooling was available (all git/grep calls failed with 'No pinned SHA available'), so scores rest on the issue discussion and the related issue #334.

Evaluated by: mr-cal-bot

Impact: 65 Quick Win: 11 Complexity: 68 Confidence: 72 Actionability: 55

Issue body

### Check existing issues - [x] I've verified that this bug isn't described by any existing issues. ### Bug description When a part like the following ``` parts: fastapi-framework/dependencies: plugin: nil stage-packages: - python3-venv ``` is added to a `rockcraft.yaml` file with at least base `ubuntu@24.04`, it creates a `/etc/ssl/certs/ca-certificates.crt` that is copied from the building machine. This is incorrect, as the scripts for the `ca-certificates` package should not run, and so that file should not be in the final rock because of that part. That is currently breaking several 12-factor extensions when not using base bare. ### Steps to reproduce Follow the tutorial in https://documentation.ubuntu.com/rockcraft/latest/tutorial/fastapi/ and update the base to ubuntu@24.04. ### Environment Reproducible when building with lxd with rockcraft as of today, for example v1.19.0 with revision 4543. ### rockcraft.yaml ```yaml If the issue is specific to a project, share its `rockcraft.yaml`. This field automatically renders as YAML, so you don't need to add special formatting. ``` ### Log output ```shell Provide any relevant logging. This field automatically renders as a log, so you don't need to add special formatting. ```

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 65
Quick Win: 11
Complexity: 68
Confidence: 72
Actionability: 55
keep open stage-packages deb pulls a host-generated /etc/ssl/certs/ca-certificates.crt that conflicts with the base/chisel copy, breaking 12-factor extensions on non-bare bases; root cause still under investigation
stealth/space-bunny-alpha
Impact: 65
Quick Win: 45
Complexity: 28
Confidence: 96
Actionability: 96
close resolved Merged PR #1264 addresses the ca-certificates.crt conflict between ca-certificates_data and staged Debian packages; issue #1261 remains open pending closure verification.
qwen3.6-35b-a3b-mtp-q6
Impact: 80
Quick Win: 40
Staleness: 60
Complexity: 50
Confidence: 85
Support Request: 10
close stale Bug where stage-packages creates /etc/ssl/certs/ca-certificates.crt from build machine, breaking 12-factor extensions. Fixed by PR #1264.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 65
Confidence: 90
Support Request: 5
keep open Bug where stage-packages causes /etc/ssl/certs/ca-certificates.crt to be copied from the build machine, breaking extensions. Maintainers are actively investigating the root cause related to cert file ordering and image generation.
qwen3.6-35b-a3b-mtp-q6
Staleness: 5
Complexity: 75
Confidence: 85
Support Request: 10
keep open Conflict in /etc/ssl/certs/ca-certificates.crt when using stage-packages with openssl on Ubuntu 24.04. Actively investigated by maintainers; narrowed to file ordering differences between build environment and base image overlay.

Update history

No update history recorded yet.

Related work

  • Related To: rockcraft#334 (confidence 70%)

    Same underlying area: stage-packages do not run maintainer scripts, so ca-certificates symlinks/files behave unexpectedly; documented in the issue as craft-parts 'path normalizer' populating etc/ssl/certs/ca-certificates.crt with the build system file.

Related issues

No related issues found above the similarity threshold.