Zscaler does TLS interception, re-signing HTTPS with its own root CA that MSYS2 doesn't trust — so pacman, curl, wget, git and friends all fail with certificate verification errors. Export the Zscaler root from the Windows cert store and add it to MSYS2's CA trust to fix them all at once.
Copy-pasteable Watchtower deploys — the one-line docker run, an equivalent docker-compose.yml, and the handful of flags I actually use (interval, cleanup, label scoping, notifications).
When a VCSA stage-and-install dies with FileNotFoundError on patching_backup_config.json, the real cause is almost always an expired or unentitled Broadcom download token. Refresh the token, clean partial staging state, retry.