Miniforge installer tries to download packages from conda.anaconda.org instead of using embedded payload (regression since 26.3.2-0)

### Solution to issue cannot be found in the documentation. - [x] I checked the documentation. ### Issue First of all, thanks to the Miniforge team and all contributors for maintaining this project — it's an essential tool for many of us, and we really appreciate the work you put into it. ## Summary Since version **26.3.2-0**, the Miniforge installer fails on systems behind a corporate proxy. The installer tries to download packages from `https://conda.anaconda.org/conda-forge/` during the "Installing base environment" phase, instead of using the packages already embedded in the installer payload. This results in HTTP 403 errors when direct access to `conda.anaconda.org` is blocked by the proxy. **Last working version:** Miniforge3-26.1.1-3 **First broken version:** Miniforge3-26.3.2-0 **Affected platforms:** macOS (arm64) and Linux (confirmed by colleagues) ## Observed behavior ### 26.1.1-3 (working) After extracting the embedded packages, the transaction **links** them directly from the local payload: ``` Transaction starting Linking bzip2-1.0.8-hd037594_9 Linking c-ares-1.34.6-hc919400_0 Linking ca-certificates-2026.2.25-hbd8a1cb_0 ... Transaction finished ``` ### 26.3.2-0 (broken) After extracting the same embedded packages, the transaction tries to **download** them from the internet: ``` Transaction starting [+] 0.2s Downloading (5) ━━━━━━━━━... error libmamba Failed to download package from https://conda.anaconda.org/conda-forge/osx-arm64/libcxx-22.1.4-h55c6f16_0.conda (status 403) error libmamba Failed to download package from https://conda.anaconda.org/conda-forge/noarch/ca-certificates-2026.4.22-hbd8a1cb_0.conda (status 403) critical libmamba Transfer finalized, status: 403 [https://conda.anaconda.org/conda-forge/noarch/ca-certificates-2026.4.22-hbd8a1cb_0.conda] 1511 bytes ``` Both installers show `Total download: 0 B` in the transaction summary, suggesting the packages _should_ be resolved locally, yet 26.3.2-0 still attempts network downloads. ## Root cause hypothesis The diff between the two releases is minimal ([comparison](https://github.com/conda-forge/miniforge/compare/26.1.1-3...26.3.2-0)), but the bundled dependency versions changed significantly: | Component | 26.1.1-3 | 26.3.2-0 | |---|---|---| | conda | 26.1.1 | 26.3.2 | | **libmamba / mamba** | **2.5.0** | **2.6.0** | | conda-libmamba-solver | 25.11.0 | 26.4.0 | | constructor | 3.15.0 | 3.15.3 | The most likely culprit is the **mamba 2.5.0 -> 2.6.0** upgrade. The [mamba 2.6.0 changelog](https://github.com/mamba-org/mamba/blob/main/CHANGELOG.md) mentions: - _"Resolve ca-certificates installed in the local environment"_ — a change in how SSL certificates are located - The libcurl backend was deprecated/removed in earlier versions (2.4.0) It seems like the new mamba/libmamba version no longer correctly resolves packages from the installer's local payload cache and falls back to downloading from the `mirrored_channels` URL (`https://conda.anaconda.org/conda-forge`) embedded in the installer's `.condarc`. ## Corporate proxy context The 403 is expected from our side: direct access to `conda.anaconda.org` is blocked by our corporate proxy. This setup worked perfectly with 26.1.1-3 because the installer never needed network access — all packages were already in the payload. The issue is not about proxy misconfiguration; it's that the installer **should not need network access at all** during the initial install, since all packages are bundled in the `.sh` file. ## Environment - **OS:** macOS 26.4 (arm64) — also reproduced on Linux by colleagues - **Shell:** zsh - **curl:** 8.7.1 (SecureTransport) LibreSSL/3.3.6 - **OpenSSL:** 3.6.2 ## Steps to reproduce 1. Be on a network where direct access to `conda.anaconda.org` is blocked (corporate proxy, firewall, etc.) 2. Download `Miniforge3-26.3.2-0-MacOSX-arm64.sh` 3. Run `bash Miniforge3-26.3.2-0-MacOSX-arm64.sh` 4. Accept license, confirm install path 5. Observe that the "Installing base environment" step fails with HTTP 403 errors trying to download from `conda.anaconda.org` **Workaround:** Use `Miniforge3-26.1.1-3` which correctly installs from the embedded payload without any network access. ## Expected behavior The installer should install the base environment using only the packages embedded