pathwaycom/pathway · error · ValueError

sslrootcert points to a non-existent path

Error message

sslrootcert points to a non-existent path

What it means

Raised by the postgres connector's _build_tls_settings when sslrootcert points to a path that does not exist. The connector probes the file up front so the pipeline fails at graph-construction time with a clear message instead of failing later inside the Rust engine during connection.

Source

Thrown at python/pathway/io/postgres/__init__.py:240

        path = ""

    owned_settings["replication"] = "database"
    query = "&".join(f"{enc(k)}={enc(v)}" for (k, v) in owned_settings.items())

    return f"postgresql://{userinfo}{hostport}{path}?{query}"


def _build_tls_settings(owned_postgres_settings: dict) -> TLSSettings:
    sslmode = owned_postgres_settings.pop("sslmode", "prefer")

    sslrootcert = owned_postgres_settings.pop("sslrootcert", None)
    if sslrootcert is not None:
        try:
            open(sslrootcert).close()
        except IsADirectoryError as e:
            raise ValueError("sslrootcert doesn't point to a file") from e
        except FileNotFoundError as e:
            raise ValueError("sslrootcert points to a non-existent path") from e
        except OSError as e:
            raise ValueError(f"sslrootcert is not readable: {e}") from e

    return TLSSettings(mode=sslmode, root_cert_path=sslrootcert)


def _construct_replication_settings(
    *,
    mode: Literal["streaming", "static"],
    postgres_settings: dict,
    publication_name: str | None,
    replication_slot_name: str | None,
    snapshot_name: str | None,
):
    # static mode doesn't require replication slots
    if mode == "static":
        if publication_name is not None:
            raise ValueError("'publication_name' is not needed for the static mode")

View on GitHub (pinned to fa2f74a464)

Solutions

1. Fix the path to the actual CA bundle file on the machine/container running the pipeline.
2. In containers, verify the mount: docker run -v $(pwd)/ca.pem:/etc/ssl/ca.pem ... and use the in-container path.
3. If TLS verification is not required for this host, drop sslrootcert and use sslmode=require.

Example fix

# before
postgres_settings={"sslrootcert": "/certs/root.pem"}  # file missing
# after
postgres_settings={"sslrootcert": "/etc/pathway/certs/root.pem"}  # verified with os.path.isfile

import os
if "sslrootcert" in postgres_settings:
    assert os.path.isfile(postgres_settings["sslrootcert"]), "sslrootcert path does not exist"

When it happens

Trigger: postgres_settings={"sslrootcert": "/path/that/does/not/exist.pem"}; paths broken by containerization (host path not mounted), typos, or a cert file not yet created.

Common situations: Docker/Kubernetes deployments where the CA file is mounted at a different path than on the developer machine; CI runners missing the mounted secret.

Related errors

• sslrootcert doesn't point to a file
• sslrootcert is not readable: {e}
• Failed to install dependencies
• Column {api.TIME_PSEUDOCOLUMN} cannot contain negative times
• Column {api.DIFF_PSEUDOCOLUMN} can only have 1 and -1 values

AI-assisted analysis of pathwaycom/pathway@fa2f74a464 (2026-08-15). Data as JSON: /api/errors/28601474614445a0. Report an issue: GitHub.