MSYS job failing with invalid SSL certificate error

[xtqqczze]

MSYS2's Cargo ships with a libgit2 build that cannot validate GitHub's TLS certificate in CI, causing Git dependency fetches to fail with:

the SSL certificate is invalid; class=Ssl

Console log from CI

+ make install DESTDIR=/tmp/w PREFIX=/tmp/usr MULTICALL=y COMPLETIONS=n MANPAGES=n LOCALES=n 'SKIP_UTILS=arch b2sum base32 base64 basename basenc cat comm cp csplit cut date dd df dir dircolors dirname du echo env expand expr factor false fmt fold head hostname hostid join link ln ls md5sum mkdir mktemp more mv nl nproc numfmt od paste pathchk pr printenv printf ptx pwd readlink realpath rm rmdir seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep sort split sum sync tac tail tee test touch tr true truncate tsort tty uname unexpand uniq unlink vdir wc whoami yes'
Detected OS = x86_64-pc-windows-gnu
    Updating git repository `[https://github.com/xtqqczze/djc-hostname.git`](https://github.com/xtqqczze/djc-hostname.git%60)
error: failed to load source for dependency `hostname`

Caused by:
  unable to update https://github.com/xtqqczze/djc-hostname.git?branch=target-aix#79b3e480

Caused by:
  failed to clone into: C:\Users\runneradmin\.cargo\git\db\djc-hostname-b43639a9f6b2c891

Caused by:
  revision 79b3e480f43a286cf493e45471e43546ab534f6b not found

Caused by:
  network failure seems to have happened
  if a proxy or similar is necessary `net.git-fetch-with-cli` may help here
  https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli

Caused by:
  the SSL certificate is invalid; class=Ssl (16)
cargo build --features openssl --features " " --profile=release --no-default-features
    Updating git repository `[https://github.com/xtqqczze/djc-hostname.git`](https://github.com/xtqqczze/djc-hostname.git%60)
error: failed to load source for dependency `hostname`

Caused by:
  unable to update https://github.com/xtqqczze/djc-hostname.git?branch=target-aix#79b3e480

Caused by:
  failed to fetch into: C:\Users\runneradmin\.cargo\git\db\djc-hostname-b43639a9f6b2c891

Caused by:
  revision 79b3e480f43a286cf493e45471e43546ab534f6b not found

Caused by:
  network failure seems to have happened
  if a proxy or similar is necessary `net.git-fetch-with-cli` may help here
  https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli

Caused by:
  the SSL certificate is invalid; class=Ssl (16)
make: *** [GNUmakefile:142: build-coreutils] Error 101

[xtqqczze]

The git CLI does not have this problem because it uses the system certificate store. git is already available on PATH in all development and CI environments. Perhaps we can add the following to .cargo/config.toml:

[net]
git-fetch-with-cli = true

[xtqqczze]

Better to set environment variable in CI workflow:

CARGO_NET_GIT_FETCH_WITH_CLI: true

[xtqqczze]

Experimenting with this approach in #14633.

[xtqqczze]

Neither workaround is effective, we just see a different error:

warning: spurious network error (3 tries remaining): No such file or directory (os error 2)
warning: spurious network error (2 tries remaining): No such file or directory (os error 2)
warning: spurious network error (1 try remaining): No such file or directory (os error 2)

[oech3]

cc @lazka

[xtqqczze]

I recall a previous Cargo issue on FreeBSD that was worked around by installing the ca_root_nss package. Perhaps a related workaround might be effective.

[xtqqczze]

The equivalent MSYS2 package is ca-certificates, trying that in 6841378.

[xtqqczze]

Neither workaround was effective, perhaps msys2/MSYS2-packages#2913 has a solution.

[lazka]

Is this about cygwin cargo, or mingw cargo? And is this a regression in MSYS2?

[oech3]

MinGW UCRT64

[lazka]

The equivalent MSYS2 package is ca-certificates, trying that in 6841378.

Then the package would be mingw-w64-ucrt-x86_64-ca-certificates instead (though I don't know if that is the solution)

[oech3]

The package and git-fetch-with-cli is needed if and only if we pull crates from git source (crate.io is not a probrem). Right?

[xtqqczze]

Yes, there seems to be an issue across multiple repositories when pulling crates from a Git source; it was also reported in the rustix repository. I’m not sure whether any of these workarounds are actually necessary, so I’m trying a few different approaches to see what works.