dvc 2.9.x installed from deb package throws pygit OpenSSL errors

[pmrowla]

Reported from multiple users in discord:
https://discord.com/channels/485586884165107732/485596304961962003/925036036411785238 (ubuntu 18.04, DVC 2.9.2)
https://discord.com/channels/485586884165107732/563406153334128681/925334641894912000 (ubuntu 20.04, DVC 2.9.3)

...
  File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
  File "PyInstaller/loader/pyimod03_importers.py", line 476, in exec_module
  File "pygit2/__init__.py", line 230, in <module>
  File "pygit2/settings.py", line 55, in __init__
  File "pygit2/settings.py", line 61, in _initialize_tls_certificate_locations
  File "pygit2/settings.py", line 191, in set_ssl_cert_locations
_pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0):func(0):reason(0)

DVC installed via pip works as expected.

[efiop]

Another user running into this 🙁 https://discord.com/channels/485586884165107732/563406153334128681/928609379924738088

[efiop]

Note that actual building with signing is happening in https://github.com/iterative/dvc-s3-repo

[DavidGOrtega]

Note that actual building with signing is happening in https://github.com/iterative/dvc-s3-repo

Sorry @efiop what do you mean? Would be that OK?

[dtrifiro]

@DavidGOrtega the github workflow in dvc-s3-repo is actually responsible for building/signing the deb/rpm packages and uploading them to s3

[dtrifiro]

Will be fixed with next release (see https://github.com/iterative/dvc-s3-repo/pulls/7207 )

A workaround for existing installations is to copy (or symlink) an existing ca cert bundle to /etc/pki/tls/ for example:

sudo mkdir -p /etc/pki/tls 
sudo ln -s /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/cert.pem