fix(policy): add tls: skip to brew preset endpoints (#2331)

[kagura-agent]

Summary

Add tls: skip to all six endpoints in the brew policy preset so the L7 proxy performs L4 pass-through instead of TLS termination.

Problem

After OpenShell v0.0.15+ began auto-terminating TLS on every detected TLS stream (OpenShell#544), git inside the sandbox fails with:

fatal: unable to access 'https://github.com/Homebrew/brew.git/':
server certificate verification failed. CAfile: none CRLfile: none

curl to the same host through the same proxy succeeds, and git -c http.sslVerify=false also succeeds — isolating the defect to the proxy's TLS termination presenting a certificate that git's OpenSSL cannot validate.

Fix

Add tls: skip to all brew preset endpoints (formulae.brew.sh, github.com, ghcr.io, pkg-containers.githubusercontent.com, objects.githubusercontent.com, raw.githubusercontent.com). This restores L4 pass-through so git validates the real server certificates directly.

This follows the same pattern established in PR #2098 for Discord/Slack WebSocket endpoints.

Test plan

• npx vitest run test/policies.test.ts — 86 tests pass
• Nightly E2E: brew preset git ls-remote against whitelisted endpoint succeeds without http.sslVerify=false

Fixes #2331

Signed-off-by: kagura-agent kagura-agent@users.noreply.github.com

Summary by CodeRabbit

• Chores
  • Updated network policy presets to modify TLS certificate verification behavior for connections to multiple package repository and external service endpoints supporting package management operations.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f5ae858-07e8-4f5c-b31e-7fc69c99d454

📥 Commits

Reviewing files that changed from the base of the PR and between d9aced4 and 97db044.

📒 Files selected for processing (1)

• nemoclaw-blueprint/policies/presets/brew.yaml

---

📝 Walkthrough

Walkthrough

The brew preset's network policy configuration for six HTTPS endpoints (:443 hosts) has been updated to include tls: skip directives, addressing TLS certificate verification failures encountered during sandboxed git operations against whitelisted repositories.

Changes

Cohort / File(s)	Summary
Brew Preset Network Policy Configuration nemoclaw-blueprint/policies/presets/brew.yaml	Added tls: skip directive to six HTTPS endpoint entries for formulae.brew.sh, github.com, ghcr.io, pkg-containers.githubusercontent.com, objects.githubusercontent.com, and raw.githubusercontent.com to resolve TLS verification failures in git operations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A brew so fine, through TLS we hop,
No more cert checks will make our git stop,
Six trusted hosts now skip the SSL dance,
Git and curl together, they prance and advance! 🍻

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding tls: skip to brew preset endpoints to fix TLS certificate verification issues.
Linked Issues check	✅ Passed	The PR fully addresses issue #2331 by implementing the required fix: adding tls: skip to all six endpoints in the brew policy preset to enable L4 pass-through for TLS, allowing Git to validate real server certificates directly.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to resolving issue #2331; only the brew.yaml preset was modified to add tls: skip directives without extraneous modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨ Thanks for submitting this issue that identifies a bug with the brew preset and proposes a fix.

---

Related open PRs:

• #2098 fix(policy): restore L4 tunnel for WebSocket hosts via tls: skip

---

Related open issues:

• #2331 Sandbox git HTTPS TLS verify fails for whitelisted endpoints despite /usr/bin/git in brew preset binaries
• #544 checkPortAvailable preflight probe fails in restricted environments and makes tests flaky

[ericksoa]

Straightforward fix. tls: skip on all 6 brew preset endpoints restores L4 pass-through so git validates real server certs instead of the proxy's MITM cert. Follows the established pattern from #2098.

LGTM.