go get x509: failed to load system roots and no roots provided

[andrewrynhard]

Installed go with nix in a nix-shell environment and I am getting errors when using go get. As the title explains the error is x509: failed to load system roots and no roots provided. I have made sure that the nix.sh environment variables are set but still get this error. This is on OS X.

[pikajude]

go being unable to interoperate with the system keychain is a known issue (hub is also broken), though it needs more investigation. The keychain interface code has also changed drastically between go 1.4 and 1.5, so it might be worth whichever is the other version of the compiler?

[nbp]

cc @cstrahan @wkennington

[andrewrynhard]

@pikajude this is with go1.5.

[zimbatm]

The nix profile sets the SSL_CERT_FILE environment variable but go doesn't seem to take that into account.

[chrisfarms]

There's an open Go issue to support SSL_CERT_FILE which should resolve this.

In the meantime I think you need to ensure /etc/ssl/certs/ca-bundle.crt exists, since Go appears to happily guess that location.

this did the trick for me:

ln -s $SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt

[zimbatm]

I actually have a patch to add SSL_CERT_FILE support to go but then decided it was too much work maintaining the patch. If you're interested it's at zimbatm@e5557a6 . Both go 1.4 and 1.5 are supported. I did it before go 1.6 so that would need to be adapted.

[ben0x539]

yo I didn't get very far trying to figure this out. The thing with putting the certs into /etc didn't help for me. I've been using the following test case:

package main
import ( "fmt"; "net/http")
func main() { fmt.Println(http.Get("https://nixos.org/channels/nixos-unstable/git-revision")) }

It fails with the error message in the issue title.

Trying to dtrace (I'm not very good with OS X) it, I noticed that it works when running as root. Unclear what the deal is, looks like there's some certificate data scrolling past in the trace either way.

Does go1.7 change the behavior? I haven't been able to get it to build so far.

[mstone]

@andrewrynhard does mstone@fc28879 work around the problem for you (perhaps if adjusted for go 1.5 instead of 1.6)?

[LnL7]

This is fixed for 1.7