Error downloading packages etc

[proitcon]

I am following the instructions from Microsoft to run CodeQL on a driver project using version 2.15.4.
When trying to download the packages I get this error:
Package specifications to check for download: microsoft/windows-drivers@1.0.13
A fatal error occurred: Could not create access credentials for microsoft/windows-drivers.
(eventual cause: SunCertPathBuilderException "unable to find valid certification path to requested target")

Another thread suggested adding certificates to a store:

But this did not make any difference.

[rvermeulen]

Hi @proitcon,

Thanks for your question.
This error is commonly caused by end point security systems intercepting traffic.
The solution is to add the root certificate of the end point security system to the CodeQL keystore.

Can you share more information on which keystore you have updated?

[proitcon]

Hi @rvermeulen
I can see now that the links I provided didn't make it through.
I used these command as suggested in another thread here:
echo | openssl s_client -showcerts -servername ghcr.io -connect ghcr.io:443 > ghcr-certificates.pem
keytool -import -alias ghcr -keystore "/codeql/tools/win64/java/lib/security/cacerts" -file ghcr-certificates.pem

The file was imported but it did not make any difference.

[rvermeulen]

Hi @proitcon,

Can you validate that ghcr-certificates.pem contain the intermediate/root public keys?
The certification path fails because it misses those.

[proitcon]

@rvermeulen I have listed the contents of the keystore. It is attached.

keystore.txt

[redsun82]

@proitcon what is the output of keytool -printcert -file ghcr-certificates.pem? For comparison mine is

ghcr-certificates.txt

[proitcon]

@redsun82
I attached the full keystore listing in the previous post.

This issue might be related to my customer's network and/or machine setups. We have now another machine where everything is running correctly. Thanks for your answers. I will close the ticket.