ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-28 05:16:23 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): keep public CA roots for one-shot commands (#112868)

Browse Source
This commit is contained in:
Peter Steinberger
2026-07-23 00:33:39 -04:00
committed by GitHub
parent aed2e6ff3f
commit 7bbc6c2d3c
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/entry.respawn.test.ts
+5 -5
View File
@@ -103,7 +103,7 @@ describe("buildCliRespawnPlan", () => {
expect(respawnPlan.detachForProcessTree).toBe(false);
});
it("uses the file-backed CA store for one-shot macOS commands", () => {
it("uses bundled public roots for one-shot macOS commands", () => {
const plan = buildCliRespawnPlan({
argv: ["node", "openclaw", "cron", "list", "--json"],
env: { NODE_USE_SYSTEM_CA: "1" },
@@ -115,7 +115,7 @@ describe("buildCliRespawnPlan", () => {
const respawnPlan = expectCliRespawnPlan(plan);
expect(respawnPlan.argv).toEqual([
EXPERIMENTAL_WARNING_FLAG,
OPENSSL_CA_FLAG,
BUNDLED_CA_FLAG,
"openclaw",
"cron",
"list",
@@ -182,15 +182,15 @@ describe("buildCliRespawnPlan", () => {
},
);
it("does not respawn again after selecting the macOS file-backed CA store", () => {
it("does not respawn again after selecting bundled public roots", () => {
expect(
buildCliRespawnPlan({
argv: ["node", "openclaw", "cron", "list", "--json"],
env: {
NODE_USE_SYSTEM_CA: "1",
NODE_USE_SYSTEM_CA: "0",
[OPENCLAW_NODE_OPTIONS_READY]: "1",
},
execArgv: [OPENSSL_CA_FLAG, EXPERIMENTAL_WARNING_FLAG],
execArgv: [BUNDLED_CA_FLAG, EXPERIMENTAL_WARNING_FLAG],
autoNodeExtraCaCerts: undefined,
platform: "darwin",
}),
src/entry.respawn.ts
+2 -2
View File
@@ -152,11 +152,11 @@ export function buildCliRespawnPlan(
!hasNodeRuntimeOption({ env, execArgv, option: OPENSSL_CA_FLAG })
) {
// Node loads the macOS Keychain off-thread on the first TLS import, then joins
// that worker during shutdown. One-shot CLIs use the file-backed CA store instead;
// that worker during shutdown. One-shot CLIs use Node's bundled public roots;
// an explicit --use-system-ca remains the opt-in for Keychain-only trust.
childEnv.NODE_USE_SYSTEM_CA = "0";
if (!hasNodeRuntimeOption({ env, execArgv, option: BUNDLED_CA_FLAG })) {
childExecArgv.unshift(OPENSSL_CA_FLAG);
childExecArgv.unshift(BUNDLED_CA_FLAG);
}
needsRespawn = true;
}