SSL error when using custom apk mirror

[Naitreey]

I'm having issue to apk add with a custom apk repository mirror url in rabbitmq rabbitmq:3.7.17-alpine image.

I'm trying to use apk mirror provided by USTC (University of Science and Technology of China):

# cat /etc/apk/repositories 
https://mirrors.ustc.edu.cn/alpine/v3.10/main
https://mirrors.ustc.edu.cn/alpine/v3.10/community

With that mirror list configured, I'm no longer able to run apk add, which aborted with the following error:

/ # apk add --no-cache tzdata
fetch https://mirrors.ustc.edu.cn/alpine/v3.10/main/x86_64/APKINDEX.tar.gz
140250143264072:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:
WARNING: Ignoring https://mirrors.ustc.edu.cn/alpine/v3.10/main/x86_64/APKINDEX.tar.gz: Permission denied
fetch https://mirrors.ustc.edu.cn/alpine/v3.10/community/x86_64/APKINDEX.tar.gz
140250143264072:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:
WARNING: Ignoring https://mirrors.ustc.edu.cn/alpine/v3.10/community/x86_64/APKINDEX.tar.gz: Permission denied
ERROR: unsatisfiable constraints:
  tzdata (missing):
    required by: world[tzdata]

Now it's really weird because it works well with vanilla alpine:3.10 -- With that mirror list configured, I can install packages with apk add without problem.

[yosifkit]

This is most likely caused by #363. That PR added LD_LIBRARY_PATH so that rabbitmq binaries use the openssl built in the Dockerfile. But this conflicts with anything from apk that needs the apk provided libssl (like apk using ssl itself).

It's not great but you should be able to do something like the following to work around it:

RUN set -ex; \
    export LD_LIBRARY_PATH= ; \
    apk add --no-cache tzdata

[Naitreey]

Thanks, by resetting LD_LIBRARY_PATH, apk add now works.

[wglambert]

Cool, going to close since it's resolved

[tianon]

I think this one is more of a legit bug and we should try to find a better solution to convincing erl to pick up the right .so without breaking things like apk 😞

[tianon]

Got it! #366 😎