HwangDongJun commented on PR #12831: URL: https://github.com/apache/gluten/pull/12831#issuecomment-6357819488
@zhouyuan Following your suggestion I switched this PR to the vcpkg approach. Your three checks (details and the full table are in the PR description): 1. **Ubuntu 22.04 and 24.04, no symlink, no env var:** works with the triplet change alone (3 runs each). The current build hangs there with `curlCode: 77` (checked on 22.04). 2. **Same images with `SSL_CERT_FILE` pointing to the bundle:** works (3 runs each). 3. **Rocky/RHEL:** Rocky 9.3 works as is, because `/etc/ssl/cert.pem` exists there. Rocky 8.9 (5 of 5 runs) and AlmaLinux 8.10 (3 of 3) hang with the triplet change alone: they have neither `/etc/ssl/cert.pem` nor hashed certificates in `/etc/ssl/certs`, so OpenSSL's default store is empty (`curlCode: 60`). They work today with the current build, so this would be a regression. Because of 3, the PR has a second commit (`TlsTrustStore`, about 130 lines plus unit tests, one call in `VeloxBackend::init`). It exports a well-known system bundle as `SSL_CERT_FILE` only when OpenSSL would find no certificates, and otherwise does nothing. With it, every layout I tried passes on Rocky 8.9, Rocky 9.3, AlmaLinux 8.10 and Ubuntu 22.04/24.04, including the original #12711 layout, a missing `SSL_CERT_FILE`, and hashed certificates removed. CI is green on the current head (x86, ARM including the TPC job). **Question:** do you want to keep the second commit, or take only the triplet change and document a link at `/etc/ssl/cert.pem` (or `SSL_CERT_FILE`) for RHEL 8 images? They are separate commits, so either is easy. The cost of keeping it is more native code and a process-wide `setenv`, which is less simple than your change. Not verified: ARM at runtime (CI build and TPC only, I have no ARM node), Azure and GCS (no environment), Debian 12, AlmaLinux 9, and the effect of the env var on child processes. The commit list still shows the earlier Velox-patch commits; the net diff is the 8 files in the description. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
