CI flake: Windows TLS trust failure when fetching release from GitHub

[clockwork-labs-bot]

Detected by CI Gremlin after a failed GitHub Actions attempt succeeded on rerun.

Tests:

• Test spacetimedb-update flow (x86_64-pc-windows-msvc)

Error:
Error: failed to download and install latest SpacetimeDB version
2026-08-12T05:54:16.0970183Z

Failed job runs:

• https://github.com/clockworklabs/SpacetimeDB/actions/runs/31567685027/job/94022884813 (Test spacetimedb-update flow (x86_64-pc-windows-msvc), attempt 1 -> 2)

Timeout detection:

• none

Context:

• none

[clockwork-labs-bot]

Exact-attempt diagnosis:

The linked job is Test spacetimedb-update flow (x86_64-pc-windows-msvc), run 31567685027, job 94022884813, attempt 1. The ticket says attempt 1 -> 2, and the job API reports run_attempt: 1.

Checkout, Rust install, default toolchain setup, and target install succeeded. The failure was in the Test spacetimedb-update step while running the Windows update-flow test for PR #5705 (joshua/ci/shard-smoketests, head ba226a98cc5052278b019059261492133ff42d92). The failing command was:

target\x86_64-pc-windows-msvc\debug\spacetimedb-update.exe self-install --root-dir=C:\Users\RUNNER~1\AppData\Local\Temp\.tmpQSx4aD --yes

Failure signature:

• Downloading latest version...
• HTTP requests will use the GITHUB_TOKEN from your environment
• Error: failed to download and install latest SpacetimeDB version
• primary download failed for https://github.com/clockworklabs/SpacetimeDB/releases/download/v2.8.0/spacetime-x86_64-pc-windows-msvc.zip
• Windows TLS error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. (os error -2146762487)
• mirror fallback also failed: HTTP status client error (400 Bad Request) for https://spacetimedb-client-binaries.s3.amazonaws.com/refs/tags/v2.8.0/spacetime-x86_64-pc-windows-msvc.zip

Root cause for this exact attempt: the update-flow test built and launched spacetimedb-update, but self-install could not fetch the latest Windows release artifact. The primary GitHub release download failed because the Windows runner did not trust the TLS certificate chain, and the S3 mirror fallback returned 400. This looks like download infrastructure / runner trust-store flakiness plus an unusable mirror fallback, not a compile failure or a product test assertion.

Suggested updated title:
CI flake: Windows spacetimedb-update self-install TLS trust failure, mirror 400

Duplicate search:
Exact searches for A certificate chain processed, root certificate which is not trusted, spacetimedb-update failed to download, and the S3 mirror 400 Bad Request signature found no older close duplicate in clockworklabs/SpacetimeDB, and org-wide searches for the certificate/mirror strings did not find another matching Test Flakes ticket. Broad Windows spacetimedb-update search only found #2478, but that is a user install blocked by Windows group policy, not this CI TLS trust / mirror fallback failure.

Top duplicate candidate: none. Similar Windows installer/update issues exist, but none are close enough to mark as duplicates.

Leaving this ticket open.