Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Package-manager download fails under Socket Firewall when .npmrc sets a pass-through registry (UnknownIssuer)

Aperta
  • Qualcosa non va?
#3,031 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
networking, security

Direzione di ricerca

Start in crates/vp_shared/src/http.rs, reading the module docs and tls_certs_merge, then trace how reqwest builds its trust store through rustls-platform-verifier and rustls-native-certs when SSL_CERT_FILE is set. Confirm the UnknownIssuer failure by reproducing with SSL_CERT_FILE pointing at a CA-only bundle and a public host. Done means the platform roots survive that setting, and a test that sets SSL_CERT_FILE to an unrelated CA still verifies a public host.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happens

Under Socket Firewall Free (for example voidzero-dev/setup-vp with sfw: true), vp install fails while bootstrapping the package manager when the project's .npmrc sets a registry that sfw does not intercept:

error: Install error: error sending request for url (https://registry-bridge.viteplus.dev/pnpm/-/pnpm-11.22.0.tgz): client error (Connect): invalid peer certificate: UnknownIssuer

Seen in the v1.2.0 release smoke test: npmx.dev fork CI (linux, sfw vp install --filter . --ignore-scripts). The same workflow passed with the v1.1.0 preview.

Why it changed

Before #2624, the package manager was always downloaded from NPM_CONFIG_REGISTRY or registry.npmjs.org, which sfw intercepts and re-signs with its own CA. Since #2624, the download uses the registry from .npmrc. When sfw passes that host through, the client sees the host's real certificate.

Likely cause

sfw sets SSL_CERT_FILE to a bundle that contains only its CA. On Linux, reqwest verifies through rustls-platform-verifier, which loads system roots with rustls-native-certs. That loader uses SSL_CERT_FILE instead of the system store, so the trust store holds only sfw's CA, and tls_certs_merge in crates/vp_shared/src/http.rs re-adds the same certificate. This contradicts the module docs ("the system store is kept"). Any host that sfw passes through fails the same way, so the bug predates #2624; #2624 makes the package-manager download hit it.

Scope

Users who run vp under sfw, or under any tool that points SSL_CERT_FILE at a partial bundle, and whose .npmrc sets a registry that the tool does not intercept.

Possible fix

Load the platform roots without letting SSL_CERT_FILE replace them, then merge the SSL_CERT_FILE and NODE_EXTRA_CA_CERTS bundles as extra roots, as the docs describe. Add a test that sets SSL_CERT_FILE to an unrelated CA and still verifies a public host.

Lingua principale
Rust
Stelle
6k
Fork
274
Merge medio
1g 11h
PR unite (30g)
203

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di voidzero-dev/vite-plus

Tutte le issue di voidzero-dev/vite-plus

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.