[GH-ISSUE #721] Issue: helm login/push yields x509: certificate signed by unknown authority with google artifact registry

kerem commented

2026-03-01 21:43:33 +03:00

Owner

Originally created by @ekallevig on GitHub (Jun 4, 2021).
Original GitHub issue: https://github.com/nektos/act/issues/721

Act version

act version 0.2.22-14-g8a9167d
commit 8a9167da82
using nektos/act-environments-ubuntu:18.04 runner

Expected behaviour

When running either helm registry login... or helm chart push with the google artifact registry (us-east1-docker.pkg.dev), it should succeed normally.

Actual behaviour

When running either helm registry login... or helm chart push with the google artifact registry (us-east1-docker.pkg.dev), it fails with the message:

Error logging in to v2 endpoint, trying next endpoint: Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority
| Error: Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority
| helm.go:81: [debug] Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority

These same helm commands work fine on the local host machine (macos) as well as on the remote github actions runner (ubuntu 18.04). It seems like there's something off with the certificate store specifically on the act runner?

Workflow and/or repository

- name: package, and deploy helm chart
  run: |
    export HELM_EXPERIMENTAL_OCI=1
    helm registry login -u _json_key_base64 -p ${{ steps.secrets.outputs.GCP_AR_KEY }} us-east1-docker.pkg.dev
    helm chart save ./charts/chart-name us-east1-docker.pkg.dev/chart-name
    helm chart push us-east1-docker.pkg.dev/chart-name:0.0.4

Originally created by @ekallevig on GitHub (Jun 4, 2021). Original GitHub issue: https://github.com/nektos/act/issues/721 ## Act version act version 0.2.22-14-g8a9167d commit 8a9167da82b3824272fdbfcc25b3671cd1260e7d using nektos/act-environments-ubuntu:18.04 runner ## Expected behaviour When running either `helm registry login...` or `helm chart push` with the google artifact registry (us-east1-docker.pkg.dev), it should succeed normally. ## Actual behaviour When running either `helm registry login...` or `helm chart push` with the google artifact registry (us-east1-docker.pkg.dev), it fails with the message: ``` Error logging in to v2 endpoint, trying next endpoint: Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority | Error: Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority | helm.go:81: [debug] Get "https://us-east1-docker.pkg.dev/v2/": x509: certificate signed by unknown authority ``` These same helm commands work fine on the local host machine (macos) as well as on the remote github actions runner (ubuntu 18.04). It seems like there's something off with the certificate store specifically on the act runner? ## Workflow and/or repository ```none - name: package, and deploy helm chart run: | export HELM_EXPERIMENTAL_OCI=1 helm registry login -u _json_key_base64 -p ${{ steps.secrets.outputs.GCP_AR_KEY }} us-east1-docker.pkg.dev helm chart save ./charts/chart-name us-east1-docker.pkg.dev/chart-name helm chart push us-east1-docker.pkg.dev/chart-name:0.0.4 ```

kerem

2026-03-01 21:43:33 +03:00

closed this issue
added the
meta/resolved

area/image

kind/external
labels

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@catthehacker commented on GitHub (Jun 4, 2021):

Image has not been updated since February 2020, please use more recent image or update it yourself.
https://github.com/nektos/act/blob/master/IMAGES.md

@catthehacker commented on GitHub (Jun 4, 2021): Image has not been updated since February 2020, please use more recent image or update it yourself. https://github.com/nektos/act/blob/master/IMAGES.md

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@ekallevig commented on GitHub (Jun 4, 2021):

Thanks for your reply. By update do you mean running something like sudo apt-get upgrade and generating a new image?

@ekallevig commented on GitHub (Jun 4, 2021): Thanks for your reply. By update do you mean running something like `sudo apt-get upgrade` and generating a new image?

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@ekallevig commented on GitHub (Jun 4, 2021):

@catthehacker I've tried this with catthehacker/ubuntu:act-latest which was updated 13 days ago and I still get the same certificate error.

@ekallevig commented on GitHub (Jun 4, 2021): @catthehacker I've tried this with `catthehacker/ubuntu:act-latest` which was updated 13 days ago and I still get the same certificate error.

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@catthehacker commented on GitHub (Jun 4, 2021):

Can you try running sudo update-ca-certificates before failing step?

@catthehacker commented on GitHub (Jun 4, 2021): Can you try running `sudo update-ca-certificates` before failing step?

