nix-build uses fails on SSL peer certificate error where other nix commands do not, likely not respecting NIX_SSL_CERT_FILE

Describe the bug

Company has added ZScaler vpn, and so my nix-darwin home-manager set up began to fail with SSL peer certificate or SSH remote key was not OK when calling cache.nixos.org. There is a Zscaler Root CA in my keychain.

After a lot of tinkering with NIX_SSL_CERT_FILE and no luck, I decided a reinstall was the way as in the manual 3.6 example has it set before the installer runs.

After much more tinkering I have a working install: exporting a .p12 of all the CAs in the keychain, converting that to a .crt, let's call it zscaler-ca.crt and export NIX_SSL_CERT_FILE=zscaler-ca.crt; sh <(curl -L https://nixos.org/nix/install)

launchctl setenv NIX_SSL_CERT_FILE ...; launchctl kickstart -k system/org.nixos.nix-daemon did not help me, so I've also edited /Library/LaunchDaemons/org.nixos.nix-daemon.plist to set NIX_SSL_CERT_FILE on boot to zscaler-ca.crt (Interestingly the nix installer respects the NIX_SSL_CERT_FILE setting but it will still be the default value in the generated launch daemon configuration)

After the install the following all work:

• nix-env -iA ripgrep and any other packages works fine
• nix-channel --update nixpkgs
• nix-env -iA git and then git clone from github over https
• CURL_CA_BUNDLE=zscaler-ca.crt curl -vL https://github.com/LnL7/nix-darwin/archive/master.tar.gz -o out

But nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer, as per the nix-darwin installation docs, does not work, with the following error

% nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer              
warning: error: unable to download 'https://github.com/LnL7/nix-darwin/archive/master.tar.gz': SSL peer certificate or SSH remote key was not OK (60); retrying in 324 ms
warning: error: unable to download 'https://github.com/LnL7/nix-darwin/archive/master.tar.gz': SSL peer certificate or SSH remote key was not OK (60); retrying in 547 ms
warning: error: unable to download 'https://github.com/LnL7/nix-darwin/archive/master.tar.gz': SSL peer certificate or SSH remote key was not OK (60); retrying in 1060 ms
warning: error: unable to download 'https://github.com/LnL7/nix-darwin/archive/master.tar.gz': SSL peer certificate or SSH remote key was not OK (60); retrying in 2350 ms
error: unable to download 'https://github.com/LnL7/nix-darwin/archive/master.tar.gz': SSL peer certificate or SSH remote key was not OK (60)

This is the same error that kicked all this off. The same applies for nix-build https://github.com/NixOS/nixpkgs/archive/master.tar.gz -A hello

This is with CURL_CA_BUNDLE SSL_CERT_FILE and NIX_SSL_CERT_FILE environment variables all set to zscaler-ca.crt, and the nix-daemon plist setting NIX_SSL_CERT_FILE

Expected behavior

nix-build https://github.com/NixOS/nixpkgs/archive/master.tar.gz -A hello should pass, respecting NIX_SSL_CERT_FILE

nix-env --version output

nix-env (Nix) 2.13.2

Additional context

• macOS Montery 12.6
• M1 chip

Priorities

Add :+1: to issues you find important.