snapcraft: use system certificates by default for https requests
Metadata
Current evaluation
Merged PR #3252 in commit 6a4aa6ff0, making Snapcraft use Debian/Ubuntu host CA certificates for HTTPS requests by default while allowing REQUESTS_CA_BUNDLE overrides.
Resolution: closed resolved
Reason: PR #3252 was approved and merged as commit 6a4aa6ff0. The change selects the host CA bundle when available and logs the setting in debug mode.
Evaluated by: mr-cal-bot
No scores available.
Issue body
The `requests` library relies on `certifi` library for CA
certificates, unless the use overrides REQUESTS_CA_BUNDLE
environment variable to point to a different certificate
bundle.
Since there is no way for the user to tell certifi to use
the host certificates, unless using the OS distribution
patched package), have snapcraft always set
REQUESTS_CA_BUNDLE to the host SSL certificates, if they
exist in the usual Debian/Ubuntu location.
Log the setting to debug.
Note that this approach does allow the user to override
this default setting of REQUESTS_CA_BUNDLE with their own.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3252 in commit 6a4aa6ff0, making Snapcraft use Debian/Ubuntu host CA certificates for HTTPS requests by default while allowing REQUESTS_CA_BUNDLE overrides. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #3252 via commit 6a4aa6ff0, defaulting Snapcraft HTTPS requests to host system CA certificates while preserving REQUESTS_CA_BUNDLE overrides. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3252 (commit 6a4aa6ff0), defaulting Snapcraft HTTPS requests to Debian/Ubuntu system CA certificates while allowing REQUESTS_CA_BUNDLE overrides. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Sets snapcraft to use system SSL certificates by default for HTTPS requests via REQUESTS_CA_BUNDLE, targeting Debian/Ubuntu paths while allowing override. Approved, passed CI, and modified one file. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Sets snapcraft to use system SSL certificates for HTTPS requests via REQUESTS_CA_BUNDLE. Targets Debian/Ubuntu paths, logs the setting for debugging, and allows user override. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1947430 snapcraft content websites have expired certificates | snapcraft (launchpad) | closed | Canonical corrected the CDN certificate chain by 2021-10-20; Snapcraft PR #3252 (commit 6a4aa6ff0) also made HTTPS requests use system CA certificates. |