[SOLVED] ssl.SSLError: […] no certificate or crl found

Message

lekto · Post by **lekto** » Sun Dec 01, 2024 8:38 am

Hi, I need to run two different versions of one program, but they can't be both installed at the same time, so one of them is running inside a chroot. My host is binpkging everything and shares binpkgs with the chroot. Because of that, I have only about 20 packages that need to be built inside the chroot. Today I've noticed that the chroot still has eselected gcc:13, so I decided to run emerge -e @world to have everything build with gcc:14. It run until sys-libs/zlib:

Code: Select all

>>> Emerging (190 of 530) sys-libs/zlib-1.3.1-r1::gentoo                                                                                                                                                           
Unable to configure loopback interface: Operation not permitted                                                                                                                                                    
 * zlib-1.3.1.tar.xz BLAKE2B SHA512 size ;-) ...                                                                                                                                                            [ ok ] 
 * zlib-1.3.1.tar.xz.asc BLAKE2B SHA512 size ;-) ...                                                                                                                                                        [ ok ] 
Unable to configure loopback interface: Operation not permitted                                                                                                                                                    
>>> Unpacking source...                                                                                                                                                                                            
 * Verifying zlib-1.3.1.tar.xz ...                                                                                                                                                                                 
Traceback (most recent call last):                                                                                                                                                                                 
  File "/usr/lib/python-exec/python3.12/gemato", line 5, in <module>
    from gemato.cli import setuptools_main
  File "/usr/lib/python3.12/site-packages/gemato/cli.py", line 25, in <module>
    from gemato.openpgp import (
  File "/usr/lib/python3.12/site-packages/gemato/openpgp.py", line 39, in <module>
    import requests
  File "/usr/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
    from .api import delete, get, head, options, patch, post, put, request
  File "/usr/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
    from . import sessions
  File "/usr/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
    from .adapters import HTTPAdapter
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 81, in <module>
    _preloaded_ssl_context.load_verify_locations(
ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4100)

then I tried to resume it, but it stopped on sys-apps/util-linux:

Code: Select all

>>> Running pre-merge checks for sys-apps/util-linux-2.40.2
[ERROR] Exception in callback AsynchronousTask._exit_listener_cb(<bound method...7f67559bd1d0>>)
handle: <Handle AsynchronousTask._exit_listener_cb(<bound method...7f67559bd1d0>>)>
Traceback (most recent call last):
  File "/usr/lib/python3.12/asyncio/events.py", line 88, in _run
    self._context.run(self._callback, *self._args)
  File "/usr/lib/python3.12/site-packages/_emerge/AsynchronousTask.py", line 209, in _exit_listener_cb
    listener(self)
  File "/usr/lib/python3.12/site-packages/_emerge/EbuildPhase.py", line 255, in _async_start_exit
    task.future.cancelled() or task.future.result()
                               ^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/_emerge/EbuildPhase.py", line 161, in _async_start
    await _setup_repo_revisions(self.settings)
  File "/usr/lib/python3.12/site-packages/_emerge/EbuildPhase.py", line 108, in _setup_repo_revisions
    sync = portage.sync.module_controller.get_class(repo_ref.sync_type)()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/module.py", line 158, in get_class
    mod = self._modules[modname]["parent"].get_class(modname)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/module.py", line 79, in get_class
    module = __import__(kid["module_name"], [], [], ["not empty"])
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/sync/modules/git/git.py", line 20, in <module>
    from portage.sync.syncbase import NewBase
  File "/usr/lib/python3.12/site-packages/portage/sync/syncbase.py", line 24, in <module>
    import gemato.openpgp
  File "/usr/lib/python3.12/site-packages/gemato/openpgp.py", line 39, in <module>
    import requests
  File "/usr/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
    from .api import delete, get, head, options, patch, post, put, request
  File "/usr/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
    from . import sessions
  File "/usr/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
    from .adapters import HTTPAdapter
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 81, in <module>
    _preloaded_ssl_context.load_verify_locations(
ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4100)
Terminated

I tried to run emerge --info, but it also failed:

Code: Select all

Traceback (most recent call last):
  File "/usr/lib/python-exec/python3.12/emerge", line 57, in main
    retval = emerge_main()
             ^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/_emerge/main.py", line 1309, in emerge_main
    return run_action(emerge_config)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/_emerge/actions.py", line 3985, in run_action
    return action_info(
           ^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/_emerge/actions.py", line 1977, in action_info
    sync = portage.sync.module_controller.get_class(repo.sync_type)()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/module.py", line 158, in get_class
    mod = self._modules[modname]["parent"].get_class(modname)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/module.py", line 79, in get_class
    module = __import__(kid["module_name"], [], [], ["not empty"])
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/portage/sync/modules/git/git.py", line 20, in <module>
    from portage.sync.syncbase import NewBase
  File "/usr/lib/python3.12/site-packages/portage/sync/syncbase.py", line 24, in <module>
    import gemato.openpgp
  File "/usr/lib/python3.12/site-packages/gemato/openpgp.py", line 39, in <module>
    import requests
  File "/usr/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
    from .api import delete, get, head, options, patch, post, put, request
  File "/usr/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
    from . import sessions
  File "/usr/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
    from .adapters import HTTPAdapter
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 81, in <module>
    _preloaded_ssl_context.load_verify_locations(
ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4100)

ADDENDUM
Looks like these errors are from gemato:

Code: Select all

chroot ~ # gemato 
Traceback (most recent call last):
  File "/usr/lib/python-exec/python3.12/gemato", line 5, in <module>
    from gemato.cli import setuptools_main
  File "/usr/lib/python3.12/site-packages/gemato/cli.py", line 25, in <module>
    from gemato.openpgp import (
  File "/usr/lib/python3.12/site-packages/gemato/openpgp.py", line 39, in <module>
    import requests
  File "/usr/lib/python3.12/site-packages/requests/__init__.py", line 164, in <module>
    from .api import delete, get, head, options, patch, post, put, request
  File "/usr/lib/python3.12/site-packages/requests/api.py", line 11, in <module>
    from . import sessions
  File "/usr/lib/python3.12/site-packages/requests/sessions.py", line 15, in <module>
    from .adapters import HTTPAdapter
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 81, in <module>
    _preloaded_ssl_context.load_verify_locations(
ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4100)

and gemato and gnupg were one of the last packages installed before it broke:

Code: Select all

     Sun Dec  1 09:10:34 2024 >>> app-text/opensp-1.5.2-r10
     Sun Dec  1 09:10:42 2024 >>> dev-lang/python-3.12.7_p1
     Sun Dec  1 09:10:51 2024 >>> app-portage/gemato-20.6
     Sun Dec  1 09:11:00 2024 >>> sys-apps/systemd-256.7
     Sun Dec  1 09:11:06 2024 >>> app-crypt/gnupg-2.4.5-r2

SOLVED:
File /etc/ssl/certs/ca-certificates.crt (and some others) broke because of quickpkg:

Code: Select all

chroot ~ # cat /etc/ssl/certs/ca-certificates.crt 
# empty file because --include-config=n when `quickpkg` was used

After I restored it from my host, gemato started working again.