Package-manager download fails under Socket Firewall when .npmrc sets a pass-through registry (UnknownIssuer)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- rust
- 领域
- networking, security
调研方向
Start in crates/vp_shared/src/http.rs, reading the module docs and tls_certs_merge, then trace how reqwest builds its trust store through rustls-platform-verifier and rustls-native-certs when SSL_CERT_FILE is set. Confirm the UnknownIssuer failure by reproducing with SSL_CERT_FILE pointing at a CA-only bundle and a public host. Done means the platform roots survive that setting, and a test that sets SSL_CERT_FILE to an unrelated CA still verifies a public host.
由索引模型根据 Issue 内容生成。
描述
What happens
Under Socket Firewall Free (for example voidzero-dev/setup-vp with sfw: true), vp install fails while bootstrapping the package manager when the project's .npmrc sets a registry that sfw does not intercept:
error: Install error: error sending request for url (https://registry-bridge.viteplus.dev/pnpm/-/pnpm-11.22.0.tgz): client error (Connect): invalid peer certificate: UnknownIssuer
Seen in the v1.2.0 release smoke test: npmx.dev fork CI (linux, sfw vp install --filter . --ignore-scripts). The same workflow passed with the v1.1.0 preview.
Why it changed
Before #2624, the package manager was always downloaded from NPM_CONFIG_REGISTRY or registry.npmjs.org, which sfw intercepts and re-signs with its own CA. Since #2624, the download uses the registry from .npmrc. When sfw passes that host through, the client sees the host's real certificate.
Likely cause
sfw sets SSL_CERT_FILE to a bundle that contains only its CA. On Linux, reqwest verifies through rustls-platform-verifier, which loads system roots with rustls-native-certs. That loader uses SSL_CERT_FILE instead of the system store, so the trust store holds only sfw's CA, and tls_certs_merge in crates/vp_shared/src/http.rs re-adds the same certificate. This contradicts the module docs ("the system store is kept"). Any host that sfw passes through fails the same way, so the bug predates #2624; #2624 makes the package-manager download hit it.
Scope
Users who run vp under sfw, or under any tool that points SSL_CERT_FILE at a partial bundle, and whose .npmrc sets a registry that the tool does not intercept.
Possible fix
Load the platform roots without letting SSL_CERT_FILE replace them, then merge the SSL_CERT_FILE and NODE_EXTRA_CA_CERTS bundles as extra roots, as the docs describe. Add a test that sets SSL_CERT_FILE to an unrelated CA and still verifies a public host.
- 主要语言
- Rust
- 星标
- 6k
- 派生
- 274
- 平均合并
- 1 天 11 小时
- 30 天内合并 PR
- 203
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
voidzero-dev/vite-plus 的其他 Issue
-
`npx --package=vite-plus vp create` fails with exit 127 when npm is the chosen package manager可能已有人在做 @Crimson341 于 2 天前认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 70/100
voidzero-dev/vite-plus#2970 ·
维护者通常 1 天内回复
-
pending triage
难度 2/5 1-3 小时 新手友好度 72/100
voidzero-dev/vite-plus#2882 · 2 条评论 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 62/100
voidzero-dev/vite-plus#2097 · 10 条评论 · 2 个 reaction ·
维护者通常 1 天内回复
-
Support npm dist-tags in `vp env pin` (e.g. `pnpm@latest-10`)可能已有人在做 @liangmiQwQ 今天认领。 未关闭enhancement
voidzero-dev/vite-plus#3034 · 2 个 reaction · 已指派 1 人 ·
维护者通常 1 天内回复
-
pending triage
难度 3/5 1-2 天 新手友好度 62/100
voidzero-dev/vite-plus#3033 ·
维护者通常 1 天内回复
查看 voidzero-dev/vite-plus 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
bytecodealliance/rustix#1703 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
Pomax/vst-plugins#24 ·
维护者通常 1 天内回复
-
V1 manifest lists written by Java lose added/existing/deleted file counts可能已有人在做 @kacper-li-airspace-intelligence 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
apache/iceberg-rust#3445 ·
维护者通常 4 天内回复
-
Slack integration: links on self-hosted domains never unfurl (parseCapShareUrl only accepts cap.so / cap.link)可能已有人在做 @mangeshraut712 今天认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 72/100
CapSoftware/Cap#2546 · 1 条评论 ·
维护者通常 1 天内回复