Alec Fong d620d65f6e feat(sandbox): inject DENO_CERT into sandbox child environment (#1441) ...

Sandbox processes running on Deno couldn't TLS-verify connections to
services signed by OpenShell's per-sandbox ephemeral CA because Deno
doesn't consult `SSL_CERT_FILE` / `NODE_EXTRA_CA_CERTS`. Deno reads its
own `DENO_CERT` env var (additive PEM bundle, same shape as
`NODE_EXTRA_CA_CERTS`) for that.

Add `DENO_CERT` to `child_env::tls_env_vars` pointing at the standalone
OpenShell CA cert (not the combined system+sandbox bundle, since DENO_CERT
is additive). The three callers in `process.rs` / `ssh.rs` iterate the
array, so the size bump from 5 to 6 entries flows through without
caller changes.

Updates the security best-practices doc to enumerate `DENO_CERT`
alongside the other trust-store env vars.

Tracks: brevdev/dex-ui#5

Signed-off-by: Alec Fong <alecf@nvidia.com>

2026-05-18 20:06:25 -07:00

..

best-practices.mdx

feat(sandbox): inject DENO_CERT into sandbox child environment (#1441)

2026-05-18 20:06:25 -07:00