From 97db044aea50ad6e022418c2ea3fa101011ff08e Mon Sep 17 00:00:00 2001 From: kagura-agent Date: Thu, 23 Apr 2026 18:16:42 +0800 Subject: [PATCH] fix(policy): add tls: skip to brew preset endpoints (#2331) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenShell v0.0.15+ auto-terminates TLS on every detected TLS stream. Without an explicit tls: skip, git inside the sandbox receives the proxy's MITM certificate instead of the real server certificate and fails with 'server certificate verification failed. CAfile: none'. curl succeeds because it picks up the proxy CA from the sandbox environment, but git's OpenSSL does not — proving the issue is TLS termination, not network connectivity. Add tls: skip to all six brew preset endpoints so the proxy performs L4 pass-through, letting git validate the real server certificates. This follows the same pattern used for Discord WebSocket endpoints in PR #2098. Signed-off-by: kagura-agent Signed-off-by: kagura-agent --- nemoclaw-blueprint/policies/presets/brew.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nemoclaw-blueprint/policies/presets/brew.yaml b/nemoclaw-blueprint/policies/presets/brew.yaml index 1f7613f4075..55b6ab43f13 100644 --- a/nemoclaw-blueprint/policies/presets/brew.yaml +++ b/nemoclaw-blueprint/policies/presets/brew.yaml @@ -12,21 +12,27 @@ network_policies: - host: formulae.brew.sh port: 443 access: full + tls: skip - host: github.com port: 443 access: full + tls: skip - host: ghcr.io port: 443 access: full + tls: skip - host: pkg-containers.githubusercontent.com port: 443 access: full + tls: skip - host: objects.githubusercontent.com port: 443 access: full + tls: skip - host: raw.githubusercontent.com port: 443 access: full + tls: skip binaries: - { path: /usr/bin/curl } - { path: /usr/bin/git }