Fetchgit fails when run in Gitlab runner

Help
1

Trying to override a dependency resulted in an error that only shows up when I’m trying to build it in a Gitlab runner:

building '/nix/store/zc81vw0lkjc3jvwqx2hb44yrlskhfx0l-source.drv'...
error: builder for '/nix/store/zc81vw0lkjc3jvwqx2hb44yrlskhfx0l-source.drv' failed with exit code 1;
       last 7 log lines:
       > exporting https://github.com/py-pdf/pypdf.git (rev refs/tags/5.2.0) into /nix/store/fvv0ij0kq9bnszljsgf8xbzxwnsgmsxb-source
       > Initialized empty Git repository in /nix/store/fvv0ij0kq9bnszljsgf8xbzxwnsgmsxb-source/.git/
       > fatal: unable to access 'https://github.com/py-pdf/pypdf.git/': TLS connect error: error:80000002:system library::No such file or directory
       > fatal: unable to access 'https://github.com/py-pdf/pypdf.git/': TLS connect error: error:80000002:system library::No such file or directory
       > fatal: unable to access 'https://github.com/py-pdf/pypdf.git/': TLS connect error: error:80000002:system library::No such file or directory
       > fatal: unable to access 'https://github.com/py-pdf/pypdf.git/': TLS connect error: error:80000002:system library::No such file or directory
       > Unable to checkout refs/tags/5.2.0 from https://github.com/py-pdf/pypdf.git.
       For full logs, run 'nix log /nix/store/zc81vw0lkjc3jvwqx2hb44yrlskhfx0l-source.drv'.

I first thought it was a temporary network issue, but I’ve been trying for hours and the problem is still there. It happens with any fetchgit operation, even on other repositories (all on Github). The error message “TLS connect error: error:80000002:system library::No such file or directory” makes me think there might be something wrong with CA certificates or something like that, but I can’t figure it out (NIX_SSL_CERT_FILE is set and the file exists). Running git clone manually on the runner works. It just fails as soon as I start using fetchgit (other fetchers work, like fetchFromGitHub when it’s not using fetchgit).

Does anyone have an idea where this could come from, or how I could debug this?!

I’m using the docker image docker.nix-community.org/nixpkgs/nix-flakes:nixos-24.11. Here’s the package I’m trying to override if it helps (but I don’t think that’s the source of the problem):

  pypdf = super.pypdf.overridePythonAttrs (old: rec {
    # pypdf in nixpkgs 24.11 is 5.1.0 but we need at least 5.2.0 to get this
    # fix: https://github.com/py-pdf/pypdf/pull/2909
    version = "5.2.0";

    src = fetchFromGitHub {
      owner = "py-pdf";
      repo = "pypdf";
      tag = version;
      # fetch sample files used in tests
      fetchSubmodules = true;
      hash = "sha256-EPccu6MKgr/YDWQc7sxvKIKQm97JMe6SH88ethO1btA=";
    };
  });