(related: #48700)

The problematic 1.12 build is disabled. Failures can be retried by commenting 'kokoro rerun' on the broken CL.

I see similar problems in Ubuntu container.

go: gopkg.in/check.v1@v1.0.0-20190902080502-41f04d3bba15: git fetch -f https://gopkg.in/check.v1 refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in /go/pkg/mod/cache/vcs/7e5fa1eab4705eb80c9746632736cea906708d060702d529df6241d1c8c2c9f9: exit status 128:
	fatal: unable to access 'https://gopkg.in/check.v1/': server certificate verification failed. CAfile: none CRLfile: none
go: gopkg.in/check.v1@v1.0.0-20180628173108-788fd7840127: unknown revision 788fd7840127
go: finding golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5
go: gopkg.in/tomb.v1@v1.0.0-20141024135613-dd632973f1e7: git fetch -f https://gopkg.in/tomb.v1 refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in /go/pkg/mod/cache/vcs/95acae1f863cd3698780e83ddc42f6ad6cd0ab1cb79143808a7de7300ae4df93: exit status 128:
	fatal: unable to access 'https://gopkg.in/tomb.v1/': server certificate verification failed. CAfile: none CRLfile: none

I found a Reddit thread about this problem: https://www.reddit.com/r/golang/comments/pz65s1/is_gopkgin_down_again/

I tried to run update-ca-certificates --fresh in Ubuntu container but it doesn't work.

This is fixed for x/tools by setting an explicit GOPROXY value.

Hi Findleyr

Thanks for looking into this.
Can you please elaborate on how we can get past this ?
I am also getting the same error as @BewareMyPower, followed by error loading modules.

Thanks

The reddit thread helped me. Thanks @BewareMyPower
https://www.reddit.com/r/golang/comments/pz65s1/is_gopkgin_down_again/hfkso9g/

Added the following command to my service inside docker compose.
command: > sh -c "apt update && apt install ca-certificates libgnutls30 -y && go test ./..."

Thanks

Ack, thanks.

In my case I set GOPROXY=https://proxy.golang.org (I had wanted to use the proxy for 1.12 CI anyway).

Yeah I did that too. The modules were loading fine with that. But I have a rabbitmq dependency in my service. I was facing issues with connecting to that container. So went with the above solution but GOPROXY=https://proxy.golang.org inside service's enviroment, will also work. @findleyr Thanks for that solution.

For the record, the issue here is that these clients have an outdated root certificate bundle with an expired certificate. The certificate we use in gopkg.in is up-to-date according to the current Let's Encrypt root certs.

There are more details about the issue here:

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/