Rockcraft fails to run on FIPS-enabled hosts
Metadata
Current evaluation
Rockcraft crashes on FIPS-enabled hosts during startup when urllib3 creates an SSLContext. Valid bug with clear reproducer, confirmed on edge, and workaround references; awaiting fix.
Suggested action: keep open
Reason: The issue is a valid, clearly scoped bug with an exact reproducer and traceback, and tigarmo's comment provides relevant references including certbot/certbot#10044 and a workaround environment variable. No fix or triage label is present, but the maintainer discussion indicates the issue has been assessed and should remain open.
Evaluated by: mr-cal-bot
Impact:
60
Quick Win:
16
Complexity:
65
Confidence:
70
Actionability:
75
Issue body
### Bug Description
If the host is FIPS-enabled, Rockcraft won't work, likely due to a python crypto operation that is not allowed by the hosts crypto libraries.
### To Reproduce
1. get a FIPS-enabled host (`pro attach <token>`, `pro enable fips-updates`, `reboot`)
2. run rockcraft (`rockcraft init`, `rockcraft pack`)
### Environment
Tested with both Rockcraft 1.12 and 1.10, on a FIPS-enabled 22.04 VM.
### rockcraft.yaml
```yaml
(any)
```
### Relevant log output
```shell
Traceback (most recent call last):
File "/snap/rockcraft/3381/bin/rockcraft", line 5, in <module>
from rockcraft.cli import run
File "/snap/rockcraft/3381/lib/python3.12/site-packages/rockcraft/cli.py", line 21, in <module>
from craft_application import commands as appcommands
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_application/__init__.py", line 18, in <module>
from craft_application.application import (
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_application/application.py", line 36, in <module>
import craft_parts
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/__init__.py", line 19, in <module>
from . import plugins
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/__init__.py", line 20, in <module>
from .plugins import (
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/plugins.py", line 37, in <module>
from .npm_plugin import NpmPlugin
File "/snap/rockcraft/3381/lib/python3.12/site-packages/craft_parts/plugins/npm_plugin.py", line 26, in <module>
import requests
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
from .api import delete, get, head, options, patch, post, put, request
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
from . import sessions
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
from .adapters import HTTPAdapter
File "/snap/rockcraft/3381/lib/python3.12/site-packages/requests/adapters.py", line 80, in <module>
_preloaded_ssl_context = create_urllib3_context()
^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/rockcraft/3381/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 298, in create_urllib3_context
context = SSLContext(PROTOCOL_TLS_CLIENT)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/rockcraft/current/usr/lib/python3.12/ssl.py", line 438, in __new__
self = _SSLContext.__new__(cls, protocol)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ssl.SSLError: [CRYPTO] unknown error (_ssl.c:3076)
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| ~deepseek/deepseek-pro-latest |
Impact:
60
Quick Win:
16
Complexity:
65
Confidence:
70
Actionability:
75
|
keep open | Rockcraft crashes on FIPS-enabled hosts during startup when urllib3 creates an SSLContext. Valid bug with clear reproducer, confirmed on edge, and workaround references; awaiting fix. | |
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
22
Complexity:
60
Confidence:
70
Actionability:
80
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to Python crypto/SSL error in urllib3. Issue is open, unlabelled, with no maintainer response. | |
| qwen/qwen3.8-27b |
Impact:
50
Quick Win:
25
Staleness:
60
Complexity:
50
Confidence:
72
Support Request:
10
|
keep open | Rockcraft fails to start on FIPS-enabled hosts because craft-parts npm_plugin.py imports requests at module level, triggering urllib3 SSLContext creation that FIPS crypto libraries reject. Maintainers confirmed the bug and shared references in June 2025; no fix or labels applied since. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
80
Complexity:
70
Confidence:
85
Support Request:
10
|
keep open | Rockcraft fails to run on FIPS-enabled hosts due to Python crypto/SSL errors. Acknowledged by a maintainer with references and a potential workaround, but remains unresolved after over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
45
Confidence:
75
Support Request:
0
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to Python SSL errors. Unlabelled, unassigned, and inactive for over a year, though community comments provide references and workarounds. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
70
Confidence:
90
Support Request:
10
|
needs triage | Rockcraft crashes on FIPS-enabled hosts due to Python SSL/crypto library incompatibility. Unlabeled, no maintainer response, inactive for over a year. |
Update history
No update history recorded yet.
Related work
-
Related To:
certbot#10044
(confidence 85%)
Explicitly referenced in tigarmo's comment as a related FIPS/snap libcrypto issue with a workaround environment variable.
Related issues
No related issues found above the similarity threshold.