From 2bb7e5b09947154fd3b2e20d9f4837482e96ab1a Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 16 Aug 2026 16:25:20 +0900 Subject: fix(ca-bundle): resolve SSL_CERT_* the way CaBundle does CaBundle::getEnvVariable() prefers $_SERVER and falls back to getenv() only under the CLI SAPI. The port read the live process environment for both SSL_CERT_FILE and SSL_CERT_DIR, skipping the snapshot entirely. Co-Authored-By: Claude Opus 5 (1M context) --- Cargo.lock | 3 +++ crates/shirabe-ca-bundle/Cargo.toml | 3 +++ crates/shirabe-ca-bundle/src/ca_bundle.rs | 13 +++++++++++-- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 86c1c272..3861f168 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2126,6 +2126,9 @@ dependencies = [ [[package]] name = "shirabe-ca-bundle" version = "0.0.1" +dependencies = [ + "shirabe-php-shim", +] [[package]] name = "shirabe-class-map-generator" diff --git a/crates/shirabe-ca-bundle/Cargo.toml b/crates/shirabe-ca-bundle/Cargo.toml index 39db9f6b..36319017 100644 --- a/crates/shirabe-ca-bundle/Cargo.toml +++ b/crates/shirabe-ca-bundle/Cargo.toml @@ -7,5 +7,8 @@ description = "A Rust port of composer/ca-bundle" repository.workspace = true license.workspace = true +[dependencies] +shirabe-php-shim.workspace = true + [lints] workspace = true diff --git a/crates/shirabe-ca-bundle/src/ca_bundle.rs b/crates/shirabe-ca-bundle/src/ca_bundle.rs index b8e4c391..9f15b55e 100644 --- a/crates/shirabe-ca-bundle/src/ca_bundle.rs +++ b/crates/shirabe-ca-bundle/src/ca_bundle.rs @@ -23,7 +23,7 @@ impl CaBundle { // not consult OpenSSL's default cert locations, does not validate the // candidate before returning it, and has no bundled cacert.pem fallback. pub fn get_system_ca_root_bundle_path(_logger: ()) -> String { - if let Ok(file) = std::env::var("SSL_CERT_FILE") + if let Some(file) = Self::get_env_variable("SSL_CERT_FILE") && std::path::Path::new(&file).is_file() { return file; @@ -49,7 +49,7 @@ impl CaBundle { } } - if let Ok(dir) = std::env::var("SSL_CERT_DIR") + if let Some(dir) = Self::get_env_variable("SSL_CERT_DIR") && std::path::Path::new(&dir).is_dir() { return dir; @@ -65,6 +65,15 @@ impl CaBundle { String::new() } + fn get_env_variable(name: &str) -> Option { + if let Some(value) = shirabe_php_shim::PHP_SERVER.lock().unwrap().get(name) { + return Some(value.to_string_lossy().into_owned()); + } + + // PHP_SAPI is always 'cli' for this application + shirabe_php_shim::getenv(name).map(|value| value.to_string_lossy().into_owned()) + } + // TODO(http): Dummy stand-in until reqwest validates certificates itself. // The original parses the file with OpenSSL and rejects malformed or expired // bundles; here we only require the file to exist and be non-empty. -- cgit v1.3.1-4-g156e