Trust the OS store and SSL_CERT_FILE for HTTPS

Every HTTPS call (patch API, public proxy, blob and registry fetches,
telemetry, self-update) trusted only the bundled Mozilla roots. Behind
a TLS-inspecting corporate proxy, whose private CA no setting could
add, every request failed with UnknownIssuer.

All production reqwest clients are now built by one constructor,
utils::http::client_builder(), which adds the platform trust store to
the bundled roots. rustls-native-certs reads the macOS keychain, the
Windows store or the Linux bundle, and honors SSL_CERT_FILE and
SSL_CERT_DIR. The store is read once per process and unusable roots
are skipped. Verification is never relaxed.

Tests run a local TLS server signed by a private CA: the handshake
succeeds only when SSL_CERT_FILE names that CA. A text ratchet keeps
new reqwest::Client constructors out of production code.

Fixes #1107

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

Cargo.lock

@@ -28,6 +28,13 @@ sha2 = "=0.10.9"
 sha1 = "=0.10.6"
 hex = "=0.4.3"
 reqwest = { version = "=0.12.28", features = ["rustls-tls", "json"], default-features = false }
+# Platform trust store (+ SSL_CERT_FILE / SSL_CERT_DIR) for every HTTPS
+# client, alongside reqwest's bundled webpki roots. `rustls` (already in
+# the graph through reqwest) only screens each native root before it is
+# handed to reqwest; no crypto provider feature is needed for that.
+rustls-native-certs = "=0.8.4"
+rustls = { version = "=0.23.45", default-features = false, features = ["std"] }
+tokio-rustls = { version = "=0.26.4", default-features = false, features = ["ring", "tls12"] }
 tokio = { version = "=1.50.0", features = ["full"] }
 tokio-util = "=0.7.18"
 futures-util = { version = "=0.3.32", default-features = false, features = ["std"] }

Cargo.toml

@@ -1128,7 +1128,7 @@ Exactly three keys are honored, each slotting **below** the env var and **above*
 Contract properties:
 
 - **Read-only pledge**: socket-patch never creates, modifies, or deletes this file; socket-cli owns it. There is no `socket-patch login`/`config` subcommand — use `socket login`.
-- Other socket-cli keys (`apiProxy`, `enforcedOrgs`, `skipAskToPersistDefaultOrg`) and unknown keys are ignored. Non-string or empty values for the three honored keys count as unset. For an HTTP forward proxy use the standard `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` vars, which the HTTP client honors; socket-cli's `apiProxy` is deliberately not mapped (and is unrelated to `--proxy-url`, which is the public patch *endpoint*).
+- Other socket-cli keys (`apiProxy`, `enforcedOrgs`, `skipAskToPersistDefaultOrg`) and unknown keys are ignored. Non-string or empty values for the three honored keys count as unset. For an HTTP forward proxy use the standard `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` vars, which the HTTP client honors. Every HTTPS client (patch API, public proxy, blob/artifact and registry fetches, telemetry, self-update) trusts the bundled webpki (Mozilla) roots plus the platform trust store; `SSL_CERT_FILE` / `SSL_CERT_DIR`, when set, replace the platform store with that bundle/directory, so a TLS-inspecting proxy's private CA can be trusted. Verification is never disabled. socket-cli's `apiProxy` is deliberately not mapped (and is unrelated to `--proxy-url`, which is the public patch *endpoint*).
 - Missing file / unresolvable data dir: silent (the normal case). Present but unreadable or undecodable (not base64(JSON), with a plain-JSON leniency fallback): a one-shot stderr warning naming the path, then treated as absent — never fatal, and `--json` stdout stays clean (all diagnostics are stderr-only).
 - The file is read lazily at most once per process, only when a key is still unresolved after flag + env.
 - The telemetry endpoint resolver shares the same `apiBaseUrl` chain as API-client construction (`resolve_api_base_url`), so telemetry can never target a different host than the client.

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -26,6 +26,8 @@ sha2 = { workspace = true }
 sha1 = { workspace = true }
 hex = { workspace = true }
 reqwest = { workspace = true }
+rustls-native-certs = { workspace = true }
+rustls = { workspace = true }
 tokio = { workspace = true }
 # CancellationToken for the in-memory hosted engine (`hosted::memory`).
 tokio-util = { workspace = true }
@@ -84,3 +86,4 @@ tempfile = { workspace = true }
 tokio = { workspace = true, features = ["full", "test-util"] }
 serial_test = { workspace = true }
 wiremock = { workspace = true }
+tokio-rustls = { workspace = true }

crates/socket-patch-core/Cargo.toml

@@ -1992,7 +1992,7 @@ fn api_client(api_token: Option<&str>, timeouts: &ApiTimeouts) -> reqwest::Clien
     }
 
     timeouts
-        .apply(reqwest::Client::builder().default_headers(default_headers))
+        .apply(crate::utils::http::client_builder().default_headers(default_headers))
         .build()
         .expect("failed to build reqwest client")
 }
@@ -2009,7 +2009,7 @@ fn plain_client(timeouts: &ApiTimeouts) -> reqwest::Client {
         HeaderValue::from_static(USER_AGENT_VALUE),
     );
     timeouts
-        .apply(reqwest::Client::builder().default_headers(headers))
+        .apply(crate::utils::http::client_builder().default_headers(headers))
         .build()
         .expect("failed to build plain reqwest client")
 }

crates/socket-patch-core/src/api/client.rs

@@ -325,7 +325,7 @@ fn prepare_send(event: PatchTelemetryEvent, auth: &TelemetryAuth) -> PreparedSen
 async fn send_telemetry_event(prepared: PreparedSend) {
     let PreparedSend { event, url, bearer } = prepared;
 
-    let client = match reqwest::Client::builder()
+    let client = match crate::utils::http::client_builder()
         .connect_timeout(std::time::Duration::from_secs(2))
         .timeout(std::time::Duration::from_secs(5))
         .build()

crates/socket-patch-core/src/telemetry.rs

@@ -60,7 +60,7 @@ fn download_client(
     endpoints: &UpdateEndpoints,
     timeouts: &UpdateTimeouts,
 ) -> Result<reqwest::Client, UpdateError> {
-    reqwest::Client::builder()
+    crate::utils::http::client_builder()
         .user_agent(crate::constants::USER_AGENT)
         .connect_timeout(timeouts.connect)
         .timeout(timeouts.download)

crates/socket-patch-core/src/update/download.rs

@@ -264,7 +264,7 @@ fn metadata_client(
     timeouts: &UpdateTimeouts,
     redirects: reqwest::redirect::Policy,
 ) -> Result<reqwest::Client, UpdateError> {
-    reqwest::Client::builder()
+    crate::utils::http::client_builder()
         .user_agent(crate::constants::USER_AGENT)
         .connect_timeout(timeouts.connect)
         .timeout(timeouts.metadata)