SSL certificates are unset inside devbox shell

[lucasrla]

Hello, Nix's SSL certificates are not working properly within devbox shell.

Here's a trivial example (Devbox 0.0.6 on macOS Monterey):

devbox init

devbox add python310

devbox shell

/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/bin/python
  Python 3.10.5 (main, Jul 29 2022, 22:05:50) [Clang 11.1.0 ] on darwin
  Type "help", "copyright", "credits" or "license" for more information.
  >>> import urllib.request
  >>> urllib.request.urlopen("https://github.com/jetpack-io/devbox")
  Traceback (most recent call last):
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 1348, in do_open
      h.request(req.get_method(), req.selector, req.data, headers,
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 1282, in request
      self._send_request(method, url, body, headers, encode_chunked)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 1328, in _send_request
      self.endheaders(body, encode_chunked=encode_chunked)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 1277, in endheaders
      self._send_output(message_body, encode_chunked=encode_chunked)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 1037, in _send_output
      self.send(msg)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 975, in send
      self.connect()
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/http/client.py", line 1454, in connect
      self.sock = self._context.wrap_socket(self.sock,
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/ssl.py", line 513, in wrap_socket
      return self.sslsocket_class._create(
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/ssl.py", line 1071, in _create
      self.do_handshake()
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/ssl.py", line 1342, in do_handshake
      self._sslobj.do_handshake()
  ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

  During handling of the above exception, another exception occurred:

  Traceback (most recent call last):
    File "<stdin>", line 1, in <module>
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 216, in urlopen
      return opener.open(url, data, timeout)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 519, in open
      response = self._open(req, data)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 536, in _open
      result = self._call_chain(self.handle_open, protocol, protocol +
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 496, in _call_chain
      result = func(*args)
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 1391, in https_open
      return self.do_open(http.client.HTTPSConnection, req,
    File "/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/lib/python3.10/urllib/request.py", line 1351, in do_open
      raise URLError(err)
  urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>
  >>> exit()

Investigating it a bit further:

# still inside that devbox shell

/nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/bin/python
  Python 3.10.5 (main, Jul 29 2022, 22:05:50) [Clang 11.1.0 ] on darwin
  Type "help", "copyright", "credits" or "license" for more information.  
  >>> import ssl
  >>> ssl.OPENSSL_VERSION
  'OpenSSL 1.1.1q  5 Jul 2022'
  >>> ssl.get_default_verify_paths()
  DefaultVerifyPaths(cafile=None, capath=None, openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/nix/store/f6rqri950vqprx12r5hjaygl2v1rkcfb-openssl-1.1.1q/etc/ssl/certs')
  >>> ssl.get_default_verify_paths().openssl_cafile
  '/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt'

echo $NIX_SSL_CERT_FILE
  /no-cert-file.crt

exit

# yet, in our main shell:

echo $NIX_SSL_CERT_FILE
  /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt

So I tried the following and it did solve the issue:

# back to the devbox shell

devbox shell

NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt /nix/store/v4iwl6az3wax9nw0wl42kjpq4vfdd7j4-python3-3.10.5/bin/python
  Python 3.10.5 (main, Jul 29 2022, 22:05:50) [Clang 11.1.0 ] on darwin
  Type "help", "copyright", "credits" or "license" for more information.
  >>> import urllib.request
  >>> urllib.request.urlopen("https://github.com/jetpack-io/devbox")
  <http.client.HTTPResponse object at 0x10338bbe0>
  >>> exit()

I guess the root cause is that devbox shell relies on nix-shell --pure. Apparently it is the intended design to set $NIX_SSL_CERT_FILE to /no-cert-file.crt inside pure nix-shells.

It would be great though not to lose such a crucial env var when using a devbox shell... Or maybe at least have them somehow listed/documented somewhere? :)

For now, I'm manually editing devbox.json to make sure my shell init_hook has export NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt in there.

Thanks in advance!

[gcurtis]

Thanks for the thorough investigation into this! I agree that it makes sense to leave the cert file set by default. This should be a simple change of just adding NIX_SSL_CERT_FILE to the list of env vars we tell the shell to keep. We'll aim at getting this fix in for the next release.