snapcraft remote-build core20 armhf openssl error
Metadata
Current evaluation
armhf/riscv64/ppc64el/s390x remote-build failed on core20 after cryptography 42.0.5 broke the OpenSSL legacy provider. Fixed by merged PR canonical/snapcraft#4784 (commit 7aeffed19), setting CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 in the snap manifest; LP#2064639 closed as fixed.
Resolution: closed resolved
Reason: The cryptography 41.0.7 -> 42.0.5 bump in snapcraft 8.2 broke the OpenSSL 3.0 legacy provider on non-amd64/arm64 core20 builders. Maintainer ~mr-cal closed the bug after PR #4784 (commit 7aeffed19) was merged, which sets CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 in snap/snapcraft.yaml; the PR summary explicitly cites fixing LP#2064639.
Evaluated by: mr-cal-bot
No scores available.
Issue body
snapcraft 8.2.1
command: snapcraft remote-build
error:
from snapcraft_legacy.sources import get
...
RuntimeError: OpenSSL 3.0's legacy provider failed to load. This is a fatal error by default, but cryptography supports running without legacy algorithms by setting the environment variable CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not expect this error, you have likely made a mistake with your OpenSSL configuration.
to reproduce:
snapcraft.yaml
name: test-snap
version: '0.1'
summary: sd
description: |
test
grade: stable
confinement: strict
base: core20
architectures:
- build-on: armhf
parts:
variant:
plugin: nil
source: .
build-packages: [tmux]
complete error log:
error: cannot perform the following tasks:
- Run configure hook of "snapcraft" snap if present (run hook "configure":
-----
Traceback (most recent call last):
File "/snap/snapcraft/11475/snap/hooks/configure", line 7, in <module>
from snapcraft.snap_config import SnapConfig
File "/snap/snapcraft/current/lib/python3.10/site-packages/snapcraft/__init__.py", line 23, in <module>
import snapcraft.sources # noqa: F401
File "/snap/snapcraft/current/lib/python3.10/site-packages/snapcraft/sources.py", line 22, in <module>
from snapcraft_legacy.sources import get
File "/snap/snapcraft/current/lib/python3.10/site-packages/snapcraft_legacy/__init__.py", line 352, in <module>
from snapcraft_legacy._store import ( # noqa
File "/snap/snapcraft/current/lib/python3.10/site-packages/snapcraft_legacy/_store.py", line 30, in <module>
import craft_store
File "/snap/snapcraft/current/lib/python3.10/site-packages/craft_store/__init__.py", line 23, in <module>
from .auth import Auth
File "/snap/snapcraft/current/lib/python3.10/site-packages/craft_store/auth.py", line 33, in <module>
from keyring.backends import SecretService
File "/snap/snapcraft/current/lib/python3.10/site-packages/keyring/backends/SecretService.py", line 16, in <module>
import secretstorage
File "/snap/snapcraft/current/lib/python3.10/site-packages/secretstorage/__init__.py", line 13, in <module>
from secretstorage.collection import Collection, create_collection, \
File "/snap/snapcraft/current/lib/python3.10/site-packages/secretstorage/collection.py", line 24, in <module>
from secretstorage.item import Item
File "/snap/snapcraft/current/lib/python3.10/site-packages/secretstorage/item.py", line 17, in <module>
from secretstorage.util import DBusAddressWrapper, \
File "/snap/snapcraft/current/lib/python3.10/site-packages/secretstorage/util.py", line 23, in <module>
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
File "/snap/snapcraft/current/lib/python3.10/site-packages/cryptography/hazmat/primitives/ciphers/__init__.py", line 11, in <module>
from cryptography.hazmat.primitives.ciphers.base import (
File "/snap/snapcraft/current/lib/python3.10/site-packages/cryptography/hazmat/primitives/ciphers/base.py", line 10, in <module>
from cryptography.exceptions import (
File "/snap/snapcraft/current/lib/python3.10/site-packages/cryptography/exceptions.py", line 9, in <module>
from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
RuntimeError: OpenSSL 3.0's legacy provider failed to load. This is a fatal error by default, but cryptography supports running without legacy algorithms by setting the environment variable CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not expect this error, you have likely made a mistake with your OpenSSL configuration.
-----)
Install failed
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/lpbuildd/target/build_snap.py", line 301, in run
self.install()
File "/usr/lib/python3/dist-packages/lpbuildd/target/build_snap.py", line 199, in install
self.backend.run(
File "/usr/lib/python3/dist-packages/lpbuildd/target/lxd.py", line 718, in run
subprocess.check_call(cmd, **kwargs)
File "/usr/lib/python3.8/subprocess.py", line 364, in check_call
raise CalledProcessError(retcode, cmd)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | armhf/riscv64/ppc64el/s390x remote-build failed on core20 after cryptography 42.0.5 broke the OpenSSL legacy provider. Fixed by merged PR canonical/snapcraft#4784 (commit 7aeffed19), setting CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 in the snap manifest; LP#2064639 closed as fixed. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR #4784 (commit 7aeffed19), which set CRYPTOGRAPHY_OPENSSL_NO_LEGACY to prevent OpenSSL legacy-provider failures. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
45
Quick Win:
22
Staleness:
85
Complexity:
50
Confidence:
40
Support Request:
20
|
close stale | snapcraft remote-build fails on core20 armhf due to OpenSSL 3.0 legacy provider error in configure hook. Unlabelled, no maintainer response, 854 days old. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
45
Confidence:
85
Support Request:
25
|
close stale | OpenSSL 3.0 legacy provider failure during snapcraft remote-build for core20 armhf. Issue has been inactive for over two years with zero maintainer interaction. Likely resolved by upstream package updates. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
60
Confidence:
85
Support Request:
10
|
close stale | OpenSSL 3.0 legacy provider error during snapcraft remote-build for core20 armhf. Issue is over 2 years old with no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
45
Confidence:
80
Support Request:
10
|
close stale | snapcraft remote-build fails on core20 armhf with OpenSSL 3.0 legacy provider error in cryptography. Untriaged, inactive for over two years. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/snapcraft#4784
(confidence 99%)
Merged PR 'fix: set CRYPTOGRAPHY_OPENSSL_NO_LEGACY' (commit 7aeffed19) setting the env var in snap/snapcraft.yaml; states it fixes LP#2064639.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4784 fix: set CRYPTOGRAPHY_OPENSSL_NO_LEGACY | snapcraft | merged | PR #4784 by mr-cal merged as commit 7aeffed19, setting CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 in snap/snapcraft.yaml so cryptography>=42 works on Ubuntu 20.04 armhf/ppc64el/riscv64/s390x. Fixes LP#2064639. | |
| #5077 Broken core20 armhf builds on launchpad | snapcraft | closed | Fixed the cryptography/OpenSSL failure on core20 armhf Launchpad builds in Snapcraft 8.4.2 via #5084; the fix was also backported to 7.5.8 in #5105. | |
| #1866300 snapcraft fails to build core20 snap | snapcraft (launchpad) | closed | Closed without a documented fix after core20 Multipass/LXD failures; core20 build-base support was unavailable and the workaround was destructive mode. | |
| #1862256 snapcraft should complain loudly when building base: core20 snap on i386 | snapcraft (launchpad) | closed | Closed as superseded: improved architecture parsing rejects unsupported core20/i386 builds, making a dedicated check unnecessary; snapcraft#4392 improved this handling. | |
| #1984227 Snapcraft 7.1.1 does not build with core22 on riscv64 | snapcraft (launchpad) | closed | Fixed in Snapcraft 7.1.2, which added the missing riscv64 support needed to build core22 snaps. | |
| #1992557 snapcraft remote-build snapcraft.yaml validation too strict | snapcraft (launchpad) | closed | Strict validation in snapcraft remote-build rejected empty LD_LIBRARY_PATH for core22 snaps. Resolved by the new remote builder, which fixes the legacy core18/20 implementation bug. | |
| #2099923 Snapcraft builds are failing: install of snap "snapcraft" failed | snapcraft (launchpad) | open | Reported Launchpad Bionic non-i386 builds cannot install Snapcraft 7.x/stable because core20 needs snapd 2.61; the issue remains open, untriaged, and unanswered. | |
| #4895 fix(remotebuild): require core20 snaps to use the legacy remote builder | snapcraft | merged | Merged in #4895 (d9c8781a1), requiring core20 remote builds to use the legacy builder because the new builder could not parse core20 snapcraft.yaml files; fixes #4886. | |
| #2080728 A core24 snap creation fails on compression (RISCV64) | snapcraft (launchpad) | closed | core24 riscv64 snap builds failed at `snap pack` (exit 20). Maintainers traced it to older snapd on RISCV lacking core24 support, not snapcraft; fixed once newer snapd shipped. Reporter confirmed 'Fixed now' on 2024-10-26. | |
| #2012074 snapcraft cannot build snap by default on aarch64 | snapcraft (launchpad) | open | ARM64 default builds failed on Snapcraft 7.3.1 because core20 selected amd64-only Multipass images; later defaults use core22/LXD on Linux, addressing the reported path. |