reqwest calls in vp fail when running behind a MITM proxy.

[watiko]

Describe the bug

When I ran the installation script in a WSL2 environment where Zscaler certificates were installed, an error occurred.
After checking the error details, it appeared that running vp install failed to retrieve the Node.js runtime list from https://nodejs.org/dist/index.json.
Since TLS communication worked correctly with curl and other programs, I suspected that the certificates were not being referenced properly. While reviewing the repository, I found the following:

1. The reqwest version is 0.12
   

   vite-plus/Cargo.toml

   Line 140 in 9db93c2

   reqwest = { version = "0.12", default-features = false }

2. The enabled reqwest features are ["stream", "rustls-tls", "json"]
   

   vite-plus/crates/vite_install/Cargo.toml

   Lines 39 to 40 in 9db93c2

   	[target.'cfg(not(target_os = "windows"))'.dependencies]
   	reqwest = { workspace = true, features = ["stream", "rustls-tls", "json"] }

3. In reqwest 0.12, specifying rustls-tls does not use the system’s CA certificates
   SSL_CERT_FILE vs feature=["rustls-tls"] - how to use? seanmonstar/reqwest#2640
4. In reqwest 0.13, the handling of root certificates has been reorganized
   https://seanmonstar.com/blog/reqwest-v013-rustls-default/

As for possible fixes, I believe the options are either adjusting the feature flags while staying on reqwest 0.12, or upgrading to reqwest 0.13.

Reproduction

To reproduce this, you need to introduce a MITM proxy such as Zscaler on the network side, rather than relying on the contents of a repository.

Steps to reproduce

Run vp install under any MITM proxy.

System Info

❯ ~/watiko/.vite-plus/0.1.12/bin/vp env current
VITE+ - The Unified Toolchain for the Web

error: Failed to download Node.js runtime: Failed to download from https://nodejs.org/dist/index.json: error sending request for url (https://nodejs.org/dist/index.json)

❯ ~/watiko/.vite-plus/0.1.12/bin/vp --version
VITE+ - The Unified Toolchain for the Web

vp v0.1.12

Local vite-plus:
  vite-plus  Not found

Tools:
  vite             Not found
  rolldown         Not found
  vitest           Not found
  oxfmt            Not found
  oxlint           Not found
  oxlint-tsgolint  Not found
  tsdown           Not found

Environment:
  Package manager  Not found
  Node.js          Not found



error: Failed to download Node.js runtime: Failed to download from https://nodejs.org/dist/index.json: error sending request for urlhttps://nodejs.org/dist/index.json)

Used Package Manager

pnpm

Logs

Validations

• Read the Contributing Guidelines.
• Check that there isn't already an issue for the same bug.
• Confirm this is a Vite+ issue and not an upstream issue (Vite, Vitest, tsdown, Rolldown, or Oxc).
• The provided reproduction is a minimal reproducible example.

[fengmk2]

Let's first try upgrading the version of reqwest

[dwhoban]

@fengmk2 I came across the same issue in FNM as a way of verification. The issues is as described above, when compiling locally there are no issues but when using the bundled version reqwest is not able to access the local certs even if defined in CARGO_HTTP_CAINFO

[Giorno-Giovana]

I've created PR, review pls

#1068

[fengmk2]

I reproduce the same issue at codex container https://chatgpt.com/codex/tasks/task_e_69bd68d397048330958bfafa539582e4