[Bug]: certificate verify failed: unable to get local issuer certificate

[kaihendry-dlg]

Feature id and version

ghcr.io/devcontainers-contrib/features/nx-npm:1

Devcontainer base Image

mcr.microsoft.com/devcontainers/universal:2

What happened?

Keep hitting "certificate verify failed: unable to get local issuer certificate" type errors on a 13.6 (22G120) i7 Mac running Docker desktop.

Relevant log output

[2023-10-23T13:54:24.715Z] 2.485   File "ssl", line 513, in wrap_socket
2.485   File "ssl", line 1071, in _create
2.485   File "ssl", line 1342, in do_handshake
2.485 ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)
2.485 
2.485 During handling of the above exception, another exception occurred:
2.485 
2.485 Traceback (most recent call last):
[2023-10-23T13:54:24.715Z] 2.486   File "<string>", line 1, in <module>
2.486   File "nanolayer.__main__", line 50, in main
2.486   File "typer.main", line 328, in __call__
2.487   File "typer.main", line 311, in __call__
2.487   File "click.core", line 1130, in __call__
2.487   File "typer.core", line 778, in main
2.487   File "typer.core", line 216, in _main
2.487   File "click.core", line 1657, in invoke
2.488   File "click.core", line 1657, in invoke
2.488   File "click.core", line 1404, in invoke
2.488   File "click.core", line 760, in invoke
[2023-10-23T13:54:24.715Z] 2.488   File "typer.main", line 683, in wrapper
2.488   File "nanolayer.cli.install", line 65, in install_devcontainer_feature
2.488   File "nanolayer.installers.devcontainer_feature.oci_feature_installer", line 67, in install
2.488   File "nanolayer.installers.devcontainer_feature.oci_feature", line 55, in get_devcontainer_feature_obj
2.488   File "nanolayer.installers.devcontainer_feature.oci_feature", line 48, in download_and_extract
2.488   File "nanolayer.utils.oci_registry", line 178, in download_and_extract_layer
[2023-10-23T13:54:24.715Z] 
2.489   File "nanolayer.utils.oci_registry", line 154, in download_layer
2.489   File "nanolayer.utils.oci_registry", line 188, in get_manifest
2.489   File "nanolayer.utils.oci_registry", line 134, in _attempt_request
2.489   File "urllib.request", line 216, in urlopen
2.489   File "urllib.request", line 519, in open
2.489   File "urllib.request", line 536, in _open
2.489   File "urllib.request", line 496, in _call_chain
2.489   File "urllib.request", line 1391, in https_open
2.489   File "urllib.request", line 1351, in do_open
2.489 urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>
2.591 Sentry is attempting to send 2 pending error messages

[stesme]

same here when installing:

• ghcr.io/devcontainers-contrib/features/azure-apiops

also with:

• ghcr.io/devcontainers-contrib/features/cert-manager

Am I missing a certificate in my CA-bundle? Or am I missing an environmental variable which points to my CA-bundle?

I am on Debian-11, and I have NO issues with downloading over https with tools like curl, wget, node, python...

[Logerfo]

I'm facing this for ant-sdkman. I'm behind a corporate network, so wasn't able to use dev containers up until the release of https://github.com/microsoft/vscode-remote-release/issues/6092#issuecomment-1927103052. Maybe it's related?