Java SSLException during web requests

snapcraft
1

Trying to build my first snap for one open-source Java application. I did build snap based on tutorials but the application fails at runtime due SSLException:

GOT (-1, -1): https://api.twitch.tv/kraken/chat/emoticon_images?emotesets=0 [javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty] [chatty.util.api.Requests$1/requestResult]

I obviously missing something. Maybe anyone has experience with similar issue? Here is snapcraft.yaml (or at github):

name: chatty
version: "0.12"
summary: Twitch Chat Client
description: |
  Chatty is a Twitch Chat Client for Desktop featuring many Twitch specific features.
base: core18

grade: stable
confinement: strict

apps:
  chatty:
    extensions:
      - gnome-3-28
    command: desktop-launch $SNAP/bin/launcher
    environment:
      JAVA_HOME: $SNAP/usr/lib/jvm/java-11-openjdk-amd64
      PATH: $JAVA_HOME/jre/bin:$PATH
    plugs:
      - home
      - network

parts:
  chatty:
    plugin: nil
    override-build: |
      wget -O $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip https://github.com/chatty/chatty/releases/download/v$SNAPCRAFT_PROJECT_VERSION/Chatty_$SNAPCRAFT_PROJECT_VERSION.zip
      unzip -o $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip -d $SNAPCRAFT_PART_INSTALL/
      rm $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip
    build-packages:
      - wget
      - unzip
    stage-packages:
      - openjdk-11-jre
      - ca-certificates
      - ca-certificates-java
      - libpulse0
      - libpulsedsp
    prime:
      - -usr/lib/jvm/java-*/lib/security/cacerts
      - -usr/lib/jvm/java-*/jre/lib/security/cacerts
  launcher:
    plugin: dump
    source: snap/local
    organize:
      'launcher': 'bin/'
      'padsp': 'bin/'
      'sensible-browser': 'bin/'
      'usr/lib/*/gvfs/*.so': 'usr/lib'
      'usr/bin/xprop': 'usr/bin/xprop.disabled'
2

Maybe this will help you debug? https://medium.com/@gustavocalcaterra/debugging-yet-another-ssl-tls-error-the-trustanchors-parameter-must-be-non-empty-7dd9cb300f43

Is it because you are removing the cacerts from the jre install?

1 Like
3

Seems issue was somehow related with build vs staged packages I moved some packages to build-packages section and it working now. Probably snap configuration file still not optimal but at least SSL issue is gone.

For a reference fixed part section:

chatty:
    plugin: nil
    override-build: |
      wget -O $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip https://github.com/chatty/chatty/releases/download/v$SNAPCRAFT_PROJECT_VERSION/Chatty_$SNAPCRAFT_PROJECT_VERSION.zip
      unzip -o $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip -d $SNAPCRAFT_PART_INSTALL/
      rm $SNAPCRAFT_PART_INSTALL/Chatty.v$SNAPCRAFT_PROJECT_VERSION.zip
    build-packages:
      - wget
      - unzip
      - openjdk-11-jre
      - ca-certificates
      - ca-certificates-java
    stage-packages:
      - openjdk-11-jre
      - libpulse0
      - libpulsedsp