in the `.sh` payload, without requiring network access — exactly as 26.1.1-3 does. ### Installed packages ```shell # packages in environment at /Users/tsal5rak/miniforge3: # # Name Version Build Channel archspec 0.2.5 pyhd8ed1ab_0 defaults backports.zstd 1.3.0 py313h48bb75e_0 defaults boltons 25.0.0 pyhd8ed1ab_0 defaults brotli-python 1.2.0 py313hde1f3bb_1 defaults bzip2 1.0.8 hd037594_9 defaults c-ares 1.34.6 hc919400_0 defaults ca-certificates 2026.2.25 hbd8a1cb_0 defaults certifi 2026.2.25 pyhd8ed1ab_0 defaults cffi 2.0.0 py313h224173a_1 defaults charset-normalizer 3.4.6 pyhd8ed1ab_0 defaults conda 26.1.1 py313h8f79df9_0 defaults conda-libmamba-solver 25.11.0 pyhd8ed1ab_1 defaults conda-package-handling 2.4.0 pyh7900ff3_2 defaults conda-package-streaming 0.12.0 pyhd8ed1ab_0 defaults cpp-expected 1.3.1 h4f10f1e_0 defaults distro 1.9.0 pyhd8ed1ab_1 defaults fmt 12.1.0 h403dcb5_0 defaults frozendict 2.4.7 py313h6535dbc_0 defaults h2 4.3.0 pyhcf101f3_0 defaults hpack 4.1.0 pyhd8ed1ab_0 defaults hyperframe 6.1.0 pyhd8ed1ab_0 defaults icu 78.3 hef89b57_0 defaults idna 3.11 pyhd8ed1ab_0 defaults jsonpatch 1.33 pyhd8ed1ab_1 defaults jsonpointer 3.0.0 pyhcf101f3_3 defaults krb5 1.22.2 h385eeb1_0 defaults libarchive 3.8.6 gpl_h6fbacd7_100 defaults libcurl 8.19.0 hd5a2499_0 defaults libcxx 22.1.1 h55c6f16_0 defaults libedit 3.1.20250104 pl5321hafb1f1b_0 defaults libev 4.33 h93a5062_2 defaults libexpat 2.7.4 hf6b4638_0 defaults libffi 3.5.2 hcf2aa1b_0 defaults libiconv 1.18 h23cfdf5_2 defaults liblzma 5.8.2 h8088a28_0 defaults libmamba 2.5.0 h7950639_0 defaults libmamba-spdlog 2.5.0 h85b9800_0 defaults libmambapy 2.5.0 py313hac152a8_0 defaults libmpdec 4.0.0 h84a0fba_1 defaults libnghttp2 1.68.1 h8f3e76b_0 defaults libsolv 0.7.36 h7d962ec_0 defaults libsqlite 3.52.0 h1ae2325_0 defaults libssh2 1.11.1 h1590b86_0 defaults libxml2 2.15.2 h8d039ee_0 defaults libxml2-16 2.15.2 h5ef1a60_0 defaults libzlib 1.3.2 h8088a28_2 defaults lz4-c 1.10.0 h286801f_1 defaults lzo 2.10 h925e9cb_1002 defaults mamba 2.5.0 h74094d2_0 defaults menuinst 2.4.2 py313h8f79df9_0 defaults msgpack-python 1.1.2 py313ha61f8ec_1 defaults ncurses 6.5 h5e97a16_3 defaults nlohmann_json-abi 3.12.0 h0f90c79_1 defaults openssl 3.6.1 hd24854e_1 defaults packaging 26.0 pyhcf101f3_0 defaults pip 26.0.1 pyh145f28c_0 defaults platformdirs 4.9.4 pyhcf101f3_0 defaults pluggy 1.6.0 pyhf9edf01_1 defaults pybind11-abi 11 hc364b38_1 defaults pycosat 0.6.6 py313hcdf3177_3 defaults pycparser 2.22 pyh29332c3_1 defaults pysocks 1.7.1 pyha55dd90_7 defaults python 3.13.12 h20e6be0_100_cp313 defaults python_abi 3.13 8_cp313 defaults readline 8.3 h46df422_0 defaults reproc 14.2.5.post0 h5505292_0 defaults reproc-cpp 14.2.5.post0 h286801f_0 defaults requests 2.32.5 pyhcf101f3_1 defaults ruamel.yaml 0.18.17 py313h6688731_2 defaults ruamel.yaml.clib 0.2.15 py313h6688731_1 defaults setuptools 82.0.1 pyh332efcf_0 defaults simdjson 4.2.4 ha7d2532_0 defaults spdlog 1.17.0 ha0f8610_1 defaults tk 8.6.13 h010d191_3 defaults tqdm 4.67.3 pyh8f84b5b_0 defaults truststore 0.10.4 pyhcf101f3_0 defaults tzdata 2025c hc9c84f9_1 defaults urllib3 2.6.3 pyhd8ed1ab_0 defaults yaml-cpp 0.8.0 ha1acc90_0 defaults zstandard 0.25.0 py313h9734d34_1 defaults zstd 1.5.7 hbf9d68e_6 defaults ``` ### Environment info ```shell active environment : base active env location : /Users/username/miniforge3 shell level : 1 user config file : /Users/username/.condarc populated config files : /Users/username/miniforge3/.condarc /Users/username/.condarc conda version : 26.1.1 conda-build version : not installed python version : 3.13.12.final.0 solver : libmamba (default) virtual packages : __archspec=1=m1 __conda=26.1.1=0 __osx=26.4=0 __unix=0=0 base environment : /Users/username/miniforge3 (writable) conda av data dir : /Users/username/miniforge3/etc/conda conda av metadata url : None channel URLs : https://corporate-artifactory.example.com/artifactory/anaconda-org/conda-forge/osx-arm64 https://corporate-artifactory.example.com/artifactory/anaconda-org/conda-forge/noarch package cache : /Users/username/miniforge3/pkgs /Users/username/.conda/pkgs envs directories : /Users/username/miniforge3/envs /Users/username/.conda/envs platform : osx-arm64 user-agent : conda/26.1.1 requests/2.32.5 CPython/3.13.12 Darwin/25.4.0 OSX/26.4 solver/libmamba conda-libmamba-solver/25.11.0 libmambapy/2.5.0 netrc file : /Users/username/.netrc offline mode : False ```