regression: remote-build fails OpenSSL error
Metadata
Current evaluation
Fixed remote-build's pygit2 TLS certificate failure by configuring a known CA-certificates path in commit b5ab95268; the fix was released to the candidate channel.
Resolution: closed resolved
Reason: Commit b5ab95268, "fix(remote-build): set a known path to cacerts", resolves the certificate lookup regression. Maintainer Sergiusens confirmed on 2024-01-18 that it was fixed and forthcoming on candidate before closing the report.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
Using `snapcraft 8.0.1` when issuing `remote-build` of a snap it fails with the following error:
```
series_classic16 (main) > snapcraft remote-build
Traceback (most recent call last):
File "/snap/snapcraft/10279/bin/snapcraft", line 5, in <module>
from snapcraft.cli import run
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/cli.py", line 35, in <module>
from snapcraft.remote import RemoteBuildError
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/remote/__init__.py", line 29, in <module>
from .git import (
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/remote/git.py", line 27, in <module>
import pygit2
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/__init__.py", line 275, in <module>
settings = Settings()
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 55, in __init__
self._initialize_tls_certificate_locations()
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations
self.set_ssl_cert_locations(
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations
option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir)
_pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0)
```
When downgrading to `snapcraft 7.x (7.5.4)` it works:
```
series_classic16 (main) > snap refresh snapcraft --channel=7.x
snapcraft (7.x/stable) 7.5.4 from Canonical✓ refreshed
series_classic16 (main) > snapcraft remote-build
snapcraft remote-build is experimental and is subject to change - use with caution.
All data sent to remote builders will be publicly available. Are you sure you want to continue? [y/N]: y
Using build ID snapcraft-checkbox-c928b55e6efa0183cc3c1512dd0ca526
```
### To Reproduce
- Install Snapcraft 8.0.1
- Run `snapcraft remote-build`
### Environment
- snapd 2.61.1
- snapcraft 8.0.1
- ArchLinux
### snapcraft.yaml
```shell
name: checkbox
summary: Checkbox test runner
description: |
Checkbox is a flexible test automation software.
It’s the main tool used in Ubuntu Certification program.
adopt-info: version-calculator
grade: stable
confinement: classic
base: core
apps:
checkbox-cli:
command-chain: [bin/wrapper_local]
command: bin/checkbox-cli-wrapper
test-runner:
command-chain: [bin/wrapper_local]
command: bin/test-runner
sru:
command-chain: [bin/wrapper_local]
command: bin/sru
client-cert-iot-server:
command-chain: [bin/wrapper_local]
command: bin/client-cert-iot-server
configure:
command: bin/configure
agent:
command-chain: [bin/wrapper_local]
command: bin/checkbox-cli-wrapper run-agent
daemon: simple
restart-condition: always
restart-delay: 1s
shell:
command-chain: [bin/wrapper_local]
command: bin/shell-wrapper
passthrough:
hooks:
configure:
command-chain: [bin/wrapper_local]
parts:
version-calculator:
plugin: dump
source: .
override-pull: |
snapcraftctl pull
# version.txt created by prepare.sh
export version=`cat $SNAPCRAFT_PART_SRC/version.txt`
[ $version ] || exit 1
snapcraftctl set-version $version
stage:
- version.txt
launchers:
plugin: dump
source: launchers/
organize:
'*': bin/
config-variables:
plugin: dump
source: .
stage: [config_vars]
workaround-automated-review-issue:
plugin: nil
override-build: |
# This is a workaround for an upstream bug in the automated snap review tool
# remove this once this issue is resolved:
# https://bugs.launchpad.net/review-tools/+bug/2049093
dd if=/dev/urandom of=$SNAPCRAFT_PART_INSTALL/size_workaround bs=16k count=1
```
### Relevant log output
```shell
N/A (see above)
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed remote-build's pygit2 TLS certificate failure by configuring a known CA-certificates path in commit b5ab95268; the fix was released to the candidate channel. | |
| stealth/space-bunny-alpha | — | closed resolved | The Arch Linux pygit2 OpenSSL regression was fixed and released to the candidate channel; the reporter was asked to reopen it if the problem persisted. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved a regression in snapcraft 8.0.1 where remote-build failed with a pygit2 OpenSSL certificate error on Arch Linux. The fix was verified and deployed to the candidate channel. | |
| qwen/qwen3.6-35b-a3b | — | — | The remote-build OpenSSL error on Arch Linux was fixed. The resolution was deployed to the candidate channel, and the issue was closed. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed the snapcraft remote-build OpenSSL certificate error on Arch Linux. The patch was released to the candidate channel, resolving the pygit2 SSL failure and closing the issue. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The remote-build OpenSSL certificate regression on Arch Linux was fixed. Maintainers addressed the pygit2 SSL configuration issue and confirmed the patch is available on the candidate channel. Issue closed. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4526 fix(remote-build): set a known path to cacerts | snapcraft | merged | Merged PR #4526 (commit b5ab95268) set a known CA-certificates path for remote-build, fixing OpenSSL/pygit2 failures in #4510 and #4520. |