Skip to content

Conversation

@Aditi-1400
Copy link
Contributor

@Aditi-1400 Aditi-1400 commented Nov 11, 2025

Makes the --use-system-ca option a per-environment option rather than a per-process option so that workers can enable/disable them individually

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/config
  • @nodejs/crypto
  • @nodejs/startup

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Nov 11, 2025
@Aditi-1400 Aditi-1400 force-pushed the ca-per-env branch 2 times, most recently from d87558c to 23473b9 Compare November 11, 2025 10:28
@joyeecheung
Copy link
Member

joyeecheung commented Nov 11, 2025

Hmm, I think this may need more work than just updating the options - the implication of being per-env is that each worker would then be able to toggle this independently. Say when the main thread does not enable it but a worker does, then the worker will have the system CA certs in their default store but the parent doesn't. Can you add a test for this, and the other way around (parent enables it, worker disables it)? My impression is that the default store initialisation code is not yet ready for this and it's still shared across the process (so if a worker enables it, suddenly the parent get it too, which would be unexpected).

@codecov
Copy link

codecov bot commented Nov 11, 2025

Codecov Report

❌ Patch coverage is 80.64516% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.52%. Comparing base (77d8197) to head (780c272).
⚠️ Report is 282 commits behind head on main.

Files with missing lines Patch % Lines
src/quic/tlscontext.cc 58.33% 5 Missing ⚠️
src/crypto/crypto_context.cc 88.88% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #60678      +/-   ##
==========================================
- Coverage   88.58%   88.52%   -0.07%     
==========================================
  Files         704      703       -1     
  Lines      207826   208396     +570     
  Branches    40049    40190     +141     
==========================================
+ Hits       184112   184479     +367     
- Misses      15757    15935     +178     
- Partials     7957     7982      +25     
Files with missing lines Coverage Δ
src/crypto/crypto_common.cc 79.67% <100.00%> (ø)
src/crypto/crypto_context.h 100.00% <ø> (ø)
src/node.cc 75.87% <ø> (-0.17%) ⬇️
src/node_options.cc 77.88% <100.00%> (+0.04%) ⬆️
src/node_options.h 97.89% <100.00%> (+0.03%) ⬆️
src/quic/endpoint.cc 56.51% <100.00%> (ø)
src/quic/tlscontext.h 65.38% <ø> (ø)
src/crypto/crypto_context.cc 71.10% <88.88%> (+2.60%) ⬆️
src/quic/tlscontext.cc 36.85% <58.33%> (ø)

... and 132 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants