fix(http): fall back to bundled Mozilla roots when the system CA store is empty by fengmk2 · Pull Request #2295 · voidzero-dev/vite-plus

fengmk2 · 2026-08-02T13:33:11Z

When the shared HTTP client cannot be built because the trust store is
empty (Debian slim and distroless images ship no ca-certificates
package), retry once with the webpki-root-certs Mozilla list merged in,
like Node's own bundled roots. A populated system store keeps sole
authority; failures the bundle cannot fix still surface the original
error. Windows keeps native-tls/SChannel and skips the fallback.

Closes #2278

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

github-actions · 2026-08-02T13:42:28Z

Native binary sizes (`976a82e`)

Final release artifacts built by the canonical build-upstream and build-windows-cli actions.

Artifact	Format	Base	PR	Change
`vp` (Linux x64)	Binary	10.38 MiB	10.51 MiB	+132.02 KiB (+1.24%)
`vp` (Linux x64)	gzip -9	4.45 MiB	4.55 MiB	+98.23 KiB (+2.15%)
NAPI (Linux x64)	Binary	33.48 MiB	33.60 MiB	+128.06 KiB (+0.37%)
NAPI (Linux x64)	gzip -9	12.93 MiB	13.02 MiB	+97.95 KiB (+0.74%)
`vp` (macOS ARM64)	Binary	7.70 MiB	7.83 MiB	+129.02 KiB (+1.64%)
`vp` (macOS ARM64)	gzip -9	3.86 MiB	3.95 MiB	+96.28 KiB (+2.44%)
NAPI (macOS ARM64)	Binary	40.79 MiB	40.92 MiB	+129.00 KiB (+0.31%)
NAPI (macOS ARM64)	gzip -9	17.15 MiB	17.24 MiB	+93.31 KiB (+0.53%)
`vp` (Windows x64)	Binary	8.42 MiB	8.42 MiB	+512 B (+0.01%)
`vp` (Windows x64)	gzip -9	3.66 MiB	3.66 MiB	+223 B (+0.01%)
NAPI (Windows x64)	Binary	27.76 MiB	27.76 MiB	0 B (0.00%)
NAPI (Windows x64)	gzip -9	10.86 MiB	10.86 MiB	+289 B (+0.00%)
Trampoline (Windows x64)	Binary	203.00 KiB	203.00 KiB	0 B (0.00%)
Trampoline (Windows x64)	gzip -9	97.91 KiB	97.91 KiB	-1 B (-0.00%)
Installer (Windows x64)	Binary	4.47 MiB	4.47 MiB	+512 B (+0.01%)
Installer (Windows x64)	gzip -9	2.09 MiB	2.09 MiB	+164 B (+0.01%)

fengmk2 · 2026-08-02T13:55:18Z

@codex review

chatgpt-codex-connector · 2026-08-02T13:59:29Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 175538b184

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-08-02T14:18:20Z

Registry bridge build (`175538b`)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
`vite-plus`	`0.0.0-commit.175538b184911b9af6584b86bb2a9a7079b1ae25`
`@voidzero-dev/vite-plus-core`	`0.0.0-commit.175538b184911b9af6584b86bb2a9a7079b1ae25`

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2295 bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2295"; irm https://vite.plus/ps1 | iex

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	`.npmrc`: `registry=https://registry-bridge.viteplus.dev/`
Yarn (v2+)	`.yarnrc.yml`: `npmRegistryServer: "https://registry-bridge.viteplus.dev/"`

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.175538b184911b9af6584b86bb2a9a7079b1ae25",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.175538b184911b9af6584b86bb2a9a7079b1ae25"
  }
}

github-actions · 2026-08-02T14:19:51Z

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
`ghcr.io/voidzero-dev/vite-plus:pr-2295`	240MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2295 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2295

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2295 vp --version

See docs/guide/docker.md for usage.

netlify · 2026-08-03T03:12:44Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`976a82e`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a70c047c69eab000801993a

github-actions · 2026-08-03T03:13:55Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 6e68170

fengmk2 · 2026-08-03T04:05:38Z

Verified the registry-bridge build (175538b) in the original repro environment (node:24-bookworm-slim, no ca-certificates, packageManager: pnpm@10.27.0, cold cache):

vite-plus@0.2.7: vp fmt --check aborts with exit 134, "No CA certificates were loaded from the system"
this build: vp fmt --check runs oxfmt and reports format results normally, and the pinned pnpm is downloaded through vp's HTTP client into ~/.vite-plus/package_manager/pnpm/10.27.0/, confirming HTTPS works through the bundled Mozilla roots fallback

…e is empty When the shared HTTP client cannot be built because the trust store is empty (Debian slim and distroless images ship no ca-certificates package), retry once with the webpki-root-certs Mozilla list merged in, like Node's own bundled roots. A populated system store keeps sole authority; failures the bundle cannot fix still surface the original error. Windows keeps native-tls/SChannel and skips the fallback. Closes #2278

On Windows native-tls rejects the invalid-DER PEM at parse time, so the bad bundle is skipped with a warning, the build succeeds against SChannel, and the is_err assertion fails. The bundled-roots retry the test guards is compiled out on Windows anyway.

Regression test for the #2278 fallback: build the global vp inside a bookworm container so its glibc floor matches the runtime image, then run vp env list-remote in node:24-bookworm-slim, which ships no ca-certificates package. The job asserts the CA bundle is really absent so the check keeps guarding if the base image changes.

Both build-failure tests carried the same temp PEM write, env set/unset, and cleanup scaffold; with_invalid_ssl_cert_file now owns it.

Mount the host rustup home so the container picks up the pinned nightly that setup-rust installed instead of downloading it on every run; rustup show still installs it if the mount misses.

fengmk2 added test: e2e Auto run e2e tests test: install-e2e run vite install e2e test test: create-e2e Run `vp create` e2e tests test: sfw preview-build Publish this PR's commits to the registry bridge as preview builds labels Aug 2, 2026

fengmk2 requested review from Brooooooklyn, cpojer and wan9chi August 3, 2026 03:11

fengmk2 marked this pull request as ready for review August 3, 2026 03:11

fengmk2 force-pushed the http-webpki-roots-fallback branch from c78a484 to 6e68170 Compare August 3, 2026 03:12

fengmk2 changed the base branch from docs/stacked-prs to main August 3, 2026 03:12

fengmk2 added 5 commits August 3, 2026 12:07

test(http): extract the invalid SSL_CERT_FILE fixture helper

ca63e86

Both build-failure tests carried the same temp PEM write, env set/unset, and cleanup scaffold; with_invalid_ssl_cert_file now owns it.

ci: reuse the host rustup toolchain in the bookworm container

b0682df

Mount the host rustup home so the container picks up the pinned nightly that setup-rust installed instead of downloading it on every run; rustup show still installs it if the mount misses.

fengmk2 force-pushed the http-webpki-roots-fallback branch from 6e68170 to b0682df Compare August 3, 2026 04:07

cpojer approved these changes Aug 3, 2026

View reviewed changes

fengmk2 added 3 commits August 3, 2026 23:30

Merge branch 'main' into http-webpki-roots-fallback

d72603b

Merge branch 'main' into http-webpki-roots-fallback

94a8d65

Merge branch 'main' into http-webpki-roots-fallback

976a82e

fengmk2 merged commit d1183bd into main Aug 3, 2026
104 checks passed

fengmk2 deleted the http-webpki-roots-fallback branch August 3, 2026 16:38

fengmk2 mentioned this pull request Aug 4, 2026

release: v0.2.8: monorepo target resolution, VP_* environment variables, and container reliability #2325

Open

Navigation Menu

Uh oh!

fix(http): fall back to bundled Mozilla roots when the system CA store is empty - #2295

fix(http): fall back to bundled Mozilla roots when the system CA store is empty#2295
fengmk2 merged 8 commits into
mainfrom
http-webpki-roots-fallback

fengmk2 commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

fengmk2 commented Aug 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

netlify Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

fengmk2 commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

fengmk2 commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Native binary sizes (976a82e)

Uh oh!

fengmk2 commented Aug 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Registry bridge build (175538b)

Uh oh!

github-actions Bot commented Aug 2, 2026

🐳 Docker preview image

Uh oh!

netlify Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

fengmk2 commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 2, 2026 •

edited

Loading

Native binary sizes (`976a82e`)

Registry bridge build (`175538b`)

netlify Bot commented Aug 3, 2026 •

edited

Loading