crypto/x509: go1.18 stops returning typed errors when using system roots on darwin

[liggitt]

What version of Go are you using (go version)?

$ go version
go version go1.18 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What did you do?

package main

import (
	"crypto/x509"
	"errors"
	"fmt"
	"net/http"
	"net/http/httptest"
)

func main() {
	// new test server
	s := httptest.NewTLSServer(nil)
	defer s.Close()

	// request with system roots
	req, _ := http.NewRequest("GET", s.URL, nil)

	// handle errors
	_, err := http.DefaultClient.Do(req)
	switch {
	case errors.As(err, &x509.UnknownAuthorityError{}):
		// ... log or fallback to alternate code path
		fmt.Println("UnknownAuthorityError", err)
	default:
		fmt.Println("unexpected error type", err)
	}
}

What did you expect to see?

UnknownAuthorityError returned, as in go1.17

go version && go run tls.go 
go version go1.17.8 darwin/amd64
UnknownAuthorityError: &url.Error{Op:"Get", URL:"https://127.0.0.1:55471", Err:x509.UnknownAuthorityError{Cert:(*x509.Certificate)(0xc0001de000), hintErr:error(nil), hintCert:(*x509.Certificate)(nil)}}

What did you see instead?

Untyped error returned on darwin

go version && go run tls.go 
go version go1.18 darwin/amd64
unexpected error type: &url.Error{Op:"Get", URL:"https://127.0.0.1:55479", Err:(*errors.errorString)(0xc000013070)}

(this was hoisted out of #51991 (comment))

[seankhliao]

cc @golang/security

[gopherbot]

Change https://go.dev/cl/418835 mentions this issue: crypto/x509: fix mac cert error handling

[cfergeau]

This was fixed through #56891 , the fix is available in go 1.20, 1.19.5 and 1.18.10