Matthias Oßwald 3b21df190d feat(sandbox): load system CA certificates for upstream TLS connections (#862) ...

The proxy's upstream TLS client only trusted Mozilla root CAs
(webpki-roots), which prevented TLS termination from working with
internal/corporate hosts using private CA certificates.

Load system CA certificates from the container's trust store
(e.g. /etc/ssl/certs/ca-certificates.crt) in addition to
webpki-roots. This allows custom sandbox images to include
corporate CAs via update-ca-certificates.

Signed-off-by: Matthias Osswald <mat.osswald@sap.com>

2026-04-16 13:40:25 -07:00

..

data

feat(policy): add deny rules to network policy schema (#822)

2026-04-14 21:52:14 -07:00

src

feat(sandbox): load system CA certificates for upstream TLS connections (#862)

2026-04-16 13:40:25 -07:00

testdata

feat(sandbox): auto-detect TLS and terminate unconditionally for credential injection (#544)

2026-03-23 18:45:18 -07:00

tests

fix(inference): allowlist routed request headers (#826)

2026-04-15 15:19:18 -07:00

Cargo.toml

feat(sandbox): integrate OCSF structured logging for sandbox events (#720)

2026-04-07 13:01:13 -07:00