Ventura 13.3.1下Podman 4.5.0运行node:18-alpine(x86_64)遇OpenSSL错误求助

升级至Ventura 13.3.1后，在Apple Silicon设备上使用Podman 4.5.0运行指定--platform linux/amd64的node:18-alpine镜像时，出现OpenSSL证书验证错误，无法获取Alpine软件源；但运行ARM架构镜像时一切正常。已通过QEMU 8.0在Podman默认机器上运行x86_64镜像，且已执行rpm-ostree install -r qemu-user-static，必须使用x86_64架构镜像，需排查该故障。

执行命令及报错信息 #

执行命令：

podman run --rm -it --name=test_ssl_error --platform linux/amd64 node:18-alpine apk upgrade

报错输出：

fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/APKINDEX.tar.gz
48CB8A0240000000:error:0200008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:crypto/rsa/rsa_pk1.c:75:
48CB8A0240000000:error:02000072:rsa routines:rsa_ossl_public_decrypt:padding check failed:crypto/rsa/rsa_ossl.c:606:
48CB8A0240000000:error:1C880004:Provider routines:rsa_verify:RSA lib:providers/implementations/signature/rsa_sig.c:774:
48CB8A0240000000:error:06880006:asn1 encoding routines:ASN1_item_verify_ctx:EVP lib:crypto/asn1/a_verify.c:217:
48CB8A0240000000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1889:
ERROR: https://dl-cdn.alpinelinux.org/alpine/v3.17/main: Permission denied
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.17/main: No such file or directory
fetch https://dl-cdn.alpinelinux.org/alpine/v3.17/community/x86_64/APKINDEX.tar.gz
48CB8A0240000000:error:0200008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:crypto/rsa/rsa_pk1.c:75:
48CB8A0240000000:error:02000072:rsa routines:rsa_ossl_public_decrypt:padding check failed:crypto/rsa/rsa_ossl.c:606:
48CB8A0240000000:error:1C880004:Provider routines:rsa_verify:RSA lib:providers/implementations/signature/rsa_sig.c:774:
48CB8A0240000000:error:06880006:asn1 encoding routines:ASN1_item_verify_ctx:EVP lib:crypto/asn1/a_verify.c:217:
48CB8A0240000000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1889:
ERROR: https://dl-cdn.alpinelinux.org/alpine/v3.17/community: Permission denied
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.17/community: No such file or directory
OK: 9 MiB in 17 packages

Podman机器信息 #

执行命令：

podman machine info

输出：

Host:
  Arch: arm64
  CurrentMachine: podman-machine-default
  DefaultMachine: ""
  EventsDir: /var/folders/3c/981sn8bj57s0hzf135y350w00000gp/T/podman-run--1/podman
  MachineConfigDir: /Users/agautam/.config/containers/podman/machine/qemu
  MachineImageDir: /Users/agautam/.local/share/containers/podman/machine/qemu
  MachineState: Running
  NumberOfMachines: 1
  OS: darwin
  VMType: qemu
Version:
  APIVersion: 4.5.0
  Built: 1681478900
  BuiltTime: Fri Apr 14 15:28:20 2023
  GitCommit: 75e3c12579d391b81d871fd1cded6cf0d043550a
  GoVersion: go1.20.3
  Os: darwin
  OsArch: darwin/arm64
  Version: 4.5.0

排查步骤 #

• 验证QEMU用户静态二进制文件配置：进入Podman机器（podman machine ssh），执行qemu-x86_64 --version确认版本为8.0，检查/usr/bin/qemu-x86_64-static是否存在且有执行权限。
• 临时跳过证书验证测试：执行podman run --rm -it --platform linux/amd64 node:18-alpine apk upgrade --no-check-certificate，若能正常获取源，说明证书验证环节存在问题。
• 更新Podman机器CA证书：进入Podman机器，执行rpm-ostree update更新系统，检查/etc/ssl/certs/ca-certificates.crt是否包含Alpine源证书的根CA（如ISRG Root X1），缺失则手动添加。
• 检查Podman机器时间同步：进入Podman机器，执行timedatectl确认系统时间与当前时间一致，时间偏差会导致证书验证失败。
• 切换Podman机器网络模式：编辑机器配置文件（~/.config/containers/podman/machine/qemu/podman-machine-default.json），将NetworkMode改为bridge，重启机器后测试。
• 调整Podman版本：尝试降级至4.4.x或升级至最新稳定版，验证是否为版本兼容性问题。
• 替换Alpine软件源：在镜像内执行sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories，测试是否能正常访问，排除源服务器问题。

内容的提问来源于stack exchange，提问作者Arpit