Declaring ca-certificates in stage-packages doesn't populate the /etc/ssl/certs directory

Metadata

Project: rockcraft
Number: #334
Type: issue
State: open
Author: weiiwang01
Labels: —
Created: 2023-07-26 10:33 AM UTC
Updated: 2025-08-15 03:12 PM UTC
Closed: —

Current evaluation

Stage packages do not run maintainer scripts, so ca-certificates symlinks are absent; overlay-packages works, and the promised documentation update remains tracked under ROCKS-1696.

Suggested action: keep open

Reason: The report has a complete reproducer, and the reporter confirmed that moving ca-certificates to overlay-packages solves it. Maintainers described changing the behavior as not easy or achievable in the short term, added ROCKS-1696 to the backlog, and committed to documenting maintainer scripts; the current overlay documentation does not yet explain this limitation.

Evaluated by: mr-cal-bot

Impact: 42 Quick Win: 24 Complexity: 35 Confidence: 95 Actionability: 88

Issue body

### Bug Description When declaring `ca-certificates` in the part's `stage-packages`, the `/etc/ssl/certs` directory is not populated as expected. The `/etc/ssl/certs` should contain symbolic links pointing to the certificates found in `/usr/share/ca-certificates/mozilla/`. It's worth noting that certificates are present in `/usr/share/ca-certificates/mozilla/` within the Rock image. ### To Reproduce Build the rock image based on the `rockcraft.yaml` file below, and then inspect the content of `/etc/ssl/certs` directory in the image. The directory is empty. ```bash rockcraft pack sudo /snap/rockcraft/current/bin/skopeo --insecure-policy copy oci-archive:ca-certs_0.1_amd64.rock docker-daemon:ca-certs:latest docker run -it --rm --entrypoint /bin/ls ca-certs:latest -lah /etc/ssl/certs ``` ### Environment ubuntu 22.04 LTS, LXD ### rockcraft.yaml ```shell # Copyright 2023 Canonical Ltd. # See LICENSE file for licensing details. name: ca-certs summary: ca-certs issue. description: ca-certs issue. version: "0.1" base: ubuntu:20.04 license: Apache-2.0 platforms: amd64: parts: apt-dependencies: plugin: nil source: . stage-packages: - ca-certificates ``` ### Relevant log output ```shell N/A ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 04:57 PM UTC	stealth/space-bunny-alpha	Impact: 42 Quick Win: 24 Complexity: 35 Confidence: 95 Actionability: 88	keep open	Stage packages do not run maintainer scripts, so ca-certificates symlinks are absent; overlay-packages works, and the promised documentation update remains tracked under ROCKS-1696.
2026-09-20 05:19 AM UTC	qwen/qwen3.6-35b-a3b	Impact: 40 Quick Win: 26 Complexity: 20 Confidence: 70 Actionability: 80	keep open	stage-packages doesn't populate /etc/ssl/certs for ca-certificates because maintainer scripts aren't run. Maintainers acknowledged this as a documentation gap (ROCKS-1696) but haven't updated docs yet.
2026-09-01 01:53 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 28 Staleness: 55 Complexity: 30 Confidence: 72 Support Request: 55	keep open	stage-packages ca-certificates leaves /etc/ssl/certs empty because maintainer scripts don't run; overlay-packages works. Maintainers confirmed it's expected behavior and a doc note was added to backlog (ROCKS-1696) in Nov 2024. Awaiting docs update.
2026-07-22 12:13 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 65 Complexity: 15 Confidence: 85 Support Request: 85	keep open	Known limitation where stage-packages skips maintainer scripts, preventing symlink creation for ca-certificates. Maintainers confirmed expected behavior, provided a workaround, and added documentation updates to their backlog.
2026-07-08 08:31 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 75 Complexity: 10 Confidence: 85 Support Request: 85	keep open	Known limitation where stage-packages do not run maintainer scripts, leaving /etc/ssl/certs empty. Acknowledged by maintainers and backlogged for documentation updates.
2026-07-05 11:05 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 90 Complexity: 15 Confidence: 90 Support Request: 85	close not a bug	ca-certificates in stage-packages does not populate /etc/ssl/certs because maintainer scripts are skipped. Maintainers confirmed this is expected behavior, not a bug, and suggested overlay-packages as a workaround. Documentation update is planned but the issue remains open.

Update history

No update history recorded yet.

Related work

Related To: canonical/rockcraft#1261 (confidence 82%)
Rockcraft 1.19.1 release notes cite PR #1261 for adding /etc/ssl/certs/ca-certificates.crt with stage-packages, but that addresses the bundle file rather than proving that all certificate-directory symlinks are generated.

Related issues

No related issues found above the similarity threshold.