Setup Python is failing with unable to get local issuer certificate error

[chandrakanthbala]

Description:
We are using self-hosted runners with GitHub Enterprise Cloud, and our enterprise is behind a proxy that requires a certificate for applications to communicate with the internet. When we try to install the setup-python, it fails with the error "unable to get local issuer certificate." How can we provide our proxy certificate to the setup-python job? Is there a way to configure pip to use system certificates?

Action version:
5.3.0

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
All

Repro steps:

1. Use setup-python action in workflow
2. Run workflow

Expected behavior:
The specified Python version should be available for the workflow in the following steps.

Actual behavior:
Setup-python failing with below error.

Version 3.10.16 was not found in the local cache
Version 3.10.16 is available for downloading
Download from "https:/github.com/actions/python-versions/releases/download/3.10.16-12302993382/python-3.10.16-1inux-22.04-x64.tar-gZ"
Extract downloaded archive
/us/bin/tar xz --warning=no-unknown-keyword --overwrite -C /_w/_temp/35258474-fb58-47ec-98d0-e5e7a4a3c88c -f/_w/_temp/ecbac867-76f1-457c-a98d-e3417c786295
Execute installation script
Check if Python hostedtoolcache folder exist...
Creating Python hostedtoolcache folder...
Create Python 3.10.16 folder
Copy Python binaries to hostedtoolcache folder
Create additional symlinks (Required for the UsePythonVersion Azure Pipelines task and the setup-python GitHub Action)
Upgrading pip...
Looking in links: /tmp/tmpt_3vpy3m
Requirement already satisfied: setuptools in /_w/_tool/Python/3.10.16/x64/lib/python3.10/site-packages (65.5.0)
Requirement already satisfied: pip in /_w/_tool/Python/3.10.16/x64/Lib/python3.10/site-packages (23.0.1)
Error: WARNING: Running pip asiche root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warning/venv
Error: WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect-None, status-None)) after connection broken by 'SSLErIOI(SSICertVerificationError (1, ' [SSI: CERTIFICATE_VERIFY_FAILEDI certificate verify failed: unable to get local issuer certificate (_ss1.c:1007) '))': / simple/pip/
Error: WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect-None, status-None)) after connection broken by 'SSLErIOI(SSICertVerificationError (1, ' [SSI: CERTIFICATE_VERIFY_FAILEDI certificate verify failed: unable to get local issuer certificate (_ss1.c:1007) '))': / simple/pip/
Error: WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect-None, status-None)) after connection broken by 'SSLErIOI(SSICertVerificationError (1, ' [SSI: CERTIFICATE_VERIFY_FAILEDI certificate verify failed: unable to get local issuer certificate (_ss1.c:1007) '))': / simple/pip/
Error: WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect-None, status-None)) after connection broken by 'SSLErIOI(SSICertVerificationError (1, ' [SSI: CERTIFICATE_VERIFY_FAILEDI certificate verify failed: unable to get local issuer certificate (_ss1.c:1007) '))': / simple/pip/
Error: WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect-None, status-None)) after connection broken by 'SSLErIOI(SSICertVerificationError (1, ' [SSI: CERTIFICATE_VERIFY_FAILEDI certificate verify failed: unable to get local issuer certificate (_ss1.c:1007) '))': / simple/pip/
Could not fetch URI https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool (host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLErTOr (SSLCertVerificationError (1, '[SSI: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl. c:1007) '))) - skipping
Error: ERROR: Could not find a version that satisfies the requirement pip (from versions: none)
Error: ERROR: No matching distribution found for pip
Error: The process '/usr/bin/bash' failed with exit code 1

[gowridurgad]

Hello @chandrakanthbala,
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.