| author |  maria <maria@kuuro.net> 2026-10-14 22:25:29+00:00 |
| committer |  GitHub <noreply@github.com> 2026-10-14 22:25:29+00:00 |
| log | aa81d1203ea43c3b6cc09c5442559fa0cf18db63 |
| tree | ca6e9f1733c8a17d30c1c35d49ffdfb42b589cf0 |
| parent | 348f217a853dd4a23d7fa4834dedb05f545c2075 |
| signature | Signed by PGP key B5690EEEBB952194 |
fix(desktop): import CA trust variables from the login shell (#19604)
2 files changed, 35 insertions(+), 0 deletions(-)
apps
desktop
apps/desktop/src/shell/DesktopShellEnvironment.test.ts+26
| ... | @@ -367,6 +367,32 @@ describe("DesktopShellEnvironment", () => { | ... | @@ -367,6 +367,32 @@ describe("DesktopShellEnvironment", () => { |
| 367 | }), | 367 | }), |
| 368 | ); | 368 | ); |
| 369 | 369 | ||
| 370 | it.effect("hydrates missing CA trust variables from the login shell", () => | ||
| 371 | Effect.gen(function* () { | ||
| 372 | const env: NodeJS.ProcessEnv = { | ||
| 373 | SHELL: "/bin/zsh", | ||
| 374 | PATH: "/usr/bin", | ||
| 375 | SSL_CERT_DIR: "/etc/ssl/certs", | ||
| 376 | }; | ||
| 377 | |||
| 378 | yield* runShellEnvironment({ | ||
| 379 | env, | ||
| 380 | platform: "darwin", | ||
| 381 | handler: () => | ||
| 382 | envOutput({ | ||
| 383 | PATH: "/opt/zerobrew/bin:/usr/bin", | ||
| 384 | SSL_CERT_FILE: "/opt/zerobrew/etc/ca-certificates/cacert.pem", | ||
| 385 | SSL_CERT_DIR: "/opt/zerobrew/etc/ca-certificates", | ||
| 386 | NODE_EXTRA_CA_CERTS: "/Users/me/corp-root.pem", | ||
| 387 | }), | ||
| 388 | }); | ||
| 389 | |||
| 390 | assert.equal(env.SSL_CERT_FILE, "/opt/zerobrew/etc/ca-certificates/cacert.pem"); | ||
| 391 | assert.equal(env.SSL_CERT_DIR, "/etc/ssl/certs"); | ||
| 392 | assert.equal(env.NODE_EXTRA_CA_CERTS, "/Users/me/corp-root.pem"); | ||
| 393 | }), | ||
| 394 | ); | ||
| 395 | |||
| 370 | it.effect("keeps mise's PATH record with the login shell PATH", () => | 396 | it.effect("keeps mise's PATH record with the login shell PATH", () => |
| 371 | Effect.gen(function* () { | 397 | Effect.gen(function* () { |
| 372 | const env: NodeJS.ProcessEnv = { | 398 | const env: NodeJS.ProcessEnv = { |
apps/desktop/src/shell/DesktopShellEnvironment.ts+9
| ... | @@ -86,6 +86,9 @@ const LOGIN_SHELL_ENV_NAMES = [ | ... | @@ -86,6 +86,9 @@ const LOGIN_SHELL_ENV_NAMES = [ |
| 86 | "XDG_SESSION_DESKTOP", | 86 | "XDG_SESSION_DESKTOP", |
| 87 | "XDG_SESSION_TYPE", | 87 | "XDG_SESSION_TYPE", |
| 88 | "WAYLAND_DISPLAY", | 88 | "WAYLAND_DISPLAY", |
| 89 | "SSL_CERT_FILE", | ||
| 90 | "SSL_CERT_DIR", | ||
| 91 | "NODE_EXTRA_CA_CERTS", | ||
| 89 | "T3CODE_TELEMETRY_ENABLED", | 92 | "T3CODE_TELEMETRY_ENABLED", |
| 90 | "__MISE_DIFF", | 93 | "__MISE_DIFF", |
| 91 | ] as const; | 94 | ] as const; |
| ... | @@ -454,6 +457,12 @@ const installPosixEnvironment = Effect.fn("desktop.shellEnvironment.installPosix | ... | @@ -454,6 +457,12 @@ const installPosixEnvironment = Effect.fn("desktop.shellEnvironment.installPosix |
| 454 | "XDG_DATA_HOME", | 457 | "XDG_DATA_HOME", |
| 455 | "XDG_RUNTIME_DIR", | 458 | "XDG_RUNTIME_DIR", |
| 456 | "WAYLAND_DISPLAY", | 459 | "WAYLAND_DISPLAY", |
| 460 | // CA trust set in the shell profile. Without it, a Node or OpenSSL build | ||
| 461 | // that has no bundled roots (a shared-OpenSSL node on PATH) cannot verify | ||
| 462 | // TLS, so provider updaters and agents fail to reach their registries. | ||
| 463 | "SSL_CERT_FILE", | ||
| 464 | "SSL_CERT_DIR", | ||
| 465 | "NODE_EXTRA_CA_CERTS", | ||
| 457 | // The telemetry opt-out is documented as a shell variable; GUI launches never see it. | 466 | // The telemetry opt-out is documented as a shell variable; GUI launches never see it. |
| 458 | "T3CODE_TELEMETRY_ENABLED", | 467 | "T3CODE_TELEMETRY_ENABLED", |
| 459 | ] as const) { | 468 | ] as const) { |