PocketFox 2.2.0 — Certificate Verification (PPC Tiger binaries)

First release with downloadable PowerPC binaries — built natively on a dual 1.25 GHz Power Mac G4 running Mac OS X Tiger 10.4.12 with Apple GCC 4.0.1.

What's new

HTTPS on Tiger now means what it means everywhere else. PocketFox verifies server certificates by default against an embedded copy of Mozilla's CA root bundle (121 roots via curl.se) — previously, connections were encrypted but unverified (MBEDTLS_SSL_VERIFY_NONE), so any network MITM could impersonate any site.

• Certificate verification ON by default, fail-closed
• Embedded Mozilla CA bundle, refreshed weekly in-repo by CI
• User override: drop a newer cacert.pem into ~/Library/Application Support/PocketFox/
• wget_tiger -k / --insecure escape hatch (curl semantics, loudly warned)
• Friendly clock-skew error: a dead PRAM battery makes every cert look invalid — PocketFox now tells you to set your clock instead of printing a hex code

Verified on real hardware (this G4, this build)

Test	Result
example.com	✅ verified — ECDSA chain, ChaCha20-Poly1305
self-signed.badssl.com	✅ rejected: not signed by trusted CA
expired.badssl.com	✅ rejected with clock-skew hint
--insecure override	✅ connects with loud warning
Full page download via wget_tiger	✅

Contents

• PocketFox.app — Cocoa GUI browser (Mach-O ppc, Tiger 10.4+)
• wget_tiger — standalone HTTPS downloader with cert verification
• pocketfox_ssl_test — TLS diagnostic tool (./pocketfox_ssl_test <host>)
• cacert.pem — Mozilla CA bundle snapshot (for the Application Support override)

SHA-256: cd21ccbd7ef252bdfb24447e8de1972e7f26eb8a5e98b167dc7604cadfc3dfce

🤖 Built and tested with Claude Code