I am getting SSL errors when trying to use pants i...
# general
g
I am getting SSL errors when trying to use pants in redhat's ubi image. I verified ca-certificates is installed and I even tried setting
PANTS_CA_CERTS_PATH=/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
and still no luck. What am I missing? If I use either ubuntu 22.04 or 24.04 it works.
Copy code
[root@5f98fadda99d monorepo]# pants test
Failed to determine release URL for Pants: 2.21.0: pants.2.21.0-cp39-linux_aarch64.pex: URL check failed: <https://github.com/pantsbuild/pants/releases/download/release_2.21.0/pants.2.21.0-cp39-linux_aarch64.pex>: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>

If this is unexpected (you are using a known good Pants version), try upgrading scie-pants first.
It may also be that the platform linux_aarch64 isn't supported for this version of Pants, or some other intermittent network/service issue.
To get help, please visit: <https://www.pantsbuild.org/community/getting-help>


Error: Failed to establish atomic directory /root/.cache/nce/f4a11f9bb68736c1c58003a35df7d459dab771227cb6777ec70921f83e0cb95d/locks/configure-09f4e5d0669495f41545c9cc8ae3be1606f524d5879c81cc605f230c000ec330. Population of work directory failed: Boot binding command failed: exit status: 1
h
Gah! This is the kind of thing that will be hard to debug without a repro. What is a minimal way to reproduce this?
g
Copy code
$ docker run --rm -it registry.access.redhat.com/ubi8/ubi:8.10-1054 bash

$$ export PATH="$HOME/.local/bin:$PATH"
$$ curl --proto '=https' --tlsv1.2 -fsSL <https://static.pantsbuild.org/setup/get-pants.sh> | bash
$$ mkdir new
$$ cd new
$$ dnf install git -y
$$ git init .
$$ pants init
repro^^
h
Thanks - can you open an issue for this at https://github.com/pantsbuild/pants/issues ?
I can reproduce it, but I want to preserve all this for posterity
g
yep, you got it.
should this go in scie or pants repo?
h
I believe the underlying issue is https://github.com/indygreg/PyOxidizer/issues/283
Actually, there is already an issue that I suspect is the same one: https://github.com/pantsbuild/scie-pants/issues/403
Can you verify and add your case there if so?
Setting
SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
seems to work
g
@happy-kitchen-89482 thanks for the workaround! I was trying to use pants settings and didn't know what to set.