cli.codecov.io TLS handshake failures prevent CLI downloads and fail coverage jobs #1976

Summary

Coverage jobs are failing while downloading the Codecov CLI from
cli.codecov.io. The confirmed failure occurs before the CLI runs or any
coverage report is uploaded.

Observed on October 5, 2026 UTC (October 4 US Eastern time). A failed CI
download occurred at 00:53 UTC, and standalone reproductions still failed
at approximately 01:42 UTC. Re-running a CI job did not resolve it.

Confirmed CI failure

Repository / PR:
libmir/mir-stat#144

Workflow run:
https://github.com/libmir/mir-stat/actions/runs/37249018308

Affected job: Windows, LDC beta
Upload name: general-windows-latest-ldc-beta

Versions reported by the log:

• codecov/codecov-action@v7, resolved version 7.1.1
• Wrapper 0.3.1
• Codecov CLI pinned to v11.3.1

The action attempts to download:

https://cli.codecov.io/v11.3.1/windows/codecov.exe

It fails with:

curl: (35) schannel: next InitializeSecurityContext failed:
SEC_E_ILLEGAL_MESSAGE (0x80090326)

The wrapper then prints “Finishing downloading”, shows an empty CLI
version, and proceeds to signature verification, which fails with:

gpg: can't open './codecov.exe.SHA256SUM.sig': No such file or directory
gpg: verify signatures failed: No such file or directory
==> Could not verify signature. Please contact Codecov if problem continues

The step exits with code 1.

Independent reproduction

No repository, coverage files, or upload token is needed.

Windows, curl 8.21.0 with Schannel:

curl.exe -I --max-time 20 https://cli.codecov.io/v11.3.1/windows/codecov.exe
curl.exe -I --max-time 20 https://cli.codecov.io/latest/windows/codecov.exe
curl.exe -I --max-time 20 https://cli.codecov.io/v11.3.1/linux/codecov
curl.exe -I --max-time 20 https://cli.codecov.io/v11.3.1/windows/codecov.exe.SHA256SUM.sig

All four requests fail with curl error 35 / SEC_E_ILLEGAL_MESSAGE.

Ubuntu under WSL, curl 8.5.0 with OpenSSL 3.0.13:

curl -I --max-time 20 https://cli.codecov.io/v11.3.1/linux/codecov

Result:

curl: (35) OpenSSL/3.0.13:
error:0A000410:SSL routines::sslv3 alert handshake failure

Explicitly selecting TLS 1.2 produces the same handshake failure:

curl -I --tlsv1.2 --tls-max 1.2 --max-time 20 \
  https://cli.codecov.io/v11.3.1/linux/codecov

As a connectivity control, a Windows curl request to the following URL
returns HTTP 200:

https://github.com/codecov/codecov-cli/releases/tag/v11.3.1

Certificate verification was not disabled.

Additional affected CI run

libmir/mir-algorithm#484
https://github.com/libmir/mir-algorithm/actions/runs/37251970478

All build/test steps passed. Eight jobs across Windows, Ubuntu, and macOS
failed specifically at “Upload coverage data”. This repository uses
codecov/codecov-action@v5.

We have confirmed the failed steps through GitHub's API, but have not
yet obtained their full logs to establish whether each has the identical
TLS error.

Expected behavior and request

The CLI binary and signature files should download successfully over HTTPS.

Could you investigate the TLS configuration or availability of
cli.codecov.io? The standalone reproductions suggest an endpoint or
network-path issue, but we cannot determine the server-side cause.

Separately, the wrapper continuing after the binary download fails
produces a secondary signature error that obscures the initial failure.

At approximately 01:42 UTC, status.codecov.com reported
“All Systems Operational” with no active incidents.