Rockcraft fails to run on FIPS-enabled hosts
Metadata
Current evaluation
Rockcraft fails to start on FIPS-enabled hosts because craft-parts npm_plugin.py imports requests at module level, triggering urllib3 SSLContext creation that FIPS crypto libraries reject. Maintainers confirmed the bug and shared references in June 2025; no fix or labels applied since.
Suggested action: keep open
Reason: Maintainers clay-lake and tigarmo explicitly confirmed the bug and provided actionable references (certbot/certbot#10044 workaround, Canonical FIPS-snap blog post) in June 2025, giving the issue clear maintainer buy-in. The root cause is a module-level `import requests` in craft-parts npm_plugin.py that forces urllib3 to build an SSLContext at import time, which FIPS crypto libraries reject. No labels or assignee have been added and no fix commit was found in rockcraft or craft-parts, but the issue is not outdated and remains a valid blocker for FIPS-host users.
Impact:
50
Quick Win:
25.0
Staleness:
60
Complexity:
50
Confidence:
72
Support Request:
10
Issue body
### Bug Description
If the host is FIPS-enabled, Rockcraft won't work, likely due to a python crypto operation that is not allowed by the hosts crypto libraries.
### To Reproduce
1. get a FIPS-enabled host (`pro attach <token>`, `pro enable fips-updates`, `reboot`)
2. run rockcraft (`rockcraft init`, `rockcraft pack`)
### Environment
Tested with both Rockcraft 1.12 and 1.10, on a FIPS-enabled 22.04 VM.
### rockcraft.yaml
```yaml
(any)
```
### Relevant log output
```shell
Traceback (most recent call last):
File "/snap/rockcraft/3381/bin/rockcraft", line 5, in <module>
from rockcraft.cli import run
File "/snap/rockcraft/3381/lib/python3.12/site-packages/rockcraft/cli.py", line 21, in <module>
from craft_application import commands as appcommands
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_application/__init__.py", line 18, in <module>
from craft_application.application import (
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_application/application.py", line 36, in <module>
import craft_parts
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/__init__.py", line 19, in <module>
from . import plugins
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/__init__.py", line 20, in <module>
from .plugins import (
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/plugins.py", line 37, in <module>
from .npm_plugin import NpmPlugin
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/npm_plugin.py", line 26, in <module>
import requests
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
from .api import delete, get, head, options, patch, post, put, request
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
from . import sessions
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
from .adapters import HTTPAdapter
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/adapters.py", line 80, in <module>
_preloaded_ssl_context = create_urllib3_context()
^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/rockcraft/3381/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 298, in create_urllib3_context
context = SSLContext(PROTOCOL_TLS_CLIENT)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/rockcraft/current/usr/lib/python3.12/ssl.py", line 438, in __new__
self = _SSLContext.__new__(cls, protocol)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ssl.SSLError: [CRYPTO] unknown error (_ssl.c:3076)
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
50
Quick Win:
25.0
Staleness:
60
Complexity:
50
Confidence:
72
Support Request:
10
|
keep open | Rockcraft fails to start on FIPS-enabled hosts because craft-parts npm_plugin.py imports requests at module level, triggering urllib3 SSLContext creation that FIPS crypto libraries reject. Maintainers confirmed the bug and shared references in June 2025; no fix or labels applied since. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
80
Complexity:
70
Confidence:
85
Support Request:
10
|
keep open | Rockcraft fails to run on FIPS-enabled hosts due to Python crypto/SSL errors. Acknowledged by a maintainer with references and a potential workaround, but remains unresolved after over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
45
Confidence:
75
Support Request:
0
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to Python SSL errors. Unlabelled, unassigned, and inactive for over a year, though community comments provide references and workarounds. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
70
Confidence:
90
Support Request:
10
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to Python SSL/crypto library incompatibility. Unlabeled, no maintainer response, inactive for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
70
Complexity:
65
Confidence:
75
Support Request:
10
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to a Python SSL error in urllib3 during startup. Issue remains open with recent comments confirming the bug and suggesting an environment variable workaround. Awaiting a code fix. |
Update history
No update history recorded yet.
Related work
-
Related To:
certbot/certbot#10044
(confidence 80%)
Referenced by tigarmo as the same class of FIPS/SSLContext-at-import failure, with a documented environment-variable workaround
Related issues
No related issues found above the similarity threshold.