snapcraft 8 tries to open certificate on host system at a non-standard path
Metadata
Current evaluation
Startup crash on non-Debian hosts (pygit2 OpenSSL cert path /usr/lib/ssl/cert.pem) was fixed by PR #4526, commit b5ab95268, which set a known CA bundle path; shipped in snapcraft 8.0.2.
Resolution: closed resolved
Reason: Maintainer mr-cal pointed to PR #4526 ("fix(remote-build): set a known path to cacerts", commit b5ab95268) as the fix and confirmed the problem was resolved in snapcraft 8.0.2, closing the issue.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
snapcraft 8 crashes on distributions other than Debian or Ubuntu because it tries to load `/usr/lib/ssl/cert.pem` on host which is not present on other distributions.
### To Reproduce
Install snapd and snapcraft on let's say Fedora. Run snapcraft.
### Environment
Tested on GNOME OS and on Fedora 39.
### snapcraft.yaml
```shell
Do not need one.
```
### Relevant log output
```shell
Traceback (most recent call last):
File "/snap/snapcraft/10279/bin/snapcraft", line 5, in <module>
from snapcraft.cli import run
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/cli.py", line 35, in <module>
from snapcraft.remote import RemoteBuildError
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/remote/__init__.py", line 29, in <module>
from .git import (
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/snapcraft/remote/git.py", line 27, in <module>
import pygit2
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/__init__.py", line 275, in <module>
settings = Settings()
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 55, in __init__
self._initialize_tls_certificate_locations()
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations
self.set_ssl_cert_locations(
File "/var/lib/snapd/snap/snapcraft/10279/lib/python3.10/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations
option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir)
_pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0)
```
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Startup crash on non-Debian hosts (pygit2 OpenSSL cert path /usr/lib/ssl/cert.pem) was fixed by PR #4526, commit b5ab95268, which set a known CA bundle path; shipped in snapcraft 8.0.2. | |
| stealth/space-bunny-alpha | — | closed resolved | Startup crash on non-Debian hosts (pygit2/OpenSSL loading /usr/lib/ssl/cert.pem) was fixed by PR #4526, which set a known CA bundle path. Maintainer mr-cal confirmed resolution in snapcraft 8.0.2. | |
| stealth/space-bunny-alpha | — | closed resolved | Snapcraft 8 crashed at startup on non-Debian hosts loading /usr/lib/ssl/cert.pem via pygit2. Fixed by PR #4526 (commit b5ab95268, set a known cacerts path) and released in snapcraft 8.0.2; issue closed by mr-cal. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR #4526 (commit b5ab95268, 'fix(remote-build): set a known path to cacerts'), which pins pygit2 to a bundled CA cert path. Maintainer confirmed resolution in snapcraft 8.0.2. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed startup failures on non-Debian systems: PR #4526 configured a known CA bundle path and shipped in snapcraft 8.0.2. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved in snapcraft 8.0.2 via PR #4526. The hardcoded SSL certificate path caused crashes on non-Debian distributions. The fix updates pygit2 to correctly locate certificates, preventing initialization failures on systems like Fedora. | |
| qwen/qwen3.6-35b-a3b | — | — | Resolved in snapcraft 8.0.2 via PR #4526. The hardcoded SSL certificate path causing crashes on non-Debian distributions was corrected to dynamically detect system certificate locations. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed in snapcraft 8.0.2 via PR #4526. The crash on non-Debian distributions caused by a hardcoded SSL certificate path has been resolved. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Resolved in snapcraft 8.0.2 via PR #4526. The crash on non-Debian distributions caused by hardcoding the SSL certificate path was fixed by implementing dynamic path detection. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
snapcraft#4526
(confidence 97%)
Merged PR 'fix(remote-build): set a known path to cacerts' (commit b5ab95268); maintainer cited it as the fix for this report.
-
Duplicate Of:
snapcraft#4510
(confidence 90%)
Maintainer identified this as one of three similar reports of the same snapcraft startup/OpenSSL certificate failure.
-
Duplicate Of:
snapcraft#4520
(confidence 90%)
Same pygit2/OpenSSL certificate regression on non-Debian distros, resolved by the same fix.
-
Related To:
canonical/craft-application#211
(confidence 55%)
Companion upstream fix in craft-application setting a known CA certificate path for pygit2, referenced in the resolution of #4510.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4510 snapcraft snap fails to launch | snapcraft | closed | Fixed by configuring pygit2 with a known CA-certificates path in craft-application#211 (commit 86e1c2b5), backported through snapcraft#4526; the fix was nearing release on candidate. |