Repository navigation
bug: git clone fails inside sandbox — missing GIT_SSL_CAINFO environment variable #790
Description
git clone over HTTPS fails in all community sandbox images with:
fatal: unable to access '...': server certificate verification failed. CAfile: none CRLfile: none
Root cause
The sandbox runtime injects CA bundle env vars for several tools but not for git:
| Variable | Value | Consumer |
|---|---|---|
SSL_CERT_FILE |
/etc/openshell-tls/ca-bundle.pem |
OpenSSL-based libs |
CURL_CA_BUNDLE |
/etc/openshell-tls/ca-bundle.pem |
curl (OpenSSL) |
REQUESTS_CA_BUNDLE |
/etc/openshell-tls/ca-bundle.pem |
Python requests |
NODE_EXTRA_CA_CERTS |
/etc/openshell-tls/openshell-ca.pem |
Node.js |
GIT_SSL_CAINFO |
not set | git |
The base image (Ubuntu Noble) ships git 2.43.0 linked against libcurl-gnutls, which does not read SSL_CERT_FILE. Git requires its own GIT_SSL_CAINFO env var (or http.sslCAInfo git config) to locate the CA bundle.
$ ldd /usr/lib/git-core/git-remote-https | grep -E 'curl|gnutls'
libcurl-gnutls.so.4 => /lib/aarch64-linux-gnu/libcurl-gnutls.so.4
libgnutls.so.30 => /lib/aarch64-linux-gnu/libgnutls.so.30
Reproduction
$ openshell sandbox create --from openclaw
# inside the sandbox:
$ env | grep GIT_SSL
# (empty)
$ git clone https://github.com/octocat/Hello-World.git
Cloning into 'Hello-World'...
fatal: unable to access 'https://github.com/octocat/Hello-World.git/': server certificate verification failed. CAfile: none CRLfile: noneWorkaround
export GIT_SSL_CAINFO=/etc/openshell-tls/ca-bundle.pem
git clone https://github.com/octocat/Hello-World.git # worksSuggested fix
Inject GIT_SSL_CAINFO=/etc/openshell-tls/ca-bundle.pem in the sandbox environment alongside the other CA variables.
Alternatively, adding openshell-ca.pem to /usr/local/share/ca-certificates/ and running update-ca-certificates at sandbox init would fix all TLS clients at once (including future ones).
Affected images
All community sandbox images (base, openclaw, openclaw-nvidia, ollama, gemini) since they all inherit from base.
Activity
github-actions commentedon Apr 9, 2026
This issue appears to have been opened without an agent investigation.
OpenShell is an agent-first project - please point your coding agent at the repo and have it diagnose this before we triage. Your agent can load skills like
debug-openshell-cluster,debug-inference,openshell-cli, andgenerate-sandbox-policy.See CONTRIBUTING.md for the full workflow.
mjamiv commentedon Apr 13, 2026
Confirmed on OpenShell
v0.0.25sandboxes based on theopenclawcommunity image:All four expected variables are injected and the combined bundle is present (~220 KB, contains system roots + the OpenShell CA). The
GIT_SSL_CAINFOgap reproduces exactly as described — the bundle is correct, git just can't find it under a name it reads because Ubuntu Noble's git links againstlibcurl-gnutlswhich ignoresSSL_CERT_FILE.The minimal fix (inject
GIT_SSL_CAINFOalongside the others) works as a patch. The alternative you mentioned (addopenshell-ca.pemto/usr/local/share/ca-certificates/+update-ca-certificates) is strictly better because it would also cover any future TLS client that doesn't read one of the currently-injected env vars — one source of truth instead of a per-tool allowlist.