{"record":{"id":"1618fc9dfe3ad73d","repo":"dagger/dagger","slug":"failed-to-read-existing-bundle-w","errorCode":null,"errorMessage":"failed to read existing bundle: %w","messagePattern":"failed to read existing bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/engineutil/cacerts/distros.go","lineNumber":349,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\t_, lookupErr := d.ctrFS.LookPath(d.updateCmd[0])\n\td.updateCommandExisted = lookupErr == nil\n\tif !d.updateCommandExisted && !errors.Is(lookupErr, exec.ErrNotFound) {\n\t\treturn fmt.Errorf(\"failed to lookup %s: %w\", d.updateCmd[0], lookupErr)\n\t}\n\n\td.installedCerts, d.installedSymlinks, err = containerfs.ReadHostCustomCADir(EngineCustomCACertsDir)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read custom CA dir: %w\", err)\n\t}\n\n\tif d.bundleExisted {\n\t\td.existingBundledCerts, err = d.ctrFS.ReadCABundleFile(d.bundlePath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read existing bundle: %w\", err)\n\t\t}\n\t\td.originalBundleMtime, err = d.ctrFS.MtimeOf(d.bundlePath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to get mtime of bundle: %w\", err)\n\t\t}\n\t}\n\n\tif d.customCACertDirExisted {\n\t\td.existingCerts, d.existingSymlinks, err = d.ctrFS.ReadCustomCADir(d.customCACertDir)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read existing custom CA dir: %w\", err)\n\t\t}\n\t} else {\n\t\td.createdCACertDirParent, err = d.ctrFS.MkdirAll(d.customCACertDir, 0755)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcleanups.append(func() error {","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/engineutil/cacerts/distros.go#L331-L367","documentation":"During commonInstaller.Install in engine/engineutil/cacerts/distros.go:349, the code wraps any error from d.ctrFS.ReadCABundleFile(d.bundlePath). This read only happens when the CA bundle file already existed in the container filesystem; the library parses it to know which certs are already bundled so it can restore the original bundle on uninstall. The wrapped cause is whatever the filesystem layer returned (permission denied, not a regular file, I/O error, etc.).","triggerScenarios":"Install() is called on a distro installer whose bundlePath already exists (bundleExisted==true) but ReadCABundleFile cannot read/parse it: file became unreadable between PathExists and the read, the path is a broken symlink or special file, or the container FS returned an I/O/permission error.","commonSituations":"The bundle path points to a directory or dangling symlink; read-only or corrupted container filesystem; another process truncated/replaced the bundle mid-install; SELinux/AppArmor-style permission restrictions inside the container.","solutions":["Check that the file at bundlePath is a readable regular PEM bundle (e.g. exec `ls -l` / `cat` the path inside the container).","Recreate or restore the default CA bundle (e.g. reinstall the ca-certificates package) so the file is valid.","Retry Install; a transient FS error may clear.","If the bundle path is customized, point it at the distro's real bundle location."],"exampleFix":"// before (broken symlink at /etc/ssl/certs/ca-certificates.crt)\nln -s /nonexistent /etc/ssl/certs/ca-certificates.crt\n// after\nln -sf /etc/ca-certificates/extracted/tls-ca-bundle.pem /etc/ssl/certs/ca-certificates.crt","handlingStrategy":"try-catch","validationCode":"// before Install, inside the container\nif [ ! -f /etc/ssl/certs/ca-certificates.crt ] || ! head -c1 /etc/ssl/certs/ca-certificates.crt >/dev/null 2>&1; then echo 'bundle unreadable'; fi","typeGuard":"func isFileReadable(path string) bool {\n\tst, err := os.Stat(path)\n\treturn err == nil && st.Mode().IsRegular()\n}","tryCatchPattern":"err := installer.Install(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to read existing bundle\") {\n\tvar perr *fs.PathError\n\tif errors.As(err, &perr) { /* inspect perr.Err: permission vs not-exist */ }\n}","preventionTips":["Verify the CA bundle path is a readable regular file before installing custom CAs.","Don't replace the bundle with symlinks to transient/volatile paths.","Avoid running competing cert-package operations concurrently with Install.","Reinstall the distro ca-certificates package if the bundle is corrupted."],"tags":["filesystem","ca-certificates","go"],"backgroundTag":"ca-bundle-read-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}