`actions/checkout@v6` incompatible with `debian:testing` since March 24, 2026

[francesco-ballarin]

Hi,
I use actions/checkout@v6 with the docker image debian:testing, and since a couple of days ago all my actions are failing with the error

  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +[sha]:refs/remotes/origin/main
  Error: fatal: unable to access 'https://github.com/[project]/': Problem with the SSL CA cert (path? access rights?)

Simplest way to reproduce is to

1. use debian:testing as the container
2. add a step with

  export DEBIAN_FRONTEND="noninteractive"
  apt update -y -q
  apt install -y -qq git

before the step with actions/checkout@v6

On March 24, 2026 the openssl package in debian:testing was upgraded from 3.5.5 to 3.6.1,
see https://tracker.debian.org/news/1734034/openssl-361-3-migrated-to-testing/
so that may (or may not) what triggered the problem.

I am opening there because this does not feel like a debian issue, in the sense that git clone with https works correctly on my debian:testing laptop. In other words, the issue seems to be specific to the actions/checkout steps (maybe the Setting up auth step), but they are too complex for me to understand where the issue is specifically.

Thanks,
Francesco

[francesco-ballarin]

The issue is the following:

• in addition to the migration of openssl on March 24, there was also a migration of the ca-certificates package on March 25
• openssl comes preinstalled with debian:testing, but ca-certificates does not.
• the current debian:testing image was released around 15 days ago, and thus still ships the old openssl as one can see in a clean debian:testing image by running

# apt show openssl-provider-legacy
Package: openssl-provider-legacy
Version: 3.5.5-1
Status: install ok installed

• ca-certificates is a suggested package of git, rather than a dependency

This command

  export DEBIAN_FRONTEND="noninteractive"
  apt update -y -q
  apt install -y -qq git

will try to install ca-certificates, fail (because openssl is too old) and silently give up on it because ca-certificates is only a suggested package.

A workaround is to either do an apt upgrade before install git, or to explicitly install ca-certificates as well.

Therefore, strictly speaking the issue is neither in github nor in upstream debian itself. I am pinging @tianon to see if he can trigger an update of the debian:testing docker image to pick up the new openssl.

[tianon]

Given that cloning from GitHub implicitly assumes CA certificates by doing an https clone, adding ca-certificates explicitly to that install command sounds correct and more future-proof to me regardless of any other fixes here.

That being said, I'll probably do an update to the Debian image early next week. (Again though, I think "both" is the most correct answer here.)