macOS integration tests hang in CI

Open
  • Is something wrong?
#179 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

  • #190 by @djc — closed without merging

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
github-actions, rust
Domain
ci-cd, operating-systems, testing-qa

Research direction

Start with the failing macOS CI log and the integration-tests/one-existing-ca.pem flow, especially the security authorizationdb and security remove-trusted-cert commands. Compare the successful and failing runner versions, then determine why the cleanup hangs and verify that the macOS integration tests complete successfully without hanging.

Written by the indexing model from the issue text.

Description

Successful run from Apr 23:

Current runner version: '2.323.0'
Operating System
  macOS
  14.7.4
  23H420
Runner Image
  Image: macos-14-arm64
  Version: 20250331.1204
  Included Software: https://github.com/actions/runner-images/blob/macos-14-arm64/20250331.1204/images/macos/macos-14-arm64-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/macos-14-arm64%2F20250331.1204

Failing run from Apr 28:

Current runner version: '2.323.0'
Operating System
  macOS
  14.7.5
  23H527
Runner Image
  Image: macos-14-arm64
  Version: 20250421.1374
  Included Software: https://github.com/actions/runner-images/blob/macos-14-arm64/20250421.1374/images/macos/macos-14-arm64-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/macos-14-arm64%2F20250421.1374

Failing log:

+ ANY_CA_PEM=integration-tests/one-existing-ca.pem
+ ANY_CA_SUBJECT='OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
+ security authorizationdb write com.apple.trust-settings.admin allow
YES (0)
+ reset
+ security remove-trusted-cert -d integration-tests/one-existing-ca.pem
SecTrustSettingsRemoveTrustSettings: The specified item could not be found in the keychain.
+ true
+ list
+ cargo test util_list_certs -- --nocapture
+ grep 'OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
cert[95] = OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign
+ test_distrust_existing_root
+ assert_exists 'OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
+ list
+ cargo test util_list_certs -- --nocapture
+ grep 'OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
+ security add-trusted-cert -d -r deny integration-tests/one-existing-ca.pem
+ assert_missing 'OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
+ set +e
+ list
+ cargo test util_list_certs -- --nocapture
+ grep 'OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign'
+ ret=1
+ set -e
+ test 1 -eq 1
+ reset
+ security remove-trusted-cert -d integration-tests/one-existing-ca.pem
[ .. hangs .. ]

https://github.com/actions/runner-images/issues/11893 suggests that security authorizationdb write com.apple.trust-settings.admin allow might stop working on macOS 15 runners. This was recommended to us in https://github.com/actions/runner-images/issues/4734.

Dominant language
Rust
Stars
245
Forks
72
Avg merge
7h 10m
Merged PRs (30d)
3

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rustls/rustls-native-certs

All issues in rustls/rustls-native-certs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.