Crash at startup: FileNotFoundError for SSL certificates on openSUSE Tumbleweed

[fabiosirna]

Hi,
When running your AppImage on openSUSE Tumbleweed, the app crashes at startup with the following error:

FileNotFoundError: [Errno 2] No such file or directory
in ssl.py: create_default_context / context.load_verify_locations(cafile, capath, cadata)

It seems the AppImage environment is strictly looking for the Debian/Ubuntu certificate path (/etc/ssl/certs/ca-certificates.crt), which does not exist by default on openSUSE (Tumbleweed uses /etc/ssl/ca-bundle.pem or /var/lib/ca-certificates/ca-bundle.pem).

As a temporary workaround, I have to manually create a symlink on my system:
sudo ln -s /etc/ssl/ca-bundle.pem /etc/ssl/certs/ca-certificates.crt

Could you please update the AppImage build configuration to also check for standard SUSE/Fedora/Arch certificate paths? Thanks!

[Samueru-sama]

It seems the AppImage environment is strictly looking for the Debian/Ubuntu certificate path (/etc/ssl/certs/ca-certificates.crt)

We already fix this issue in sharun, see VHSgunzo/sharun#100

If it is not working, it is because Tauon or whatever library it is using does not listen to any of those env variables. That happens sometimes.

[Samueru-sama]

Python such a disaster I'm so done with this shit.

I already had to patch another nonsense from a different python library. Aermoss/PySDL3#35 and this issue was so bad that upstream cpython actually decided to deprecate the function because they realized it was a total unreliable hack lmao.

[Samueru-sama]

Alright I asked AI and it told me that ssl.py honors SSL_CERT_FILE but only when you don't pass cafile, capath, or cadata to ssl.create_default_context.

Not sure what is going on then, maybe the issue is with tauon itself?

[Samueru-sama]

Alright found the problem.

./AppDir/lib/python*/site-packages/certifi/cacert.pem is a symlink to /etc/ca-certificates/extracted/tls-ca-bundle.pem

This is such a terrible hack... It pretty much means we are forced to ship the certificates with python now.

[Samueru-sama]

kek

certifi/python-certifi#271

[Samueru-sama]

"fixed" in pkgforge-dev/Anylinux-AppImages#478

Hopefully Tauon can just not use this library at all. Because now that we are bundling the ceritficate every single appimage that uses it will eventually stop working in the future.

Taiko2k/Tauon#2093