Fix TLS upload failures by embedding a CA trust bundle

Browse Source

SSL_CTX_set_default_verify_paths() only works if OpenSSL's compiled-in
default CA path happens to exist on the machine running the binary -
a path baked in wherever OpenSSL was built, not where the release
binary ends up. That almost never matched an end user's machine
(no such path on stock macOS; Linux distros disagree on the
location), so --upload failed with a TLS/certificate error on nearly
every machine except the one that built the release binaries.

Embed the Mozilla CA root bundle (src/ca_bundle.h) as a fallback trust
source, tried alongside the system's own default paths so locally-
trusted/corporate CAs still work where present. Windows is unaffected
since TLS is stubbed out there already.

Bump to 0.1.5-hotfix2.

...

This commit is contained in:

owen

2026-07-18 07:03:04 -05:00

parent 72043eb956

commit 8ae7c6ecf9

2 changed files with 3134 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

src/ca_bundle.h

+3101

File diff suppressed because it is too large Load Diff