All attempts to connect to pypi.org failed. With python 3.13 #12066
Comments
github-actions
bot
added
L: elm
TheSuperiorStanislav
changed the title
|
Hey we are running into this same issue, is there any update from Dependabot team? |
|
Are there any updates or known workarounds? |
|
The customer-reported error has been successfully reproduced: https://github.com/dsp-testing/python_3_13_pypi_org_failed/actions/runs/14758285854/job/41432185587 Further investigation is required. |
|
Observations:
Current Issue:
Suspected Root Cause:
Next Steps:
|
|
No, the SSL error Here's why:
In short, the problem lies with how the internal CA certificate was generated, not with the Python version or its source image. The Python environment is simply (correctly) refusing to trust an improperly configured CA certificate. |
|
@thavaahariharangit Thanks for the explanation but how would I solve this using the standard github action ci (normal github runner). |
|
FYI: I add a discussion for this issue on github actions forum |
|
@thavaahariharangit any updates? |
|
@abdulapopoola do you have any updates on this task? |
|
I have asked support about that. They have a reproducer, so hopefully it will be fixed soon. |
|
@Paul-B98 Due to the London bank holidays, I’ve just returned. I identified the issue—it’s related to the SSL certificate—but couldn’t find a solution on Friday. I’m picking it up again today. |
|
@thavaahariharangit Thanks for the reply and sorry for the impatience. |
|
Some Findings |
|
Another observation: As shown above, installing the rich package via pip using poetry run works correctly — the packages are downloaded and installed without any issue. However, running: fails with the above error. This suggests that poetry is not able to access the internet (specifically pypi.org) during the update command, even though pip works. I suspect this is because poetry is not using the system certificate store or is not configured to trust the proxy's certificate. We'll need to investigate how to configure poetry (or its underlying requests) to trust the proxy certificate — possibly by pointing it to the custom CA bundle or setting appropriate environment variables like REQUESTS_CA_BUNDLE. I feel the inorder to poetry update to happen we need to set the proxies certificate with the poetry update request. Need to figure out how to do that |
Observations:
Disabling SSL verification allows the request to go through, bypassing certificate validation.
The failure indicates an issue with certificate validation, specifically missing key usage extensions.
The new error suggests a mismatch between the authority and subject key identifiers. Possible Solutions:
|
|
When I set However, when I switch to using the system certificate bundle,everything works — poetry run pip install requests completes successfully without SSL issues. This suggests the default Certifi bundle lacks some required intermediate or custom CA certificates (likely used by a corporate proxy or MITM setup), whereas the system bundle includes them. It seems I’m getting very close to solving the root cause of the SSL verification failures. |
|
Initially, running After setting the environment variables: The error message evolved to: This indicates progress—while the initial issue was related to a self-signed certificate, the new error suggests a problem with the key usage extension in the CA certificate. |
|
Related reading: |
|
@thavaahariharangit Thank you for the update |
Is there an existing issue for this?
Package ecosystem
pip
Package manager version
2.1.1
Language version
3.13
Manifest location and content before the Dependabot update
Repository:
https://github.com/TheSuperiorStanislav/test-dependabot
pyproject.toml
poetry.lock
dependabot.yml content
Updated dependency
No response
What you expected to see, versus what you actually saw
Expected: Dependabot creates pr, and action is okay
Actual: dependabot fails to update any dependency, but if i specify python 3.12 dependabot works
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
Smallest manifest that reproduces the issue
No response
The text was updated successfully, but these errors were encountered: