x/crypto/x509roots: regeneration fails with "404 Not Found"

[dmitshur]

Attempting to regenerate this package currently fails with:

$ go generate golang.org/x/crypto/x509roots
2025/08/11 15:34:05 got non-200 OK status code: 404 Not Found body: "\nerror: security/nss/lib/ckfw/builtins/certdata.txt@3654da6b808b2eb5628337291235935c662bf711: not found in manifest\n"
exit status 1
gen_fallback_bundle.go:7: running "go": exit status 1

Detected because the relui workflow ran into this.

CC @golang/security.

[rolandshoemaker]

Huh, unable to repro. Possible the mozilla server was down for a short time?

[dmitshur]

Indeed; the issue's gone now. I guess we can close this now and reopen if it keeps coming up. Thanks.

[dmitshur]

Happened again this morning. As of posting this, it reproduces with:

$ date
Mon Aug 18 12:23:43 EDT 2025
$ go generate ./x509roots
2025/08/18 12:23:45 got non-200 OK status code: 404 Not Found body: "\nerror: security/nss/lib/ckfw/builtins/certdata.txt@282a0c837c80a651e8a8e98b20e2d1ad96ec3150: not found in manifest\n"
exit status 1
x509roots/gen_fallback_bundle.go:7: running "go": exit status 1

Edit: It kept reproducing on the next day too, in the morning, but started working again in the afternoon.

[rolandshoemaker]

Hm, will investigate further. Someone at Mozilla may be able to point to a better way to do this.

[dmitshur]

Reopening since this seems to continue to reproduce at least 1-2 days out of a week, fairly consistently over the last few weeks.