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@ekallevig commented on GitHub (Jun 4, 2021):

I have tried that and it doesn't add any certs (same resulting error). I think this may be caused by the fact that I need to be on my company's VPN, which changes the cert issuer from Google to my company. Thinking I need to somehow install my company's ca cert in the runner store but I'm not sure where to get the cert and how it should be installed.

I've tried doing it this way without success:

export my company's root CA file (ie. Company Root CA.pem) from Keychain Access (macos)

convert cert file to .crt format

openssl x509 -outform der -in Company\ Root\ CA.pem -out compnay-root-ca.crt

copying the cert into the runner and attempting to install it

sudo apt-get install ca-certificates -y
sudo cp ./company-root-ca.crt /usr/local/share/ca-certificates
sudo update-ca-certificates

I'm not clear on:

if that's the right certificate that is needed in the runner (or do i download the certificate that is sent when making a request to the domain?)
if that's the correct way to install the cert

@ekallevig commented on GitHub (Jun 4, 2021): I have tried that and it doesn't add any certs (same resulting error). I think this may be caused by the fact that I need to be on my company's VPN, which changes the cert issuer from Google to my company. Thinking I need to somehow install my company's ca cert in the runner store but I'm not sure where to get the cert and how it should be installed. I've tried doing it this way without success: 1. export my company's root CA file (ie. `Company Root CA.pem`) from Keychain Access (macos) 2. convert cert file to .crt format ``` openssl x509 -outform der -in Company\ Root\ CA.pem -out compnay-root-ca.crt ``` 3. copying the cert into the runner and attempting to install it ``` sudo apt-get install ca-certificates -y sudo cp ./company-root-ca.crt /usr/local/share/ca-certificates sudo update-ca-certificates ``` I'm not clear on: * if that's the right certificate that is needed in the runner (or do i download the certificate that is sent when making a request to the domain?) * if that's the correct way to install the cert

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@ekallevig commented on GitHub (Jun 4, 2021):

I've managed to solve the issue. I was slightly off on the method for exporting the comopany root ca file.

find cert in keychain access (macos), right click and 'export' in .pem format
rename file from .pem to .crt

create a runner image with the .crt file included or add a step like this to copy file and install

  - name: Install company root ca cert for local vpn runs
    id: install-ca-cert
    if: ${{ env.ACT }}
    run: |
      sudo cp ./company-root-ca.crt /usr/local/share/ca-certificates
      sudo update-ca-certificates

@ekallevig commented on GitHub (Jun 4, 2021): I've managed to solve the issue. I was slightly off on the method for exporting the comopany root ca file. 1. find cert in keychain access (macos), right click and 'export' in .pem format 2. rename file from .pem to .crt 3. create a runner image with the .crt file included or add a step like this to copy file and install ```` - name: Install company root ca cert for local vpn runs id: install-ca-cert if: ${{ env.ACT }} run: | sudo cp ./company-root-ca.crt /usr/local/share/ca-certificates sudo update-ca-certificates ````

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@orcutt989 commented on GitHub (Jul 20, 2021):

I am having the same issue, but with running Pulumi from within the container. I have no special network configuration and this action works fine on GitHub.

@orcutt989 commented on GitHub (Jul 20, 2021): I am having the same issue, but with running Pulumi from within the container. I have no special network configuration and this action works fine on GitHub.

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@catthehacker commented on GitHub (Jul 20, 2021):

@orcutt989 please create new issue

@catthehacker commented on GitHub (Jul 20, 2021): @orcutt989 please create new issue

kerem commented

2026-03-01 21:43:34 +03:00

Author

Owner

@catthehacker commented on GitHub (Jul 20, 2021):

Locking conversation here since the issue wasn't really a fault of act nor image, but a company certificate which we have no way of pulling nor detecting.
For anyone finding that issue as related to theirs, please create a new one and fill required information.

@catthehacker commented on GitHub (Jul 20, 2021): Locking conversation here since the issue wasn't really a fault of `act` nor image, but a company certificate which we have no way of pulling nor detecting. For anyone finding that issue as related to theirs, please create a new one and fill required information.

Rows
Columns

[GH-ISSUE #721] Issue: helm login/push yields x509: certificate signed by unknown authority with google artifact registry #454

Act version

Expected behaviour

Actual behaviour

Workflow and/or repository