[BUG] apm update fails

[lirantal]

I am on version 0.8.5. and tried to update to apm latest using apm update command it fails:

node ➜ /workspaces/coding-agent-security-benchmark (main) $ apm update
[i] Current version: 0.8.5
[>] Checking for updates...
[*] Latest version available: 0.9.2
[>] Downloading and installing update...
[*] Running installer...
-e 
╔══════════════════════════════════════════════════════════════╗
║                         APM Installer                        ║
║              The NPM for AI-Native Development               ║
╚══════════════════════════════════════════════════════════════╝
-e 
-e Detected platform: linux-arm64
-e Target binary: apm-linux-arm64.tar.gz
-e ⚠ Container/Dev Container environment detected
-e Note: PyInstaller binaries may have compatibility issues in containers.
-e If installation fails, consider using: pip install --user apm-cli

-e Note: Will need sudo permissions to install to /usr/local/bin
-e Fetching latest release information...
curl: /usr/local/lib/apm/_internal/libssl.so.3: version `OPENSSL_3.2.0' not found (required by /lib/aarch64-linux-gnu/libcurl.so.4)
curl: /usr/local/lib/apm/_internal/libssl.so.3: version `OPENSSL_3.3.0' not found (required by /lib/aarch64-linux-gnu/libcurl.so.4)
[x] Installation failed - see output above for details

here is the apm version log:

$ apm --version
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Agent Package Manager (APM) CLI version 0.8.5 (52e9b1b)                                                                                                                  │
╰────────────────────────────────────────────────────────────

Environment info

I'm on a Linux dev container:

$ uname -a
Linux 081a30351bb8 6.12.76-linuxkit #1 SMP Sun Mar  8 14:41:59 UTC 2026 aarch64 GNU/Linux

The dev container uses the following container image and config:

"image": "mcr.microsoft.com/devcontainers/typescript-node:24-trixie",
    "features": {
        "ghcr.io/devcontainers/features/python:1": {
            "version": "3.12",
            "installPythonDevDependencies": true
        },
        "ghcr.io/devcontainer-community/devcontainer-features/astral.sh-uv:1": {
            "shellautocompletion": true
        }
    },

[danielmeppiel]

Triaged under the new portability/security/governance roadmap (see #116).

Triage decision

accept -- the failure (curl shipped inside the PyInstaller bundle
linking against an older system OpenSSL) is a real distribution bug
on the Portable pillar. We need a clean reproducer before we can fix
it though, so applying status/needs-triage until we can repro on a
matching linux-arm64 dev container.

Could you share the exact dev container image digest you reproduced
on, plus the output of ldd /usr/local/lib/apm/_internal/libssl.so.3
inside that container? That will let us confirm whether the fix is to
rebundle curl with its own OpenSSL or to fall back to the system curl
when the bundled libssl is too old.

Proposed labels

theme/portability
area/distribution
type/bug
status/needs-triage

(Removing the legacy bug and accepted labels; the bug is real but
needs a reproducer before it can be moved to status/accepted and
get a milestone.)

Milestone

null -- pin to a milestone once a reproducer is in hand.

Suggested next action

Reply with the dev container image digest + ldd output above. Once
we can repro locally, this moves to status/accepted and lands in
the next patch.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

apm update is a critical first-run / second-run surface -- if it
fails, users either downgrade trust or fall back to pip install.
The current error already names a workaround (pip install --user apm-cli) which is good ergonomics, but the silent failure of the
PyInstaller bundle on common dev containers is the real bug.

Supply Chain Security Expert -- Risk-Surface Reviewer

Touches area/distribution. The bundled-vs-system OpenSSL mismatch
is not an integrity issue (no signature is missing), but it does
expose users to "fall back to less-trusted install path" pressure
when the bundled binary fails. The fix should keep the bundled
fallback fully self-contained -- never silently shell out to a
system binary that wasn't part of the release.

OSS Growth Hacker -- Contributor-Tone Reviewer

Not activated -- author has 7 prior interactions on microsoft/apm.

APM CEO -- Triage Arbiter

Distribution bugs on apm update are existential for adoption: if
upgrade is unreliable, users lose confidence in the binary channel.
Ratifying accept in principle, but holding milestone until we have
a clean reproducer to size the fix correctly. Primary
theme/portability.