Install fails due to dependency certificate issue

[eero-t]

How to reproduce it (as minimally and precisely as possible):

Try installing:

$ go install sigs.k8s.io/kind@v0.29.0

What happened:

Dependency certificate is not accepted:

$ go install sigs.k8s.io/kind@v0.29.0
go: downloading sigs.k8s.io/kind v0.29.0
go: downloading al.essio.dev/pkg/shellescape v1.5.1
go/pkg/mod/sigs.k8s.io/kind@v0.29.0/pkg/exec/helpers.go:26:2: unrecognized import path "al.essio.dev/pkg/shellescape": https fetch: Get "https://al.essio.dev/pkg/shellescape?go-get=1": tls: failed to verify certificate: x509: certificate signed by unknown authority
$ go version
go version go1.24.4 linux/amd64

What you expected to happen:

Install to succeed.

Environment:

Fedora 42.

Anything else we need to know?:

• Filed bug also to dependency project: Vanity site "certificate signed by unknown authority" alessio/shellescape#59
• Last version that can be installed is v0.26:

$ go install sigs.k8s.io/kind@v0.26.0
go: downloading sigs.k8s.io/kind v0.26.0
go: downloading github.com/alessio/shellescape v1.4.2
go: downloading github.com/google/safetext v0.0.0-20220905092116-b49f7bc46da2

[eero-t]

Appears to have been changed to a less well maintained site from GitHub in #3841.

[stmcginnis]

Thanks for the report, but I believe we will need to wait for the dependency project to fix. We can track it here to make sure it's visible to kind users.

[BenTheElder]

Appears to have been changed to a less well maintained site from GitHub in #3841.

Yeah, due to #3840.

I see you filed alessio/shellescape#59, thanks.

We should consider re-introducing vendor/.

Downsides:

• bloats git repo
• requires running an extra script or command when updating dependencies

Upsides:

• insulated from changes like this
• insulated from dependencies being deleted
• much easier to review dependency changes for safety (you can literally inspect the diff)

cc @aojea

[BenTheElder]

As a fallback you can install from a binary in the meantime.

[BenTheElder]

I think al.essio.dev/pkg/shellescape was fixed?

[eero-t]

Weird. On another Fedora 42 machine the install worked (at least last evening), but on the original one it still fails to same error:
failed to verify certificate: x509: certificate signed by unknown authority

No idea whether it's related, but the machine where things (still) fail, is upgraded across many Fedora versions and uses network through corporate proxy, and one where install succeeded, is from-scratch install accessing (in this case) network directly. They have some differences also in package versions and what's installed on them, but I don't think that should be something affecting what certs are accepted...

Does the install work for the others currently?

[stmcginnis]

Seems to work for me.

You mention a corporate proxy. That makes me a little suspicious. Might be good to check in with whoever runs that to see if there's something it could be doing that would trigger this issue.