SSL certificate not trusted when compiling with Static Linux SDK

[iwa]

Hello!

When building an app with the Static Linux SDK, my HTTP calls fail because there's apparently a self-signed certificate in the chain (but afaik there's not?)
The error doesn't happen when I'm running the app on my Mac or run it dynamically on a Debian server, nor when building the same program in Rust & Go with statically built executable

Dev machine: Macbook pro M4, macOS 15.5
Swift: Swift version 6.1 (swift-6.1-RELEASE)
SDK: swift-6.1-RELEASE_static-linux-0.0.1
Target: x86_64-swift-linux-musl (built in a docker container swift:latest, installed static sdk manually)

Program is aimed to run in an Alpine container on a Debian machine, but the executable throws the same error when launched by both Debian host & Alpine container

error

Async request failed:
Error Domain=NSURLErrorDomain Code=-1 "(null)"UserInfo={NSErrorFailingURLKey=<<redacted URL>>,
NSErrorFailingURLStringKey=<<redacted URL>>,
NSLocalizedDescription=SSL certificate problem: self signed certificate in certificate chain,
NSUnderlyingError=Error Domain=NSURLErrorDomain Code=-1 "(null)"UserInfo={NSLocalizedDescription=SSL certificate problem: self signed certificate in certificate chain}}

code snippet

...
    // 2. Create the URL
    guard let url = URL(string: "https://api.telegram.org/bot\(telegramBotToken)/sendMessage")
    else {
        fatalError("Invalid URL")
    }

    // 3. Create the request
    var request = URLRequest(url: url)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Content-Type")
    request.httpBody = jsonData

    do {
        let (_, response) = try await URLSession.shared.data(for: request)
        if let httpResponse = response as? HTTPURLResponse {
            print("Status code from Telegram API:", httpResponse.statusCode)
        }
    } catch {
        print("Async request failed:", error)
    }

[Lukasa]

It may be worth investigating whether the copy of curl embedded in Foundation is finding the trust roots in your container image. Are the root certs installed? If so, which ones? Telegram does appear to serve its root cert (unnecessarily, as it won't ever be used), so if your binary isn't finding the root certs at all then you'll encounter this error.

[iwa]

thanks for your response! root certs are installed via ca-certificates iirc, they do exists in the container & in the debian host

tho after some research, it seems the issue has already been tracked here: swiftlang/swift-corelibs-foundation#5157 and a PR has been merged for v6.2 (swiftlang/swift-corelibs-foundation#5159)

closing this as it's most likely misplaced & a duplicate