Summary
HTTPS requests from the CLI used rustls-tls-webpki-roots, which embeds the Mozilla CA list and never reads the OS trust store. A TLS-intercepting proxy whose CA is installed in the system store (for example Zscaler on macOS) then fails certificate verification, while curl and Node with --use-system-ca succeed.
This switches reqwest to rustls-tls-native-roots, so the client trusts the same certificate store as the operating system.
This fork's main is behind upstream, so the commits in this pull request also include changes already on vercel-labs/opensrc main. The fix itself is one commit. Upstream compare:
Test
http_client_trusts_os_certificate_store serves HTTPS with a private CA that is not in the Mozilla set. The client rejects that server until the CA is provided through SSL_CERT_FILE, which is the trust input rustls-native-certs reads on every platform.
cargo clippy --manifest-path packages/opensrc/cli/Cargo.toml -- -D warnings and cargo test --manifest-path packages/opensrc/cli/Cargo.toml pass (114 tests).
Activity
6
vercel-security-reviewer[bot]1mo ago
@cursoragent is attempting to deploy a commit to the Vercel Labs Team on Vercel.
A member of the Team first needs to authorize it.