Skip to content

Conversation

benburkert
Copy link

@benburkert benburkert commented Sep 17, 2025

Simplify CA Bundle loading for single files and byte buffers of CA certificate data.

This also fixes a footgun I encountered while using a std.http.Client with a custom ca_bundle:

var ca_bundle: Bundle = .{};
try ca_bundle.addCertsFromFilePath(allocator, cwd, "path/to/cacert.pem");

var http_client: http.Client = .{
        .allocator = gpa,
        .ca_bundle = ca_bundle,
        
          // failing to set this will cause the bundle to rescan from only the system certs,
          // which drops the certs in path/to/cacert.pem above.
        .next_https_rescan_certs = false,
};

Tracking the source now in Bundle won't cause the system certs to load on a rescan:

var bundle: Bundle = try .init(gpa, .{ .file = "path/to/cacert.pem" });
defer bundle.deinit(gpa);

var http_client: http.Client = .{
    .allocator = gpa,
    .ca_bundle = ca_bundle,
};

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant