← Back to issue list

Snapcraft cannot authenticate proxy.golang.org

View original Github issue

Metadata

Project
snapcraft-rocks
Number
#34
Type
issue
State
open
Author
zyga
Labels
—
Created
Updated
Closed
—

Current evaluation

Go builds via Snapcraft fail TLS verification against proxy.golang.org in the 7_core22 container. Maintainers traced it to CA certificates and two merged snapcraft PRs addressed it; issue left open since Apr 2024.

Suggested action: close resolved

Reason: The report is an environment defect rather than a snapcraft-rocks bug: the rock definition only supplies the build image, and the failure is Snapcraft's certificate handling. Two merged upstream PRs address exactly this root cause — snapcraft#3224 'cli: provide option to install ca certs into build environment' (commit 7389ae516) and snapcraft#3252 'snapcraft: use system certificates by default for https requests' (commit 6a4aa6ff0), which preserve REQUESTS_CA_BUNDLE overrides. Confidence is held down because the last comment is a truncated 8_core22 re-run with no reporter confirmation that the x509 error disappeared, so the exact proxy.golang.org scenario is unverified.

Evaluated by: mr-cal-bot

Impact: 42 Quick Win: 20 Complexity: 35 Confidence: 68 Actionability: 72

Issue body

I was trying to build my toy snap with this but along the way this failed with: ``` 2024-04-10T16:01:51.966Z [snapcraft] :: go: golang.org/x/exp@v0.0.0-20231006140011-7918f672742d: Get "https://proxy.golang.org/golang.org/x/exp/@v/v0.0.0-20231006140011-7918f672742d.info": x509: certificate signed by unknown authority ``` I bet this is related to `ca-certificates` that are in the container.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 42
Quick Win: 20
Complexity: 35
Confidence: 68
Actionability: 72
close resolved Go builds via Snapcraft fail TLS verification against proxy.golang.org in the 7_core22 container. Maintainers traced it to CA certificates and two merged snapcraft PRs addressed it; issue left open since Apr 2024.
qwen/qwen3.6-35b-a3b
Impact: 45
Quick Win: 23
Complexity: 35
Confidence: 85
Actionability: 80
close resolved Snapcraft fails to authenticate with proxy.golang.org due to missing CA certificates in core22 container, causing x509 certificate errors. Resolved by merged PRs #3224 and #3252.
qwen/qwen3.8-27b
Impact: 40
Quick Win: 28
Staleness: 85
Complexity: 30
Confidence: 55
Support Request: 10
close stale x509 certificate error when Go tooling in snapcraft 7_core22 docker image tries to reach proxy.golang.org. Maintainer asked reporter to test 8_core22; reporter started but never reported back. Open 2+ years, no labels, no resolution.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 20
Confidence: 90
Support Request: 30
close stale Report of x509 certificate error when building snaps with core22 base. Maintainers requested image version; author confirmed 7_core22 and tested 8_core22 with no follow-up. Unresolved after over two years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 90
Complexity: 20
Confidence: 85
Support Request: 25
close stale Build failure due to x509 certificate error on core22 base using snapcraft 7_core22 image. Author is testing 8_core22 but no follow-up in over two years.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: snapcraft#3224 (confidence 80%)

    Merged PR adding --install-ca-certificates to push CA files into LXD/Multipass build environments, matching tigarmo's diagnosis of missing CA certs during the Go plugin download.

  • Likely Fixed By: snapcraft#3252 (confidence 75%)

    Merged PR making Snapcraft use system CA certificates by default for HTTPS requests, addressing x509 'unknown authority' failures for outbound fetches.

Related issues

Issue Project State Summary Similarity
#4935 snapcraft cannot connect through a transparent SSL proxy snapcraft open Snapcraft 7.5.5/8.3.1 was reported to reject a system-trusted MITM proxy CA for host commands such as whoami; it remains untriaged and unanswered.
78%
#2073910 snapcraft cannot connect through a transparent SSL proxy snapcraft (launchpad) open Snapcraft 7.5.5/8.3.1 rejects a system-trusted MITM proxy CA; setting REQUESTS_CA_BUNDLE works, but the report remains untriaged.
76%
#5635 Fail to run snapcraft using a proxy snapcraft closed Proxy-related GPG key retrieval was fixed in craft-archives#189 (daf89a2) and adopted by snapcraft#5670; the reporter confirmed the failure no longer occurs.
71%
#1947430 snapcraft content websites have expired certificates snapcraft (launchpad) closed Canonical corrected the CDN certificate chain by 2021-10-20; Snapcraft PR #3252 (commit 6a4aa6ff0) also made HTTPS requests use system CA certificates.
71%
#1875781 Unable to verify self signed certificate snapcraft (launchpad) closed Fixed in newer OpenSSL releases; Snapcraft improved proxy env var handling. Marked as resolved by maintainer mr-cal after upstream patch landed.
70%