Declaring ca-certificates in stage-packages doesn't populate the /etc/ssl/certs directory

Metadata

Project: rockcraft
Number: #334
Type: issue
State: open
Author: weiiwang01
Labels: —
Created: 2023-07-26 10:33 AM UTC
Updated: 2025-08-15 03:12 PM UTC
Closed: —

Current evaluation

stage-packages ca-certificates leaves /etc/ssl/certs empty because maintainer scripts don't run; overlay-packages works. Maintainers confirmed it's expected behavior and a doc note was added to backlog (ROCKS-1696) in Nov 2024. Awaiting docs update.

Suggested action: keep open

Reason: Multiple maintainers (cjdcordeiro, jnsgruk, sergiusens, dboddie) triaged this and confirmed the behavior is expected — stage-packages doesn't run maintainer scripts, so ca-certificates' postinst that creates /etc/ssl/certs symlinks never runs. The reporter confirmed overlay-packages works. In Nov 2024 cjdcordeiro added it to backlog (ROCKS-1696) and committed to a doc note, so the issue is triaged, valid, and has an agreed resolution path (documentation), warranting keep_open.

Impact: 40 Quick Win: 28.0 Staleness: 55 Complexity: 30 Confidence: 72 Support Request: 55

Issue body

### Bug Description When declaring `ca-certificates` in the part's `stage-packages`, the `/etc/ssl/certs` directory is not populated as expected. The `/etc/ssl/certs` should contain symbolic links pointing to the certificates found in `/usr/share/ca-certificates/mozilla/`. It's worth noting that certificates are present in `/usr/share/ca-certificates/mozilla/` within the Rock image. ### To Reproduce Build the rock image based on the `rockcraft.yaml` file below, and then inspect the content of `/etc/ssl/certs` directory in the image. The directory is empty. ```bash rockcraft pack sudo /snap/rockcraft/current/bin/skopeo --insecure-policy copy oci-archive:ca-certs_0.1_amd64.rock docker-daemon:ca-certs:latest docker run -it --rm --entrypoint /bin/ls ca-certs:latest -lah /etc/ssl/certs ``` ### Environment ubuntu 22.04 LTS, LXD ### rockcraft.yaml ```shell # Copyright 2023 Canonical Ltd. # See LICENSE file for licensing details. name: ca-certs summary: ca-certs issue. description: ca-certs issue. version: "0.1" base: ubuntu:20.04 license: Apache-2.0 platforms: amd64: parts: apt-dependencies: plugin: nil source: . stage-packages: - ca-certificates ``` ### Relevant log output ```shell N/A ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 01:53 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 28.0 Staleness: 55 Complexity: 30 Confidence: 72 Support Request: 55	keep open	stage-packages ca-certificates leaves /etc/ssl/certs empty because maintainer scripts don't run; overlay-packages works. Maintainers confirmed it's expected behavior and a doc note was added to backlog (ROCKS-1696) in Nov 2024. Awaiting docs update.
2026-07-22 12:13 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 65 Complexity: 15 Confidence: 85 Support Request: 85	keep open	Known limitation where stage-packages skips maintainer scripts, preventing symlink creation for ca-certificates. Maintainers confirmed expected behavior, provided a workaround, and added documentation updates to their backlog.
2026-07-08 08:31 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 75 Complexity: 10 Confidence: 85 Support Request: 85	keep open	Known limitation where stage-packages do not run maintainer scripts, leaving /etc/ssl/certs empty. Acknowledged by maintainers and backlogged for documentation updates.
2026-07-05 11:05 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 90 Complexity: 15 Confidence: 90 Support Request: 85	close not a bug	ca-certificates in stage-packages does not populate /etc/ssl/certs because maintainer scripts are skipped. Maintainers confirmed this is expected behavior, not a bug, and suggested overlay-packages as a workaround. Documentation update is planned but the issue remains open.
2026-06-16 01:54 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 65 Complexity: 10 Confidence: 85 Support Request: 30	keep open	Using ca-certificates in stage-packages fails to populate /etc/ssl/certs symlinks as maintainer scripts do not run. Workaround is overlay-packages. Added to backlog for documentation updates; behavior change not planned short-term.

Update history

No update history recorded yet.

Related work

Related To: canonical/rockcraft#1261 (confidence 60%)
PR #1261 fixed a related ca-certificates issue where stage-packages with deb packages created /etc/ssl/certs/ca-certificates.crt in the final rock, showing the team is actively working on ca-certificates edge cases.

Related issues

No related issues found above the similarity threshold.