Repository navigation
Conversation
This was referenced Oct 13, 2026
|
Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.
|
This was referenced Oct 13, 2026
11 tasks done
Titles that bundle OpenSSL load the console's CA file from the sandbox directory and fail every HTTPS request without it. ProsperoRadio (PPSA99001, libcurl 8.18.0 + OpenSSL 3.5.2) on main + boykopovar#4796 + boykopovar#4525: [ProsperoRadio][http] https://all.api.radio-browser.info/json/servers: Problem with the SSL CA cert (path? access rights?) (error adding trust anchors from file: /gkbHtXc3Wq/common/cert/CA_LIST.cer) SwanStation (PPSA98510) stops on the same file (boykopovar#5001). The guest path resolver now accepts exact-path providers, and libkernel registers one for /<sceKernelGetFsSandboxRandomWord()>/common/cert/CA_LIST.cer. On first use it writes a PEM bundle once per process to cert_cache/CA_LIST.cer in the run directory, read-only: on Windows the current user's ROOT and CA system stores, elsewhere SSL_CERT_FILE or the first distro bundle that exists. Without a certificate the path keeps resolving under the guest root and does not exist, as before. Every other path under the sandbox word is unchanged. The console file's format and the rest of its common/cert directory are unverified and recorded in docs/dev/debt/libkernel.md. With this change, boykopovar#4796, boykopovar#4525 and boykopovar#5025 on Windows 11, 60 s each: [ProsperoRadio][http] 11846160 bytes in 1458 ms: 1161 passes, 803 waits (679 woken) for 1428 ms [ProsperoRadio][catalog] page offset=0 bytes=11846160 objects=10000 accepted=9549 total=9549 ... [ProsperoRadio][catalog] page offset=60000 bytes=1712035 objects=1494 accepted=1436 total=59371 [SwanStationPS5] update: latest 1.2.5, this 1.1.3, available [SwanStationPS5] gamedb: index written Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
MarcZX10
force-pushed
the
codex/sandbox-ca-list-5001
branch
from
October 13, 2026 19:08
c47b0a2 to
bb5eea6
Compare
Collaborator
|
Closing: no title is known to reach this. With the queue at 700+ open PRs, please hold off on new PRs that don't name a title needing the change until it's down. If a title stops on this on current main, reopen with the title ID and the log line. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Carries screamm’s independently authored commit for host-provided
/<sandbox word>/common/cert/CA_LIST.cer, preserving the original commit author. The path provider lazily creates a read-only bundle from the Windows ROOT/CA stores or LinuxSSL_CERT_FILE/standard distro bundle paths. If no certificates are available, opening the file fails withENOENT.Overlap: #5280 carries the same original commit and is the broader implementation, adding Windows trust filtering, resolver precedence tests and Windows title evidence. This PR is retained as the minimal carry, but should be reviewed/merged only if maintainers want this narrower implementation; it is functionally superseded by #5280. The two PRs add the same provider and certificate tests and should not both be merged.
Tested
The carried implementation was reported tested on Windows 11 with MinGW-w64 GCC 15.2.0 and on Ubuntu 24.04 with GCC 13.3. On Windows,
guest_sandbox_certificatesand filesystem tests passed; the reported non-AGC suite had one knownpatched_librariesfailure and oneguest_raise_exceptiontimeout. On Linux,guest_sandbox_certificatespassed 20/20 and all 335guest_*tests passed twice. No title run was reported for this PR. Current rebased source files pass MinGW GCC 12 syntax-only checks; conventions pass. Full current-head Windows/Linux test execution is not claimed.AI-assisted: yes.
Checklist