{"record":{"id":"877d2cf3a2c12525","repo":"Hmbown/CodeWhale","slug":"building-bundle-fetch-client-failed","errorCode":null,"errorMessage":"building bundle fetch client failed","messagePattern":"building bundle fetch client failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/config_bundles.rs","lineNumber":764,"sourceCode":"// ---------------------------------------------------------------------------\n// Remote fetch\n// ---------------------------------------------------------------------------\n\n/// Fetch a bundle over HTTPS (or plain http on loopback only) with a hard\n/// size cap, a timeout, and bounded redirects. Mirrors the skill installer's\n/// fetch bounds.\npub fn fetch_bundle(url: &str) -> Result<Vec<u8>> {\n    let mut current_url = reqwest::Url::parse(url).map_err(|_| anyhow!(\"invalid bundle URL\"))?;\n    validate_bundle_url(&current_url)?;\n    let initial_scheme = current_url.scheme().to_string();\n\n    let client = codewhale_release::platform_blocking_http_client_builder()\n        .timeout(std::time::Duration::from_secs(FETCH_TIMEOUT_SECS))\n        // Redirect targets must pass the same scheme/host policy as the\n        // initial request, so redirects are followed explicitly below.\n        .redirect(reqwest::redirect::Policy::none())\n        .build()\n        .map_err(|_| anyhow!(\"building bundle fetch client failed\"))?;\n    let mut redirects = 0usize;\n    let response = loop {\n        let response = client\n            .get(current_url.clone())\n            .send()\n            // reqwest errors can include the full URL (including its query or\n            // userinfo), so keep transport failures deliberately URL-free.\n            .map_err(|_| anyhow!(\"bundle fetch request failed\"))?;\n\n        if !response.status().is_redirection() {\n            break response;\n        }\n        if redirects >= MAX_REDIRECTS {\n            bail!(\"bundle fetch exceeded the five-redirect limit\");\n        }\n        let location = response\n            .headers()\n            .get(reqwest::header::LOCATION)","sourceCodeStart":746,"sourceCodeEnd":782,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/cli/src/config_bundles.rs#L746-L782","documentation":"`fetch_bundle` builds its HTTP client via `platform_blocking_http_client_builder` with a timeout and `Policy::none()` redirects; if `reqwest::Client::build()` fails, this error is raised before any request is made. It indicates the HTTP client could not be constructed in this environment.","triggerScenarios":"`reqwest::ClientBuilder::build()` fails inside `fetch_bundle` — typically TLS backend initialization failure (no system roots, broken OpenSSL/rustls setup) or unavailable runtime resources.","commonSituations":"Missing/empty system CA certificate store (minimal containers, musl builds without roots); mismatched OpenSSL versions at runtime; statically linked builds lacking TLS roots.","solutions":["Ensure the system CA certificate bundle exists (e.g. install `ca-certificates` or set SSL_CERT_FILE/SSL_CERT_DIR).","Reinstall/upgrade the `codewhale` binary for your platform; the TLS backend may be broken in that build.","Check that no environment overriding cert paths points to a nonexistent file."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// heuristic pre-check: a missing CA bundle usually breaks client build\nif !std::path::Path::new(\"/etc/ssl/certs/ca-certificates.crt\").exists()\n    && std::env::var_os(\"SSL_CERT_FILE\").is_none() {\n    eprintln!(\"no system CA bundle found; TLS client build will likely fail\");\n}","typeGuard":null,"tryCatchPattern":"match fetch_bundle(url) {\n    Err(e) if e.to_string().contains(\"building bundle fetch client failed\") => {\n        eprintln!(\"check TLS/CA setup: install ca-certificates or set SSL_CERT_FILE\");\n    }\n    other => other,\n}","preventionTips":["Install a CA certificate bundle in containers/minimal images.","Avoid mixing OpenSSL versions when packaging the binary.","Set SSL_CERT_FILE explicitly when the system store is nonstandard."],"tags":["http","tls","network","environment"],"backgroundTag":"http-request-failed","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T21:17:16.096Z"}