Re: [Buildroot] [PATCH 1/1] package/libselinux: host-python3 needs SSL support

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Bernd,

On Wed, 17 Dec 2025 19:48:22 +0100
Bernd Kuhls <bernd@kuhls.net> wrote:

>   WARNING: pip is configured with locations that require TLS/SSL,
>    however the ssl module in Python is not available.
> [...]
>   Could not fetch URL https://pypi.org/simple/setuptools/:
>    There was a problem confirming the ssl certificate:
>    HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded
>    with url: /simple/setuptools/ (Caused by SSLError("Can't connect to
>    HTTPS URL because the SSL module is not available.")) - skipping
>   ERROR: Could not find a version that satisfies the requirement setuptools>=40.8.0 (from versions: none)

This should be a very strong red flag. Why is the build process of
libselinux even trying to connect to the network to download stuff? It
definitely should not, as everything should be downloaded by Buildroot.
Packages are not allowed to download random stuff.

> +	select BR2_PACKAGE_HOST_PYTHON3_SSL if BR2_PACKAGE_PYTHON3

This doesn't work as it doesn't make sense: it is perfectly possible
for host-libselinux to be built, which will build host-python-pip,
without BR2_PACKAGE_PYTHON3=y.

See the build failures that continue to pop up:

  https://autobuild.buildroot.net/?reason=host-libselinux%

For example:

  https://autobuild.buildroot.net/results/0e9/0e9de0c0d8b6ec57eea9f8834f02076b296ba4f1/config

has:

  # BR2_PACKAGE_PYTHON3 is not set

So your patch has no effect to fix the issue.

The solution is clearly not to add SSL support in Python. The solution
is to make sure libselinux doesn't use pip to connect over the network.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot