Bug 1563895

Summary:	koji fails on certifi missing cacert.pem
Product:	[Fedora] Fedora	Reporter:	Michal Ambroz <rebus>
Component:	python-certifi	Assignee:	William Moreno <williamjmorenor>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	27	CC:	bperkins, williamjmorenor
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-certifi-2018.10.15-1.fc28	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-12 05:28:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michal Ambroz 2018-04-05 01:58:46 UTC

Description of problem:
When trying to run koji command it fails on certifi missing the cacert.pem

$ koji wait-repo f28-build --build=libdasm-1.6-1.fc28
OSError: Could not find a suitable TLS CA certificate bundle, invalid path: /usr/lib/python3.6/site-packages/certifi/cacert.pem


Version-Release number of selected component (if applicable):
python3-certifi-2018.1.18-1.fc27.noarch

How reproducible:
100%

Steps to Reproduce:
1. koji wait-repo f28-build --build=libdasm-1.6-1.fc28

Actual results:
OSError: Could not find a suitable TLS CA certificate bundle, invalid path: /usr/lib/python3.6/site-packages/certifi/cacert.pem

Expected results:
Successfully waited 0:02 for libdasm-1.6-1.fc28 to appear in the f28-build repo

Additional info:
$ rpm -qf /usr/lib/python3.6/site-packages/certifi/cacert.pem
file /usr/lib/python3.6/site-packages/certifi/cacert.pem is not owned by any package

$ rpm -qf /usr/lib/python3.6/site-packages/certifi
python3-certifi-2018.1.18-1.fc27.noarch

Comment 1 Michal Ambroz 2018-04-05 02:02:06 UTC

As a workaround I have created symlink to /etc/pki/tls/cert.pem and it helped:

sudo ln -s /etc/pki/tls/cert.pem /usr/lib/python3.6/site-packages/certifi/cacert.pem

Comment 2 William Moreno 2018-10-28 16:36:38 UTC

The last certify release should return alway a valid system cert:

https://bodhi.fedoraproject.org/updates/FEDORA-2018-0ea4b6a958

python3 -c "import certifi; print(certifi.where())"
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Can you test it?

Comment 3 Fedora Update System 2018-10-28 16:38:03 UTC

python-certifi-2018.10.15-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-0ea4b6a958

Comment 4 Fedora Update System 2018-10-28 18:55:06 UTC

python-certifi-2018.10.15-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-0ea4b6a958

Comment 5 Fedora Update System 2018-11-12 05:28:17 UTC

python-certifi-2018.10.15-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.