"failed to run apt update" when using a specific package-repository with 20.04 base

Metadata

Project: rockcraft
Number: #344
Type: issue
State: open
Author: tigarmo
Labels: —
Created: 2023-08-14 01:22 PM UTC
Updated: 2025-08-15 03:12 PM UTC
Closed: —

Current evaluation

apt update fails in the overlay step with a certificate-verification error when an HTTPS package-repository is used with the ubuntu:20.04 base; http or a 22.04 base works. Open since Aug 2023, no labels, no maintainer response, inactive ~13 months.

Suggested action: needs triage

Reason: The issue has zero comments, no labels, and no maintainer acknowledgement in ~3 years (last activity 381 days ago), so it has never been triaged. It is a genuine, well-reproduced bug (log shows 'Certificate verification failed' during chrooted apt-get update, while wget from the same 20.04 image works), and the overlay/package-repositories mechanism still exists in the codebase, so it cannot be closed as stale or irrelevant without first checking whether current versions still reproduce it.

Impact: 40 Quick Win: 18.0 Staleness: 75 Complexity: 55 Confidence: 65 Support Request: 10

Issue body

### Bug Description Building the provided rockcraft.yaml fails. The problem happens specifically because of the "https" `url`. If I change it to "http", _or_ if I change the base to 22.04, it works. As part of diagnosis I tried running a `public.ecr.aws/ubuntu/ubuntu:20.04` container; I can `wget` that url just fine. ### To Reproduce Use the `rockcraft.yaml` provided, then `rockcraft -v` ### Environment rockcraft from edge (`latest/edge: 0+git.3c49911 2023-08-14 (980)`) ### rockcraft.yaml ```shell name: my-rock-name base: ubuntu:20.04 version: '0.1' summary: Test description: Test license: GPL-3.0 platforms: amd64: package-repositories: - type: apt components: [main] suites: [focal] key-id: 9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280 url: https://deb.nodesource.com/node_14.x parts: my-part: plugin: nil overlay-packages: [hello] ``` ### Relevant log output ```shell 2023-08-14 10:06:24.222 :: 2023-08-14 13:06:19.406 [pid=619] chroot to PosixPath('/root/overlay/overlay') 2023-08-14 10:06:24.222 :: 2023-08-14 13:06:19.406 Executing: ['apt-get', 'update'] 2023-08-14 10:06:24.222 :: 2023-08-14 13:06:19.529 :: Ign:1 https://deb.nodesource.com/node_14.x jammy InRelease 2023-08-14 10:06:24.222 :: 2023-08-14 13:06:19.610 :: Err:2 https://deb.nodesource.com/node_14.x jammy Release 2023-08-14 10:06:24.222 :: 2023-08-14 13:06:19.610 :: Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 189.72.175.82 443] ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-09-01 01:54 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 18.0 Staleness: 75 Complexity: 55 Confidence: 65 Support Request: 10	needs triage	apt update fails in the overlay step with a certificate-verification error when an HTTPS package-repository is used with the ubuntu:20.04 base; http or a 22.04 base works. Open since Aug 2023, no labels, no maintainer response, inactive ~13 months.
2026-07-22 12:13 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 95 Complexity: 30 Confidence: 85 Support Request: 10	close stale	Bug report about apt update failing due to certificate verification on Ubuntu 20.04 base with a specific HTTPS repository. Untriaged and inactive for nearly three years.
2026-07-08 08:26 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 92 Complexity: 30 Confidence: 70 Support Request: 40	close stale	Unassessed issue reporting apt certificate verification failures when using Ubuntu 20.04 base with NodeSource 14.x repository. No maintainer response or labels.
2026-07-05 11:02 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 90 Complexity: 40 Confidence: 75 Support Request: 10	needs triage	Rockcraft fails apt update with HTTPS package repository on Ubuntu 20.04 due to certificate verification errors. Unlabelled, no maintainer comments, inactive for over a year.
2026-06-16 01:47 PM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 95 Complexity: 20 Confidence: 80 Support Request: 10	close stale	rockcraft fails apt update with HTTPS certificate verification errors on Ubuntu 20.04 base when using specific package repositories. Open, unassigned, and awaiting triage with no comments.

Update history

No update history recorded yet.

Related work

Related To: rockcraft#278 (confidence 60%)
Commit f8cd8b90 'parts: install package repositories in overlays (#278)' introduced the overlay code path where the failing apt-get update runs, so any fix would likely land in this area.

Related issues

No related issues found above the similarity threshold.