From 6f828cb92e4c2fc6b466d5c6998481aa2c40762d Mon Sep 17 00:00:00 2001 From: Halil Durak Date: Wed, 15 Jul 2026 15:22:09 +0300 Subject: [PATCH] `createX509Store`: track hashed directories separately --- src/network/Network.zig | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/network/Network.zig b/src/network/Network.zig index 09d17ed29..8f863bf35 100644 --- a/src/network/Network.zig +++ b/src/network/Network.zig @@ -737,10 +737,13 @@ const CreateX509StoreError = std.crypto.Certificate.Bundle.RescanError || error{ pub fn createX509Store(allocator: Allocator, config: *const Config) CreateX509StoreError!*crypto.X509_STORE { const store = crypto.X509_STORE_new() orelse return error.FailedToCreateX509Store; errdefer crypto.X509_STORE_free(store); + // Hashed directories register a lazy lookup: their certs are read on + // demand during verification and never appear in the store's object + // stack, so they must be tracked separately from `getCertCount`. + var loaded_hashed_dir = false; // Report back if no certificates loaded. defer { - const num_of_certs = crypto.getCertCount(store); - if (num_of_certs == 0) { + if (!loaded_hashed_dir and crypto.getCertCount(store) == 0) { log.warn(.app, "No certificates loaded", .{}); } } @@ -757,7 +760,9 @@ pub fn createX509Store(allocator: Allocator, config: *const Config) CreateX509St } for (directories) |ca_path| { - if (crypto.X509_STORE_load_locations(store, null, ca_path) != 1) { + if (crypto.X509_STORE_load_locations(store, null, ca_path) == 1) { + loaded_hashed_dir = true; + } else { log.warn(.app, "Invalid CA path", .{ .ca_path = ca_path }); } } @@ -780,6 +785,7 @@ pub fn createX509Store(allocator: Allocator, config: *const Config) CreateX509St "/etc/pki/tls/certs", // Fedora/RHEL }) |dir| { if (loadHashedDirectory(store, dir)) { + loaded_hashed_dir = true; break :blk; } }