akai/readest
2
1
Fork 1
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

release: version 0.11.18 (#5003)
CodeQL Advanced / Analyze (actions) (push) Waiting to run
Details
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Details
CodeQL Advanced / Analyze (rust) (push) Waiting to run
Details
Publish Docker image / build (linux/amd64, ubuntu-latest) (push) Waiting to run
Details
Publish Docker image / build (linux/arm64, ubuntu-24.04-arm) (push) Waiting to run
Details
Publish Docker image / merge (push) Blocked by required conditions
Details
PR checks / rust_lint (push) Waiting to run
Details
PR checks / build_web_app (push) Waiting to run
Details
PR checks / test_web_app (1) (push) Waiting to run
Details
PR checks / test_web_app (2) (push) Waiting to run
Details
PR checks / test_extensions (push) Waiting to run
Details
PR checks / build_tauri_app (push) Waiting to run
Details
Scorecard supply-chain security / Scorecard analysis (push) Waiting to run
Details
Deploy to vercel on merge / build_and_deploy (push) Waiting to run
Details

Browse Source
This commit is contained in:
Huang Xin
2026-07-08 03:17:35 +09:00
committed by GitHub
parent 883dae36aa
commit 4af203755d
8 changed files with 36 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/readest-app/.claude/memory/opds-autodownload-tls-skipssl-4988.md
+1 -1
View File
@@ -11,6 +11,6 @@ Issue #4988: OPDS auto-download failed while manual browse/download of the same
**Real signature:** feed GETs and HEAD probes appear in the server log, download GETs never do → the native `download_file` dies client-side in the TLS handshake. The Tauri http-plugin path (`opdsReq.ts`) always passes `danger: {acceptInvalidCerts: true}`, but `transfer_file.rs` builds its reqwest client with **rustls**, which ignores the OS trust store — self-signed, private-CA, or incomplete-chain certs all fail unless `skip_ssl_verification` is set. Manual download (`page.tsx handleDownload`) got `skipSslVerification: true` in #2900 (for #2871); `autoDownload.ts downloadAndImport` never did.
**Fix (2026-07-08):** pass `skipSslVerification: true` in autoDownload's `downloadFile` call. Test in `opds-auto-download.test.ts`.
**Fix (2026-07-08, PR #5002):** pass `skipSslVerification: true` in autoDownload's `downloadFile` call. Test in `opds-auto-download.test.ts`.
**How to apply:** any new code path that downloads via native `download_file`/`tauriDownload` from a user-configured server must mirror the manual path's `skipSslVerification` — TLS behavior differs between the http plugin (danger flags on) and transfer_file (strict rustls by default), so "browse works but download fails, nothing in server logs" = check this first. "curl works without -k" on another machine proves nothing about rustls trust.