So I've dug up 2yr old pants project, and have run into a problem around the new scie-pants. Pretty much everything works fine except

pants generate-lockfiles

I get:

xlevus@xd1:~/Projects/xlvs/gymkhana$ pants generate-lockfiles --resolve=python-default
Bootstrapping Pants 2.18.0
Installing pantsbuild.pants==2.18.0 into a virtual environment at /home/xlevus/.cache/nce/29319df9a6ca02e838617675b5b8dd7e5b18a393c27e74979823158b85c015d9/bindings/venvs/2.18.0
Found existing installation: setuptools 58.1.0
Uninstalling setuptools-58.1.0:
  Successfully uninstalled setuptools-58.1.0
New virtual environment successfully created at /home/xlevus/.cache/nce/29319df9a6ca02e838617675b5b8dd7e5b18a393c27e74979823158b85c015d9/bindings/venvs/2.18.0.
08:54:49.38 [INFO] Completed: Generate lockfile for python-default
08:54:49.38 [ERROR] 1 Exception encountered:

Engine traceback:
  in `generate-lockfiles` goal

ProcessExecutionFailure: Process 'Generate lockfile for python-default' failed with exit code 1.
stdout:

stderr:
Failed to spawn a job for /var/home/xlevus/.pyenv/versions/3.10.13/bin/python3.10: unknown error (_ssl.c:3161)



Use `--keep-sandboxes=on_failure` to preserve the process chroot for inspection.

I think i've traced it down to something in the scie-pants venv. Running the pex command inside the sandb But I can't replicate it, and no amount of fiddling with the

__run.sh

script in the sandbox seems to either output anything helpful What I can do, is kinda get it to work by using

nix

with:

nix-shell -p python310 python310Packages.pip python310Packages.distlib python310Packages.distutils-extra python310Packages.pip

and then running

PEX_SCRIPT=pex3 python3.10 ./pex lock create '--output=lock.json' -vv --emit-warnings $'--style=universal' --pip-version 23.1.2 --resolver-version pip-2020-resolver --target-system linux --target-system mac $'--indent=2' --no-pypi $'--index=<https://pypi.org/simple/>' --manylinux manylinux2014 --interpreter-constraint $'CPython==3.10.*' django

but similar error when running:

xlevus@xd1:/tmp/pants-sandbox-m4HhMB$ PEX_SCRIPT=pex3 ~/.cache/nce/29319df9a6ca02e838617675b5b8dd7e5b18a393c27e74979823158b85c015d9/bindings/venvs/2.18.0/bin/python3.9 ./pex lock create '--output=lock.json' -vv --emit-warnings $'--style=universal' --pip-version 23.1.2 --resolver-version pip-2020-resolver --target-system linux --target-system mac $'--indent=2' --no-pypi $'--index=<https://pypi.org/simple/>' --manylinux manylinux2014  django
pex: Resolving for:
Failed to spawn a job for /var/home/xlevus/.cache/nce/67912efc04f9156d8f5b48a0348983defb964de043b8c13ddc6cc8a002f8e691/cpython-3.9.18+20240107-x86_64-unknown-linux-gnu-install_only.tar.gz/python/bin/python3.9: unknown error (_ssl.c:3161)

Does your nix-shell contain openssl? https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/python.section.md does mention that, though I'm no expert on nix at all so not sure how that works.

presumably yes. as

python3.10 -c "from urllib.request import urlopen; urlopen('<https://www.python.org>')"

works fine but also so does (???)

/var/home/xlevus/.cache/nce/67912efc04f9156d8f5b48a0348983defb964de043b8c13ddc6cc8a002f8e691/cpython-3.9.18+20240107-x86_64-unknown-linux-gnu-install_only.tar.gz/python/bin/python3.9  -c "from urllib.request import urlopen; urlopen('<https://www.python.org>')"

explicitly Adding pyopenssl and openssl doesn't seem to fix anything

Interesting. How does nix deal with cert bundles etc?

it's not a full sandbox

You mentioned switching pbs version, xlevus. I'm currenly blocked by this on Fedora, did you have a workaround?

The only workaround I think so far is to run the command in a non-fedora docker container.