Macos execution environment has outdated CA certificates

Hello. I am running a build on xcode:11.7.0 executor. Until 1 week ago the building worked fine, but since then I got a ca-certificates error when installing pyenv. I ssh-ed in the instance and ran the commands manually and everything was working fine. I ran brew update then brew install pyenv.
What do you suggest I should try next?

Note that I require the 11.7.0 executor for this build and I cannot upgrade the executor.

Can you provide some more info, like error message, copy of config.yml (or relevant sections), etc.? I’ll make sure to get the team to review

Sure thing

steps:
      - run:
          name: install-pyenv
          command: |
            brew install pyenv
            echo 'eval "$(pyenv init --path)"' >> ~/.bash_profile

I managed to fix this issue.
I did brew install ca-certificates and I assume the root certificates were updated thought this added a lot of runtime on the job, jumping from 5-10 min to 25 min.

@aristoHero Yes, it seems the only way to work around this is to install the ca-certificates package. The main reason this is out of date in the first place is that the image is about 2.5 years old now.

I would have suggested to use HOMEBREW_NO_AUTO_UPDATE=1 brew install ca-certificates to cut down on the install time due to home-brew updating itself, but the ca-certificates package was not introduced to Homebrew until late 2021: ca-certificates 2021-09-30 (new formula) · Homebrew/homebrew-core@ef2fb64 · GitHub

The image was built in September 2020 (Xcode 11.7 Released), therefore this formula is not present in the image until Homebrew gets updated.

I would definitely suggest, if you can, moving to a newer Xcode image. The 11.7 image will be deprecated and removed later in the year, so being ahead of the curve will be beneficial!

Thank you very much for the help. Have a great day

1 Like

No problem :slight_smile: sorry it is not a better solution, but hopefully you are unstuck for now! If you need any more help just let us know.

Happy Building :circleci:

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.