{"record":{"id":"28601474614445a0","repo":"pathwaycom/pathway","slug":"sslrootcert-points-to-a-non-existent-path","errorCode":null,"errorMessage":"sslrootcert points to a non-existent path","messagePattern":"sslrootcert points to a non-existent path","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/pathway/io/postgres/__init__.py","lineNumber":240,"sourceCode":"        path = \"\"\n\n    owned_settings[\"replication\"] = \"database\"\n    query = \"&\".join(f\"{enc(k)}={enc(v)}\" for (k, v) in owned_settings.items())\n\n    return f\"postgresql://{userinfo}{hostport}{path}?{query}\"\n\n\ndef _build_tls_settings(owned_postgres_settings: dict) -> TLSSettings:\n    sslmode = owned_postgres_settings.pop(\"sslmode\", \"prefer\")\n\n    sslrootcert = owned_postgres_settings.pop(\"sslrootcert\", None)\n    if sslrootcert is not None:\n        try:\n            open(sslrootcert).close()\n        except IsADirectoryError as e:\n            raise ValueError(\"sslrootcert doesn't point to a file\") from e\n        except FileNotFoundError as e:\n            raise ValueError(\"sslrootcert points to a non-existent path\") from e\n        except OSError as e:\n            raise ValueError(f\"sslrootcert is not readable: {e}\") from e\n\n    return TLSSettings(mode=sslmode, root_cert_path=sslrootcert)\n\n\ndef _construct_replication_settings(\n    *,\n    mode: Literal[\"streaming\", \"static\"],\n    postgres_settings: dict,\n    publication_name: str | None,\n    replication_slot_name: str | None,\n    snapshot_name: str | None,\n):\n    # static mode doesn't require replication slots\n    if mode == \"static\":\n        if publication_name is not None:\n            raise ValueError(\"'publication_name' is not needed for the static mode\")","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/pathwaycom/pathway/blob/fa2f74a4649b7c5908690cf60137263d8d80de5f/python/pathway/io/postgres/__init__.py#L222-L258","documentation":"Raised by the postgres connector's _build_tls_settings when sslrootcert points to a path that does not exist. The connector probes the file up front so the pipeline fails at graph-construction time with a clear message instead of failing later inside the Rust engine during connection.","triggerScenarios":"postgres_settings={\"sslrootcert\": \"/path/that/does/not/exist.pem\"}; paths broken by containerization (host path not mounted), typos, or a cert file not yet created.","commonSituations":"Docker/Kubernetes deployments where the CA file is mounted at a different path than on the developer machine; CI runners missing the mounted secret.","solutions":["Fix the path to the actual CA bundle file on the machine/container running the pipeline.","In containers, verify the mount: docker run -v $(pwd)/ca.pem:/etc/ssl/ca.pem ... and use the in-container path.","If TLS verification is not required for this host, drop sslrootcert and use sslmode=require."],"exampleFix":"# before\npostgres_settings={\"sslrootcert\": \"/certs/root.pem\"}  # file missing\n# after\npostgres_settings={\"sslrootcert\": \"/etc/pathway/certs/root.pem\"}  # verified with os.path.isfile","handlingStrategy":"validation","validationCode":"import os\nif \"sslrootcert\" in postgres_settings:\n    assert os.path.isfile(postgres_settings[\"sslrootcert\"]), \"sslrootcert path does not exist\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use paths that exist inside the container/pod, not the host path used during development.","Add a startup preflight that checks existence and readability of every configured TLS file."],"tags":["postgres","tls","ssl","file-not-found","configuration"],"backgroundTag":null,"analyzedSha":"fa2f74a4649b7c5908690cf60137263d8d80de5f","analyzedAt":"2026-08-15T01:48:17.006Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}