Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Zig only reads CA Certificates from SystemRootCertificates.keychain and not from System.keychain #22700

Open
dreilly1982 opened this issue Jan 31, 2025 · 1 comment · May be fixed by #22701
Open

Zig only reads CA Certificates from SystemRootCertificates.keychain and not from System.keychain #22700

dreilly1982 opened this issue Jan 31, 2025 · 1 comment · May be fixed by #22701
Labels
bug Observed behavior contradicts documented or intended behavior

Comments

@dreilly1982
Copy link

Zig Version

0.14.0-dev.2989+bf6ee7cb3

Steps to Reproduce and Observed Behavior

run zig fetch <url> returns error: unable to connect to server: TlsInitializationFailed this is due to a TLS intercept using a coporate signed TLS certificate.

Expected Behavior

I am very sure that this was intended as written, however many organizations use TLS intercept on their devices. Allowing to read certificates from both /System/Library/Keychains/SystemRootCertificates.keychain as well as /Library/Keychains/System.keychain would allow trusted intercept certificates to be installed in the System keychain, and still be trusted for actions such as "zig build fetch".
@dreilly1982 dreilly1982 added the bug Observed behavior contradicts documented or intended behavior label Jan 31, 2025
@dreilly1982 dreilly1982 linked a pull request Jan 31, 2025 that will close this issue
Open
@dreilly1982
Copy link
Author

I only mentioned zig fetch in the initial issue as this is where I found the issue, and the fetch command doesn't currently have any apparent way to pass the arguments to ignore TLS verification. This is a show stopper for anyone using Zig on machines where their traffic is forced through intercept proxies on MacOS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Observed behavior contradicts documented or intended behavior
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Read System.keychain as well as SystemRootCertificates.keychain for MacOS CA Bundle dreilly1982/zig
1 participant
@dreilly1982