MacOS CA Bundle regression after b3a11018ae1fe99190fb6fb7ae82a486c40f6f15

[jedisct1]

Zig Version

0.14.0-dev.3213+53216d2f2

Steps to Reproduce and Observed Behavior

After b3a1101 , root CAs are not properly loaded any more on macOS.

Random example while trying to compile zls:

zls/build.zig.zon:16:20: error: unable to connect to server: CertificateBundleLoadFailure
            .url = "https://github.com/ziglibs/known-folders/archive/1cceeb70e77dec941a4178160ff6c8d05a74de6f.tar.gz",

Reverting b3a1101 fixes this.

Expected Behavior

root CAs can be loaded.

[alexrp]

FYI @dreilly1982

We'll have to revert that PR if this can't be fixed in time for 0.14.0.

[dreilly1982]

That is odd, I'll look into this today.

[jedisct1]

The bundle properly loads if the order of the keychains is switched:

diff --git a/lib/std/crypto/Certificate/Bundle/macos.zig b/lib/std/crypto/Certificate/Bundle/macos.zig
index 7fb16af543..4589adb217 100644
--- a/lib/std/crypto/Certificate/Bundle/macos.zig
+++ b/lib/std/crypto/Certificate/Bundle/macos.zig
@@ -12,8 +12,8 @@ pub fn rescanMac(cb: *Bundle, gpa: Allocator) RescanMacError!void {
     cb.map.clearRetainingCapacity();
 
     const keychainPaths = [2][]const u8{
-        "/System/Library/Keychains/SystemRootCertificates.keychain",
         "/Library/Keychains/System.keychain",
+        "/System/Library/Keychains/SystemRootCertificates.keychain",
     };
 
     for (keychainPaths) |keychainPath| {

[dreilly1982]

So I couldn't reproduce your issue on my end, but swapping the order didn't affect my functionality. What is weird, and I'm looking into it, is the cb.bytes.items.len IS different based of the order, which I find odd. I'm looking more into this tonight.

[nurpax]

If it helps, I can also try to repro this with and w/o this change. I seem to be hitting this regression too. I just don't know where to download aarch64 macOS builds of zig for past changes, I can only find the latest master.

EDIT: I got some help finding the right nightlies. Here's a log of when the problem started happening:

➜  ~/dev/zig2d git:(main) ~/zig-macos-aarch64-0.14.0-dev.3066+1a1389c51/zig fetch --save git+https://github.com/natecraddock/ziglua
info: resolved to commit daa99a28a21523f680ebade522202440bbe720db
info: existing dependency named 'ziglua' is up-to-date

➜  ~/dev/zig2d git:(main) ~/zig-macos-aarch64-0.14.0-dev.3089+87bbb49d5/zig fetch --save git+https://github.com/natecraddock/ziglua
info: resolved to commit daa99a28a21523f680ebade522202440bbe720db
info: existing dependency named 'ziglua' is up-to-date

➜  ~/dev/zig2d git:(main) ~/zig-macos-aarch64-0.14.0-dev.3091+42e48b83b/zig fetch --save git+https://github.com/natecraddock/ziglua
info: resolved to commit daa99a28a21523f680ebade522202440bbe720db
info: existing dependency named 'ziglua' is up-to-date

➜  ~/dev/zig2d git:(main) ~/zig-macos-aarch64-0.14.0-dev.3187+d4c85079c/zig fetch --save git+https://github.com/natecraddock/ziglua
error: unable to discover remote git server capabilities: CertificateBundleLoadFailure