sudo required for MacOS #4
Comments
|
Can you help debug this? I don't have a mac, and wrote this all blind using azure devops. The tests use sudo because they call |
|
Interestingly enough on Windows it fails regardless of privilage(this crate is probably only working on linux properly) |
|
Please can you file a separate issue for any Windows-specific problems you are having. Note that the tests pass on Windows CI, so it is likely some difference between your site and Azure's configuration. |
|
First, thank you for your great work! Same error happened on my MBP too.
Repro code: use rustls_native_certs::load_native_certs;
fn main() -> Result<(), Box<dyn std::error::Error>> {
load_native_certs()
.map_err(|(_, e)| format!("Error: {:?}", e))
.expect("");
Ok(())
}Run normally: Run with sudo: I tried to debug and found that error happens here. On my MBP, If I understand correctly, the root error raised in the webpki crate.
When removing |
|
That's very interesting, and the fact there's a user-level item that is invalid explains why sudo fixes it. Could you look in "keychain access" and see what this certificate actually is? I've checked on a friend's mac (running Catalina) and Thanks a lot for helping debug this! |
|
@ctz It is a login certificate. I have 3 certs, and 1 of them raises an error on adding the cert into a This certificate uses the
I checked behavior with below. use rustls::RootCertStore;
use rustls_native_certs::load_native_certs;
use security_framework::os::macos::certificate::SecCertificateExt;
use security_framework::trust_settings::{Domain, TrustSettings};
fn main() -> Result<(), Box<dyn std::error::Error>> {
let ts = TrustSettings::new(Domain::User);
let certs = ts.iter()?.collect::<Vec<_>>();
println!("certs.len():{}", certs.len());
let mut results = Vec::new();
let mut store = RootCertStore::empty();
for cert in certs {
let der = cert.to_der();
results.push((cert, store.add(&rustls::Certificate(der))));
}
for r in results {
println!("{:?}", r);
}
Ok(())
}result is
I found why sudo fixes this. When executing |
|
Do you know where this certificate came from? I'd like to get a similar one for testing; albeit without any of your sensitive information inside. |
|
I think I get this certificate at an airport, or maybe at a hotel. |
|
Also running into this. Combined with the inability to specify target-specific features on stable, I now have a native tls set of features for a dep on MacOS, and use sed to swap in Rustls for my MuslC builds on Linux. I would ideally use Rustls on both. |
|
I believe this is fixed now by the API changes introduced in 0.2.0. That means that individual users of this crate can opt-in to "best effort" behaviour where certificates we cannot parse are omitted. hyper-rustls does this. |
Instead of failing and bailing when a bad cert is found, ignore one-off errors for bad certs and continue to load the rest of the store. These one-off errors mostly affect MacOS users, as found in this rustls-native-certs issue: rustls/rustls-native-certs#4 Fixes: hyperium#519
Instead of failing and bailing when a bad cert is found, ignore one-off errors for bad certs and continue to load the rest of the store. These one-off errors mostly affect MacOS users, as found in this rustls-native-certs issue: rustls/rustls-native-certs#4 Fixes: #519
If I call
rustls_native_certs::load_native_certs()when running on MacOS Catalina as normal non-root user I get the following error:Custom { kind: InvalidData, error: BadDER }If I use
sudoto run my rust app as root it works.Took a look at the integration tests in this project and they are using sudo on MacOS: https://github.com/ctz/rustls-native-certs/blob/master/admin/pipelines/macos-tests.yml#L2
Seems like it should be possible to run rust apps using rustls on MacOS as a non-root user. This is definitely possible in other languages/frameworks using tls on MacOS.
The text was updated successfully, but these errors were encountered: