zhouyuan commented on PR #12831: URL: https://github.com/apache/gluten/pull/12831#issuecomment-6271848582
@HwangDongJun thanks for digging into this and for the thorough patch and test matrix. I've been trying another fix that might be simpler, because it doesn't need any changes to our native S3/GCS/ABFS code. The root cause looks like vcpkg's curl build. With the default `CURL_CA_BUNDLE=auto`, curl's CMake searches the build host for a CA bundle and compiles in the first path it finds. That's `/etc/pki/tls/certs/ca-bundle.crt` on our CentOS/Rocky build image. libcurl then fails with error 77 when that path is missing at runtime, and never tries anything else. We could disable that auto-detection in the vcpkg triplets, the same way we already add a per-port option for snappy: https://github.com/apache/gluten/blob/main/dev/vcpkg/triplets/x64-linux-avx.cmake#L13-L15 ``` if("${PORT}" STREQUAL "curl") list(APPEND VCPKG_CMAKE_CONFIGURE_OPTIONS -DCURL_CA_BUNDLE=none -DCURL_CA_PATH=none) endif() ``` (The same change would also go in arm64-linux-neon.cmake.) The vcpkg curl port already builds with CURL_CA_FALLBACK=ON(https://github.com/microsoft/vcpkg/blob/2026.03.18/ports/curl/portfile.cmake#L22), so once nothing is compiled in, libcurl falls back to OpenSSL's default trust store (OPENSSLDIR=/etc/ssl). That should help in two ways: - Debian/Ubuntu images should work out of the box through /etc/ssl/certs. - SSL_CERT_FILE / SSL_CERT_DIR are honored natively by OpenSSL. That covers S3, ABFS and GCS at once, without patching Velox or adding a new config. Could you try this approach in your environment? It would be great to check: 1. A Debian/Ubuntu image with no symlink and no environment variable set 2. The same image with SSL_CERT_FILE pointing to the bundle 3. If possible, a Rocky/RHEL runtime, to make sure we don't break the setups that already work Thanks, -yuan -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
