regression: snapcraft fails to import pygit2 on non-ubuntu systems
Metadata
Current evaluation
Fixed by craft-application PR #729 (commit 40e4317e), replacing the hardcoded core22 certificate path so pygit2 imports correctly for Snapcraft on non-Ubuntu systems.
Resolution: closed resolved
Reason: The upstream fix merged in canonical/craft-application#729 at commit 40e4317e. It selects the certificate directory based on the active snap base rather than assuming core22, and craft-application’s changelog confirms the non-Ubuntu pygit2 fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
Snapcraft 8.x installation fails on Fedora and Arch trying to load certificates from /usr/lib/ssl. This looks like #4527 again.
```
[test@mar111622-468815 ~]$ sudo snap install --classic snapcraft
error: cannot perform the following tasks:
- Run configure hook of "snapcraft" snap if present (run hook "configure":
-----
Traceback (most recent call last):
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/_git_repo.py", line 37, in <module>
import pygit2 # type: ignore[import-untyped]
^^^^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/__init__.py", line 275, in <module>
settings = Settings()
^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 55, in __init__
self._initialize_tls_certificate_locations()
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations
self.set_ssl_cert_locations(
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations
option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir)
_pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/var/lib/snapd/snap/snapcraft/13860/meta/hooks/configure", line 7, in <module>
from snapcraft.snap_config import SnapConfig
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft/__init__.py", line 20, in <module>
import snapcraft.sources # noqa: F401
^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft/sources.py", line 22, in <module>
from snapcraft_legacy.sources import get
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/__init__.py", line 340, in <module>
from snapcraft_legacy.internal import repo # noqa
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/repo/__init__.py", line 22, in <module>
from ._base import BaseRepo # noqa
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/repo/_base.py", line 30, in <module>
from snapcraft_legacy.internal import mangling, xattrs
File "/snap/snapcraft/current/lib/python3.12/site-packages/snapcraft_legacy/internal/xattrs.py", line 21, in <module>
from craft_application.util import strtobool
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/__init__.py", line 18, in <module>
from craft_application.application import (
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/application.py", line 40, in <module>
from craft_application import _config, commands, errors, grammar, models, secrets, util
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/commands/__init__.py", line 18, in <module>
from .base import AppCommand, ExtensibleCommand
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/commands/base.py", line 29, in <module>
from craft_application.services import service_factory
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/services/__init__.py", line 22, in <module>
from craft_application.services.init import InitService
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/services/init.py", line 32, in <module>
from craft_application.git import GitError, GitRepo, is_repo, parse_describe
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/__init__.py", line 27, in <module>
from ._git_repo import (
File "/snap/snapcraft/current/lib/python3.12/site-packages/craft_application/git/_git_repo.py", line 43, in <module>
import pygit2 # type: ignore[import-untyped]
^^^^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/__init__.py", line 275, in <module>
settings = Settings()
^^^^^^^^^^
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 55, in __init__
self._initialize_tls_certificate_locations()
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 61, in _initialize_tls_certificate_locations
self.set_ssl_cert_locations(
File "/snap/snapcraft/current/lib/python3.12/site-packages/pygit2/settings.py", line 191, in set_ssl_cert_locations
option(_pygit2.GIT_OPT_SET_SSL_CERT_LOCATIONS, cert_file, cert_dir)
_pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0)
-----)
```
Also seen in snapd CI https://github.com/canonical/snapd/actions/runs/13788538947/job/38565217785?pr=14852#step:20:630
7.x installation works.
### To Reproduce
Try to install snapcraft on Fedora or Arch.
### Environment
Arch, Fedora 41
### snapcraft.yaml
```yaml
-
```
### Relevant log output
```shell
-
```
### Additional context
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed by craft-application PR #729 (commit 40e4317e), replacing the hardcoded core22 certificate path so pygit2 imports correctly for Snapcraft on non-Ubuntu systems. | |
| stealth/space-bunny-alpha | — | closed resolved | Fixed by craft-application commit 40e4317e, merged in PR #729, replacing the hardcoded core22 certificate path so pygit2 imports on non-Ubuntu Snapcraft installs. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed as a regression from the core24 base upgrade. Deferred to craft-application#679 for a base-independent SSL path fix. Internal tracking ticket CRAFT-4358 created. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed as a regression from the core24 base switch. Hardcoded SSL paths break pygit2 on non-Ubuntu systems. Resolution deferred to craft-application issue #679 for a base-independent fix, tracked internally as CRAFT-4358. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed as a regression from the core22 to core24 base switch. Hardcoded SSL paths cause pygit2 failures on non-Ubuntu systems. Developer acknowledged the bug and redirected the fix to craft-application#679 for a base-independent solution. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/craft-application#729
(confidence 100%)
The merged fix replaces the hardcoded core22 SSL_CERT_DIR with base-aware certificate discovery.
-
Related To:
canonical/craft-application#679
(confidence 95%)
Maintainers linked this regression to the upstream craft-application fix effort.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4510 snapcraft snap fails to launch | snapcraft | closed | Fixed by configuring pygit2 with a known CA-certificates path in craft-application#211 (commit 86e1c2b5), backported through snapcraft#4526; the fix was nearing release on candidate. |