ghcr.io registry certificate broken

[jurajseffer]

Select Topic Area

Bug

Body

Pulling an image from ghcr.io results in a certificate error:

error pulling image configuration: download failed after attempts=6: x509: certificate is valid for *.githubassets.com, githubassets.com, not pkg-containers.githubusercontent.com

* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=GitHub, Inc.; CN=*.githubassets.com
*  start date: Oct  5 00:00:00 2022 GMT
*  expire date: Oct  5 23:59:59 2023 GMT
*  subjectAltName does not match pkg-containers.githubusercontent.com
* SSL: no alternative certificate subject name matches target host name 'pkg-containers.githubusercontent.com'

[tasansal]

I am having the same issue.

docker pull ghcr.io/org/package

causes:

failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:*": x509: certificate is valid for *.githubassets.com, githubassets.com, not pkg-containers.githubusercontent.com

[dwclogic]

Same issue here I think:
`Build container for action use: '/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0/Dockerfile'.
/usr/bin/docker build -t 6c0442:dad457f654114f0aa4e380b4495f81b5 -f "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0/Dockerfile" "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0"
Sending build context to Docker daemon 35.84kB

Step 1/4 : FROM ghcr.io/hadolint/hadolint:v2.12.0-debian
v2.12.0-debian: Pulling from hadolint/hadolint
e9995326b091: Pulling fs layer
405c84fd6fe2: Pulling fs layer
e9995326b091: Downloading
e9995326b091: Retrying in 5 seconds
405c84fd6fe2: Downloading
405c84fd6fe2: Retrying in 5 seconds
e9995326b091: Retrying in 4 seconds
405c84fd6fe2: Retrying in 4 seconds
e9995326b091: Retrying in 3 seconds
405c84fd6fe2: Retrying in 3 seconds
e9995326b091: Retrying in 2 seconds
405c84fd6fe2: Retrying in 2 seconds
e9995326b091: Retrying in 1 second
error pulling image configuration: download failed after attempts=6: x509: certificate is valid for *.githubassets.com, githubassets.com, not pkg-containers.githubusercontent.com
Warning: Docker build failed with exit code 1, back off 8.779 seconds before retry.
/usr/bin/docker build -t 6c0442:dad457f654114f0aa4e380b4495f81b5 -f "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0/Dockerfile" "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0"
Sending build context to Docker daemon 35.84kB

Step 1/4 : FROM ghcr.io/hadolint/hadolint:v2.12.0-debian
v2.12.0-debian: Pulling from hadolint/hadolint
e9995326b091: Pulling fs layer
405c84fd6fe2: Pulling fs layer
e9995326b091: Retrying in 5 seconds
405c84fd6fe2: Downloading
405c84fd6fe2: Retrying in 5 seconds
e9995326b091: Retrying in 4 seconds
405c84fd6fe2: Retrying in 4 seconds
e9995326b091: Retrying in 3 seconds
405c84fd6fe2: Retrying in 3 seconds
e9995326b091: Retrying in 2 seconds
405c84fd6fe2: Retrying in 2 seconds
e9995326b091: Retrying in 1 second
405c84fd6fe2: Retrying in 1 second
error pulling image configuration: download failed after attempts=6: x509: certificate is valid for *.githubassets.com, githubassets.com, not pkg-containers.githubusercontent.com
Warning: Docker build failed with exit code 1, back off 9.116 seconds before retry.
/usr/bin/docker build -t 6c0442:dad457f654114f0aa4e380b4495f81b5 -f "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0/Dockerfile" "/home/runner/work/_actions/hadolint/hadolint-action/v3.1.0"
Sending build context to Docker daemon 35.84kB

Step 1/4 : FROM ghcr.io/hadolint/hadolint:v2.12.0-debian
v2.12.0-debian: Pulling from hadolint/hadolint
e9995326b091: Pulling fs layer
405c84fd6fe2: Pulling fs layer
405c84fd6fe2: Downloading
405c84fd6fe2: Retrying in 5 seconds
e9995326b091: Downloading
e9995326b091: Retrying in 5 seconds
405c84fd6fe2: Retrying in 4 seconds
e9995326b091: Retrying in 4 seconds
405c84fd6fe2: Retrying in 3 seconds
e9995326b091: Retrying in 3 seconds
405c84fd6fe2: Retrying in 2 seconds
e9995326b091: Retrying in 2 seconds
405c84fd6fe2: Retrying in 1 second
e9995326b091: Retrying in 1 second
error pulling image configuration: download failed after attempts=6: x509: certificate is valid for *.githubassets.com, githubassets.com, not pkg-containers.githubusercontent.com
Error: Docker build failed with exit code 1`

[brianmaresca]

same for maven packages.
transfer failed for https://maven.pkg.github.com/*****: Certificate for <github-registry-files.githubusercontent.com> doesn't match any of the subject alternative names: [*.githubassets.com, githubassets.com]

[angelo-loria]

our NPM package registry is also throwing this error. looks like they are aware of it now, status page was just updated https://www.githubstatus.com/

[dwclogic]

Reran the GHA and it worked....