Files
magpie/internal/plugin/systemca_windows.go
T
yetone 564033d044 plugin: Bun is given the roots the system trusts — installing @magpie-community/opencode-kiro-auth failed with "error: UNABLE_TO_VERIFY_LEAF_SIGNATURE downloading package manifest" (chenyyi001 on X): Bun checks TLS against the roots it ships, not the system's, so behind a box that re-signs HTTPS with a root the user installed (a company proxy, a VPN, Surge's or Proxyman's MITM) magpie gets through and bun add, and a plugin's own requests, don't. bunCommand, which starts every bun (installs and the host), now sets NODE_EXTRA_CA_CERTS to the system's roots unless the user set it: on macOS the certificates in the System and login keychains the user or an admin marked as trusted (security trust-settings-export; one denied, or only kept in a keychain, stays out; Apple's own aren't added), written once a run beside Bun's cache; on Linux the distribution's CA bundle (SSL_CERT_FILE first); on Windows the ROOT store. NODE_USE_SYSTEM_CA does nothing for bun 1.4.2's installs. Reproduced with a local registry behind a re-signing proxy: bun add through bunCommand fails with the reporter's error on the old code and installs opencode-kiro-auth@0.1.7 with the proxy's root trusted; TestBunIsGivenTheSystemsRoots fails on the old code and passes, TestTrustedIn and TestSystemRootsAreTheTrustedOnes cover the trust settings. Not tried: a real keychain-trusted root (changing trust settings is left to the user), and the Windows store on a Windows machine (the test box was unreachable; it builds). go vet, builds (darwin, GOOS=linux, GOOS=windows) and go test -tags nogui of internal/plugin and internal/proc under a temp HOME pass.
2026-10-04 17:18:25 +08:00

36 lines
787 B
Go

package plugin
import (
"unsafe"
"golang.org/x/sys/windows"
)
func systemCABundle() string { return "" }
// systemRoots are the certificates in Windows' ROOT store, where a proxy's
// or a company's root is installed (the user's view, which holds the
// machine's too).
func systemRoots() [][]byte {
name, err := windows.UTF16PtrFromString("ROOT")
if err != nil {
return nil
}
store, err := windows.CertOpenSystemStore(0, name)
if err != nil {
return nil
}
defer windows.CertCloseStore(store, 0)
var certs [][]byte
var c *windows.CertContext
for {
c, err = windows.CertEnumCertificatesInStore(store, c)
if err != nil || c == nil {
break
}
der := unsafe.Slice(c.EncodedCert, c.Length)
certs = append(certs, append([]byte(nil), der...))
}
return certs
}