Enable native-certs for ureq across all crates - #2
Merged
Conversation
Switch ureq's TLS from the bundled webpki-roots to the platform's native certificate store by enabling the `native-certs` feature in every crate that makes HTTPS requests (rocm, rocmd, rocm-core, lemonade). This lets downloads succeed in environments that terminate TLS with a custom root CA or a corporate MITM proxy, where the static webpki root set rejects the re-signed certificate chain.
r0x0r
approved these changes
Jun 12, 2026
Collaborator
|
TLS error is gone when downloading Python on macOS with this pr |
Collaborator
Author
michaelroy-amd
approved these changes
Jun 14, 2026
michaelroy-amd
left a comment
michaelroy-amd
left a comment
Member
There was a problem hiding this comment.
Approving: clean native-certs enablement across crates. Incremental PR-stack merge.
michaelroy-amd
added a commit
that referenced
this pull request
Jun 29, 2026
The 5-tab IA has no ActiveTab::Overview and overview::draw had zero callers; tabs/mod.rs::draw_placeholder was likewise uncalled (rominf #2, in-scope part). Removes overview.rs, its pub mod decl, draw_placeholder, and the imports only those needed. tui.rs is deferred to a tracked issue. Signed-off-by: Michael Roy <michael.roy@amd.com>
7 tasks
5 tasks
michaelroy-amd
added a commit
that referenced
this pull request
Jul 14, 2026
The readiness-reason helper hand-rolled two authority parsers
(port_from_base_url / host_from_base_url) with rsplit(':'), which mangles
a bracketed IPv6 loopback: host_from_base_url("http://[::1]:8000") kept
the brackets so is_loopback_host("[::1]") was false, and
port_from_base_url("http://[::1]/v1") parsed "1]" and failed. Either
path silently disabled chat_backend_wait_reason for a legitimate local
IPv6 endpoint.
Replace both helpers with the crate's existing parse_host_port, which
already strips IPv6 brackets, defaults the port from the scheme, and is
pinned by parse_host_port_handles_bracketed_ipv6. Drop the now-redundant
per-helper unit tests (covered by the llm.rs suite) and add a
bracketed-IPv6 regression test against chat_backend_wait_reason.
Also tighten the doc comment: Running is not a hard HTTP-readiness
guarantee, and record the #106/#107 status-signal dependency in-tree so
the Starting/Stopped/Error arms are discoverable as pending until that
work lands beneath this change.
Addresses pr-review-watcher blocking finding #2 (IPv6) and the doc /
test-coverage non-blocking notes on #108.
Signed-off-by: Michael Roy <michael.roy@amd.com>
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
native-certsfeature in every crate that makes HTTPS requests (rocm,rocmd,rocm-core,rocm-engine-lemonade), so TLS validates against the operating system's certificate store instead of the bundledwebpki-rootsstatic set.Why: in environments that terminate TLS with a custom/private root CA or a corporate MITM proxy, the static webpki root set rejects the re-signed certificate chain and downloads fail. Using the system trust store lets those certificates (already installed at the OS level) be honored, while remaining a no-op on machines with a standard public CA chain.
Risk: low — only changes which trust anchors ureq consults; no API or behavior change for standard public endpoints.
Test plan
cargo buildacross the workspace with the feature enabled.