From 5891f041b292bc32e311bb3029737e8302e4e38a Mon Sep 17 00:00:00 2001 From: Winston Howes Date: Wed, 3 Jun 2026 18:55:52 -0700 Subject: [PATCH] Preserve always-trusted macOS roots --- codex-rs/network-proxy/src/native_certs.rs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/codex-rs/network-proxy/src/native_certs.rs b/codex-rs/network-proxy/src/native_certs.rs index f4ef4a7b85..0ab697375c 100644 --- a/codex-rs/network-proxy/src/native_certs.rs +++ b/codex-rs/network-proxy/src/native_certs.rs @@ -52,9 +52,7 @@ pub(crate) fn load_platform_native_certs() -> CertificateResult { for cert in iter { let der = cert.to_der(); let trusted = match ts.tls_trust_settings_for_certificate(&cert) { - Ok(Some(trusted)) => trusted, - Ok(None) if *domain == Domain::System => TrustSettingsForCertificate::TrustRoot, - Ok(None) => continue, + Ok(trusted) => trusted.unwrap_or(TrustSettingsForCertificate::TrustRoot), Err(err) => { result.errors.push(Error { context: "certificate not trusted",