Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Package-manager download fails under Socket Firewall when .npmrc sets a pass-through registry (UnknownIssuer)

Abierto
  • ¿Algo no está bien?
#3,031 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
rust
Área
networking, security

Línea de trabajo

Start in crates/vp_shared/src/http.rs, reading the module docs and tls_certs_merge, then trace how reqwest builds its trust store through rustls-platform-verifier and rustls-native-certs when SSL_CERT_FILE is set. Confirm the UnknownIssuer failure by reproducing with SSL_CERT_FILE pointing at a CA-only bundle and a public host. Done means the platform roots survive that setting, and a test that sets SSL_CERT_FILE to an unrelated CA still verifies a public host.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

What happens

Under Socket Firewall Free (for example voidzero-dev/setup-vp with sfw: true), vp install fails while bootstrapping the package manager when the project's .npmrc sets a registry that sfw does not intercept:

error: Install error: error sending request for url (https://registry-bridge.viteplus.dev/pnpm/-/pnpm-11.22.0.tgz): client error (Connect): invalid peer certificate: UnknownIssuer

Seen in the v1.2.0 release smoke test: npmx.dev fork CI (linux, sfw vp install --filter . --ignore-scripts). The same workflow passed with the v1.1.0 preview.

Why it changed

Before #2624, the package manager was always downloaded from NPM_CONFIG_REGISTRY or registry.npmjs.org, which sfw intercepts and re-signs with its own CA. Since #2624, the download uses the registry from .npmrc. When sfw passes that host through, the client sees the host's real certificate.

Likely cause

sfw sets SSL_CERT_FILE to a bundle that contains only its CA. On Linux, reqwest verifies through rustls-platform-verifier, which loads system roots with rustls-native-certs. That loader uses SSL_CERT_FILE instead of the system store, so the trust store holds only sfw's CA, and tls_certs_merge in crates/vp_shared/src/http.rs re-adds the same certificate. This contradicts the module docs ("the system store is kept"). Any host that sfw passes through fails the same way, so the bug predates #2624; #2624 makes the package-manager download hit it.

Scope

Users who run vp under sfw, or under any tool that points SSL_CERT_FILE at a partial bundle, and whose .npmrc sets a registry that the tool does not intercept.

Possible fix

Load the platform roots without letting SSL_CERT_FILE replace them, then merge the SSL_CERT_FILE and NODE_EXTRA_CA_CERTS bundles as extra roots, as the docs describe. Add a test that sets SSL_CERT_FILE to an unrelated CA and still verifies a public host.

Lenguaje dominante
Rust
Estrellas
6k
Forks
274
Merge medio
1 d 11 h
PR fusionados (30 d)
203

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de voidzero-dev/vite-plus

Todos los issues de voidzero-dev/vite-plus

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.