From 2bb7e5b09947154fd3b2e20d9f4837482e96ab1a Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 16 Aug 2026 16:25:20 +0900 Subject: fix(ca-bundle): resolve SSL_CERT_* the way CaBundle does CaBundle::getEnvVariable() prefers $_SERVER and falls back to getenv() only under the CLI SAPI. The port read the live process environment for both SSL_CERT_FILE and SSL_CERT_DIR, skipping the snapshot entirely. Co-Authored-By: Claude Opus 5 (1M context) --- crates/shirabe-ca-bundle/src/ca_bundle.rs | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'crates/shirabe-ca-bundle/src/ca_bundle.rs') diff --git a/crates/shirabe-ca-bundle/src/ca_bundle.rs b/crates/shirabe-ca-bundle/src/ca_bundle.rs index b8e4c391..9f15b55e 100644 --- a/crates/shirabe-ca-bundle/src/ca_bundle.rs +++ b/crates/shirabe-ca-bundle/src/ca_bundle.rs @@ -23,7 +23,7 @@ impl CaBundle { // not consult OpenSSL's default cert locations, does not validate the // candidate before returning it, and has no bundled cacert.pem fallback. pub fn get_system_ca_root_bundle_path(_logger: ()) -> String { - if let Ok(file) = std::env::var("SSL_CERT_FILE") + if let Some(file) = Self::get_env_variable("SSL_CERT_FILE") && std::path::Path::new(&file).is_file() { return file; @@ -49,7 +49,7 @@ impl CaBundle { } } - if let Ok(dir) = std::env::var("SSL_CERT_DIR") + if let Some(dir) = Self::get_env_variable("SSL_CERT_DIR") && std::path::Path::new(&dir).is_dir() { return dir; @@ -65,6 +65,15 @@ impl CaBundle { String::new() } + fn get_env_variable(name: &str) -> Option { + if let Some(value) = shirabe_php_shim::PHP_SERVER.lock().unwrap().get(name) { + return Some(value.to_string_lossy().into_owned()); + } + + // PHP_SAPI is always 'cli' for this application + shirabe_php_shim::getenv(name).map(|value| value.to_string_lossy().into_owned()) + } + // TODO(http): Dummy stand-in until reqwest validates certificates itself. // The original parses the file with OpenSSL and rejects malformed or expired // bundles; here we only require the file to exist and be non-empty. -- cgit v1.3.1-4-g156e