Repository navigation
MSYS job failing with invalid SSL certificate error #14908
Description
MSYS2's Cargo ships with a libgit2 build that cannot validate GitHub's TLS certificate in CI, causing Git dependency fetches to fail with:
the SSL certificate is invalid; class=Ssl
Console log from CI
+ make install DESTDIR=/tmp/w PREFIX=/tmp/usr MULTICALL=y COMPLETIONS=n MANPAGES=n LOCALES=n 'SKIP_UTILS=arch b2sum base32 base64 basename basenc cat comm cp csplit cut date dd df dir dircolors dirname du echo env expand expr factor false fmt fold head hostname hostid join link ln ls md5sum mkdir mktemp more mv nl nproc numfmt od paste pathchk pr printenv printf ptx pwd readlink realpath rm rmdir seq sha1sum sha224sum sha256sum sha384sum sha512sum shred shuf sleep sort split sum sync tac tail tee test touch tr true truncate tsort tty uname unexpand uniq unlink vdir wc whoami yes'
Detected OS = x86_64-pc-windows-gnu
Updating git repository `[https://github.com/xtqqczze/djc-hostname.git`](https://github.com/xtqqczze/djc-hostname.git%60)
error: failed to load source for dependency `hostname`
Caused by:
unable to update https://github.com/xtqqczze/djc-hostname.git?branch=target-aix#79b3e480
Caused by:
failed to clone into: C:\Users\runneradmin\.cargo\git\db\djc-hostname-b43639a9f6b2c891
Caused by:
revision 79b3e480f43a286cf493e45471e43546ab534f6b not found
Caused by:
network failure seems to have happened
if a proxy or similar is necessary `net.git-fetch-with-cli` may help here
https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli
Caused by:
the SSL certificate is invalid; class=Ssl (16)
cargo build --features openssl --features " " --profile=release --no-default-features
Updating git repository `[https://github.com/xtqqczze/djc-hostname.git`](https://github.com/xtqqczze/djc-hostname.git%60)
error: failed to load source for dependency `hostname`
Caused by:
unable to update https://github.com/xtqqczze/djc-hostname.git?branch=target-aix#79b3e480
Caused by:
failed to fetch into: C:\Users\runneradmin\.cargo\git\db\djc-hostname-b43639a9f6b2c891
Caused by:
revision 79b3e480f43a286cf493e45471e43546ab534f6b not found
Caused by:
network failure seems to have happened
if a proxy or similar is necessary `net.git-fetch-with-cli` may help here
https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli
Caused by:
the SSL certificate is invalid; class=Ssl (16)
make: *** [GNUmakefile:142: build-coreutils] Error 101Metadata
Metadata
Assignees
Labels
No labels
Activity
xtqqczze commentedon Sep 28, 2026
The
gitCLI does not have this problem because it uses the system certificate store.gitis already available onPATHin all development and CI environments. Perhaps we can add the following to.cargo/config.toml:xtqqczze commentedon Sep 28, 2026
Better to set environment variable in CI workflow:
xtqqczze commentedon Sep 28, 2026
Experimenting with this approach in #14633.
xtqqczze commentedon Sep 28, 2026
Neither workaround is effective, we just see a different error:
oech3 commentedon Sep 29, 2026
cc @lazka
xtqqczze commentedon Sep 29, 2026
I recall a previous Cargo issue on FreeBSD that was worked around by installing the
ca_root_nsspackage. Perhaps a related workaround might be effective.xtqqczze commentedon Sep 29, 2026
The equivalent MSYS2 package is
ca-certificates, trying that in 6841378.xtqqczze commentedon Sep 29, 2026
Neither workaround was effective, perhaps msys2/MSYS2-packages#2913 has a solution.
lazka commentedon Sep 30, 2026
Is this about cygwin cargo, or mingw cargo? And is this a regression in MSYS2?
oech3 commentedon Sep 30, 2026
MinGW UCRT64
lazka commentedon Sep 30, 2026
Then the package would be mingw-w64-ucrt-x86_64-ca-certificates instead (though I don't know if that is the solution)
oech3 commentedon Sep 30, 2026
The package and git-fetch-with-cli is needed if and only if we pull crates from git source (crate.io is not a probrem). Right?
xtqqczze commentedon Sep 30, 2026
Yes, there seems to be an issue across multiple repositories when pulling crates from a Git source; it was also reported in the rustix repository. I’m not sure whether any of these workarounds are actually necessary, so I’m trying a few different approaches to see what works.
25 remaining items
oech3 commentedon Oct 1, 2026
New libgit2 was uploaded https://packages.msys2.org/base/mingw-w64-libgit2 .
xtqqczze commentedon Oct 1, 2026
The job is still failing:
https://github.com/uutils/coreutils/actions/runs/36833541806/job/110275422164?pr=14633#step:7:39
https://packages.msys2.org/base/libgit2 is still at
1.9.7-1.I'll give it a bit longer and check again tomorrow.
ognevny commentedon Oct 1, 2026
package updates don't appear in mirrors immediately, unfortunately:(
xtqqczze commentedon Oct 1, 2026
mingw-w64-ucrt-x86_64-libgit2-1.9.7-2seems to have done the trick: https://github.com/uutils/coreutils/actions/runs/36844061917/job/110309839974?pr=14633#step:7:39@oech3 @lazka @ognevny Thank you for your assistance!
SnoozeThis commentedon Oct 2, 2026
Resolved.
xtqqczze commentedon Oct 18, 2026
failing again with the same error, since at least 2026-10-15T22:56:03Z:
https://github.com/uutils/coreutils/actions/runs/38818423996/job/116708782291
lazka commentedon Oct 19, 2026
your "Update MSYS2 packages" step is failing, so that is another issue (you are doing a partial system update, which is not supported)
xtqqczze commentedon Oct 19, 2026
I see the step was reported as successful but actually failed:
xtqqczze commentedon Oct 19, 2026
@lazka I tried adding
set -eto the step, I don't understand why is reported as successful when it failed:https://github.com/uutils/coreutils/actions/runs/39319701135/job/118290258552?pr=15536#step:7:1
oech3 commentedon Oct 20, 2026
Just replacing
-Sywith-Syyu? Does it increate time needed for installing?xtqqczze commentedon Oct 21, 2026
I think we must do update first as separate step: